loopd, bxctl, inferproxy: read args_os instead of panicking

M3a review finding 7, for the other three roles. loopd keeps its config path
as a path; bxctl and inferproxy take text arguments and answer one that is
not UTF-8 with their usage.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/bxctl/src/main.rs

@@ -11,7 +11,19 @@ use bxctl::escape::escape_model_text;
 use proto::{ErrorCode, SessionId, Timestamp, TurnDone};
 
 fn main() -> ExitCode {
-    let args: Vec<String> = std::env::args().skip(1).collect();
+    // `args_os`, because `args` panics on an argument that is not UTF-8. bxctl's arguments are
+    // text (ids, messages, paths it prints back), so such an argument is a usage error.
+    let args: Vec<String> = match std::env::args_os()
+        .skip(1)
+        .map(|a| a.into_string())
+        .collect()
+    {
+        Ok(args) => args,
+        Err(_) => {
+            eprintln!("bxctl: an argument is not valid UTF-8\n{USAGE}");
+            return ExitCode::from(2);
+        }
+    };
     // $BOXMAKER_HOME defaults to /var/lib/boxmaker; defaults for the sockets are read from it.
     let home = std::env::var_os("BOXMAKER_HOME")
         .map(PathBuf::from)

crates/bxctl/tests/args_os.rs

@@ -0,0 +1,19 @@
+//! An argument that is not UTF-8 is a usage error, not a panic (M3a review finding 7).
+
+use std::ffi::OsStr;
+use std::os::unix::ffi::OsStrExt;
+use std::process::Command;
+
+#[test]
+fn an_argument_that_is_not_utf8_is_a_usage_error() {
+    let out = Command::new(env!("CARGO_BIN_EXE_bxctl"))
+        .args([OsStr::new("approve"), OsStr::from_bytes(b"4\xff")])
+        .output()
+        .unwrap();
+    assert_eq!(out.status.code(), Some(2));
+    let err = String::from_utf8_lossy(&out.stderr);
+    assert!(
+        err.starts_with("bxctl: an argument is not valid UTF-8"),
+        "{err}"
+    );
+}