adelie-ai 0.2.11 → 0.2.13

package/README.md

@@ -6,14 +6,14 @@
 
 <p align="center">
   <strong>Autonomous AI Orchestration System</strong><br/>
-  <sub>10 specialized agents · 6-phase lifecycle · zero human intervention</sub>
+  <sub>13 specialized agents · 6-phase lifecycle · zero human intervention</sub>
 </p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/adelie-ai"><img src="https://img.shields.io/npm/v/adelie-ai?style=flat-square&logo=npm&color=CB3837" alt="npm version" /></a>
   <img src="https://img.shields.io/badge/python-3.10+-3776AB?style=flat-square&logo=python&logoColor=white" alt="Python" />
   <img src="https://img.shields.io/badge/LLM-Gemini%20│%20Ollama-FF6F00?style=flat-square" alt="LLM" />
-  <img src="https://img.shields.io/badge/tests-197%20passing-2EA043?style=flat-square" alt="Tests" />
+  <img src="https://img.shields.io/badge/tests-636%20passing-2EA043?style=flat-square" alt="Tests" />
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" alt="License" /></a>
 </p>
 
@@ -23,7 +23,8 @@
   <a href="#architecture">Architecture</a>&ensp;·&ensp;
   <a href="#cli">CLI</a>&ensp;·&ensp;
   <a href="#dashboard">Dashboard</a>&ensp;·&ensp;
-  <a href="#configuration">Configuration</a>
+  <a href="https://ade1ie.github.io/adelie/">Docs</a>&ensp;·&ensp;
+  <a href="https://github.com/Ade1ie/adelie/blob/main/CHANGELOG.md">Changelog</a>
 </p>
 
 ---
@@ -33,8 +34,8 @@
 Adelie is an autonomous AI orchestrator that plans, codes, reviews, tests, deploys, and evolves software projects through a coordinated multi-agent loop. It ships as a single CLI (`npm install -g adelie-ai`) and requires only an LLM provider — no cloud backend, no account.
 
 ```
-    (o_    Adelie v0.2.1
-    //\    ollama · deepseek-v3.1:671b-cloud
+    (o_    Adelie v0.2.12
+    //\    gemini · gemini-2.0-flash
     V_/_   Phase: mid_2
 ```
 
@@ -49,9 +50,25 @@ Adelie is an autonomous AI orchestrator that plans, codes, reviews, tests, deplo
 7. **Tester** runs tests and reports failures
 8. **Runner** builds, installs, deploys
 9. **Monitor** watches system health
-10. **Phase gates** decide when to advance the project lifecycle
+10. **Analyst** evaluates trends and growth opportunities
+11. **Inform** generates human-readable project status reports
+12. **Phase gates** decide when to advance the project lifecycle
 
-The loop runs continuously at a configurable interval (default 30 s), or once with `adelie run once`.
+The loop runs continuously at a configurable interval (default 30 s), or once with `adelie run --once`.
+
+---
+
+## What's New in v0.2.12
+
+🔒 **Security Hardening** — Shell injection prevention (`&`, `>` blocked), path traversal protection via `Path.resolve()`, staging race condition locks.
+
+🧵 **Thread Safety** — `_usage_lock` protects global token counters during parallel agent execution.
+
+🪟 **Windows Stability** — Fixed `python3` Microsoft Store stub, venv `activate.bat` wrapper, `cmd /c` resolver, cross-platform path handling.
+
+📋 **Changelog** — [Full changelog](https://ade1ie.github.io/adelie/#changelog) now on the docs site with interactive expand/collapse.
+
+> See [CHANGELOG.md](./CHANGELOG.md) for complete release history.
 
 ---
 
@@ -98,16 +115,17 @@ brew install adelie
 git clone https://github.com/Ade1ie/adelie.git
 cd adelie
 pip install -r requirements.txt
-python adelie/cli.py --version
+python -c "from adelie.cli import main; main()"
 ```
 
 ### Update
 
 ```bash
-# npm
-npm install -g adelie-ai@latest
+# Built-in update checker
+adelie --update
 
-# curl / PowerShell — re-run the install command above
+# or manual
+npm install -g adelie-ai@latest
 
 # Homebrew
 brew upgrade adelie
@@ -136,7 +154,10 @@ adelie config --provider ollama --model gemma3:12b
 adelie run --goal "Build a REST API for task management"
 
 # Single cycle
-adelie run once --goal "Analyze and document the codebase"
+adelie run --once --goal "Analyze and document the codebase"
+
+# Resume a saved workspace
+adelie run ws 1
 ```
 
 The real-time **dashboard** opens automatically at **http://localhost:5042**.
@@ -157,8 +178,9 @@ The real-time **dashboard** opens automatically at **http://localhost:5042**.
 | **Tester** | Executes tests, collects failures, feeds back to coder | After review |
 | **Runner** | Installs deps, builds, deploys (whitelisted commands) | Mid-phase + |
 | **Monitor** | System health, resource checks, service restarts | Periodic |
-| **Analyst** | Trend analysis, insights, KB synthesis | Periodic |
+| **Analyst** | Trend analysis, market insights, KB synthesis | Periodic |
 | **Research** | Web search → KB for external knowledge | On demand |
+| **Inform** | Human-readable project reports and status summaries | On demand |
 
 ### 6-Phase Lifecycle
 
@@ -178,6 +200,16 @@ The Coder Manager dispatches tasks across three dependency layers:
 
 Failed layers trigger targeted retries with reviewer feedback.
 
+### Security
+
+Adelie enforces multiple security layers:
+
+- **Shell injection prevention** — `BLOCKED_CHARS` filter blocks `&`, `>`, `|`, `;`, backticks, and other shell metacharacters in all subprocess commands
+- **Path traversal protection** — `Path.resolve()` verification ensures generated files stay within the staging directory
+- **Staging isolation** — Code is written to `.adelie/staging/` first, verified with `py_compile` / `node --check`, then promoted to project root
+- **Thread-safe operations** — `_usage_lock` and `_staging_lock` prevent race conditions during parallel agent execution
+- **Whitelisted commands** — Runner and Tester only execute pre-approved command patterns
+
 ---
 
 ## Architecture
@@ -192,7 +224,7 @@ Failed layers trigger targeted retries with reviewer feedback.
 
 Adelie serves a real-time monitoring UI at **`http://localhost:5042`** (auto-starts with `adelie run`).
 
-- **Agent grid** — live status of all 10 agents (idle / running / done / error)
+- **Agent grid** — live status of all 13 agents (idle / running / done / error)
 - **Log stream** — real-time SSE-powered log feed with category filtering
 - **Cycle metrics** — tokens, LLM calls, files written, test results, review scores
 - **Phase timeline** — visual progress through the 6-phase lifecycle
@@ -211,6 +243,7 @@ Built with zero external dependencies — Python `http.server` + SSE + embedded
 
 ```bash
 adelie --version                  # Show version
+adelie --update                   # Check for updates
 adelie help                       # Full command reference
 ```
 
@@ -220,13 +253,14 @@ adelie help                       # Full command reference
 adelie init [dir]                 # Initialize .adelie workspace
 adelie ws                         # List all workspaces
 adelie ws remove <N>              # Remove workspace
+adelie scan                       # Scan existing codebase → KB
 ```
 
 ### Execution
 
 ```bash
 adelie run --goal "…"             # Start continuous loop
-adelie run once --goal "…"        # Single cycle
+adelie run --once --goal "…"      # Single cycle
 adelie run ws <N>                 # Resume workspace #N
 ```
 
@@ -235,9 +269,9 @@ adelie run ws <N>                 # Resume workspace #N
 ```bash
 adelie config                     # Show current config
 adelie config --provider ollama   # Switch LLM provider
-adelie config --model gpt-4o     # Set model
+adelie config --model gemma3:12b  # Set model
 adelie config --api-key KEY       # Set Gemini API key
-adelie config --ollama-url URL    # Set Ollama server URL
+adelie config --plan-mode true    # Enable Plan Mode (human approval)
 ```
 
 ### Settings
@@ -260,6 +294,7 @@ adelie inform                     # AI-generated project report
 adelie phase                      # Show current phase
 adelie phase set <phase>          # Set phase manually
 adelie metrics                    # Cycle metrics & history
+adelie metrics --agents           # Per-agent token usage
 ```
 
 ### Knowledge Base & Project
@@ -276,6 +311,15 @@ adelie spec load <file>           # Load spec (MD/PDF/DOCX) into KB
 adelie git                        # Git status & recent commits
 ```
 
+### Customization
+
+```bash
+adelie prompts                    # List agent system prompts
+adelie prompts export             # Export prompts for editing
+adelie tools                      # List registered tools
+adelie commands                   # List custom commands
+```
+
 ### Integrations
 
 ```bash
@@ -288,6 +332,24 @@ adelie ollama run [model]         # Interactive chat
 
 ---
 
+## Plan Mode
+
+Enable Plan Mode for human-in-the-loop control:
+
+```bash
+adelie config --plan-mode true
+```
+
+When enabled, the Expert AI generates a **plan** before executing code changes. You can review, approve, or reject from the interactive REPL:
+
+| Command | Action |
+|:--|:--|
+| `/plan` | View pending plan |
+| `/approve` | Execute the plan |
+| `/reject [reason]` | Reject and provide feedback |
+
+---
+
 ## Configuration
 
 ### Environment (`.adelie/.env`)
@@ -352,13 +414,15 @@ Use functional components with TypeScript props…
 | 📊 **Dashboard** | Real-time web UI with SSE streaming on port 5042 |
 | 🔄 **Loop Detector** | 5 stuck-pattern types with escalating interventions |
 | ⚡ **Scheduler** | Per-agent frequency control with cooldown/priority |
+| 🔒 **Security** | Shell injection prevention, path traversal protection, staging isolation |
+| 📋 **Plan Mode** | Human-in-the-loop approval for code changes |
 
 ---
 
 ## Testing
 
 ```bash
-python -m pytest tests/ -v    # 197 tests
+python -m pytest tests/ -v    # 636 tests
 ```
 
 ---
@@ -368,13 +432,20 @@ python -m pytest tests/ -v    # 197 tests
 ```
 adelie/
 ├── orchestrator.py          # Main loop — state machine + phase gates
-├── cli.py                   # All CLI commands
+├── commands/                # CLI command modules
+│   ├── workspace.py         #   init, ws
+│   ├── run.py               #   run, run once, run ws
+│   ├── config.py            #   config, settings
+│   ├── monitoring.py        #   status, phase, metrics, inform
+│   ├── knowledge.py         #   kb, feedback, goal, research, spec, scan
+│   └── integrations.py      #   ollama, telegram, git, tools, prompts
+├── cli.py                   # CLI entry point + argparse routing
 ├── config.py                # Configuration & env loading
 ├── llm_client.py            # LLM abstraction (Gemini + Ollama + fallback)
 ├── interactive.py           # REPL + dashboard integration
 ├── dashboard.py             # Real-time web server (HTTP + SSE)
 ├── dashboard_html.py        # Embedded dashboard UI template
-├── agents/                  # 10 specialized AI agents
+├── agents/                  # 12 specialized AI agents
 │   ├── writer_ai.py         #   Knowledge Base curator
 │   ├── expert_ai.py         #   Strategic decision maker
 │   ├── coder_ai.py          #   Code generator
@@ -385,6 +456,7 @@ adelie/
 │   ├── monitor_ai.py        #   Health monitor
 │   ├── analyst_ai.py        #   Trend analyzer
 │   ├── research_ai.py       #   Web researcher
+│   ├── inform_ai.py         #   Status report generator
 │   └── scanner_ai.py        #   Initial codebase scanner
 ├── kb/                      # Knowledge Base (retriever + embeddings)
 ├── channels/                # Multichannel providers (Discord, Slack)
@@ -393,12 +465,13 @@ adelie/
 ├── sandbox.py               # Docker/Seatbelt isolation
 ├── gateway.py               # REST API gateway
 ├── skill_manager.py         # Skill registry
+├── env_strategy.py          # Runtime environment detection
+├── plan_mode.py             # Plan Mode (human approval)
 ├── loop_detector.py         # Stuck-pattern detection
 ├── scheduler.py             # Per-agent scheduling
 ├── phases.py                # Lifecycle phase definitions
 ├── hooks.py                 # Event-driven plugin system
-├── process_supervisor.py    # Subprocess management
-└── env_strategy.py          # Runtime environment detection
+└── process_supervisor.py    # Subprocess management
 ```
 
 ---
@@ -418,6 +491,15 @@ python -m pytest tests/ -v   # Ensure all tests pass
 
 ---
 
+## Links
+
+- 📖 [Documentation](https://ade1ie.github.io/adelie/) — Full command reference & guides
+- 📋 [Changelog](https://github.com/Ade1ie/adelie/blob/main/CHANGELOG.md) — Release history
+- 📦 [npm](https://www.npmjs.com/package/adelie-ai) — `npm install -g adelie-ai`
+- 🐛 [Issues](https://github.com/Ade1ie/adelie/issues) — Bug reports
+
+---
+
 ## License
 
 [MIT](./LICENSE)

package/adelie/__init__.py

@@ -13,4 +13,4 @@ def _get_version() -> str:
         pass
     return "0.0.0"
 
-__version__ = "0.2.11"
+__version__ = "0.2.12"

package/adelie/agents/coder_ai.py

@@ -238,12 +238,20 @@ def run_coder(
         if not filepath or not content:
             continue
 
-        # Sanitize — prevent writing outside workspace
+        # Sanitize — prevent writing outside staging area
+        # Check both Unix absolute paths (/...) and Windows (C:\...)
         if filepath.startswith("/") or ".." in filepath:
             console.print(
                 f"[yellow]⚠️  Skipped unsafe path: {filepath}[/yellow]"
             )
             continue
+        # Resolve-based check: ensure the final path is under STAGING_ROOT
+        resolved_out = (STAGING_ROOT / filepath).resolve()
+        if not str(resolved_out).startswith(str(STAGING_ROOT.resolve())):
+            console.print(
+                f"[yellow]⚠️  Skipped path escaping staging: {filepath}[/yellow]"
+            )
+            continue
 
         out_path = STAGING_ROOT / filepath
         out_path.parent.mkdir(parents=True, exist_ok=True)

package/adelie/agents/runner_ai.py

@@ -57,7 +57,7 @@ DEPLOY_COMMANDS = RUN_COMMANDS + [
 BLOCKED_FLAGS = {"-c", "--eval", "eval", "exec", "--exec", "-e"}
 
 # Dangerous shell metacharacters
-BLOCKED_CHARS = {";", "|", "&&", "||", "`", "$(", ">>", "<<"}
+BLOCKED_CHARS = {";", "|", "&", "&&", "||", "`", "$(", ">", ">>", "<<"}
 
 EXEC_TIMEOUT_BUILD = 120
 EXEC_TIMEOUT_RUN = 10  # Short timeout — we just check if it starts

package/adelie/agents/tester_ai.py

@@ -44,7 +44,7 @@ ALLOWED_COMMANDS = [
 BLOCKED_FLAGS = {"-c", "--eval", "eval", "exec", "--exec", "-e"}
 
 # Dangerous shell metacharacters
-BLOCKED_CHARS = {";", "|", "&&", "||", "`", "$(", ">>", "<<"}
+BLOCKED_CHARS = {";", "|", "&", "&&", "||", "`", "$(", ">", ">>", "<<"}
 
 EXEC_TIMEOUT = 60  # seconds
 

package/adelie/agents/writer_ai.py

@@ -301,13 +301,17 @@ Remember: output ONLY a valid JSON array.
                 ratio = min(len_existing, len_new) / max(len_existing, len_new)
                 if ratio > 0.90:
                     # Check first 200 chars — if very similar, skip
-                    common_start = 0
-                    for a, b in zip(existing_body[:200], new_body[:200]):
-                        if a == b:
-                            common_start += 1
-                    if common_start / min(200, len(existing_body[:200])) > 0.7:
-                        console.print(f"[dim]  ⏭  Skipped {cat}/{filename} (similar content)[/dim]")
-                        continue
+                    compare_len = min(200, len(existing_body), len(new_body))
+                    if compare_len < 20:
+                        pass  # Too short to compare meaningfully
+                    else:
+                        common_start = 0
+                        for a, b in zip(existing_body[:compare_len], new_body[:compare_len]):
+                            if a == b:
+                                common_start += 1
+                        if common_start / compare_len > 0.7:
+                            console.print(f"[dim]  ⏭  Skipped {cat}/{filename} (similar content)[/dim]")
+                            continue
 
         # Prepend a frontmatter header for human readability
         header = (

package/adelie/commands/_helpers.py

@@ -171,7 +171,8 @@ def _detect_os() -> dict:
                 osrel = Path("/etc/os-release").read_text()
                 for line in osrel.splitlines():
                     if line.startswith("PRETTY_NAME="):
-                        os_name = f"Linux ({line.split('=', 1)[1].strip('\"')})"
+                        pretty = line.split("=", 1)[1].strip('"')
+                        os_name = f"Linux ({pretty})"
                         break
             except Exception:
                 pass

package/adelie/env_strategy.py

@@ -20,8 +20,10 @@ Strategy selection follows the project phase:
 
 from __future__ import annotations
 
+import os
 import shutil
 import subprocess
+import sys
 from dataclasses import dataclass, field
 from enum import Enum
 from pathlib import Path
@@ -124,6 +126,7 @@ def detect_env(project_root: Path) -> EnvProfile:
     # ── Python environments ───────────────────────────────────────────────
 
     # Standard venv
+    _is_win = sys.platform == "win32"
     for venv_dir in [".venv", "venv"]:
         venv_path = project_root / venv_dir
         if venv_path.is_dir():
@@ -133,7 +136,12 @@ def detect_env(project_root: Path) -> EnvProfile:
             if bin_dir.exists():
                 profile.python_bin = str(bin_dir / "python")
                 profile.pip_bin = str(bin_dir / "pip")
-                profile.shell_wrapper = f"source {venv_path / 'bin' / 'activate'}"
+                # Windows: use activate.bat; Unix: source activate
+                if _is_win:
+                    activate_script = bin_dir / "activate.bat"
+                    profile.shell_wrapper = f"{activate_script} &&"
+                else:
+                    profile.shell_wrapper = f"source {bin_dir / 'activate'}"
                 profile.env_type = "venv"
                 detected.append("venv")
                 break
@@ -164,7 +172,7 @@ def detect_env(project_root: Path) -> EnvProfile:
     node_modules_bin = project_root / "node_modules" / ".bin"
     if node_modules_bin.is_dir():
         profile.node_bin = str(node_modules_bin / "node") if (node_modules_bin / "node").exists() else None
-        profile.npm_prefix = str(node_modules_bin) + "/"
+        profile.npm_prefix = str(node_modules_bin) + os.sep
         if profile.env_type == "system":
             profile.env_type = "npm"
         detected.append("npm")
@@ -475,11 +483,16 @@ def _wrap_resolver(cmd: str, profile: EnvProfile) -> str:
     elif profile.env_type == "poetry":
         return f"poetry run {cmd}"
 
-    # For standard venv: use bash -c with activation
-    if profile.shell_wrapper and "source" in profile.shell_wrapper:
-        # Escape single quotes in cmd
-        escaped_cmd = cmd.replace("'", "'\\''")
-        return f"bash -c '{profile.shell_wrapper} && {escaped_cmd}'"
+    # For standard venv: wrap with activation
+    if profile.shell_wrapper:
+        if sys.platform == "win32" and profile.shell_wrapper.endswith("&&"):
+            # Windows: cmd /c "activate.bat && command"
+            escaped_cmd = cmd.replace('"', '\\"')
+            return f'cmd /c "{profile.shell_wrapper} {escaped_cmd}"'
+        elif "source" in profile.shell_wrapper:
+            # Unix: bash -c "source activate && command"
+            escaped_cmd = cmd.replace("'", "'\\''")
+            return f"bash -c '{profile.shell_wrapper} && {escaped_cmd}'"
 
     # Fallback to direct if no resolver available
     return _wrap_direct(cmd, profile)

package/adelie/kb/retriever.py

@@ -77,7 +77,7 @@ def list_categories() -> dict[str, int]:
     """Return a dict of {category_name: file_count} for all KB categories."""
     ensure_workspace()
     return {
-        cat: len(list((WORKSPACE_PATH / cat).glob("*")))
+        cat: len(list((WORKSPACE_PATH / cat).glob("*.md")))
         for cat in KB_CATEGORIES
     }
 

package/adelie/llm_client.py

@@ -32,6 +32,7 @@ console = Console()
 
 # ── Token usage tracking ─────────────────────────────────────────────────────
 _usage = {"prompt_tokens": 0, "completion_tokens": 0, "total_tokens": 0, "calls": 0}
+_usage_lock = threading.Lock()
 
 # Per-agent usage tracking (agent_name -> {prompt_tokens, completion_tokens, total_tokens, calls, time})
 _agent_usage: dict[str, dict] = {}
@@ -58,17 +59,19 @@ def _get_current_agent() -> str:
 
 def reset_usage() -> None:
     """Reset token counters (call at start of each loop)."""
-    _usage["prompt_tokens"] = 0
-    _usage["completion_tokens"] = 0
-    _usage["total_tokens"] = 0
-    _usage["calls"] = 0
+    with _usage_lock:
+        _usage["prompt_tokens"] = 0
+        _usage["completion_tokens"] = 0
+        _usage["total_tokens"] = 0
+        _usage["calls"] = 0
     with _agent_usage_lock:
         _agent_usage.clear()
 
 
 def get_usage() -> dict:
     """Return current accumulated token usage."""
-    return dict(_usage)
+    with _usage_lock:
+        return dict(_usage)
 
 
 def get_agent_usage() -> dict[str, dict]:
@@ -78,10 +81,11 @@ def get_agent_usage() -> dict[str, dict]:
 
 
 def _record_usage(prompt: int, completion: int) -> None:
-    _usage["prompt_tokens"] += prompt
-    _usage["completion_tokens"] += completion
-    _usage["total_tokens"] += prompt + completion
-    _usage["calls"] += 1
+    with _usage_lock:
+        _usage["prompt_tokens"] += prompt
+        _usage["completion_tokens"] += completion
+        _usage["total_tokens"] += prompt + completion
+        _usage["calls"] += 1
 
     # Also record per-agent
     agent = _get_current_agent()

package/adelie/orchestrator.py

@@ -16,6 +16,7 @@ import json
 from typing import Callable, Optional
 import signal
 import sys
+import threading
 import time
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from datetime import datetime
@@ -94,6 +95,10 @@ class Orchestrator:
         # Process supervisor for spawned commands
         self.supervisor = ProcessSupervisor(max_concurrent=5)
 
+        # Lock to protect staging directory operations from race conditions
+        # between the tester thread (Phase 3) and the main orchestrator thread.
+        self._staging_lock = threading.Lock()
+
 
 
         # Graceful shutdown on Ctrl+C or SIGTERM
@@ -390,8 +395,15 @@ class Orchestrator:
         Verify staged files with lightweight syntax checks before promotion.
         Returns (passed, failed) file lists.
         """
+        import shutil
         import subprocess
         staging_root = ADELIE_ROOT / "staging"
+        # On Windows, 'python3' may resolve to the Microsoft Store stub
+        # (WindowsApps/python3.EXE) which doesn't work. Prefer sys.executable.
+        if sys.platform == "win32":
+            python_bin = sys.executable
+        else:
+            python_bin = shutil.which("python3") or shutil.which("python") or sys.executable
         passed: list[dict] = []
         failed: list[dict] = []
 
@@ -410,7 +422,7 @@ class Orchestrator:
             if ext == ".py":
                 try:
                     result = subprocess.run(
-                        ["python3", "-m", "py_compile", str(staged_path)],
+                        [python_bin, "-m", "py_compile", str(staged_path)],
                         capture_output=True, text=True, timeout=10,
                     )
                     if result.returncode != 0:
@@ -931,9 +943,13 @@ class Orchestrator:
                         score = review.get("overall_score", 5)
                         self._review_score_history.append(score)
 
-                        if review.get("approved", True) or retry >= MAX_REVIEW_RETRIES:
+                        if review.get("approved", True):
                             reviewer_approved = True
                             break
+                        if retry >= MAX_REVIEW_RETRIES:
+                            # Retry limit reached — use actual review result (do NOT force approve)
+                            reviewer_approved = False
+                            break
 
                         # Feed review back to coder for retry
                         console.print(f"  [yellow]🔄 Retry {retry+1}/{MAX_REVIEW_RETRIES} — sending feedback to coder[/yellow]")
@@ -988,8 +1004,9 @@ class Orchestrator:
 
         # ── Promote staged files to project (after review) ────────────────
         if all_written_files and reviewer_approved:
-            self._promote_staged_files(all_written_files)
-            self._cleanup_staging()
+            with self._staging_lock:
+                self._promote_staged_files(all_written_files)
+                self._cleanup_staging()
 
             # ── Git auto-commit (MID_1+) ──────────────────────────────────────
             if self.phase in ("mid_1", "mid_2", "late", "evolve"):
@@ -1080,8 +1097,9 @@ class Orchestrator:
                                     new_files = self._collect_staged_files(fix_start_time)
                                     if new_files:
                                         _files = new_files
-                                    self._promote_staged_files(_files)
-                                    self._cleanup_staging()
+                                    with self._staging_lock:
+                                        self._promote_staged_files(_files)
+                                        self._cleanup_staging()
                             except Exception as ce:
                                 console.print(f"[red]❌ Coder fix error: {ce}[/red]")
                                 break

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adelie-ai",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "description": "Adelie — Self-Communicating Autonomous AI Loop CLI",
   "bin": {
     "adelie": "bin/adelie.js"