fix(agents): validate sessions_spawn agentId format (#31381)

src/routing/session-key.test.ts

@@ -6,6 +6,7 @@ import {
 } from "../sessions/session-key-utils.js";
 import {
   classifySessionKeyShape,
+  isValidAgentId,
   parseAgentSessionKey,
   toAgentStoreSessionKey,
 } from "./session-key.js";
@@ -115,3 +116,17 @@ describe("session key canonicalization", () => {
     ).toBe("agent:main:main");
   });
 });
+
+describe("isValidAgentId", () => {
+  it("accepts valid agent ids", () => {
+    expect(isValidAgentId("main")).toBe(true);
+    expect(isValidAgentId("my-research_agent01")).toBe(true);
+  });
+
+  it("rejects malformed agent ids", () => {
+    expect(isValidAgentId("")).toBe(false);
+    expect(isValidAgentId("Agent not found: xyz")).toBe(false);
+    expect(isValidAgentId("../../../etc/passwd")).toBe(false);
+    expect(isValidAgentId("a".repeat(65))).toBe(false);
+  });
+});

src/routing/session-key.ts

@@ -99,6 +99,11 @@ export function normalizeAgentId(value: string | undefined | null): string {
   );
 }
 
+export function isValidAgentId(value: string | undefined | null): boolean {
+  const trimmed = (value ?? "").trim();
+  return Boolean(trimmed) && VALID_ID_RE.test(trimmed);
+}
+
 export function sanitizeAgentId(value: string | undefined | null): string {
   return normalizeAgentId(value);
 }