Sub-agent session history persisted via pickle: silent corruption fallback, version fragility, and avoidable pickle.load risk

Files:

• code_puppy/tools/agent_tools.py (~lines 120-185): _save_session_history / _load_session_history
• code_puppy/tools/subagent_invocation.py uses the same .pkl session files

Severity: Medium (robustness; low-grade security footnote)

Sub-agent session history is persisted with pickle:

with open(tmp_pkl, "wb") as f:
    pickle.dump(message_history, f)
...
with open(pkl_path, "rb") as f:
    return pickle.load(f)

Problems:

1. Errors pass silently: _load_session_history catches bare Exception and returns [], so a corrupted/incompatible session silently restarts the sub-agent with no memory and no warning (refusing-to-guess violation). At minimum emit_warning the load failure.
2. Version fragility: pydantic-ai message classes change between releases; pickled histories break on upgrade with no migration path. JSON serialization via pydantic_core.to_jsonable_python / ModelMessagesTypeAdapter (which pydantic-ai provides specifically for message history persistence) is stable and human-inspectable.
3. pickle.load on a shared-location file (~/.code_puppy/...) executes arbitrary code if anything else writes those files. Low practical risk (local user dir) but trivially avoided by using the JSON adapters.
4. The .tmp rename pattern here is fine, but the companion .txt metadata uses a read-modify-write without locking - concurrent parallel sub-agents on the same session can interleave.

Suggested fix: switch to ModelMessagesTypeAdapter.dump_json() / validate_json() for session history, log load failures, and keep a one-release fallback that reads legacy .pkl files.

Filed by Zen Reviewer B (code-puppy-60635a)

Start with _save_session_history and _load_session_history in code_puppy/tools/agent_tools.py, then inspect how code_puppy/tools/subagent_invocation.py uses the .pkl and .txt session files. Use the pydantic-ai message adapters named in the issue, preserve a legacy .pkl fallback, and ensure load failures emit a warning; done means session history remains recoverable across versions without pickle as the primary format.