@gajae-code/coding-agent 0.11.7 → 0.11.8

package/src/coordinator-mcp/model-preset.ts

@@ -1,44 +1,10 @@
 import * as path from "node:path";
 import { getAgentDir } from "@gajae-code/utils";
 import { YAML } from "bun";
+import { UnknownModelProfileError, validateModelProfileName } from "../config/model-profile-contract";
+import { mergeModelProfiles } from "../config/model-profiles";
 import { ModelsConfigSchema } from "../config/models-config-schema";
 
-/**
- * The coordinator runs in the shipped MCP process and must stay outside the
- * session host import graph. Keep this identity catalog in the coordinator
- * boundary; profile activation and model registry code belong to that host.
- */
-const BUILTIN_MODEL_PROFILE_NAMES = [
-	"codex-eco",
-	"codex-medium",
-	"codex-pro",
-	"opencodego",
-	"claude-opus",
-	"claude-fable",
-	"glm-eco",
-	"glm-medium",
-	"glm-pro",
-	"kimi-coding-plan-eco",
-	"kimi-coding-plan-medium",
-	"kimi-coding-plan-pro",
-	"mimo-eco",
-	"mimo-medium",
-	"mimo-pro",
-	"grok-eco",
-	"grok-medium",
-	"grok-pro",
-	"grok-build-pro",
-	"cursor-eco",
-	"cursor-medium",
-	"cursor-pro",
-	"minimax-eco",
-	"minimax-medium",
-	"minimax-pro",
-	"opus-codex",
-	"codex-opencodego",
-	"fable-opus-codex",
-] as const;
-
 export interface CoordinatorModelProfile {
 	name: string;
 }
@@ -53,8 +19,6 @@ export type CoordinatorModelProfileLoader = () =>
 	| Promise<Map<string, CoordinatorModelProfile>>;
 
 const MAX_ECHOED_MPRESET_LENGTH = 128;
-const LEGACY_MODEL_PROFILE_ALIASES: ReadonlyMap<string, string> = new Map([["codex-standard", "codex-medium"]]);
-
 /**
  * Thrown by the default loader when `models.yml` exists but is invalid or
  * unreadable. This lets the resolver fail closed with a distinct, stable reason
@@ -69,35 +33,25 @@ export class CoordinatorModelProfileRegistryError extends Error {
 	}
 }
 
-function builtInCoordinatorModelProfiles(): Map<string, CoordinatorModelProfile> {
-	return new Map(BUILTIN_MODEL_PROFILE_NAMES.map(name => [name, { name }]));
+function coordinatorModelProfiles(
+	profiles?: Parameters<typeof mergeModelProfiles>[0],
+): Map<string, CoordinatorModelProfile> {
+	return new Map([...mergeModelProfiles(profiles).keys()].map(name => [name, { name }]));
 }
 
 export const loadCoordinatorModelProfiles: CoordinatorModelProfileLoader = async () => {
 	const modelsFile = Bun.file(path.join(getAgentDir(), "models.yml"));
-	if (!(await modelsFile.exists())) return builtInCoordinatorModelProfiles();
+	if (!(await modelsFile.exists())) return coordinatorModelProfiles();
 	try {
 		const parsed = YAML.parse(await modelsFile.text());
 		const config = ModelsConfigSchema.safeParse(parsed);
 		if (!config.success) throw config.error;
-		const profiles = builtInCoordinatorModelProfiles();
-		for (const name of Object.keys(config.data.profiles ?? {})) profiles.set(name, { name });
-		return profiles;
+		return coordinatorModelProfiles(config.data.profiles);
 	} catch (error) {
 		throw new CoordinatorModelProfileRegistryError(error);
 	}
 };
 
-function sortedProfileNames(profiles: ReadonlyMap<string, CoordinatorModelProfile>): string[] {
-	return [...profiles.keys()].sort((left, right) => left.localeCompare(right));
-}
-
-function resolveCoordinatorModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string {
-	if (profiles.has(profileName)) return profileName;
-	const replacement = LEGACY_MODEL_PROFILE_ALIASES.get(profileName);
-	return replacement && profiles.has(replacement) ? replacement : profileName;
-}
-
 export type CoordinatorMpresetResolution =
 	| { ok: true; mpreset: string | null }
 	| { ok: false; reason: "unknown_model_profile"; mpreset: string; available_profiles: string[] }
@@ -120,7 +74,7 @@ export async function resolveCoordinatorMpreset(
 	loadProfiles: CoordinatorModelProfileLoader,
 ): Promise<CoordinatorMpresetResolution> {
 	if (raw === undefined || raw === null) return { ok: true, mpreset: null };
-	const requested = typeof raw === "string" ? raw.trim() : "";
+	const requested = typeof raw === "string" ? raw : "";
 	const echoed = requested.slice(0, MAX_ECHOED_MPRESET_LENGTH);
 	let profiles: Map<string, CoordinatorModelProfile>;
 	try {
@@ -131,24 +85,17 @@ export async function resolveCoordinatorMpreset(
 		}
 		throw error;
 	}
-	// Non-string input and explicit blank/whitespace strings can never name a
-	// profile; only absent/null (handled above) means "no selection".
-	if (typeof raw !== "string" || requested.length === 0) {
-		return {
-			ok: false,
-			reason: "unknown_model_profile",
-			mpreset: echoed,
-			available_profiles: sortedProfileNames(profiles),
-		};
-	}
-	const canonical = resolveCoordinatorModelProfileName(requested, profiles);
-	if (!profiles.has(canonical)) {
-		return {
-			ok: false,
-			reason: "unknown_model_profile",
-			mpreset: echoed,
-			available_profiles: sortedProfileNames(profiles),
-		};
+	try {
+		const canonical = validateModelProfileName(requested, profiles);
+		return { ok: true, mpreset: canonical };
+	} catch (error) {
+		if (error instanceof UnknownModelProfileError)
+			return {
+				ok: false,
+				reason: "unknown_model_profile",
+				mpreset: error.details.requestedProfile.slice(0, MAX_ECHOED_MPRESET_LENGTH),
+				available_profiles: error.details.availableProfiles,
+			};
+		throw error;
 	}
-	return { ok: true, mpreset: canonical };
 }

package/src/defaults/gjc/skills/deep-interview/SKILL.md

@@ -382,7 +382,7 @@ Auto-answer has a clarity cap: unless the architect confidence is `high` and unc
 
 ### Step 2b″: Refine Free-Text Answers
 
-When the user's answer is free-text that carries reasoning, constraints, or scope decisions, do not forward it to scoring as a lossy one-line label. First structure it into a compact interpretation using the canonical sections — **Decision**, **Reasoning**, **Constraints (user-stated)**, **Out of scope (user-stated)**, and **Codebase context (verified)** (omit empty sections) — then confirm with exactly one `ask` that nothing is lost or misrepresented. Apply `language.instruction` when present.
+When the user's answer is free-text that carries reasoning, constraints, or scope decisions, do not forward it to scoring as a lossy one-line label. First structure it into a compact interpretation using the canonical sections — **Decision**, **Reasoning**, **Constraints (user-stated)**, **Out of scope (user-stated)**, and **Codebase context (verified)** (omit empty sections). Then confirm with exactly one `ask` that nothing is lost or misrepresented: the `ask` question body MUST render the full structured interpretation — every non-empty canonical section, verbatim — before the confirmation prompt. The user is approving that specific interpretation, so it must be visible inside the question body; never ask "does this capture it?" / "이 해석이 맞아?" without first displaying the interpretation itself. A confirmation `ask` whose body omits the interpretation it is asking about is a hard error: re-issue it with the interpretation shown. Apply `language.instruction` when present.
 
 Offer options such as **Send as-is**, **Add a constraint**, **Mark something out of scope**, **Add context**, and **Rewrite**, plus free-text. If the user picks anything other than "Send as-is", collect the exact missing text with one follow-up `ask` (never infer it from the option label), fold it into the structured interpretation, and re-confirm. Do not advance to scoring while the user is still saying something is missing.
 
@@ -601,7 +601,7 @@ When ambiguity ≤ threshold (or hard cap / early exit):
 
 **4a. Closure / Acceptance Guard.** Even when ambiguity ≤ threshold, do not treat the math as completion. Run an independent readiness audit from the full main-session perspective (including explore findings, established facts, and triggers the scorer may not have fully weighed). Confirm every active topology component has goal/constraint/criteria coverage, no unresolved or disputed trigger remains on a path that matters, no disputed established fact lacks a `superseded_by` resolution, and no low-confidence auto-answer is standing in for user-confirmed truth above the clarity cap. If a material gap exists, explicitly override the gate to the user — "The math says ready, but I am not accepting it yet because {gap}" — and ask the single highest-impact follow-up, returning to Phase 2. Record any override in `state.closure_overrides`.
 
-**4b. Restate gate.** Once closure passes, collapse the agreed answers into ONE sentence goal that covers every active component, and confirm it with a single `ask`: "If someone read only this line, would they reach the same outcome you have in mind?" Offer **Yes, crystallize**, **Adjust wording**, and **Missing scope**, plus free-text, applying `language.instruction` when present. Because this gate has options, it MUST go through `ask`: do not print the Restate question and options as assistant prose with `Question:`/`Options:` labels. If the Restate gate was already printed that way, immediately call `ask` with the same question/options before accepting or waiting for any answer. On "Adjust wording" / "Missing scope", collect the exact correction with one follow-up `ask`, route it back through Step 2c scoring and established-facts maintenance (a correction can change ambiguity), then re-run closure and ask the Restate gate again. Cap at two loops; if alignment is not reached, return to Phase 2 with a targeted question instead of forcing a goal line. Persist the confirmed line as `state.restated_goal`.
+**4b. Restate gate.** Once closure passes, collapse the agreed answers into ONE sentence goal that covers every active component, and confirm it with a single `ask` whose body MUST begin by stating that one-sentence goal verbatim, followed by: "If someone read only this line, would they reach the same outcome you have in mind?" The goal line must be visible inside the `ask` body; never ask the confirmation without first displaying the collapsed goal it refers to. Offer **Yes, crystallize**, **Adjust wording**, and **Missing scope**, plus free-text, applying `language.instruction` when present. Because this gate has options, it MUST go through `ask`: do not print the Restate question and options as assistant prose with `Question:`/`Options:` labels. If the Restate gate was already printed that way, immediately call `ask` with the same question/options before accepting or waiting for any answer. On "Adjust wording" / "Missing scope", collect the exact correction with one follow-up `ask`, route it back through Step 2c scoring and established-facts maintenance (a correction can change ambiguity), then re-run closure and ask the Restate gate again. Cap at two loops; if alignment is not reached, return to Phase 2 with a targeted question instead of forcing a goal line. Persist the confirmed line as `state.restated_goal`.
 
 1. **Generate the specification** using opus model with the prompt-safe transcript. If the full interview transcript or initial context is too large, include the summary plus all concrete decisions, acceptance criteria, unresolved gaps, and ontology snapshots; never overflow the prompt with raw oversized context.
    - Apply `language.instruction` when present so user-facing prose in the spec preserves the session language; keep code identifiers, file paths, commands, JSON/settings keys, and quoted source text unchanged.

package/src/defaults/gjc/skills/ralplan/SKILL.md

@@ -34,6 +34,8 @@ For corrupt, tampered, unreadable, or stale current-session ralplan state, run `
 
 Ralplan is planning only. It may inspect context and draft plan/spec/proposal artifacts, but those remain `pending approval` until explicit current-turn or structured-UI execution approval. Before that approval, do not mutate product source, run mutation-oriented shell, commit, push, open PRs, invoke execution skills, or delegate implementation.
 
+Explicitly naming `ultragoal` or `team` (including `/skill:` and `gjc` forms) counts as opting into execution for that skill — do not re-ask for the same consent.
+
 Persist planning artifacts and handoffs through the ralplan CLI writer, never direct `.gjc/` edits:
 Direct `write`, `edit`, or `ast_edit` calls against `.gjc/_session-{sessionid}/specs`, `.gjc/_session-{sessionid}/plans`, `.gjc/_session-{sessionid}/state`, or any other `.gjc/` path are forbidden unless an explicit force override is active.
 
@@ -82,7 +84,7 @@ The consensus workflow:
       - For every confirmed open item, embed the resolved outcome into the final plan under an **## Intent Reconciliation** section so the `pending approval` artifact records each decision; record any item the user explicitly defers as an open confirmation under that same section.
    d. Persist the reconciliation with `gjc ralplan --write --stage post-interview --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus a compact status (reconciled-clean / reconciled-with-revision / open-confirmations-pending) instead of pasting the full body.
 7. On reconciliation completion, re-check the review join gate (Critic `OKAY` plus Architect `CLEAR`/`APPROVE` for the same Planner artifact/pass), mark the plan `pending approval` unless explicit execution approval has already been captured, persist the ADR/final plan via `gjc ralplan --write --stage final --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT`, and do not directly edit `.gjc/_session-{sessionid}/plans`. Final plan must include ADR (Decision, Drivers, Alternatives considered, Why chosen, Consequences, Follow-ups) and, when present, the **## Intent Reconciliation** section.
-8. **Always** present the finalized plan via the `ask` tool (regardless of `--interactive`) with `workflowGate: { stage: "ralplan", kind: "approval" }` on the final question so RPC/headless clients receive a `ralplan`/`approval` workflow gate, not a deep-interview question gate. Use these options:
+8. **Final approval gate (with explicit-execution exception):** If the user already explicitly named an execution skill in the current turn or via the structured approval UI (`ultragoal`, `/skill:ultragoal`, `gjc ultragoal`, `team`, `/skill:team`, `gjc team`, or "Approve execution via ultragoal/team"), that is execution approval — skip the re-ask and proceed to step 9 with that skill. Otherwise, **always** present the finalized plan via the `ask` tool (regardless of `--interactive`) with `workflowGate: { stage: "ralplan", kind: "approval" }` on the final question so RPC/headless clients receive a `ralplan`/`approval` workflow gate, not a deep-interview question gate. Use these options:
    - **Refine further** — re-run the consensus loop / request changes, then return here
    - **Approve execution via ultragoal (Recommended)** — goal-tracked autonomous execution
    - **Approve execution via team** — only when tmux-based interactive worker parallelization is required

package/src/edit/index.ts

@@ -1,5 +1,5 @@
 import type { AgentTool, AgentToolContext, AgentToolResult, AgentToolUpdateCallback } from "@gajae-code/agent-core";
-import { prompt } from "@gajae-code/utils";
+import { $pickenv, prompt } from "@gajae-code/utils";
 import type * as z from "zod/v4";
 import {
 	executeHashlineSingle,
@@ -352,11 +352,8 @@ export class EditTool implements AgentTool<TInput> {
 	readonly #pendingDeferredFetches = new Map<string, AbortController>();
 
 	constructor(private readonly session: ToolSession) {
-		const {
-			PI_EDIT_FUZZY: editFuzzy = "auto",
-			PI_EDIT_FUZZY_THRESHOLD: editFuzzyThreshold = "auto",
-			PI_EDIT_VARIANT: envEditVariant = "auto",
-		} = Bun.env;
+		const { PI_EDIT_FUZZY: editFuzzy = "auto", PI_EDIT_FUZZY_THRESHOLD: editFuzzyThreshold = "auto" } = Bun.env;
+		const envEditVariant = $pickenv("GJC_EDIT_VARIANT", "PI_EDIT_VARIANT") ?? "auto";
 
 		this.#editMode = resolveConfiguredEditMode(envEditVariant);
 		this.#allowFuzzy = resolveAllowFuzzy(session, editFuzzy);

package/src/edit/modes/patch.ts

@@ -44,6 +44,7 @@ import {
 	restoreLineEndings,
 	stripBom,
 } from "../normalize";
+import { withEditPathMutation } from "../path-mutation-lock";
 import { readEditFileText, serializeEditFileText } from "../read-file";
 import type { EditToolDetails, LspBatchRequest } from "../renderer";
 import {
@@ -93,6 +94,15 @@ export interface ApplyPatchOptions {
 	fuzzyThreshold?: number;
 	allowFuzzy?: boolean;
 	fs?: FileSystem;
+	/**
+	 * When false, skip durable cross-process file locks (in-process path mutex
+	 * still serializes). Defaults to true only for the real `defaultFileSystem`
+	 * (or when `fs` is omitted). Disk-backed adapters that are not
+	 * `defaultFileSystem` (notably production `LspFileSystem` via
+	 * `executePatchSingle`) MUST pass `crossProcessLock: true` explicitly —
+	 * object identity is not a durable-lock capability probe.
+	 */
+	crossProcessLock?: boolean;
 }
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -1409,13 +1419,29 @@ function applyHunksToContent(
 
 /**
  * Apply a patch operation to the filesystem.
+ *
+ * Concurrent mutations of the same absolute path are serialized (in-process always;
+ * cross-process file lock when using the real filesystem) so disjoint concurrent
+ * edits cannot silently overwrite each other (#2900).
  */
 export async function applyPatch(input: PatchInput, options: ApplyPatchOptions): Promise<ApplyPatchResult> {
-	return applyNormalizedPatch(input, options);
+	const resolvePath = (p: string): string => resolveToCwd(p, options.cwd);
+	const absolutePath = resolvePath(input.path);
+	const mutationPaths = [absolutePath];
+	if (input.rename) {
+		const destPath = resolvePath(input.rename);
+		if (destPath !== absolutePath) mutationPaths.push(destPath);
+	}
+	const usingDefaultFs = options.fs === undefined || options.fs === defaultFileSystem;
+	// dryRun/preview must stay read-only: never create durable `<path>.lock` dirs
+	// (would fail on read-only parents and mutate the FS during preview) (#2900 review).
+	const crossProcess = options.dryRun === true ? false : (options.crossProcessLock ?? usingDefaultFs);
+	return withEditPathMutation(mutationPaths, () => applyNormalizedPatch(input, options), { crossProcess });
 }
 
 /**
  * Apply a normalized patch operation to the filesystem.
+ * Caller must already hold path mutation rights when concurrent writers exist.
  * @internal
  */
 async function applyNormalizedPatch(input: PatchInput, options: ApplyPatchOptions): Promise<ApplyPatchResult> {
@@ -1514,6 +1540,12 @@ async function applyNormalizedPatch(input: PatchInput, options: ApplyPatchOption
 	const isMove = Boolean(input.rename) && destPath !== absolutePath;
 
 	if (!dryRun) {
+		// Commit-time CAS: reject if another writer mutated the file after our
+		// authoritative read (e.g. a process that did not take the path lock).
+		const commitContent = await readExistingPatchFile(fs, absolutePath, input.path);
+		if (commitContent !== originalContent) {
+			throw new ApplyPatchError(`concurrent edit conflict: file changed since read: ${input.path}`);
+		}
 		if (isMove) {
 			const parentDir = path.dirname(destPath);
 			if (parentDir && parentDir !== ".") {
@@ -1735,11 +1767,16 @@ export async function executePatchSingle(
 
 	const input: PatchInput = { path: resolvedPath, op, rename: resolvedRename, diff };
 	const patchFileSystem = new LspFileSystem(writethrough, signal, batchRequest, beginDeferredDiagnosticsForPath);
+	// Production edit path uses LspFileSystem (disk-backed writethrough), which is
+	// not `defaultFileSystem` by object identity. Force durable cross-process
+	// locking so multi-process agents cannot silently race past the path mutex
+	// (#2900 review: do not infer lock capability from FileSystem identity).
 	const result = await applyPatch(input, {
 		cwd: session.cwd,
 		fs: patchFileSystem,
 		fuzzyThreshold,
 		allowFuzzy,
+		crossProcessLock: true,
 	});
 
 	// Post-write verification: only meaningful for in-place updates where the

package/src/edit/modes/replace.ts

@@ -55,6 +55,7 @@ void import("@gajae-code/natives")
 		// Native unavailable; fuzzy matching uses the TS fallback.
 	});
 
+import { withEditPathMutation } from "../path-mutation-lock";
 import { readEditFileText, serializeEditFileText } from "../read-file";
 import type { EditToolDetails, LspBatchRequest } from "../renderer";
 
@@ -1087,6 +1088,47 @@ export async function executeReplaceSingle(
 	}
 
 	const absolutePath = resolvePlanPath(session, path);
+	return withEditPathMutation([absolutePath], () =>
+		executeReplaceSingleUnderLock({
+			session,
+			path,
+			params,
+			signal,
+			batchRequest,
+			allowFuzzy,
+			fuzzyThreshold,
+			writethrough,
+			beginDeferredDiagnosticsForPath,
+			absolutePath,
+			old_text,
+			new_text,
+			all,
+		}),
+	);
+}
+
+async function executeReplaceSingleUnderLock(
+	options: ExecuteReplaceSingleOptions & {
+		absolutePath: string;
+		old_text: string;
+		new_text: string;
+		all: boolean | undefined;
+	},
+): Promise<AgentToolResult<EditToolDetails, typeof replaceEditEntrySchema>> {
+	const {
+		path,
+		signal,
+		batchRequest,
+		allowFuzzy,
+		fuzzyThreshold,
+		writethrough,
+		beginDeferredDiagnosticsForPath,
+		absolutePath,
+		old_text,
+		new_text,
+		all,
+	} = options;
+
 	const rawContent = await readEditFileText(absolutePath, path);
 	const { bom, text: content } = stripBom(rawContent);
 	const originalEnding = detectLineEnding(content);

package/src/edit/path-mutation-lock.ts

@@ -0,0 +1,112 @@
+/**
+ * Path-scoped mutation coordinator for edit tools.
+ *
+ * Serializes concurrent read→compute→write windows against the same absolute
+ * path so independent sessions cannot silently overwrite each other's successful
+ * disjoint edits (https://github.com/Yeachan-Heo/gajae-code/issues/2900).
+ *
+ * - Always: in-process async mutex keyed by resolved absolute path.
+ * - Optionally: durable cross-process `<path>.lock` via `withFileLock` for real
+ *   filesystem mutations (subagents / separate processes).
+ *
+ * Nested acquisition of the same path is not supported; callers that already
+ * hold the lock must not re-enter.
+ */
+import * as path from "node:path";
+import { type FileLockOptions, withFileLock } from "../config/file-lock";
+
+type AsyncMutex = {
+	acquire(): Promise<() => void>;
+};
+
+const pathMutexes = new Map<string, AsyncMutex>();
+
+function createAsyncMutex(): AsyncMutex {
+	let locked = false;
+	const waiters: Array<() => void> = [];
+	return {
+		async acquire(): Promise<() => void> {
+			if (!locked) {
+				locked = true;
+				return () => release();
+			}
+			const { promise, resolve } = Promise.withResolvers<void>();
+			waiters.push(resolve);
+			await promise;
+			return () => release();
+		},
+	};
+
+	function release(): void {
+		const next = waiters.shift();
+		if (next) {
+			next();
+			return;
+		}
+		locked = false;
+	}
+}
+
+function mutexFor(absolutePath: string): AsyncMutex {
+	const key = path.resolve(absolutePath);
+	let mutex = pathMutexes.get(key);
+	if (!mutex) {
+		mutex = createAsyncMutex();
+		pathMutexes.set(key, mutex);
+	}
+	return mutex;
+}
+
+async function withInProcessPathLock<T>(absolutePath: string, fn: () => Promise<T>): Promise<T> {
+	const release = await mutexFor(absolutePath).acquire();
+	try {
+		return await fn();
+	} finally {
+		release();
+	}
+}
+
+/** Default lock budget: long enough for large writes + formatter writeback. */
+const DEFAULT_CROSS_PROCESS_LOCK: FileLockOptions = {
+	staleMs: 60_000,
+	retries: 600,
+	retryDelayMs: 50,
+};
+
+export type EditPathMutationOptions = {
+	/**
+	 * When true (default), also acquire a durable cross-process file lock.
+	 * Disable for injectible/in-memory filesystem tests that do not touch disk.
+	 */
+	crossProcess?: boolean;
+	fileLock?: FileLockOptions;
+};
+
+/**
+ * Run `fn` while holding exclusive mutation rights for every absolute path.
+ * Paths are locked in lexicographic order to avoid deadlocks on multi-path ops
+ * (e.g. rename source + destination).
+ */
+export async function withEditPathMutation<T>(
+	absolutePaths: readonly string[],
+	fn: () => Promise<T>,
+	options: EditPathMutationOptions = {},
+): Promise<T> {
+	const unique = [...new Set(absolutePaths.map(entry => path.resolve(entry)))].sort();
+	if (unique.length === 0) return fn();
+
+	const crossProcess = options.crossProcess !== false;
+	const fileLock = { ...DEFAULT_CROSS_PROCESS_LOCK, ...options.fileLock };
+
+	const runAt = async (index: number): Promise<T> => {
+		if (index >= unique.length) return fn();
+		const target = unique[index];
+		const next = () => runAt(index + 1);
+		return withInProcessPathLock(target, async () => {
+			if (!crossProcess) return next();
+			return withFileLock(target, next, fileLock);
+		});
+	};
+
+	return runAt(0);
+}

package/src/eval/py/executor.ts

@@ -61,7 +61,7 @@ export interface PythonExecutorOptions {
 	/** @internal Bridge session id, set by `executePython` before delegating. */
 	bridgeSessionId?: string;
 	/** @internal Bridge endpoint info, set by `executePython` before delegating. */
-	bridge?: { url: string; token: string };
+	bridge?: { url: string; capability: string };
 }
 
 export interface PythonKernelExecutor {
@@ -106,6 +106,7 @@ export interface PythonResult {
 interface PythonSession {
 	sessionId: string;
 	kernel: PythonKernel;
+	bridgeCapability?: string;
 	ownerIds: Set<string>;
 	hasFallbackOwner: boolean;
 	queue: Promise<void>;
@@ -261,14 +262,14 @@ function buildKernelEnv(options: {
 	sessionFile?: string;
 	artifactsDir?: string;
 	bridgeSessionId?: string;
-	bridge?: { url: string; token: string };
+	bridge?: { url: string; capability: string };
 }): Record<string, string> | undefined {
 	const env: Record<string, string> = {};
 	if (options.sessionFile) env.PI_SESSION_FILE = options.sessionFile;
 	if (options.artifactsDir) env.PI_ARTIFACTS_DIR = options.artifactsDir;
 	if (options.bridge && options.bridgeSessionId) {
 		env.PI_TOOL_BRIDGE_URL = options.bridge.url;
-		env.PI_TOOL_BRIDGE_TOKEN = options.bridge.token;
+		env.PI_TOOL_BRIDGE_CAPABILITY = options.bridge.capability;
 		env.PI_TOOL_BRIDGE_SESSION = options.bridgeSessionId;
 	}
 	return Object.keys(env).length > 0 ? env : undefined;
@@ -328,6 +329,7 @@ async function acquireSession(sessionId: string, cwd: string, options: PythonExe
 			const session: PythonSession = {
 				sessionId,
 				kernel,
+				bridgeCapability: options.bridge?.capability,
 				ownerIds: new Set(),
 				hasFallbackOwner: false,
 				queue: Promise.resolve(),
@@ -361,12 +363,25 @@ async function replaceSessionKernel(
 		throw new PythonExecutionCancelledError(false);
 	}
 	requireRemainingTimeoutMs(options.deadlineMs);
-	const next = await startKernel(cwd, options);
-	if (sessions.get(session.sessionId) !== session) {
-		await next.shutdown().catch(() => undefined);
-		throw new PythonExecutionCancelledError(false);
+	const bridge = options.bridge;
+	const previousCapability = bridge?.capability;
+	const nextCapability = bridge ? crypto.randomUUID() : undefined;
+	if (bridge && nextCapability) bridge.capability = nextCapability;
+	let next: PythonKernel | undefined;
+	try {
+		next = await startKernel(cwd, options);
+		if (sessions.get(session.sessionId) !== session) {
+			throw new PythonExecutionCancelledError(false);
+		}
+		session.kernel = next;
+		session.bridgeCapability = nextCapability;
+	} catch (err) {
+		await next?.shutdown().catch(() => undefined);
+		if (bridge && previousCapability && bridge.capability === nextCapability) {
+			bridge.capability = previousCapability;
+		}
+		throw err;
 	}
-	session.kernel = next;
 }
 
 async function resetSession(sessionId: string): Promise<void> {
@@ -481,8 +496,8 @@ async function executeWithKernel(
 			displayOutputs.push({ type: "status", event });
 		});
 	const unregisterBridge =
-		options?.toolSession && options?.bridgeSessionId
-			? registerPyToolBridge(options.bridgeSessionId, {
+		options?.toolSession && options?.bridgeSessionId && options.bridge
+			? registerPyToolBridge(options.bridgeSessionId, options.bridge.capability, {
 					toolSession: options.toolSession,
 					signal: options.signal,
 					emitStatus,
@@ -578,7 +593,8 @@ async function ensureKernelAvailable(cwd: string, options: PythonExecutorOptions
 async function ensureToolBridge(options: PythonExecutorOptions): Promise<void> {
 	if (!options.toolSession || options.bridge) return;
 	try {
-		options.bridge = await ensurePyToolBridge();
+		const bridge = await ensurePyToolBridge();
+		options.bridge = { ...bridge, capability: crypto.randomUUID() };
 	} catch (err) {
 		logger.warn("Failed to start Python tool bridge", {
 			error: err instanceof Error ? err.message : String(err),
@@ -607,6 +623,9 @@ async function executeOnSession(code: string, cwd: string, options: PythonExecut
 		await resetSession(sessionId);
 	}
 	const session = await acquireSession(sessionId, cwd, options);
+	if (options.bridge && session.bridgeCapability) {
+		options.bridge.capability = session.bridgeCapability;
+	}
 	return await runQueued(session, options, async () => {
 		if (options.signal?.aborted) {
 			throw new PythonExecutionCancelledError(isTimedOutCancellation(options.signal.reason, options.signal));

package/src/eval/py/prelude.py

@@ -453,10 +453,10 @@ if "__gjc_prelude_loaded__" not in globals():
 
     if all(
         _k in os.environ
-        for _k in ("PI_TOOL_BRIDGE_URL", "PI_TOOL_BRIDGE_TOKEN", "PI_TOOL_BRIDGE_SESSION")
+        for _k in ("PI_TOOL_BRIDGE_URL", "PI_TOOL_BRIDGE_CAPABILITY", "PI_TOOL_BRIDGE_SESSION")
     ):
         tool = _ToolProxy(
             os.environ["PI_TOOL_BRIDGE_URL"],
-            os.environ["PI_TOOL_BRIDGE_TOKEN"],
+            os.environ["PI_TOOL_BRIDGE_CAPABILITY"],
             os.environ["PI_TOOL_BRIDGE_SESSION"],
         )