@caddis/cli 0.2.6 → 0.4.0

package/bundles/antigravity-plugin/session_end_agy.py

@@ -22,16 +22,58 @@ def _artifact_root(root: str) -> str:
     return os.path.join(str(root), ".caddis")
 
 
+
+def _hook_note(feature, exc, root=None):
+    """Record a swallowed failure in the caddis hook ledger. Never raises, never prints.
+
+    agy hooks ship FLAT at the plugin root while hook_log.py ships under scripts/, and in
+    the source repo this file sits in claude-harness/agy/ with hook_log.py one level up in
+    claude-harness/scripts/. Try both layouts.
+    """
+    try:
+        _here = os.path.dirname(os.path.abspath(__file__))
+        for _cand in (os.path.join(_here, "scripts"),
+                      os.path.join(os.path.dirname(_here), "scripts")):
+            if os.path.isdir(_cand) and _cand not in sys.path:
+                sys.path.insert(0, _cand)
+        import hook_log as _hl  # noqa: E402
+        _hl.record(os.path.basename(__file__).replace(".py", ""), feature, exc, root)
+    except Exception:
+        pass
+
+
+def _workspace_roots(data):
+    """Every workspace root in the payload, as a list. Empty when the payload has none.
+
+    agy sends `workspacePaths` as a LIST. All three caddis agy hooks used to read
+    `workspacePaths[0]` and treat it as "the workspace" — silently, with no signal that a
+    choice had been made. In a single-root workspace that is correct and the behaviour here
+    is unchanged. In a MULTI-root workspace it is a coin toss: the hook acts on the first
+    root regardless of which one the session is actually working in.
+
+    Nothing on this machine is multi-root today, so this has never fired. It is a live trap
+    for exactly the multi-repo workspaces the leakage investigation was about, which is why
+    each caller below now handles the list rather than assuming its first element.
+    """
+    roots = data.get("workspacePaths") if isinstance(data, dict) else None
+    if not isinstance(roots, list):
+        return []
+    return [str(r) for r in roots if isinstance(r, (str, bytes)) and str(r).strip()]
+
 def main() -> None:
     try:
         data = json.load(sys.stdin)
     except Exception:
         data = {}
     try:
-        workspaces = data.get("workspacePaths") or []
-        workspace = workspaces[0] if workspaces else os.getcwd()
-        art = _artifact_root(workspace)
-        os.makedirs(art, exist_ok=True)
+        roots = _workspace_roots(data) or [os.getcwd()]
+        # Write the record to every root that ALREADY has a .caddis dir, rather than to
+        # whichever root happened to be first. A multi-root session's usage belongs to each
+        # repo that participates in it, and creating .caddis in a repo that never opted in
+        # would be caddis littering someone else's tree.
+        targets = [_artifact_root(r) for r in roots if os.path.isdir(_artifact_root(r))]
+        if not targets:
+            targets = [_artifact_root(roots[0])]  # single-root default: unchanged behaviour
         record = {
             "ts": datetime.now(timezone.utc).isoformat(),
             "event": "session_end",
@@ -41,10 +83,12 @@ def main() -> None:
             "terminationReason": data.get("terminationReason"),
             "model": data.get("modelName"),
         }
-        with open(os.path.join(art, "usage-log.jsonl"), "a", encoding="utf-8") as fh:
-            fh.write(json.dumps(record) + "\n")
-    except Exception:
-        pass  # never fail the turn
+        for art in targets:
+            os.makedirs(art, exist_ok=True)
+            with open(os.path.join(art, "usage-log.jsonl"), "a", encoding="utf-8") as fh:
+                fh.write(json.dumps(record) + "\n")
+    except Exception as _exc:
+        _hook_note("agy usage-log write", _exc)  # never fail the turn
     # No stdout: agy interprets a Stop hook's stdout as a decision object.
 
 

package/bundles/antigravity-plugin/skills/_registry.md

@@ -86,6 +86,7 @@
 | Ship Pr | `ship-pr/` | Open a reviewed PR for the current feature branch — rebase-safe push, PR create/update, monitor CI, STOP at green. Never merges, never deploys (that's /ship-merge). |
 | Spawn Hub | `spawn-hub/` | Hand the Advisory Hub role to a fresh session — run the mechanical audit, then generate the succession prompt with a context self-check the new Hub must pass |
 | Spawn Session | `spawn-session/` | Hand the WORK to a fresh session — generate the handover from the repo, then validate the successor by re-deriving its answers |
+| Statusline | `statusline/` | Install the caddis status line into Claude Code and agy — one renderer, once per machine |
 | Tdd | `tdd/` | Run a strict red-green-refactor TDD cycle for a unit of behavior |
 | Ui Brief | `ui-brief/` | Design-first UI brief — lock the aesthetic before writing any code |
 | Usage Review | `usage-review/` | Review local caddis usage over a window, surface prioritised recommendations, and apply config changes in one step |

package/bundles/antigravity-plugin/skills/advisory-hub/SKILL.md

@@ -93,6 +93,50 @@ A three-phase feature hits none of this. `/caddis:feature-plan` Step 3b runs thi
 it never creates the file silently. This is the test's only home — do not restate the thresholds
 elsewhere, or the copies drift.
 
+### Failing this test correctly does not mean "no discipline"
+
+A plan can fail the test above — properly, no Hub needed — and still be multi-phase, multi-session,
+and worth structuring. The trap is what happens next.
+
+The Hub's file conventions are *attractive*. Once one plan in a repo runs in Hub mode, its
+`phase-NN.prompt.md` / `phase-NN.report.md` / CONTINUE GATE artefacts are sitting right there as the
+most recent example of "how we structure a multi-session plan here." A second, smaller plan copies
+them by analogy. It gets the readability. It gets **none** of the safety, because the safety was
+never in the file names — it was in the role split and the verdict gate.
+
+That has happened. A six-phase UI plan borrowed the naming, and an implementing session filed its own
+batch report **and then wrote the next batch's prompt in the same session**, with nobody having
+looked at the work in between. Nothing was wrong that time. Nothing *checked*, either — and the good
+outcome is not evidence the mechanism worked, it is evidence nothing tested it.
+
+This skill already says why role separation is not decoration:
+
+> *An implementer that writes its own verdict has produced a self-assessment wearing a verdict's
+> name — worse than no verdict, because it looks like a check happened.*
+
+The same sentence holds with two words changed: **an implementer that writes the next phase's
+instructions** has produced a plan wearing an independently-authored prompt's name.
+
+### The one lightweight rule — cheap enough to always afford
+
+> **The session that files a phase's report must not also write the next phase's prompt without an
+> independent re-check in between.**
+
+That is the whole rule. It costs minutes, not a session:
+
+- re-run the test suite rather than trusting the report's claim that it passed
+- grep the source for the report's two or three load-bearing claims
+- open one or two of the screenshots it describes, rather than reading its description of them
+
+No switch file. No dedicated Hub session. No advisory-context doc. If the re-check finds nothing, you
+have lost ten minutes; if it finds something, it found it *before* the wrong instruction went into a
+fresh session that cannot know any better.
+
+**State which one you are doing, in the plan.** A plan that borrows Hub file conventions should say
+either "full Advisory Hub mode" or "Hub file conventions, lightweight re-check rule, no Hub" —
+because a reader six phases later cannot tell the two apart from the artefacts alone. That is the
+entire problem this section exists to prevent.
+
 ## Succession is not the same as a standing validator
 
 Two things look alike from outside and are not:

package/bundles/antigravity-plugin/skills/code-review/SKILL.md

@@ -8,6 +8,17 @@ license: Apache-2.0
 
 # Code Review
 
+> **On Claude Code, prefer the native `/code-review`.** It is a command, not a skill, so it always
+> fires — including headless — and it has grown capabilities this one does not have: effort levels
+> (`low`…`max`), an `ultra` mode that runs a multi-agent review in the cloud, `--comment` to post
+> findings as inline PR comments, and `--fix` to apply them to the working tree. Reach for it first.
+>
+> This surface remains because caddis ships to harnesses that have **no** native equivalent — agy,
+> Codex and Copilot. There it is the only review you get. Do not delete it to tidy up Claude Code.
+>
+> `/caddis:cross-review` is NOT replaced by either. It sends the diff to a **different vendor's**
+> model, which neither this nor the native reviewer can do.
+
 ## Review Categories
 
 ### 1. Security Review

package/bundles/antigravity-plugin/skills/fastapi-dev/SKILL.md

@@ -295,6 +295,6 @@ async def create_record(record: RecordCreate, service: ...):
 | Resource | Path |
 |----------|------|
 | FastAPI instructions | `instructions/fastapi.instructions.md` |
-| SQL expert skill | `skills/coding/sql/SKILL.md` |
+| SQL expert skill | the `sql` skill |
 | Python instructions | `instructions/python.instructions.md` |
 | Security instructions | `instructions/security.instructions.md` |

package/bundles/antigravity-plugin/skills/feature-plan/SKILL.md

@@ -349,6 +349,27 @@ this. But **always record the determination in the plan, pass or fail**: one lin
 > `Advisory Hub: not applicable — no REQUIRED trigger (not a migration / security change /
 > production data correctness / numbers published to stakeholders).`
 
+### If the test FAILS but this repo already runs a Hub for another plan
+
+Check for an existing `*-advisory-context.md` in `.caddis/plans/` belonging to a **different** plan.
+If one exists, add a second line under `## Constraints & decisions`:
+
+> `Hub conventions: this repo runs Advisory Hub for <other-plan>. This plan does NOT — if it borrows
+> the phase-NN.prompt.md / .report.md / CONTINUE GATE conventions, the lightweight rule applies: the
+> session that files a report must not write the next prompt without an independent re-check.`
+
+**Why this line exists.** A repo with one Hub plan has its artefacts sitting there as the most recent
+example of "how we structure a multi-session plan here", and the next plan copies them by analogy.
+It inherits the file names and none of the safety, because the safety was never in the names.
+Measured once already: an implementing session filed its own batch report and then wrote the next
+batch's prompt in the same session, with nobody having looked in between. Nothing was wrong that
+time — and nothing checked either.
+
+This is the cheapest possible place to catch it: when the second plan is created, before any
+artefact-mimicry has happened. See *"Failing this test correctly does not mean no discipline"* in the
+`advisory-hub` skill for the rule itself. Do not restate the rule here — one home, or the copies
+drift.
+
 Silent to the human, auditable in the artifact. "Say nothing" once meant *leave no trace anywhere*,
 and a wrong negative was then invisible — no line in the plan, no line in the chat, nothing for
 anyone to challenge. A rule whose failures leave no artifact cannot be reviewed.

package/bundles/antigravity-plugin/skills/gate-review/SKILL.md

@@ -5,6 +5,17 @@ description: Deterministic headless code review — adversarial diff review, sel
 
 # /caddis:gate-review — headless adversarial code review (self-contained)
 
+> **On Claude Code, prefer the native `/code-review`.** It is a command, not a skill, so it always
+> fires — including headless — and it has grown capabilities this one does not have: effort levels
+> (`low`…`max`), an `ultra` mode that runs a multi-agent review in the cloud, `--comment` to post
+> findings as inline PR comments, and `--fix` to apply them to the working tree. Reach for it first.
+>
+> This surface remains because caddis ships to harnesses that have **no** native equivalent — agy,
+> Codex and Copilot. There it is the only review you get. Do not delete it to tidy up Claude Code.
+>
+> `/caddis:cross-review` is NOT replaced by either. It sends the diff to a **different vendor's**
+> model, which neither this nor the native reviewer can do.
+
 Perform an adversarial code review of **$ARGUMENTS** (a git range, e.g. `abc123..HEAD` — defaults
 to the current working diff when empty).
 

package/bundles/antigravity-plugin/skills/implement/SKILL.md

@@ -137,6 +137,42 @@ This is the Hub's central power and until now it ran on human discipline alone:
 whether the next phase could start, and *nothing read it*. Five lines of check make the claim true by
 machine.
 
+### Ringing the Hub, and waiting for it (Claude Code only, optional)
+
+Two moments in Advisory-Hub mode currently cost the user a copy-paste. Both are optional, both
+degrade to today's behaviour, and neither replaces a file.
+
+**After you file `phase-NN.report.md`** — if `ListAgents` is available, look for a peer session whose
+name starts with **this repo's directory name**. Sessions are auto-named `<repo-dir>-<hash>`, so a
+same-repo peer is the Hub:
+
+```
+SendMessage({to: "<peer-name>", summary: "phase-05 report filed",
+             message: "phase-05.report.md is filed and awaiting a verdict."})
+```
+
+**When you are BLOCKED on a verdict** — instead of stopping dead, subscribe once:
+
+```
+SendMessage({to: "<peer-name>", notify_when_idle: true,
+             message: "blocked on phase-05 verdict; ping me when you have written it"})
+```
+
+`notify_when_idle` is one-shot and costs the Hub nothing extra. **Never poll `ListAgents` in a loop,
+and never send "are you done yet?"** — that burns both sessions' context to no purpose.
+
+**The rules that keep this from becoming a mess:**
+
+- **The file is the decision; the message is a doorbell.** Never treat a chat message as a verdict.
+  If a peer says "accepted", still read `phase-NN.verdict.md` — the gate above checks the FILE, and
+  a message cannot be re-read next week or by a third session.
+- **No `ListAgents`, no peer, or more than one same-repo peer → do nothing and carry on.** caddis
+  also runs on agy and Codex, which have no cross-session messaging at all. Everything above is an
+  accelerant on one harness; the file protocol is the portable layer and is what actually works.
+- **Headless runs never message.** There is no copy-paste to save.
+- **Never ask a peer to perform work your own session was denied.** Permission boundaries are
+  per-session, and routing blocked work through another session launders the user's decision.
+
 **If a `phase-NN.prompt.md` exists for the phase you are about to run, it is the INSTRUCTION OF
 RECORD** — read it, and measure your DEVIATIONS against it, not against the plan alone. The Hub writes
 that file before the phase precisely so a deviation is falsifiable; an executor that never reads it

package/bundles/antigravity-plugin/skills/security-review/SKILL.md

@@ -6,6 +6,15 @@ description: "Security review workflow — OWASP, code scanning, cloud infrastru
 
 # Security Review
 
+> **On Claude Code, prefer the native `/security-review`.** It is a command, not a skill, so it always
+> fires — including headless — and it has grown capabilities this one does not have: Reach for it first.
+>
+> This surface remains because caddis ships to harnesses that have **no** native equivalent — agy,
+> Codex and Copilot. There it is the only review you get. Do not delete it to tidy up Claude Code.
+>
+> `/caddis:cross-review` is NOT replaced by either. It sends the diff to a **different vendor's**
+> model, which neither this nor the native reviewer can do.
+
 Security review workflow covering OWASP Top 10, code scanning, and cloud infrastructure.
 
 ## When to Use

package/bundles/antigravity-plugin/skills/ship/SKILL.md

@@ -103,5 +103,5 @@ Release tag:     <tag> → <sha> | n/a
 
 ## Skill reference
 Full procedures for the Gitea lane (CI monitoring, prod validation, queue triage, failure remediation)
-are in `skills/devops/deploy-local/SKILL.md`. For the GitHub lane, the `gh-cli` skill covers `gh run`
+are in the `deploy-local` skill (ships in the optional `caddis-extras` plugin — enable it with `claude plugin enable caddis-extras`). For the GitHub lane, the `gh-cli` skill covers `gh run`
 usage. Load whichever matches the detected lane when a step needs more detail.

package/bundles/antigravity-plugin/skills/ship-merge/SKILL.md

@@ -99,5 +99,5 @@ Cleanup:       remote branch ✗ deleted / local ✗ deleted / backup ref droppe
 - Local-only lane: no PR, no merge — refuse and point at `/ship`.
 
 ## Skill reference
-Gitea deploy monitoring, prod validation, failure triage: `skills/devops/deploy-local/SKILL.md`.
+Gitea deploy monitoring, prod validation, failure triage: the `deploy-local` skill (ships in the optional `caddis-extras` plugin — enable it with `claude plugin enable caddis-extras`).
 GitHub `gh pr merge` / `gh run` usage: the `gh-cli` skill.

package/bundles/antigravity-plugin/skills/ship-pr/SKILL.md

@@ -98,5 +98,5 @@ human-confirmed door.
 - Local-only lane: refuse + point at `/ship`. On the default branch: stop + point at `/ship`.
 
 ## Skill reference
-Gitea API monitoring + failure triage: `skills/devops/deploy-local/SKILL.md`. GitHub `gh pr` / `gh run`
+Gitea API monitoring + failure triage: the `deploy-local` skill (ships in the optional `caddis-extras` plugin — enable it with `claude plugin enable caddis-extras`). GitHub `gh pr` / `gh run`
 usage: the `gh-cli` skill. Load whichever matches the detected lane.

package/bundles/antigravity-plugin/skills/statusline/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: statusline
+description: Install the caddis status line into Claude Code and agy — one renderer, once per machine
+---
+
+# /statusline — set up the status bar
+
+Wire the caddis status line into every coding agent on this machine. One Python renderer serves
+both hosts. It installs at **user scope**, so every project gets the line and no project holds a
+copy that can drift.
+
+## What the user gets
+
+Claude Code:
+
+```
+⌂ claudster-source | saajunaid/caddis ⎇ main +2 ●1 ?3 ↑1 | ◆ Opus 5 (1M context) v2.1.239 |
+◉ 412k/1M [███░░░░░]  41%  | ⚡ 386k cached | effort:high | style:Plain | thinking |
+5h:12% 7d:40% | 💻 57% (37 GB) | ⏺ relay | ◷ 07:58
+```
+
+agy (Antigravity):
+
+```
+▛▜ agy | ● idle | 🧠 Gemini 3.6 Flash (High) (high) | 📁 claudster-source | ⎇ main ?3 |
+◉ 48.5k/1M [░░░░░░░░]  5%  | ⚡ 40k cached | q 62% | 💻 57% (37 GB) | ⏺ relay | ◷ 08:01
+```
+
+Both lines come from `caddis_statusline.py`. It has two profiles, because the two hosts send
+different field names — agy's payload is a sibling of Claude Code's, not a copy.
+
+## Run it
+
+Find the renderer in this install and run it. Try these paths in order and use the first that exists:
+
+- `${CLAUDE_PLUGIN_ROOT}/scripts/caddis_statusline.py`
+- `claude-harness/scripts/caddis_statusline.py` (working inside the caddis source repo)
+
+Then:
+
+```bash
+python <path>/caddis_statusline.py --install          # both hosts
+python <path>/caddis_statusline.py --install --host claude
+python <path>/caddis_statusline.py --install --host agy
+python <path>/caddis_statusline.py --install --dry-run # print, write nothing
+```
+
+`--install` does four things:
+
+1. Copies the renderer to `~/.caddis/statusline.py` — a **stable** path. Pointing the host
+   settings at the plugin cache would break on every caddis upgrade, because the version number
+   is in that path.
+2. Creates `~/.caddis/statusline.json` with the default toggles. It never overwrites an existing one.
+3. Backs up each host's `settings.json` to `settings.json.bak-caddis-statusline`.
+4. Sets `statusLine` in `~/.claude/settings.json` and `~/.gemini/antigravity-cli/settings.json`,
+   preserving every other key. A host that is not installed is skipped, not failed.
+
+Report the tool's own output to the user. Then tell them the line appears on the **next** session —
+neither host re-reads `settings.json` mid-session.
+
+## Verify
+
+```bash
+python ~/.caddis/statusline.py --check                        # what is wired where
+python ~/.caddis/statusline.py --sample --profile claude      # preview, no host needed
+python ~/.caddis/statusline.py --sample --profile agy
+```
+
+`--check` exits non-zero when a host's `statusLine` is missing or points somewhere else.
+
+## Change the look
+
+Edit `~/.caddis/statusline.json`. Every key is optional; a missing file means defaults.
+
+| key | default | what it controls |
+|---|---|---|
+| `color` | `true` | ANSI colour |
+| `icons` | `true` | Unicode segment icons. These are plain Unicode, **not** Nerd Font glyphs |
+| `progress_bar` | `true` | the `[███░░░░░]` context bar |
+| `bar_width` | `8` | bar cells |
+| `token_counts` | `true` | `◉ 412k/1M` |
+| `cached_tokens` | `true` | `⚡ 386k cached` — bold and bright by design, never width-gated |
+| `ram` | `true` | `💻 57% (37 GB)` |
+| `ram_min_width` | `0` | hide RAM below this terminal width; `0` always shows it |
+| `clock` | `true` | `◷ 07:58` |
+| `relay` | `true` | `⏺ relay` when a parked resume pointer exists |
+| `rate_limits` | `true` | `5h:12% 7d:40%` (Claude Code only) |
+| `session_id` | `false` | `#a1b2c3d4` |
+| `git` | `true` | branch, staged/unstaged/untracked counts, ahead/behind |
+| `separator` | `"\|"` | segment separator |
+
+Config changes take effect on the next render. No reinstall needed.
+
+## Notes for you, not the user
+
+- Do **not** hand-edit either `settings.json` to wire this. `--install` reads, merges and writes
+  back, so it cannot drop an unrelated key. Hand edits have dropped `trustedWorkspaces` before.
+- The renderer never crashes the host. A bad payload, a missing field, or an unreadable config
+  degrades to fewer segments; a hard failure degrades to the directory name.
+- RAM on Windows uses `ctypes` `GlobalMemoryStatusEx`, an in-process call. Do not replace it with
+  `Get-CimInstance Win32_OperatingSystem` — that cost about 300 ms on **every** render in the
+  PowerShell line this replaced.
+- If the user asks why their old `~/.claude/statusline-custom.sh` or
+  `~/.gemini/statusline/statusline.ps1` no longer runs: nothing points at them any more. They are
+  superseded, not deleted. Both are safe to remove once the user is happy with the new line.

package/bundles/antigravity-plugin/skills/use-model/SKILL.md

@@ -55,9 +55,21 @@ A wholly new provider: add a row to `PROVIDERS` in `oss_model.py` (base_url, mod
 pass an unknown provider name with `OSS_BASE_URL`+`OSS_MODEL` set — no table edit required.
 
 ## First-time install
-Put `claude-harness/scripts/` (or your plugin's `scripts/` dir) on `PATH`, or add a shell profile
-function. `/setup-project-ai` documents the one-liner for your platform (PowerShell profile function /
-bash alias) — it does not silently edit your shell profile.
+
+```
+npm i -g @caddis/cli     # puts claude-oss / claude-glm / claude-deepseek on PATH
+caddis keys              # prompts for each provider key, validates it, writes ~/.caddis/keys.env
+claude-glm --print-config    # zero-token check: endpoint, model, key all resolved
+```
+
+npm does the PATH work on Windows, macOS and Linux. No profile edit, no script copying, no
+Python needed on the lane path — the resolver is ported into the CLI, because the npm tarball
+ships only `dist` and `bundles`.
+
+`npx` runs the default `caddis` binary only; the lane binaries need the global install above.
+
+**Plugin-only installs** (no npm CLI) keep the original route: put the plugin's `scripts/`
+directory on `PATH`, or add a shell profile function. caddis never silently edits your profile.
 
 ## Exit codes
 `claude-oss`/`claude-glm` propagate the wrapped `claude` process's exit code, except a resolver failure

package/bundles/antigravity-plugin/skills/validate-phase/SKILL.md

@@ -98,6 +98,37 @@ step, not just described.
 Add or update this phase's row in `.caddis/advisory-hub-reports/README.md` (Phase | Report | Verdict |
 Outcome | Date).
 
+## Step 8 — tell the implementing session (Claude Code only, optional)
+
+The verdict file is the decision. This step only saves the user from carrying it by hand.
+
+If `ListAgents` is available, look for a peer session whose name starts with **this repo's directory
+name** — sessions are auto-named `<repo-dir>-<hash>`, so in a repo directory called `acme-api`,
+`acme-api-91` is a session in this repo and `other-project-e8` is not. If exactly one such peer
+exists, it is the implementer:
+
+```
+SendMessage({to: "<peer-name>", summary: "phase-05 verdict",
+             message: "phase-05.verdict.md written — verdict: accept-with-correction. "
+                      "Corrections are in the file and in advisory-context.md."})
+```
+
+Send the **headline and the filename**, never the whole verdict. The file is the record; the message
+is a doorbell. A chat message cannot be re-read next week; `phase-05.verdict.md` can.
+
+**Do not do any of this if:**
+
+- there is no `ListAgents` — caddis also runs on agy and Codex, which have no cross-session
+  messaging. The file-based flow is the portable one and works everywhere. This step is an
+  accelerant, not a requirement.
+- **more than one** same-repo peer is listed. Guessing which is the implementer is worse than not
+  sending — say so to the user and let them name it.
+- you are headless. There is no one to save a copy-paste for.
+
+**Never ask the peer to run something your own session was denied.** Permission boundaries are
+per-session; routing blocked work through another session launders the user's decision. Route it back
+to the user instead.
+
 ## Rules
 
 - **Fail closed.** A gate you could not re-run is `NOT RE-RUN`, never `PASS`. A claim you could not

package/bundles/antigravity-plugin/warm_start_agy.py

@@ -131,14 +131,90 @@ def truncate_relay(text: str) -> str:
     return text
 
 
+
+def _hook_note(feature, exc, root=None):
+    """Record a swallowed failure in the caddis hook ledger. Never raises, never prints.
+
+    agy hooks ship FLAT at the plugin root while hook_log.py ships under scripts/, and in
+    the source repo this file sits in claude-harness/agy/ with hook_log.py one level up in
+    claude-harness/scripts/. Try both layouts.
+    """
+    try:
+        _here = os.path.dirname(os.path.abspath(__file__))
+        for _cand in (os.path.join(_here, "scripts"),
+                      os.path.join(os.path.dirname(_here), "scripts")):
+            if os.path.isdir(_cand) and _cand not in sys.path:
+                sys.path.insert(0, _cand)
+        import hook_log as _hl  # noqa: E402
+        _hl.record(os.path.basename(__file__).replace(".py", ""), feature, exc, root)
+    except Exception:
+        pass
+
+
+
+def _injected_marker(root, conversation):
+    """Path of the per-conversation "relay already injected" marker, or None."""
+    try:
+        safe = "".join(c for c in str(conversation) if c.isalnum() or c in "-_")[:64]
+        if not safe:
+            return None
+        return os.path.join(str(root), ".caddis", ".relay-injected", safe)
+    except Exception:
+        return None
+
+
+def _already_injected(root, conversation):
+    """True when this conversation has had its relay injected before. Fail-open: on any
+    error return False, because a duplicate relay is a smaller harm than none at all."""
+    try:
+        marker = _injected_marker(root, conversation)
+        return bool(marker) and os.path.isfile(marker)
+    except Exception:
+        return False
+
+
+def _mark_injected(root, conversation):
+    """Record that this conversation received its relay. Never raises.
+
+    A failure here means the next truncation may re-inject — the pre-2026-08-22 behaviour,
+    which is exactly the fail-open direction we want.
+    """
+    try:
+        marker = _injected_marker(root, conversation)
+        if not marker:
+            return
+        os.makedirs(os.path.dirname(marker), exist_ok=True)
+        with open(marker, "w", encoding="utf-8") as fh:
+            fh.write("")
+    except Exception as _exc:
+        _hook_note("agy relay injection marker", _exc, root)
+
+def _workspace_roots(data):
+    """Every workspace root in the payload, as a list. Empty when the payload has none.
+
+    agy sends `workspacePaths` as a LIST. All three caddis agy hooks used to read
+    `workspacePaths[0]` and treat it as "the workspace" — silently, with no signal that a
+    choice had been made. In a single-root workspace that is correct and the behaviour here
+    is unchanged. In a MULTI-root workspace it is a coin toss: the hook acts on the first
+    root regardless of which one the session is actually working in.
+
+    Nothing on this machine is multi-root today, so this has never fired. It is a live trap
+    for exactly the multi-repo workspaces the leakage investigation was about, which is why
+    each caller below now handles the list rather than assuming its first element.
+    """
+    roots = data.get("workspacePaths") if isinstance(data, dict) else None
+    if not isinstance(roots, list):
+        return []
+    return [str(r) for r in roots if isinstance(r, (str, bytes)) and str(r).strip()]
+
 def main() -> None:
     try:
         _reconfig = getattr(sys.stdout, "reconfigure", None)
         if _reconfig:
             try:
                 _reconfig(encoding="utf-8")
-            except Exception:
-                pass
+            except Exception as _exc:
+                _hook_note("agy stdout utf-8 reconfigure", _exc)
         try:
             data = json.load(sys.stdin)
         except Exception:
@@ -154,17 +230,47 @@ def main() -> None:
             return
         if is_headless():
             return
-        workspaces = data.get("workspacePaths") or []
-        if not (isinstance(workspaces, list) and workspaces):
+        roots = _workspace_roots(data)
+        if not roots:
             return
-        root = str(workspaces[0])
-        relay = resolve_relay(root)
-        if not relay:
-            return
-        text = open(relay, encoding="utf-8").read().strip()
-        if not text:
+
+        # DOUBLE-INJECTION GUARD (2026-08-22). The gate above is `invocationNum == 0`, and
+        # agy RESTARTS invocation numbering after a CHECKPOINT truncation. A long session
+        # therefore hits invocation 0 a second time mid-conversation and injected the relay
+        # again — observed at steps 53 and 56 of one transcript, after a truncation at 50.
+        # A relay injected mid-task is worse than noise: it carries a "next step" from a
+        # PREVIOUS session, and that has been seen executed in place of the real prompt.
+        #
+        # Conversation ids are unique per session, so a marker file per id is enough. Stale
+        # markers are harmless — they only ever suppress a re-injection into a conversation
+        # that already received one.
+        conversation = str(data.get("conversationId") or "").strip()
+
+        blocks = []
+        for root in roots:
+            relay = resolve_relay(root)
+            if not relay:
+                continue
+            try:
+                text = open(relay, encoding="utf-8").read().strip()
+            except Exception as _exc:
+                _hook_note("agy relay read", _exc, root)
+                continue
+            if not text:
+                continue
+            if conversation and _already_injected(root, conversation):
+                continue
+            # Label the block ONLY when there is more than one root. A single-root session
+            # must produce byte-identical output to before this change.
+            if len(roots) > 1:
+                blocks.append("relay for " + os.path.basename(root.rstrip("/\\")) + ":")
+            blocks.append(truncate_relay(text))
+            if conversation:
+                _mark_injected(root, conversation)
+
+        if not blocks:
             return
-        message = (RELAY_FRAME_HEADER + "\n" + truncate_relay(text)
+        message = (RELAY_FRAME_HEADER + "\n" + "\n\n".join(blocks)
                    + "\n\n" + RELAY_FRAME_FOOTER)
         payload = json.dumps({"injectSteps": [{"ephemeralMessage": message}]})
         sys.stdout.write(payload)

package/bundles/antigravity-plugin-extras/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis-extras",
-  "version": "1.3.24",
+  "version": "1.3.26",
   "description": "caddis-extras — the long-tail skills for the Antigravity (agy) caddis plugin; install alongside caddis for the full set."
 }

package/bundles/antigravity-plugin-extras/skills/architecture-design/SKILL.md

@@ -241,4 +241,4 @@ def fetch_records(status: str = None, page: int = 1):
 | Architect agent | `agents/architect.agent.md` |
 | FastAPI dev skill | `skills/coding/fastapi-dev/SKILL.md` |
 | Streamlit dev skill | `skills/frontend/streamlit-dev/SKILL.md` |
-| SQL expert skill | `skills/coding/sql/SKILL.md` |
+| SQL expert skill | the `sql` skill |

package/bundles/antigravity-plugin-extras/skills/caching-patterns/SKILL.md

@@ -382,4 +382,4 @@ This pattern is complementary to chunk retry (Step 6 + Gotcha 6) — the 3-layer
 |----------|------|
 | Streamlit dev skill | `skills/frontend/streamlit-dev/SKILL.md` |
 | Streamlit instructions | `instructions/streamlit.instructions.md` |
-| SQL expert skill | `skills/coding/sql/SKILL.md` |
+| SQL expert skill | the `sql` skill |