fix: resolve type errors where workdir (string | undefined) flows to string-only params

After the node early-return, narrow workdir back to string via
resolvedWorkdir for gateway/sandbox paths. Update
buildExecApprovalPendingToolResult and buildApprovalPendingMessage
to accept string | undefined for cwd since node execution may omit it.

src/agents/bash-tools.exec-host-shared.ts

@@ -403,7 +403,7 @@ export async function sendExecApprovalFollowupResult(
 export function buildExecApprovalPendingToolResult(params: {
   host: "gateway" | "node";
   command: string;
-  cwd: string;
+  cwd: string | undefined;
   warningText: string;
   approvalId: string;
   approvalSlug: string;

src/agents/bash-tools.exec-runtime.ts

@@ -340,7 +340,7 @@ export function buildApprovalPendingMessage(params: {
   approvalId: string;
   allowedDecisions?: readonly ExecApprovalDecision[];
   command: string;
-  cwd: string;
+  cwd: string | undefined;
   host: "gateway" | "node";
   nodeId?: string;
 }) {
@@ -361,7 +361,7 @@ export function buildApprovalPendingMessage(params: {
   if (params.nodeId) {
     lines.push(`Node: ${params.nodeId}`);
   }
-  lines.push(`CWD: ${params.cwd}`);
+  lines.push(`CWD: ${params.cwd ?? "(node default)"}`);
   lines.push("Command:");
   lines.push(commandBlock);
   lines.push("Mode: foreground (interactive approvals available).");

src/agents/bash-tools.exec.ts

@@ -1469,10 +1469,15 @@ export function createExecTool(
         });
       }
 
+      // After the node early-return above, workdir is guaranteed to be a string
+      // (it was initialised from rawWorkdir and only set to undefined inside the
+      // node branch which already returned).
+      const resolvedWorkdir: string = workdir ?? rawWorkdir;
+
       if (host === "gateway" && !bypassApprovals) {
         const gatewayResult = await processGatewayAllowlist({
           command: params.command,
-          workdir,
+          workdir: resolvedWorkdir,
           env,
           requestedEnv: params.env,
           pty: params.pty === true && !sandbox,
@@ -1518,12 +1523,12 @@ export function createExecTool(
 
       // Preflight: catch a common model failure mode (shell syntax leaking into Python/JS sources)
       // before we execute and burn tokens in cron loops.
-      await validateScriptFileForShellBleed({ command: params.command, workdir });
+      await validateScriptFileForShellBleed({ command: params.command, workdir: resolvedWorkdir });
 
       const run = await runExecProcess({
         command: params.command,
         execCommand: execCommandOverride,
-        workdir,
+        workdir: resolvedWorkdir,
         env,
         sandbox,
         containerWorkdir,