fix(cli): harden init templates per Greptile feedback (suite-wide)

Addresses the systemic template issues Greptile flagged across the init
template PRs (#434/#435/#436), applied consistently to every affected
template instead of one family:

- manifest.yaml.j2 (19): render `description` via `{{ description | tojson }}`
  so a user-supplied description containing YAML-significant characters
  (`:`, `#`, quotes) can no longer produce an invalid or truncated manifest.
- Dockerfile-uv.j2 (19): `agentex init` renders `pyproject.toml` but no
  `uv.lock`, so `COPY ... uv.lock` + `uv sync --locked` broke a fresh uv
  build. Drop `uv.lock` from the COPY and `--locked` from `uv sync` so a
  freshly scaffolded project builds out of the box.
- acp.py.j2 / workflow.py.j2 (non-text events): `params(.event).content` is a
  TaskMessageContent union; reading `.content` on a data/tool message raised
  AttributeError. Guard with `isinstance(content, TextContent)` before
  reading the text (async handlers return early, sync handlers return a
  TextContent notice, streaming handlers end the stream).
- default-codex acp.py.j2 (concurrency): serialize turns per task with an
  asyncio lock so two near-simultaneous events can no longer both read a
  stale `codex_thread_id` and fork the session. (The temporal-codex variant
  already serializes via its own turn lock.)

Verified by rendering every template: all project Python compiles and every
manifest parses with a YAML-hostile description value.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: declan-scale

src/agentex/lib/cli/templates/default-claude-code/Dockerfile-uv.j2

@@ -31,18 +31,18 @@ ENV UV_HTTP_TIMEOUT=1000
 WORKDIR /app/{{ project_path_from_build_root }}
 
 # Copy dependency files for layer caching
-COPY {{ project_path_from_build_root }}/pyproject.toml {{ project_path_from_build_root }}/uv.lock ./
+COPY {{ project_path_from_build_root }}/pyproject.toml ./
 
 # Install dependencies (without project itself, for layer caching)
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-install-project --no-dev
+    uv sync --no-install-project --no-dev
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project ./project
 
 # Install the project
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-dev
+    uv sync --no-dev
 
 ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"
 ENV PYTHONPATH=/app

src/agentex/lib/cli/templates/default-claude-code/manifest.yaml.j2

@@ -65,7 +65,7 @@ agent:
 
   # Description of what your agent does
   # Helps with documentation and discovery
-  description: {{ description }}
+  description: {{ description | tojson }}
 
   # Temporal workflow configuration
   # Set enabled: true to use Temporal workflows for long-running tasks

src/agentex/lib/cli/templates/default-claude-code/project/acp.py.j2

@@ -27,6 +27,7 @@ from agentex.lib.core.harness import UnifiedEmitter
 from agentex.lib.types.fastacp import AsyncACPConfig
 from agentex.lib.types.tracing import SGPTracingProcessorConfig
 from agentex.lib.utils.logging import make_logger
+from agentex.types.text_content import TextContent
 from agentex.lib.sdk.fastacp.fastacp import FastACP
 from agentex.lib.core.tracing.tracing_processor_manager import add_tracing_processor_config
 
@@ -134,7 +135,11 @@ async def handle_task_create(params: CreateTaskParams):
 async def handle_task_event_send(params: SendEventParams):
     """Handle a user message: spawn Claude Code locally and push events to the task stream."""
     task_id = params.task.id
-    prompt = params.event.content.content
+    content = params.event.content
+    if not isinstance(content, TextContent):
+        logger.warning("Ignoring non-text event content (type=%s)", getattr(content, "type", "?"))
+        return
+    prompt = content.content
     logger.info("Processing message for task %s", task_id)
 
     await adk.messages.create(task_id=task_id, content=params.event.content)

src/agentex/lib/cli/templates/default-codex/Dockerfile-uv.j2

@@ -31,18 +31,18 @@ ENV UV_HTTP_TIMEOUT=1000
 WORKDIR /app/{{ project_path_from_build_root }}
 
 # Copy dependency files for layer caching
-COPY {{ project_path_from_build_root }}/pyproject.toml {{ project_path_from_build_root }}/uv.lock ./
+COPY {{ project_path_from_build_root }}/pyproject.toml ./
 
 # Install dependencies (without project itself, for layer caching)
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-install-project --no-dev
+    uv sync --no-install-project --no-dev
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project ./project
 
 # Install the project
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-dev
+    uv sync --no-dev
 
 ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"
 ENV PYTHONPATH=/app

src/agentex/lib/cli/templates/default-codex/manifest.yaml.j2

@@ -65,7 +65,7 @@ agent:
 
   # Description of what your agent does
   # Helps with documentation and discovery
-  description: {{ description }}
+  description: {{ description | tojson }}
 
   # Temporal workflow configuration
   # Set enabled: true to use Temporal workflows for long-running tasks

src/agentex/lib/cli/templates/default-codex/project/acp.py.j2

@@ -32,6 +32,7 @@ load_dotenv()
 import agentex.lib.adk as adk
 from agentex.lib.adk import CodexTurn
 from agentex.lib.types.acp import SendEventParams, CancelTaskParams, CreateTaskParams
+from agentex.types.text_content import TextContent
 from agentex.lib.core.harness import UnifiedEmitter
 from agentex.lib.types.fastacp import AsyncACPConfig
 from agentex.lib.types.tracing import SGPTracingProcessorConfig
@@ -57,6 +58,20 @@ acp = FastACP.create(
 
 MODEL = os.environ.get("CODEX_MODEL", "o4-mini")
 
+# Serialize turns per task. Two ``task/event/send`` calls for the same task can
+# otherwise both read the old ``codex_thread_id`` (or ``None``), run independent
+# codex turns, and race to overwrite the stored thread id — forking the session.
+# A per-task lock keeps turns sequential without blocking other tasks.
+_task_locks: dict[str, asyncio.Lock] = {}
+
+
+def _task_lock(task_id: str) -> asyncio.Lock:
+    lock = _task_locks.get(task_id)
+    if lock is None:
+        lock = asyncio.Lock()
+        _task_locks[task_id] = lock
+    return lock
+
 
 class ConversationState(BaseModel):
     """Per-task conversation state persisted via ``adk.state``.
@@ -150,81 +165,93 @@ async def handle_task_event_send(params: SendEventParams):
     """Handle each user message: spawn codex, stream events, save thread ID."""
     task_id = params.task.id
     agent_id = params.agent.id
-    user_message = params.event.content.content
-
-    logger.info("Processing message for task %s", task_id)
-
-    await adk.messages.create(task_id=task_id, content=params.event.content)
-
-    task_state = await adk.state.get_by_task_and_agent(task_id=task_id, agent_id=agent_id)
-    if task_state is None:
-        state = ConversationState()
-        task_state = await adk.state.create(task_id=task_id, agent_id=agent_id, state=state)
-    else:
-        state = ConversationState.model_validate(task_state.state)
 
-    state.turn_number += 1
+    content = params.event.content
+    if not isinstance(content, TextContent):
+        logger.warning(
+            "Ignoring non-text event content (type=%s) for task %s",
+            getattr(content, "type", "?"),
+            task_id,
+        )
+        return
+    user_message = content.content
 
-    async with adk.tracing.span(
-        trace_id=task_id,
-        task_id=task_id,
-        name=f"Turn {state.turn_number}",
-        input={"message": user_message},
-        data={"__span_type__": "AGENT_WORKFLOW"},
-    ) as turn_span:
-        start_ms = int(time.monotonic() * 1000)
+    logger.info("Processing message for task %s", task_id)
 
-        process = await _spawn_codex(MODEL, thread_id=state.codex_thread_id)
+    await adk.messages.create(task_id=task_id, content=content)
 
-        assert process.stdin is not None
-        process.stdin.write(user_message.encode("utf-8"))
-        await process.stdin.drain()
-        process.stdin.close()
+    # Serialize the read-modify-write of ``codex_thread_id`` so two concurrent
+    # turns on the same task cannot fork the codex session.
+    async with _task_lock(task_id):
+        task_state = await adk.state.get_by_task_and_agent(task_id=task_id, agent_id=agent_id)
+        if task_state is None:
+            state = ConversationState()
+            task_state = await adk.state.create(task_id=task_id, agent_id=agent_id, state=state)
+        else:
+            state = ConversationState.model_validate(task_state.state)
 
-        turn = CodexTurn(
-            events=_process_stdout(process),
-            model=MODEL,
-        )
+        state.turn_number += 1
 
-        emitter = UnifiedEmitter(
-            task_id=task_id,
+        async with adk.tracing.span(
             trace_id=task_id,
-            parent_span_id=turn_span.id if turn_span else None,
-        )
-
-        # Guarantee the subprocess is reaped even if auto_send_turn raises
-        # (e.g. a Redis error); otherwise codex stays blocked writing to a full
-        # stdout pipe buffer and the OS process leaks until the server restarts.
-        try:
-            result = await emitter.auto_send_turn(turn)
-        finally:
-            if process.returncode is None:
-                process.kill()
-            await process.wait()
-
-        # Record the real wall-clock duration AFTER streaming completes; setting
-        # it before the stream ran would capture only subprocess spawn overhead.
-        turn.duration_ms = int(time.monotonic() * 1000) - start_ms
-
-        usage = turn.usage()
-
-        # Persist the codex session id (public accessor; valid post-stream) so the
-        # next turn resumes the same session.
-        if turn.session_id:
-            state.codex_thread_id = turn.session_id
-
-        await adk.state.update(
-            state_id=task_state.id,
             task_id=task_id,
-            agent_id=agent_id,
-            state=state,
-        )
-
-        if turn_span:
-            turn_span.output = {
-                "final_text": result.final_text,
-                "model": usage.model,
-            }
+            name=f"Turn {state.turn_number}",
+            input={"message": user_message},
+            data={"__span_type__": "AGENT_WORKFLOW"},
+        ) as turn_span:
+            start_ms = int(time.monotonic() * 1000)
+
+            process = await _spawn_codex(MODEL, thread_id=state.codex_thread_id)
+
+            assert process.stdin is not None
+            process.stdin.write(user_message.encode("utf-8"))
+            await process.stdin.drain()
+            process.stdin.close()
+
+            turn = CodexTurn(
+                events=_process_stdout(process),
+                model=MODEL,
+            )
+
+            emitter = UnifiedEmitter(
+                task_id=task_id,
+                trace_id=task_id,
+                parent_span_id=turn_span.id if turn_span else None,
+            )
+
+            # Guarantee the subprocess is reaped even if auto_send_turn raises
+            # (e.g. a Redis error); otherwise codex stays blocked writing to a full
+            # stdout pipe buffer and the OS process leaks until the server restarts.
+            try:
+                result = await emitter.auto_send_turn(turn)
+            finally:
+                if process.returncode is None:
+                    process.kill()
+                await process.wait()
+
+            # Record the real wall-clock duration AFTER streaming completes; setting
+            # it before the stream ran would capture only subprocess spawn overhead.
+            turn.duration_ms = int(time.monotonic() * 1000) - start_ms
+
+            usage = turn.usage()
+
+            # Persist the codex session id (public accessor; valid post-stream) so the
+            # next turn resumes the same session.
+            if turn.session_id:
+                state.codex_thread_id = turn.session_id
+
+            await adk.state.update(
+                state_id=task_state.id,
+                task_id=task_id,
+                agent_id=agent_id,
+                state=state,
+            )
+
+            if turn_span:
+                turn_span.output = {
+                    "final_text": result.final_text,
+                    "model": usage.model,
+                }
 
 
 @acp.on_task_cancel

src/agentex/lib/cli/templates/default-langgraph/Dockerfile-uv.j2

@@ -27,18 +27,18 @@ ENV UV_HTTP_TIMEOUT=1000
 WORKDIR /app/{{ project_path_from_build_root }}
 
 # Copy dependency files for layer caching
-COPY {{ project_path_from_build_root }}/pyproject.toml {{ project_path_from_build_root }}/uv.lock ./
+COPY {{ project_path_from_build_root }}/pyproject.toml ./
 
 # Install dependencies (without project itself, for layer caching)
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-install-project --no-dev
+    uv sync --no-install-project --no-dev
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project ./project
 
 # Install the project
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-dev
+    uv sync --no-dev
 
 ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"
 ENV PYTHONPATH=/app

src/agentex/lib/cli/templates/default-langgraph/manifest.yaml.j2

@@ -65,7 +65,7 @@ agent:
 
   # Description of what your agent does
   # Helps with documentation and discovery
-  description: {{ description }}
+  description: {{ description | tojson }}
 
   # Temporal workflow configuration
   # Set enabled: true to use Temporal workflows for long-running tasks

src/agentex/lib/cli/templates/default-langgraph/project/acp.py.j2

@@ -22,6 +22,7 @@ from agentex.protocol.acp import SendEventParams, CancelTaskParams, CreateTaskPa
 from agentex.lib.types.fastacp import AsyncACPConfig
 from agentex.lib.types.tracing import SGPTracingProcessorConfig
 from agentex.lib.utils.logging import make_logger
+from agentex.types.text_content import TextContent
 from agentex.lib.adk import LangGraphTurn
 
 from project.graph import create_graph
@@ -55,7 +56,11 @@ async def handle_task_event_send(params: SendEventParams):
     """Handle incoming events, streaming tokens and tool calls via Redis."""
     graph = await get_graph()
     task_id = params.task.id
-    user_message = params.event.content.content
+    content = params.event.content
+    if not isinstance(content, TextContent):
+        logger.warning("Ignoring non-text event content (type=%s)", getattr(content, "type", "?"))
+        return
+    user_message = content.content
 
     logger.info(f"Processing message for thread {task_id}")
 

src/agentex/lib/cli/templates/default-openai-agents/Dockerfile-uv.j2

@@ -27,18 +27,18 @@ ENV UV_HTTP_TIMEOUT=1000
 WORKDIR /app/{{ project_path_from_build_root }}
 
 # Copy dependency files for layer caching
-COPY {{ project_path_from_build_root }}/pyproject.toml {{ project_path_from_build_root }}/uv.lock ./
+COPY {{ project_path_from_build_root }}/pyproject.toml ./
 
 # Install dependencies (without project itself, for layer caching)
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-install-project --no-dev
+    uv sync --no-install-project --no-dev
 
 # Copy the project code
 COPY {{ project_path_from_build_root }}/project ./project
 
 # Install the project
 RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-dev
+    uv sync --no-dev
 
 ENV PATH="/app/{{ project_path_from_build_root }}/.venv/bin:$PATH"
 ENV PYTHONPATH=/app