@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/edit/modes/patch.ts

@@ -6,10 +6,12 @@
  */
 
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentToolResult } from "@gajae-code/agent-core";
 import { isEnoent } from "@gajae-code/utils";
 import * as z from "zod/v4";
+import type { Settings } from "../../config/settings";
 import {
 	type FileDiagnosticsResult,
 	flushLspWritethroughBatch,
@@ -80,6 +82,17 @@ export interface ApplyPatchOptions {
 	 * object identity is not a durable-lock capability probe.
 	 */
 	crossProcessLock?: boolean;
+	/** Explicit artifacts `local` root for this call. The caller session owns it. */
+	localRoot?: string;
+	signal?: AbortSignal;
+	/**
+	 * Recheck a rename destination while this call holds the path mutation lock.
+	 * The request preflight runs before that lock.
+	 */
+	destinationGuard?: {
+		settings: Pick<Settings, "get">;
+		displayPath: string;
+	};
 }
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -117,6 +130,117 @@ function loadNativePatchBindings(): Promise<NativePatchBindings> {
 	return nativePatchBindingsPromise;
 }
 
+function explicitLocalRootForSession(session: ToolSession): string | undefined {
+	const artifactsDir = session.getArtifactsDir?.();
+	if (!artifactsDir || session.isManagedSessionDestination?.()) return undefined;
+	return path.resolve(artifactsDir, "local");
+}
+
+function pathIsWithin(target: string, root: string): boolean {
+	const relative = path.relative(root, target);
+	return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+/**
+ * Trust root for a delete. `localRoot` is the caller session's explicit
+ * artifacts root. `gjc-local/<id>` is recognized from the path. Else `cwd`.
+ */
+function boundaryForPatchDelete(cwd: string, absolutePath: string, localRoot?: string): string {
+	const resolved = path.resolve(absolutePath);
+	if (localRoot) {
+		const explicit = path.resolve(localRoot);
+		if (pathIsWithin(resolved, explicit)) return explicit;
+	}
+	const managedParent = path.join(os.tmpdir(), "gjc-local");
+	if (pathIsWithin(resolved, managedParent)) {
+		const rest = resolved.slice(managedParent.length + path.sep.length);
+		const sessionSegment = rest.split(path.sep, 1)[0] ?? "";
+		if (sessionSegment.length > 0) return path.join(managedParent, sessionSegment);
+	}
+	return path.resolve(cwd);
+}
+
+/**
+ * `unlink` follows a directory symlink. Resolve the parent only, then delete
+ * that real parent plus the final name so a file symlink is removed as a link.
+ */
+async function resolvePatchDeletePath(
+	root: string,
+	absolutePath: string,
+	displayPath: string,
+	signal?: AbortSignal,
+): Promise<string> {
+	signal?.throwIfAborted();
+	let realRoot: string;
+	try {
+		realRoot = await fs.promises.realpath(root);
+	} catch (error) {
+		if (isEnoent(error)) throw new ApplyPatchError(`File not found: ${displayPath}`);
+		throw error;
+	}
+	signal?.throwIfAborted();
+	let realParent: string;
+	try {
+		realParent = await fs.promises.realpath(path.dirname(absolutePath));
+	} catch (error) {
+		if (isEnoent(error)) throw new ApplyPatchError(`File not found: ${displayPath}`);
+		throw error;
+	}
+	signal?.throwIfAborted();
+	if (!pathIsWithin(realParent, realRoot)) {
+		throw new ApplyPatchError(`Delete target resolves outside its root: ${displayPath}`);
+	}
+	return path.join(realParent, path.basename(absolutePath));
+}
+
+/**
+ * `mkdir` follows a directory symlink. Walk to the nearest existing ancestor
+ * and return its real path plus the missing suffix. A parent that is already
+ * lexically outside the workspace or session local root is unchanged.
+ */
+async function resolvePatchMkdirPath(
+	cwd: string,
+	absolutePath: string,
+	localRoot: string | undefined,
+	parentDir: string,
+	displayPath: string,
+	signal?: AbortSignal,
+): Promise<string> {
+	signal?.throwIfAborted();
+	const boundary = path.resolve(boundaryForPatchDelete(cwd, absolutePath, localRoot));
+	const lexicalParent = path.resolve(parentDir);
+	if (!pathIsWithin(lexicalParent, boundary)) return parentDir;
+	// A root that does not exist yet is not an escape. Keep the missing suffix
+	// under its real ancestor, which is what mkdir did before this check.
+	const realRoot = await realpathThroughExistingAncestor(boundary, signal);
+	signal?.throwIfAborted();
+	const realParent = await realpathThroughExistingAncestor(lexicalParent, signal);
+	signal?.throwIfAborted();
+	if (!pathIsWithin(realParent, realRoot)) {
+		throw new ApplyPatchError(`Parent directory resolves outside its root: ${displayPath}`);
+	}
+	return realParent;
+}
+
+async function realpathThroughExistingAncestor(target: string, signal?: AbortSignal): Promise<string> {
+	const resolved = path.resolve(target);
+	const missing: string[] = [];
+	let cursor = resolved;
+	for (;;) {
+		signal?.throwIfAborted();
+		try {
+			const real = await fs.promises.realpath(cursor);
+			return missing.length === 0 ? real : path.join(real, ...missing.reverse());
+		} catch (error) {
+			if (!isEnoent(error)) throw error;
+			const parent = path.dirname(cursor);
+			if (parent === cursor) return resolved;
+			missing.push(path.basename(cursor));
+			cursor = parent;
+		}
+	}
+}
+
 async function readExistingPatchFile(fileSystem: FileSystem, absolutePath: string, path: string): Promise<string> {
 	try {
 		return await fileSystem.read(absolutePath);
@@ -160,6 +284,9 @@ export async function applyPatch(input: PatchInput, options: ApplyPatchOptions):
 		const destPath = resolvePath(input.rename);
 		if (destPath !== absolutePath) mutationPaths.push(destPath);
 	}
+	// The cross-process lock creates missing parent directories for `<path>.lock`.
+	// Check every locked create/move path, including a rename on create, first.
+	await preflightPatchMkdir(input, options);
 	const usingDefaultFs = options.fs === undefined || options.fs === defaultFileSystem;
 	// dryRun/preview must stay read-only: never create durable `<path>.lock` dirs
 	// (would fail on read-only parents and mutate the FS during preview) (#2900 review).
@@ -167,6 +294,36 @@ export async function applyPatch(input: PatchInput, options: ApplyPatchOptions):
 	return withEditPathMutation(mutationPaths, () => applyNormalizedPatch(input, options), { crossProcess });
 }
 
+/** Read-only mkdir check for one patch hunk. Does not create directories. */
+export async function preflightPatchMkdir(input: PatchInput, options: ApplyPatchOptions): Promise<void> {
+	const resolvePath = (p: string): string => resolveToCwd(p, options.cwd);
+	const absolutePath = resolvePath(input.path);
+	const op = input.op ?? "update";
+	if (op === "create") {
+		await rejectPatchMkdirEscape(options.cwd, absolutePath, options.localRoot, input.path, options.signal);
+	}
+	if (input.rename) {
+		const destPath = resolvePath(input.rename);
+		if (destPath !== absolutePath) {
+			// The source is locked too. Check it before that lock can mkdir through a symlink.
+			await rejectPatchMkdirEscape(options.cwd, absolutePath, options.localRoot, input.path, options.signal);
+			await rejectPatchMkdirEscape(options.cwd, destPath, options.localRoot, input.rename, options.signal);
+		}
+	}
+}
+
+async function rejectPatchMkdirEscape(
+	cwd: string,
+	absolutePath: string,
+	localRoot: string | undefined,
+	displayPath: string,
+	signal?: AbortSignal,
+): Promise<void> {
+	const parentDir = path.dirname(absolutePath);
+	if (!parentDir || parentDir === ".") return;
+	await resolvePatchMkdirPath(cwd, absolutePath, localRoot, parentDir, displayPath, signal);
+}
+
 /**
  * Apply a normalized patch operation to the filesystem.
  * Caller must already hold path mutation rights when concurrent writers exist.
@@ -179,6 +336,8 @@ async function applyNormalizedPatch(input: PatchInput, options: ApplyPatchOption
 		fs = defaultFileSystem,
 		fuzzyThreshold = DEFAULT_FUZZY_THRESHOLD,
 		allowFuzzy = true,
+		localRoot,
+		signal,
 	} = options;
 
 	const resolvePath = (p: string): string => resolveToCwd(p, cwd);
@@ -201,11 +360,17 @@ async function applyNormalizedPatch(input: PatchInput, options: ApplyPatchOption
 		const normalizedContent = normalizeCreateContent(input.diff);
 		const content = normalizedContent.endsWith("\n") ? normalizedContent : `${normalizedContent}\n`;
 
+		const parentDir = path.dirname(absolutePath);
+		const mkdirPath =
+			parentDir && parentDir !== "."
+				? await resolvePatchMkdirPath(cwd, absolutePath, localRoot, parentDir, input.path, signal)
+				: undefined;
 		if (!dryRun) {
-			const parentDir = path.dirname(absolutePath);
-			if (parentDir && parentDir !== ".") {
-				await fs.mkdir(parentDir);
+			if (mkdirPath) {
+				signal?.throwIfAborted();
+				await fs.mkdir(mkdirPath);
 			}
+			signal?.throwIfAborted();
 			await fs.write(absolutePath, content);
 		}
 
@@ -220,9 +385,14 @@ async function applyNormalizedPatch(input: PatchInput, options: ApplyPatchOption
 
 	// Handle DELETE operation
 	if (op === "delete") {
-		const oldContent = await readExistingPatchFile(fs, absolutePath, input.path);
+		signal?.throwIfAborted();
+		const boundary = boundaryForPatchDelete(cwd, absolutePath, localRoot);
+		const deletePath = await resolvePatchDeletePath(boundary, absolutePath, input.path, signal);
+		signal?.throwIfAborted();
+		const oldContent = await readExistingPatchFile(fs, deletePath, input.path);
+		signal?.throwIfAborted();
 		if (!dryRun) {
-			await fs.delete(absolutePath);
+			await fs.delete(deletePath);
 		}
 
 		return {
@@ -260,6 +430,20 @@ async function applyNormalizedPatch(input: PatchInput, options: ApplyPatchOption
 	const finalContent = bom + restoreLineEndings(newContent, lineEnding);
 	const destPath = input.rename ? resolvePath(input.rename) : absolutePath;
 	const isMove = Boolean(input.rename) && destPath !== absolutePath;
+	let moveParent: string | undefined;
+	if (isMove) {
+		const parentDir = path.dirname(destPath);
+		if (parentDir && parentDir !== ".") {
+			moveParent = await resolvePatchMkdirPath(
+				cwd,
+				destPath,
+				localRoot,
+				parentDir,
+				input.rename ?? input.path,
+				signal,
+			);
+		}
+	}
 
 	if (!dryRun) {
 		// Commit-time CAS: reject if another writer mutated the file after our
@@ -269,10 +453,18 @@ async function applyNormalizedPatch(input: PatchInput, options: ApplyPatchOption
 			throw new ApplyPatchError(`concurrent edit conflict: file changed since read: ${input.path}`);
 		}
 		if (isMove) {
-			const parentDir = path.dirname(destPath);
-			if (parentDir && parentDir !== ".") {
-				await fs.mkdir(parentDir);
+			// Preflight can pass, then another writer holding this lock can
+			// turn a handwritten destination into a generated file.
+			if (options.destinationGuard) {
+				signal?.throwIfAborted();
+				await assertEditableFile(destPath, options.destinationGuard.displayPath, options.destinationGuard.settings);
+				signal?.throwIfAborted();
 			}
+			if (moveParent) {
+				signal?.throwIfAborted();
+				await fs.mkdir(moveParent);
+			}
+			signal?.throwIfAborted();
 			await fs.write(destPath, finalContent);
 			await fs.delete(absolutePath);
 		} else {
@@ -467,7 +659,15 @@ export async function executePatchSingle(
 	const resolvedPath = resolvePlanPath(session, path);
 	const resolvedRename = rename ? resolvePlanPath(session, rename) : undefined;
 
+	signal?.throwIfAborted();
 	await assertEditableFile(resolvedPath, path, session.settings);
+	// The rename destination is the path that is written. The source call above
+	// already uses this helper, including generated names that do not exist yet.
+	signal?.throwIfAborted();
+	if (resolvedRename && rename && resolvedRename !== resolvedPath) {
+		await assertEditableFile(resolvedRename, rename, session.settings);
+		signal?.throwIfAborted();
+	}
 
 	// Capture pre-edit content so we can verify the write actually hit disk.
 	// `LspFileSystem.writeFile` delegates to a writethrough callback that, in
@@ -493,12 +693,18 @@ export async function executePatchSingle(
 	// not `defaultFileSystem` by object identity. Force durable cross-process
 	// locking so multi-process agents cannot silently race past the path mutex
 	// (#2900 review: do not infer lock capability from FileSystem identity).
+	const localRoot = explicitLocalRootForSession(session);
 	const result = await applyPatch(input, {
 		cwd: session.cwd,
 		fs: patchFileSystem,
 		fuzzyThreshold,
 		allowFuzzy,
 		crossProcessLock: true,
+		localRoot,
+		signal,
+		...(op === "update" && resolvedRename && rename && resolvedRename !== resolvedPath
+			? { destinationGuard: { settings: session.settings, displayPath: rename } }
+			: {}),
 	});
 
 	// Post-write verification: only meaningful for in-place updates where the

package/src/edit/modes/replace.ts

@@ -9,6 +9,7 @@ import { markDesignedError } from "@gajae-code/utils/error-classification";
 import * as z from "zod/v4";
 import type { WritethroughCallback, WritethroughDeferredHandle } from "../../lsp";
 import type { ToolSession } from "../../tools";
+import { assertEditableFile, assertEditableFileContent } from "../../tools/auto-generated-guard";
 import { invalidateFsScanAfterWrite } from "../../tools/fs-cache-invalidation";
 import { outputMeta } from "../../tools/output-meta";
 import { enforcePlanModeWrite, resolvePlanPath } from "../../tools/plan-mode-guard";
@@ -636,6 +637,7 @@ export async function executeReplaceSingle(
 	}
 
 	const absolutePath = resolvePlanPath(session, path);
+	await assertEditableFile(absolutePath, path, session.settings);
 	return withEditPathMutation([absolutePath], () =>
 		executeReplaceSingleUnderLock({
 			session,
@@ -664,6 +666,7 @@ async function executeReplaceSingleUnderLock(
 	},
 ): Promise<AgentToolResult<EditToolDetails, typeof replaceEditEntrySchema>> {
 	const {
+		session,
 		path,
 		signal,
 		batchRequest,
@@ -678,6 +681,8 @@ async function executeReplaceSingleUnderLock(
 	} = options;
 
 	const rawContent = await readEditFileText(absolutePath, path);
+	assertEditableFileContent(rawContent, path, session.settings);
+	await assertEditableFile(absolutePath, path, session.settings);
 	const { bom, text: content } = stripBom(rawContent);
 	const originalEnding = detectLineEnding(content);
 	const normalizedContent = normalizeToLF(content);
@@ -749,3 +754,134 @@ async function executeReplaceSingleUnderLock(
 		},
 	};
 }
+
+export async function executeReplaceEntries(
+	options: Omit<ExecuteReplaceSingleOptions, "params"> & { edits: ReplaceEditEntry[] },
+): Promise<AgentToolResult<EditToolDetails, typeof replaceEditSchema>> {
+	if (options.edits.length <= 1) {
+		const only = options.edits[0];
+		if (!only) {
+			throw new ToolError("edits must not be empty.");
+		}
+		return executeReplaceSingle({ ...options, params: only });
+	}
+
+	const { session, path, edits } = options;
+	try {
+		enforcePlanModeWrite(session, path);
+		for (const entry of edits) {
+			if (entry.old_text.length === 0) {
+				throw new ToolError("old_text must not be empty.");
+			}
+		}
+		const absolutePath = resolvePlanPath(session, path);
+		return await withEditPathMutation([absolutePath], () =>
+			executeReplaceEntriesUnderLock({ ...options, absolutePath }),
+		);
+	} catch (err) {
+		const errorText = err instanceof Error ? err.message : String(err);
+		return {
+			content: [{ type: "text", text: `Error editing ${path}: ${errorText}` }],
+			details: { diff: "", path },
+			isError: true,
+		};
+	}
+}
+
+async function executeReplaceEntriesUnderLock(
+	options: Omit<ExecuteReplaceSingleOptions, "params"> & {
+		edits: ReplaceEditEntry[];
+		absolutePath: string;
+	},
+): Promise<AgentToolResult<EditToolDetails, typeof replaceEditSchema>> {
+	const {
+		session,
+		path,
+		edits,
+		signal,
+		batchRequest,
+		allowFuzzy,
+		fuzzyThreshold,
+		writethrough,
+		beginDeferredDiagnosticsForPath,
+		absolutePath,
+	} = options;
+
+	const rawContent = await readEditFileText(absolutePath, path);
+	assertEditableFileContent(rawContent, path, session.settings);
+	await assertEditableFile(absolutePath, path, session.settings);
+
+	const { bom, text: content } = stripBom(rawContent);
+	const originalEnding = detectLineEnding(content);
+	let normalizedContent = normalizeToLF(content);
+	const originalNormalized = normalizedContent;
+	const texts: string[] = [];
+
+	for (const [index, entry] of edits.entries()) {
+		const normalizedOldText = normalizeToLF(entry.old_text);
+		const normalizedNewText = normalizeToLF(entry.new_text);
+		const replaced = await replaceText(normalizedContent, normalizedOldText, normalizedNewText, {
+			fuzzy: allowFuzzy,
+			all: entry.all ?? false,
+			threshold: fuzzyThreshold,
+		});
+		if (replaced.count === 0) {
+			const matchOutcome = await findMatch(normalizedContent, normalizedOldText, {
+				allowFuzzy,
+				threshold: fuzzyThreshold,
+			});
+			if (matchOutcome.occurrences && matchOutcome.occurrences > 1) {
+				throw new ToolError(formatOccurrenceError(path, matchOutcome));
+			}
+			throw new EditMatchError(path, normalizedOldText, matchOutcome.closest, {
+				allowFuzzy,
+				threshold: fuzzyThreshold,
+				fuzzyMatches: matchOutcome.fuzzyMatches,
+			});
+		}
+		if (normalizedContent === replaced.content) {
+			throw new ToolError(`Edits to ${path} resulted in no changes being made.`);
+		}
+		normalizedContent = replaced.content;
+		if (index < edits.length - 1) {
+			assertEditableFileContent(normalizedContent, path, session.settings);
+		}
+		texts.push(
+			replaced.count > 1
+				? `Successfully replaced ${replaced.count} occurrences in ${path}.`
+				: `Successfully replaced text in ${path}.`,
+		);
+	}
+
+	const finalContent = await serializeEditFileText(
+		absolutePath,
+		path,
+		bom + restoreLineEndings(normalizedContent, originalEnding),
+	);
+	const diagnostics = await writethrough(
+		absolutePath,
+		finalContent,
+		signal,
+		Bun.file(absolutePath),
+		batchRequest,
+		dst => (dst === absolutePath ? beginDeferredDiagnosticsForPath(absolutePath) : undefined),
+	);
+	invalidateFsScanAfterWrite(absolutePath);
+
+	const diffResult = generateDiffString(originalNormalized, normalizedContent);
+	const meta = outputMeta()
+		.diagnostics(diagnostics?.summary ?? "", diagnostics?.messages ?? [])
+		.get();
+	return {
+		content: [{ type: "text", text: texts.join("\n") }],
+		details: {
+			diff: diffResult.diff,
+			path: absolutePath,
+			firstChangedLine: diffResult.firstChangedLine,
+			diagnostics,
+			meta,
+			oldText: rawContent,
+			newText: finalContent,
+		},
+	};
+}

package/src/eval/js/context-manager.ts

@@ -523,15 +523,41 @@ async function spawnJsWorker(): Promise<WorkerHandle> {
 }
 
 function wrapBunWorker(worker: Worker): WorkerHandle {
+	// Cells share parentPort, so worker→host frames use a port transferred before
+	// the first cell. worker "message" events are accepted only until ready.
+	const channel = new MessageChannel();
+	const hostPort = channel.port2;
+	const queued: WorkerOutbound[] = [];
+	let onFrame: ((msg: WorkerOutbound) => void) | undefined;
+	let acceptWorkerEvent = true;
+	const deliver = (msg: WorkerOutbound): void => {
+		if (msg?.type === "ready" || msg?.type === "init-failed") acceptWorkerEvent = false;
+		if (onFrame) onFrame(msg);
+		else queued.push(msg);
+	};
+	const onPort = (event: Event): void => {
+		deliver((event as MessageEvent).data as WorkerOutbound);
+	};
+	const onWorker = (event: Event): void => {
+		if (!acceptWorkerEvent) return;
+		deliver((event as MessageEvent).data as WorkerOutbound);
+	};
+	hostPort.addEventListener("message", onPort);
+	worker.addEventListener("message", onWorker);
+	worker.postMessage({ type: "gjc-bind", port: channel.port1 }, { transfer: [channel.port1] });
 	return {
 		mode: "worker",
 		send(msg) {
 			worker.postMessage(msg);
 		},
 		onMessage(handler) {
-			const wrap = (event: MessageEvent): void => handler(event.data as WorkerOutbound);
-			worker.addEventListener("message", wrap);
-			return () => worker.removeEventListener("message", wrap);
+			onFrame = handler;
+			for (const msg of queued.splice(0)) handler(msg);
+			return () => {
+				if (onFrame === handler) onFrame = undefined;
+				hostPort.removeEventListener("message", onPort);
+				worker.removeEventListener("message", onWorker);
+			};
 		},
 		async terminate() {
 			worker.terminate();

package/src/eval/js/worker-entry.ts

@@ -1,24 +1,57 @@
-import { parentPort } from "node:worker_threads";
+import { type MessagePort, parentPort } from "node:worker_threads";
 import { WorkerCore } from "./worker-core";
 import type { Transport, WorkerInbound, WorkerOutbound } from "./worker-protocol";
 
 if (!parentPort) throw new Error("js worker-entry: missing parentPort");
 
-const port = parentPort;
-const transport: Transport = {
-	send: (msg: WorkerOutbound) => port.postMessage(msg),
-	onMessage: handler => {
-		const wrap = (data: unknown): void => handler(data as WorkerInbound);
-		port.on("message", wrap);
-		return () => port.off("message", wrap);
-	},
-	close: () => {
-		try {
-			port.close();
-		} catch {
-			// Already closed.
-		}
-	},
-};
+const parent = parentPort;
+
+function isHostPort(value: unknown): value is MessagePort {
+	if (!value || typeof value !== "object") return false;
+	const port = value as MessagePort;
+	return typeof port.postMessage === "function" && typeof port.on === "function";
+}
+
+function readBindPort(data: unknown): MessagePort | undefined {
+	if (!data || typeof data !== "object") return undefined;
+	const record = data as { type?: unknown; port?: unknown };
+	if (record.type !== "gjc-bind" || !isHostPort(record.port)) return undefined;
+	return record.port;
+}
 
-new WorkerCore(transport);
+function listen(port: MessagePort): void {
+	// Bound before any user cell. A later prototype patch cannot retarget this send.
+	const post = port.postMessage.bind(port);
+	const transport: Transport = {
+		send: (msg: WorkerOutbound) => {
+			post(msg);
+		},
+		onMessage: handler => {
+			const wrap = (data: unknown): void => handler(data as WorkerInbound);
+			parent.on("message", wrap);
+			return () => parent.off("message", wrap);
+		},
+		close: () => {
+			try {
+				port.close();
+			} catch {
+				// Already closed.
+			}
+			try {
+				parent.close();
+			} catch {
+				// Already closed.
+			}
+		},
+	};
+	new WorkerCore(transport);
+}
+
+const onParent = (data: unknown): void => {
+	const port = readBindPort(data);
+	if (!port) return;
+	if (data && typeof data === "object") (data as { port?: unknown }).port = undefined;
+	parent.off("message", onParent);
+	listen(port);
+};
+parent.on("message", onParent);

package/src/eval/py/executor.ts

@@ -912,7 +912,17 @@ async function replaceSessionKernel(
 	const old = session.kernel;
 	const remaining = getRemainingTimeoutMs(options.deadlineMs);
 	const ownerIds = new Set(session.ownerIds);
-	await shutdownOrRetainKernel(old, ownerIds, remaining === undefined ? undefined : Math.max(0, remaining));
+	try {
+		await shutdownOrRetainKernel(old, ownerIds, remaining === undefined ? undefined : Math.max(0, remaining));
+	} catch (error) {
+		// Suppress unconfirmed shutdown error ONLY when we have positive evidence the
+		// process actually exited (exitCode is set). Without that evidence, propagate the error
+		// so we don't start a replacement while the old subprocess is still running.
+		// See https://github.com/yeachan-heo/gajae-code/issues/6569
+		const hasConfirmedExit = old.getExitCode() !== null;
+		if (!hasConfirmedExit || !(error instanceof Error) || error.name !== "PythonKernelShutdownUnconfirmedError")
+			throw error;
+	}
 	throwIfExecutionCancelled(options);
 	if (sessions.get(session.sessionId) !== session) {
 		throw new PythonExecutionCancelledError(false);
@@ -1076,7 +1086,6 @@ export function disposeKernelSessionsByOwner(ownerId: string): Promise<void> {
 	const toShutdown: PythonSession[] = [];
 	const initializersToAbort: InitializingPythonSession[] = [];
 	for (const entry of initializing) {
-		entry.retirementOwnerIds.add(ownerId);
 		let hasOwnerRequest = false;
 		for (const request of entry.requests) {
 			if (request.ownerId === ownerId && !request.signal?.aborted) {
@@ -1089,6 +1098,7 @@ export function disposeKernelSessionsByOwner(ownerId: string): Promise<void> {
 			if (entry.ownerIds.size > 0) removeKernelOwner(entry.kernel, ownerId);
 		}
 		if (![...entry.ownerIds].some(id => id !== ownerId)) {
+			entry.retirementOwnerIds.add(ownerId);
 			entry.cancelled ??= new PythonExecutionCancelledError(false);
 			initializersToAbort.push(entry);
 		}
@@ -1137,10 +1147,10 @@ export function disposeKernelSessionsByOwner(ownerId: string): Promise<void> {
 	return (async () => {
 		await Promise.all([
 			...requests.map(request => request.completion),
-			...initializing.map(entry => entry.promise.catch(() => undefined)),
+			...initializersToAbort.map(entry => entry.promise.catch(() => undefined)),
 		]);
 		const failures: unknown[] = [];
-		for (const entry of initializing)
+		for (const entry of initializersToAbort)
 			if (entry.cleanupFailed) {
 				if (entry.kernel) retainKernelForOwners(entry.kernel, new Set([ownerId]));
 				failures.push(entry.cleanupError);