@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/export/ttsr.ts

@@ -4,7 +4,12 @@
  * Manages rules that get injected mid-stream when their condition pattern matches
  * the agent's output. When a match occurs, the stream is aborted, the rule is
  * injected as a system reminder, and the request is retried.
+ *
+ * Rules may also carry `astCondition` ast-grep patterns, which are evaluated
+ * against the source a write/edit tool call introduces, before it executes.
  */
+import * as path from "node:path";
+import { AstMatchStrictness, astMatch } from "@gajae-code/natives";
 import { logger } from "@gajae-code/utils";
 import type { Rule } from "../capability/rule";
 import type { TtsrSettings } from "../config/settings";
@@ -22,6 +27,14 @@ export interface TtsrMatchContext {
 	streamKey?: string;
 }
 
+/** An astCondition pattern parse issue observed while checking a target language. */
+export interface TtsrAstConditionDiagnostic {
+	ruleName: string;
+	lang: string;
+	patterns: string[];
+	parseErrors: string[];
+}
+
 interface ToolScope {
 	toolName?: string;
 	pathGlob?: Bun.Glob;
@@ -39,6 +52,7 @@ interface TtsrEntry {
 	rule: Rule;
 	conditions: RegExp[];
 	conditionWindows: Array<number | undefined>;
+	astConditions?: string[];
 
 	scope: TtsrScope;
 	globalPathGlobs?: Bun.Glob[];
@@ -69,6 +83,7 @@ const DEFAULT_SETTINGS: Required<TtsrSettings> = {
 
 const SAFE_REGEX_WINDOW_CAP = 4096;
 const SAFE_REGEX_WINDOW_MULTIPLIER = 4;
+const SOURCE_SYNTAX_PARSE_ERROR = "parse error (syntax tree contains error nodes)";
 
 const DEFAULT_SCOPE: TtsrScope = {
 	allowText: true,
@@ -81,7 +96,9 @@ export class TtsrManager {
 	readonly #settings: Required<TtsrSettings>;
 	readonly #rules = new Map<string, TtsrEntry>();
 	readonly #injectionRecords = new Map<string, InjectionRecord>();
+	readonly #astConditionDiagnostics = new Map<string, TtsrAstConditionDiagnostic>();
 	readonly #buffers = new Map<string, string>();
+	readonly #lastAstSnapshots = new Map<string, string>();
 	#messageCount = 0;
 
 	constructor(settings?: Partial<TtsrSettings>) {
@@ -339,7 +356,10 @@ export class TtsrManager {
 		}
 
 		const conditions = this.#compileConditions(rule);
-		if (conditions.length === 0) {
+		const astConditions = rule.astCondition ?? [];
+
+		// Rule must have either regex or AST conditions
+		if (conditions.length === 0 && astConditions.length === 0) {
 			return false;
 		}
 
@@ -357,6 +377,7 @@ export class TtsrManager {
 			rule,
 			conditions,
 			conditionWindows,
+			astConditions: astConditions.length > 0 ? astConditions : undefined,
 			scope,
 			globalPathGlobs,
 		});
@@ -364,6 +385,7 @@ export class TtsrManager {
 		logger.debug("TTSR rule registered", {
 			ruleName: rule.name,
 			conditions: rule.condition,
+			astConditions: rule.astCondition,
 			scope: rule.scope,
 			globs: rule.globs,
 		});
@@ -446,6 +468,25 @@ export class TtsrManager {
 		return Array.from(this.#injectionRecords.keys());
 	}
 
+	/**
+	 * Undo a provisional claim whose reminder was never delivered: restore the
+	 * record the rule had before the claim, or forget it when it had none, so the
+	 * rule is eligible again exactly as before.
+	 */
+	releaseInjected(ruleName: string, previous: TtsrInjectionRecord | undefined): void {
+		const name = ruleName.trim();
+		if (name.length === 0) return;
+		if (!previous) {
+			this.#injectionRecords.delete(name);
+			return;
+		}
+		this.#injectionRecords.set(name, {
+			lastInjectedAt: previous.lastInjectedAt,
+			repeatMode: previous.repeatMode,
+			repeatGap: previous.repeatGap,
+		});
+	}
+
 	/** Get full injected rule records (for persistence). */
 	getInjectedRecords(): TtsrInjectionRecord[] {
 		return Array.from(this.#injectionRecords, ([name, record]) => ({ name, ...record }));
@@ -477,6 +518,7 @@ export class TtsrManager {
 	/** Reset stream buffers (called on new turn). */
 	resetBuffer(): void {
 		this.#buffers.clear();
+		this.#lastAstSnapshots.clear();
 	}
 
 	/** Check if any TTSR rules are registered. */
@@ -509,4 +551,137 @@ export class TtsrManager {
 	getSettings(): Required<TtsrSettings> {
 		return this.#settings;
 	}
+
+	/** Check if any registered rule carries an `astCondition`. */
+	hasAstRules(): boolean {
+		if (this.#isDisabled()) {
+			return false;
+		}
+		for (const entry of this.#rules.values()) {
+			if (entry.astConditions) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+	/** Get observed astCondition pattern parse issues for rule diagnostics. */
+	getAstConditionDiagnostics(): TtsrAstConditionDiagnostic[] {
+		return Array.from(this.#astConditionDiagnostics.values(), diagnostic => ({
+			...diagnostic,
+			patterns: [...diagnostic.patterns],
+			parseErrors: [...diagnostic.parseErrors],
+		}));
+	}
+
+	/** Derive an ast-grep language alias from the candidate file extensions. */
+	#deriveLang(filePaths: string[] | undefined): string | undefined {
+		for (const filePath of filePaths ?? []) {
+			const ext = path.extname(this.#normalizePath(filePath));
+			if (ext.length > 1) return ext.slice(1).toLowerCase();
+		}
+		return undefined;
+	}
+
+	/** Match the source introduced by finalized tool arguments, before execution. */
+	async checkAstSnapshot(snapshot: string, context: TtsrMatchContext, signal?: AbortSignal): Promise<Rule[]> {
+		if (this.#isDisabled() || context.source !== "tool" || signal?.aborted) {
+			return [];
+		}
+		const lang = this.#deriveLang(context.filePaths);
+		if (!lang) return [];
+
+		const candidates: TtsrEntry[] = [];
+		for (const [name, entry] of this.#rules) {
+			if (!entry.astConditions?.length) continue;
+			if (
+				!this.#canTrigger(name) ||
+				!this.#matchesScope(entry, context) ||
+				!this.#matchesGlobalPaths(entry, context)
+			) {
+				continue;
+			}
+			candidates.push(entry);
+		}
+		if (candidates.length === 0) return [];
+
+		const bufferKey = this.#bufferKey(context);
+		if (this.#lastAstSnapshots.get(bufferKey) === snapshot) return [];
+		this.#lastAstSnapshots.set(bufferKey, snapshot);
+
+		const matches: Rule[] = [];
+		for (const entry of candidates) {
+			if (!entry.astConditions) continue;
+			const matched = await this.#astConditionsMatch(entry.rule.name, entry.astConditions, snapshot, lang, signal);
+			if (signal?.aborted) return [];
+			if (matched) {
+				matches.push(entry.rule);
+				logger.debug("TTSR ast condition matched", {
+					ruleName: entry.rule.name,
+					astConditions: entry.rule.astCondition,
+					toolName: context.toolName,
+					filePaths: context.filePaths,
+				});
+			}
+		}
+		return matches;
+	}
+
+	#recordAstConditionDiagnostics(
+		ruleName: string,
+		patterns: string[],
+		lang: string,
+		parseErrors: string[] | undefined,
+	): void {
+		const patternParseErrors = parseErrors?.filter(parseError => parseError !== SOURCE_SYNTAX_PARSE_ERROR) ?? [];
+		if (patternParseErrors.length === 0) return;
+
+		const key = JSON.stringify([ruleName, lang]);
+		if (this.#astConditionDiagnostics.has(key)) return;
+
+		const diagnostic: TtsrAstConditionDiagnostic = {
+			ruleName,
+			lang,
+			patterns: [...patterns],
+			parseErrors: patternParseErrors,
+		};
+		this.#astConditionDiagnostics.set(key, diagnostic);
+		logger.warn("TTSR astCondition pattern is invalid for target language", {
+			ruleName,
+			lang,
+			patterns: diagnostic.patterns,
+			parseErrors: diagnostic.parseErrors,
+		});
+	}
+
+	async #astConditionsMatch(
+		ruleName: string,
+		patterns: string[],
+		source: string,
+		lang: string,
+		signal?: AbortSignal,
+	): Promise<boolean> {
+		try {
+			const result = await astMatch({
+				patterns,
+				source,
+				lang,
+				strictness: AstMatchStrictness.Smart,
+				limit: 1,
+				signal,
+			});
+			if (!signal?.aborted) {
+				this.#recordAstConditionDiagnostics(ruleName, patterns, lang, result.parseErrors);
+			}
+			return result.totalMatches > 0;
+		} catch (error) {
+			logger.warn("TTSR ast match failed, treating as no match", {
+				ruleName,
+				patterns,
+				lang,
+				error: error instanceof Error ? error.message : String(error),
+			});
+			return false;
+		}
+	}
 }

package/src/extensibility/extensions/loader.ts

@@ -15,6 +15,7 @@ import { loadCapability } from "../../discovery";
 import { getExtensionNameFromPath } from "../../discovery/helpers";
 import type { ExecOptions } from "../../exec/exec";
 import { execCommand } from "../../exec/exec";
+import type { QueuedRunStartFailure } from "../../session/agent-session";
 import type { CustomMessage } from "../../session/messages";
 import { EventBus } from "../../utils/event-bus";
 import { installLegacyPiSpecifierShim, loadLegacyPiModule } from "../plugins/legacy-pi-compat";
@@ -394,6 +395,7 @@ class ConcreteExtensionAPI implements ExtensionAPI {
 			onPreflightAccepted?: () => void;
 			onPreflightAcceptCommit?: () => void | Promise<void>;
 			onQueuedPromoted?: (promotion: { startsOwnRun?: boolean; removed?: boolean }) => void;
+			onQueuedRunStartFailed?: (failure: QueuedRunStartFailure) => void;
 			onDispatchDisposition?: (promotion: { startsOwnRun: boolean }) => void;
 			preflightSignal?: AbortSignal;
 		},

package/src/extensibility/extensions/ouroboros-ooo-bridge.ts

@@ -1,9 +1,14 @@
+import { ptree } from "@gajae-code/utils";
+import { $credentialEnv, startupProjectEnvSnapshot } from "@gajae-code/utils/env";
+import { canonicalEnvKey } from "@gajae-code/utils/env-file";
+import type { ExecResult } from "../../exec/exec";
 import type { MCPServerConnection, MCPToolCallResult } from "../../runtime-mcp";
 import { callTool, connectToServer, disconnectServer } from "../../runtime-mcp";
 import { createExactPrefixCommandBridge } from "./prefix-command-bridge";
 import type { ExtensionContext, InputEvent, InputEventResult } from "./types";
 
 const OUROBOROS_CLI_ENV = "OUROBOROS_CLI";
+const DEFAULT_OUROBOROS_COMMAND = "ouroboros";
 const INTERVIEW_COMMAND = "ooo interview";
 const INTERVIEW_TOOL = "ouroboros_interview";
 const INTERVIEW_SESSION_PATTERN = /^interview_[A-Za-z0-9_-]+$/;
@@ -23,8 +28,64 @@ interface OuroborosOooBridgeHandler {
 	reset(): Promise<void>;
 }
 
+function projectSuppliedOuroborosCli(): boolean {
+	const snapshot = startupProjectEnvSnapshot();
+	const key = canonicalEnvKey(OUROBOROS_CLI_ENV);
+	return Object.hasOwn(snapshot.values, key) || snapshot.dynamic.has(key);
+}
+
+/**
+ * Executable for `ooo` dispatch and the interview MCP server.
+ *
+ * The string is spawned directly, so a repository `.env` must not choose it.
+ * `$credentialEnv` keeps a launching-shell or user-owned setting and ignores
+ * the project dotenv, including a dynamic declaration. Anything else stays the
+ * default command name. A rejected project value is removed from `process.env`
+ * before either spawn. Prefix dispatch also passes that cleaned object: Bun
+ * keeps the startup environment for a spawn that omits `env`, so deleting the
+ * key alone would still hand the project value to the child.
+ */
 function resolveOuroborosCommand(): string {
-	return process.env[OUROBOROS_CLI_ENV]?.trim() || "ouroboros";
+	const trusted = $credentialEnv(OUROBOROS_CLI_ENV)?.trim();
+	if (trusted) {
+		const live = process.env[OUROBOROS_CLI_ENV];
+		if (live !== undefined && live.trim() !== trusted) process.env[OUROBOROS_CLI_ENV] = trusted;
+		return trusted;
+	}
+	if (projectSuppliedOuroborosCli()) delete process.env[OUROBOROS_CLI_ENV];
+	return DEFAULT_OUROBOROS_COMMAND;
+}
+
+function ouroborosSpawnEnv(): Record<string, string> {
+	resolveOuroborosCommand();
+	const env: Record<string, string> = {};
+	for (const key of Object.keys(process.env)) {
+		const value = process.env[key];
+		if (typeof value === "string") env[key] = value;
+	}
+	return env;
+}
+
+async function dispatchOuroborosCommand(
+	command: string,
+	args: string[],
+	ctx: ExtensionContext,
+	execOptions: { timeout?: number },
+): Promise<ExecResult> {
+	const result = await ptree.exec([command, ...args], {
+		cwd: ctx.cwd,
+		timeout: execOptions.timeout,
+		allowNonZero: true,
+		allowAbort: true,
+		stderr: "full",
+		env: ouroborosSpawnEnv(),
+	});
+	return {
+		stdout: result.stdout,
+		stderr: result.stderr,
+		code: result.exitCode ?? 0,
+		killed: Boolean(result.exitError?.aborted),
+	};
 }
 
 function interviewArgument(text: string): string | undefined {
@@ -89,6 +150,7 @@ export function createOuroborosOooBridge(options: OuroborosOooBridgeOptions = {}
 		prefix: "ooo",
 		command: resolveOuroborosCommand(),
 		args: ["dispatch", "--runtime", "gjc"],
+		dispatch: dispatchOuroborosCommand,
 	});
 
 	function assertCurrent(generation: number, signal: AbortSignal | undefined): void {

package/src/extensibility/extensions/types.ts

@@ -50,7 +50,7 @@ import type { CustomEditor } from "../../modes/components/custom-editor";
 import type { WorkflowGateEmitter } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { Theme } from "../../modes/theme/theme";
 import type { ProjectProgressSnapshot } from "../../progress/progress-contract";
-import type { AgentSessionEventListener } from "../../session/agent-session";
+import type { AgentSessionEventListener, QueuedRunStartFailure } from "../../session/agent-session";
 import type {
 	ClientBridge,
 	ClientBridgePermissionOption,
@@ -1347,6 +1347,8 @@ export interface ExtensionAPI {
 			onPreflightAccepted?: () => void;
 			onPreflightAcceptCommit?: () => void | Promise<void>;
 			onQueuedPromoted?: (promotion: { startsOwnRun?: boolean; removed?: boolean }) => void;
+			/** Internal positive refusal before an exact queued invocation can start. */
+			onQueuedRunStartFailed?: (failure: QueuedRunStartFailure) => void;
 			onDispatchDisposition?: (promotion: { startsOwnRun: boolean }) => void;
 			preflightSignal?: AbortSignal;
 			/** Internal SDK correlation owner for an exact queued follow-up. */
@@ -1577,6 +1579,8 @@ export type SendUserMessageHandler = (
 		 * grants root abort ownership.
 		 */
 		onQueuedPromoted?: (promotion: { startsOwnRun?: boolean; removed?: boolean }) => void;
+		/** Internal positive refusal, not an inference from a dispatch error or missing event. */
+		onQueuedRunStartFailed?: (failure: QueuedRunStartFailure) => void;
 		/**
 		 * Fired synchronously when a plain prompt's dispatch resolves at queue
 		 * time instead of run end (diverted into an in-flight run's steering).

package/src/extensibility/hooks/loader.ts

@@ -346,9 +346,17 @@ export async function discoverAndLoadHooks(configuredPaths: string[], cwd: strin
 	};
 
 	// 1. Discover hooks via capability API and validate the provider descriptor
-	// against the canonical model before importing project-controlled code.
+	// against the canonical model before importing. A repository
+	// `<cwd>/.gjc/hooks` module is not imported. Skip those entries before
+	// dedup so a same-named user-agent hook still loads. An explicit path
+	// below remains a consent path.
 	const discovered = await loadCapability<Hook>(hookCapability.id, { cwd, providers: ["native"] });
-	for (const hook of discovered.items) {
+	const seenHookKeys = new Set<string>();
+	for (const hook of discovered.all) {
+		if (hook.level === "project") continue;
+		const hookKey = `${hook.type}:${hook.tool}:${hook.name}`;
+		if (seenHookKeys.has(hookKey)) continue;
+		seenHookKeys.add(hookKey);
 		const convention =
 			hook._source.provider === "native"
 				? HookSourceConvention.NativeGjc

package/src/extensibility/plugins/marketplace/manager.ts

@@ -15,6 +15,7 @@ import {
 	type NativeDirectoryTreeSnapshot,
 	type NativeExactUnlinkResult,
 	renameDirectoryNoReplacePathAsync,
+	renameNoReplacePathAsync,
 	snapshotDirectoryTree,
 } from "@gajae-code/natives";
 import { isEnoent, logger, pathIsWithin } from "@gajae-code/utils";
@@ -175,6 +176,13 @@ async function snapshotIfPresent(targetPath: string): Promise<NativeDirectoryTre
 	return snapshot.ok ? snapshot.snapshot : undefined;
 }
 
+/** Windows supports directory no-replace through the handle-based path API, not the POSIX directory fallback. */
+function renameDirectoryNoReplace(sourcePath: string, destinationPath: string) {
+	return process.platform === "win32"
+		? renameNoReplacePathAsync(sourcePath, destinationPath)
+		: renameDirectoryNoReplacePathAsync(sourcePath, destinationPath);
+}
+
 /**
  * Full identity comparison between two directory tree snapshots. A same-
  * filesystem `renameat`-class namespace operation changes neither the root's
@@ -850,9 +858,10 @@ export class MarketplaceManager {
 			});
 			if (finalStat?.isSymbolicLink()) throw new MarketplaceRestoreError("final_path_is_symlink");
 			const hadFinal = finalStat !== undefined;
-			// Single-component name; never renamed elsewhere on collision since the
-			// native no-replace primitive is what actually refuses an occupied slot.
-			const backup = `${finalPath}.restore-backup-${process.pid}-${randomBytes(6).toString("hex")}`;
+			// Keep the private backup component bounded independently of the canonical
+			// cache basename, which can itself be near NAME_MAX through a long version.
+			const backupName = `.gjc-restore-backup-${createHash("sha256").update(finalPath).digest("hex")}-${randomBytes(12).toString("hex")}`;
+			const backup = path.join(pluginsCacheDir, backupName);
 
 			const parentRecheck = await fs.lstat(pluginsCacheDir, { bigint: true }).catch(() => undefined);
 			if (!parentRecheck || parentRecheck.dev !== parentBefore.dev || parentRecheck.ino !== parentBefore.ino)
@@ -878,12 +887,29 @@ export class MarketplaceManager {
 				// merely a decision about whether it is safe to proceed. sideEffectStarted
 				// stays false — effects are physical, not procedural.
 				if (!finalSnapshotBefore) throw new MarketplaceRestoreError("final_path_snapshot_unavailable");
-				const detached = exactRemoveDirectoryTree(finalPath, finalSnapshotBefore, {
-					dev: parentBefore.dev,
-					ino: parentBefore.ino,
-				});
+				const detached = exactRemoveDirectoryTree(
+					finalPath,
+					finalSnapshotBefore,
+					{
+						dev: parentBefore.dev,
+						ino: parentBefore.ino,
+					},
+					true,
+				);
 				const detachedPath = detachedTree(detached);
 				if (!detachedPath) {
+					if (detached.code === "restore_failed" && detached.detachedPath) {
+						const retainedSnapshot = await snapshotIfPresent(detached.detachedPath).catch(() => undefined);
+						const retainedBackupPath =
+							retainedSnapshot && sameDirectoryTreeIdentity(finalSnapshotBefore, retainedSnapshot)
+								? detached.detachedPath
+								: undefined;
+						throw new MarketplaceRestoreError("backup_detach_unverified", {
+							sideEffectStarted: true,
+							outcome: "uncertain",
+							...(retainedBackupPath ? { retainedBackupPath } : {}),
+						});
+					}
 					// identity_mismatch means finalPath already changed before we ever
 					// touched it — exactRemoveDirectoryTree refused the mutation entirely,
 					// so this is a pure precheck refusal: nothing moved, sideEffectStarted
@@ -906,7 +932,7 @@ export class MarketplaceManager {
 				// later detach of the same canonical path inside this same transaction (the
 				// rollback path) collides with our own leftover and is misread as a foreign
 				// claim. The rename below is what vacates it; failure is reported, never assumed.
-				const backupPublish = await renameDirectoryNoReplacePathAsync(detachedPath, backup);
+				const backupPublish = await renameDirectoryNoReplace(detachedPath, backup);
 				if (!backupPublish.ok) {
 					// mutationState "not_committed" proves the rename never moved the
 					// object; it is still at the detached path, so that path is real
@@ -962,7 +988,7 @@ export class MarketplaceManager {
 				// devices on cross_device, the dev/ino-stability assumption behind
 				// `stagedSnapshot` breaks silently and every identity-bound check in this
 				// method becomes unsound.
-				const publish = await renameDirectoryNoReplacePathAsync(token.stagedArtifactPath, finalPath);
+				const publish = await renameDirectoryNoReplace(token.stagedArtifactPath, finalPath);
 				// Test seam only (no-op in production): lets a test deterministically
 				// simulate a concurrent second writer republishing finalPath here,
 				// exercising the foreign-owner branch below without weakening it.
@@ -1233,7 +1259,7 @@ export class MarketplaceManager {
 						);
 					}
 				}
-				const restorePublish = await renameDirectoryNoReplacePathAsync(backup, finalPath);
+				const restorePublish = await renameDirectoryNoReplace(backup, finalPath);
 				if (!restorePublish.ok) {
 					// Restore failed: confirm what actually remains at `backup` right now
 					// (the no-replace rename may have left it there proven-untouched, or

package/src/extensibility/slash-commands.ts

@@ -116,6 +116,11 @@ export const BUILTIN_SLASH_COMMANDS: ReadonlyArray<
 	return cmd;
 });
 
+export function getBuiltinSlashCommandsForSession(hasExactMcpControls: boolean): typeof BUILTIN_SLASH_COMMANDS {
+	if (hasExactMcpControls) return BUILTIN_SLASH_COMMANDS;
+	return BUILTIN_SLASH_COMMANDS.filter(command => command.name !== "mcp");
+}
+
 /**
  * Represents a custom slash command loaded from a file
  */

package/src/gjc-runtime/gc-runtime.ts

@@ -2299,7 +2299,10 @@ async function removeGcDiskEntry(
 		return { removed: false, reason: "entry_changed" };
 	}
 	const retainedAtOriginal = !removal.detachedPath || path.resolve(removal.detachedPath) === path.resolve(target);
-	if ((removal.code === "permission_denied" || removal.code === "io_error") && retainedAtOriginal) {
+	if (
+		(removal.code === "permission_denied" || removal.code === "access_denied" || removal.code === "io_error") &&
+		retainedAtOriginal
+	) {
 		return { removed: false, reason: "withheld_evidence_incomplete: tree_unreadable", withheld: true };
 	}
 	return {

package/src/gjc-runtime/launch-tmux.ts

@@ -71,11 +71,13 @@ import {
 } from "./tmux-owner-isolation";
 import { assertGjcTmuxStagedMutationAuthoritySync } from "./tmux-provider-context";
 import {
+	childGjcSessionIdAssignment,
 	findGjcTmuxSessionByName,
 	findGjcTmuxSessionByScope,
 	type GjcTmuxSessionStatus,
 	type ProvenTmuxSessionIdentity,
 	proveGjcTmuxSessionMutationTarget,
+	tmuxLaunchIdentityEnv,
 } from "./tmux-sessions";
 import {
 	buildWindowsPowerShellInnerCommand,
@@ -433,6 +435,8 @@ function stripRootTmuxFlag(rawArgs: string[]): string[] {
 
 export function applyGjcTmuxProfile(context: GjcTmuxProfileContext): GjcTmuxProfileResult {
 	const env = context.env ?? process.env;
+	const cwd = context.cwd ?? process.cwd();
+	const identityEnv = tmuxLaunchIdentityEnv(env, cwd);
 	const branchSlug = context.branch ? buildGjcTmuxSessionSlug(context.branch) : (context.branchSlug ?? null);
 	// The psmux UX filter (mouse / set-clipboard / mode-style /
 	// set-window-option) now lives in buildGjcTmuxProfileCommands so every
@@ -448,8 +452,8 @@ export function applyGjcTmuxProfile(context: GjcTmuxProfileContext): GjcTmuxProf
 			branch: context.branch ?? null,
 			branchSlug,
 			project: context.project ?? null,
-			sessionId: context.sessionId ?? env[GJC_COORDINATOR_SESSION_ID_ENV] ?? null,
-			sessionStateFile: context.sessionStateFile ?? env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV] ?? null,
+			sessionId: context.sessionId ?? identityEnv[GJC_COORDINATOR_SESSION_ID_ENV] ?? null,
+			sessionStateFile: context.sessionStateFile ?? identityEnv[GJC_COORDINATOR_SESSION_STATE_FILE_ENV] ?? null,
 			ownerGeneration: context.ownerGeneration ?? null,
 			ownerServerKey: context.ownerServerKey ?? null,
 			version: context.version ?? null,
@@ -463,7 +467,6 @@ export function applyGjcTmuxProfile(context: GjcTmuxProfileContext): GjcTmuxProf
 		});
 	if (commands.length === 0) return { skipped: true, commands: [], failures: [] };
 	const spawnSync = context.spawnSync ?? defaultSpawnSync;
-	const cwd = context.cwd ?? process.cwd();
 	const options: TmuxSpawnOptions = {
 		cwd,
 		env,
@@ -1106,22 +1109,24 @@ export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaun
 	if (policy === "tmux" && !isInteractiveRootLaunch(context.parsed, tty)) return undefined;
 
 	const cwd = context.cwd ?? process.cwd();
+	const identityEnv = tmuxLaunchIdentityEnv(env, cwd);
 	const branch = context.worktreeBranch ?? context.currentBranch ?? readCurrentBranch(cwd);
 	const project = context.project ?? cwd;
-	const sessionName = buildGjcTmuxSessionName(env, { branch });
+	const sessionName = buildGjcTmuxSessionName(identityEnv, { branch });
 	// Pick the most appropriate tmux binary for this platform. On native Windows
 	// the resolver walks psmux / pmux / tmux and uses the first one present on
 	// PATH, so the default `gjc --tmux` flow lands on a real multiplexer even
 	// without an explicit GJC_TMUX_COMMAND override.
 	const resolvedBinary = resolveGjcTmuxBinary({ platform, env });
 	const tmuxCommand = resolvedBinary.command;
-	const sessionId = env[GJC_COORDINATOR_SESSION_ID_ENV]?.trim() || sessionName;
+	const sessionId = identityEnv[GJC_COORDINATOR_SESSION_ID_ENV]?.trim() || sessionName;
 	// The session ROOT is keyed by the active GJC session (GJC_SESSION_ID), NOT the
 	// coordinator/tmux identity. Fall back to the coordinator id only for standalone
-	// tmux launches with no GJC session context.
-	const gjcSessionId = env.GJC_SESSION_ID?.trim() || sessionId;
+	// tmux launches with no GJC session context. Project dotenv pins are already
+	// removed from identityEnv.
+	const gjcSessionId = identityEnv.GJC_SESSION_ID?.trim() || sessionId;
 	const sessionStateFile =
-		env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]?.trim() ||
+		identityEnv[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]?.trim() ||
 		tmuxRuntimeSessionPath(cwd, gjcSessionId, buildGjcTmuxSessionSlug(sessionName));
 	const signingEnv = coordinatorSidecarSigningEnv(env);
 	// Stage only the one-shot channel descriptor (path + key id). The PKCS#8 key
@@ -1136,13 +1141,13 @@ export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaun
 		(context.diagnosticWriter ?? safeStderrWrite)(formatTmuxUnavailableDiagnostic(platform));
 		return undefined;
 	}
-	const existingSessionName = allowsExistingTmuxAttach(context.parsed, env)
+	const existingSessionName = allowsExistingTmuxAttach(context.parsed, identityEnv)
 		? "existingBranchSessionName" in context
 			? (context.existingBranchSessionName ?? undefined)
 			: resolvedBinary.isPsmux && platform === "win32"
-				? explicitTmuxSessionName(env)
+				? explicitTmuxSessionName(identityEnv)
 				: findExistingSessionForLaunch({
-						env,
+						env: identityEnv,
 						project,
 						branch,
 					})
@@ -1154,6 +1159,7 @@ export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaun
 			execPath: context.execPath ?? process.execPath,
 			extraEnv: {
 				...childSigningEnv,
+				...childGjcSessionIdAssignment(env, identityEnv, cwd, gjcSessionId),
 				[GJC_COORDINATOR_SESSION_ID_ENV]: sessionId,
 				[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]: sessionStateFile,
 				// Carry the GJC-managed session name into the child so tmux-backed
@@ -1210,6 +1216,9 @@ function trustedReplacementAuthority(
 function prepareManagedOwnerLifecycle(plan: TmuxLaunchPlan, context: TmuxLaunchContext): void {
 	if (plan.ownerGeneration) return;
 	const sessionId = plan.sessionId ?? plan.sessionName;
+	const launchEnv = context.env ?? process.env;
+	const identityEnv = tmuxLaunchIdentityEnv(launchEnv, plan.cwd);
+	const gjcSessionId = identityEnv.GJC_SESSION_ID?.trim() || sessionId;
 	const stateDir = path.dirname(plan.sessionStateFile ?? path.join(plan.cwd, ".gjc", "runtime"));
 	const baseline = captureOwnerGenerationBaselineSync(stateDir, sessionId);
 	const replacement = trustedReplacementAuthority(stateDir, sessionId, baseline);
@@ -1234,6 +1243,7 @@ function prepareManagedOwnerLifecycle(plan: TmuxLaunchPlan, context: TmuxLaunchC
 							[GJC_COORDINATOR_SIDECAR_KEY_ID_ENV]: plan.coordinatorSidecarBootstrap.keyId,
 						}
 					: {}),
+				...childGjcSessionIdAssignment(launchEnv, identityEnv, plan.cwd, gjcSessionId),
 				[GJC_COORDINATOR_SESSION_ID_ENV]: sessionId,
 				[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]: plan.sessionStateFile ?? "",
 				// The tmux server inherits the bootstrap secret as child environment;
@@ -1527,7 +1537,7 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 		try {
 			if (plan.attachSessionName) {
 				const stateDir = env[GJC_TMUX_OWNER_STATE_DIR_ENV]?.trim();
-				const sessionId = env[GJC_COORDINATOR_SESSION_ID_ENV]?.trim();
+				const sessionId = tmuxLaunchIdentityEnv(env, plan.cwd)[GJC_COORDINATOR_SESSION_ID_ENV]?.trim();
 				const generation = env[GJC_TMUX_OWNER_GENERATION_ENV]?.trim();
 				if (!stateDir || !sessionId || !generation) throw new Error("gjc_tmux_provider_authority_unavailable");
 				plan.authority = readGjcTmuxProviderAuthoritySync({ stateDir, sessionId, generation });
@@ -1596,7 +1606,7 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 		}
 	};
 	const creationSpawn = plan.authority ? spawnSync : rawSpawnSync;
-	const spawnEnv = { ...env };
+	const spawnEnv = { ...tmuxLaunchIdentityEnv(env, plan.cwd) };
 	delete spawnEnv[GJC_COORDINATOR_SIDECAR_SIGNING_KEY_ENV];
 	const signingEnv = coordinatorSidecarSigningEnv(env);
 	Object.assign(spawnEnv, signingEnv);