From c41ea252b0451c9342638c746f4db3098cd5ef26 Mon Sep 17 00:00:00 2001
From: Josh Palmer <joshp123@users.noreply.github.com>
Date: Thu, 29 Jan 2026 11:05:11 +0100
Subject: [PATCH] fix flaky web-fetch tests + lock cleanup

What:
- stub resolvePinnedHostname in web-fetch tests to avoid DNS flake
- close lock file handles via FileHandle.close during cleanup to avoid EBADF

Why:
- make CI deterministic without network/DNS dependence
- prevent double-close errors from GC

Tests:
- pnpm vitest run --config vitest.unit.config.ts src/agents/tools/web-tools.fetch.test.ts src/agents/session-write-lock.test.ts (failed: missing @aws-sdk/client-bedrock)
---
 src/agents/session-write-lock.ts         |  4 ++--
 src/agents/tools/web-tools.fetch.test.ts | 15 ++++++++++++++-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/agents/session-write-lock.ts b/src/agents/session-write-lock.ts
index 832d368a6..82a2428da 100644
--- a/src/agents/session-write-lock.ts
+++ b/src/agents/session-write-lock.ts
@@ -35,8 +35,8 @@ function isAlive(pid: number): boolean {
 function releaseAllLocksSync(): void {
   for (const [sessionFile, held] of HELD_LOCKS) {
     try {
-      if (typeof held.handle.fd === "number") {
-        fsSync.closeSync(held.handle.fd);
+      if (typeof held.handle.close === "function") {
+        void held.handle.close().catch(() => {});
       }
     } catch {
       // Ignore errors during cleanup - best effort
diff --git a/src/agents/tools/web-tools.fetch.test.ts b/src/agents/tools/web-tools.fetch.test.ts
index 04923b607..86bdeb7a2 100644
--- a/src/agents/tools/web-tools.fetch.test.ts
+++ b/src/agents/tools/web-tools.fetch.test.ts
@@ -1,5 +1,6 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+import * as ssrf from "../../infra/net/ssrf.js";
 import { createWebFetchTool } from "./web-tools.js";
 
 type MockResponse = {
@@ -73,6 +74,18 @@ function requestUrl(input: RequestInfo): string {
 describe("web_fetch extraction fallbacks", () => {
   const priorFetch = global.fetch;
 
+  beforeEach(() => {
+    vi.spyOn(ssrf, "resolvePinnedHostname").mockImplementation(async (hostname) => {
+      const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
+      const addresses = ["93.184.216.34", "93.184.216.35"];
+      return {
+        hostname: normalized,
+        addresses,
+        lookup: ssrf.createPinnedLookup({ hostname: normalized, addresses }),
+      };
+    });
+  });
+
   afterEach(() => {
     // @ts-expect-error restore
     global.fetch = priorFetch;