@caddis/cli 0.3.0 → 0.4.0

package/bundles/antigravity-plugin/session_end_agy.py

@@ -41,16 +41,39 @@ def _hook_note(feature, exc, root=None):
     except Exception:
         pass
 
+
+def _workspace_roots(data):
+    """Every workspace root in the payload, as a list. Empty when the payload has none.
+
+    agy sends `workspacePaths` as a LIST. All three caddis agy hooks used to read
+    `workspacePaths[0]` and treat it as "the workspace" — silently, with no signal that a
+    choice had been made. In a single-root workspace that is correct and the behaviour here
+    is unchanged. In a MULTI-root workspace it is a coin toss: the hook acts on the first
+    root regardless of which one the session is actually working in.
+
+    Nothing on this machine is multi-root today, so this has never fired. It is a live trap
+    for exactly the multi-repo workspaces the leakage investigation was about, which is why
+    each caller below now handles the list rather than assuming its first element.
+    """
+    roots = data.get("workspacePaths") if isinstance(data, dict) else None
+    if not isinstance(roots, list):
+        return []
+    return [str(r) for r in roots if isinstance(r, (str, bytes)) and str(r).strip()]
+
 def main() -> None:
     try:
         data = json.load(sys.stdin)
     except Exception:
         data = {}
     try:
-        workspaces = data.get("workspacePaths") or []
-        workspace = workspaces[0] if workspaces else os.getcwd()
-        art = _artifact_root(workspace)
-        os.makedirs(art, exist_ok=True)
+        roots = _workspace_roots(data) or [os.getcwd()]
+        # Write the record to every root that ALREADY has a .caddis dir, rather than to
+        # whichever root happened to be first. A multi-root session's usage belongs to each
+        # repo that participates in it, and creating .caddis in a repo that never opted in
+        # would be caddis littering someone else's tree.
+        targets = [_artifact_root(r) for r in roots if os.path.isdir(_artifact_root(r))]
+        if not targets:
+            targets = [_artifact_root(roots[0])]  # single-root default: unchanged behaviour
         record = {
             "ts": datetime.now(timezone.utc).isoformat(),
             "event": "session_end",
@@ -60,8 +83,10 @@ def main() -> None:
             "terminationReason": data.get("terminationReason"),
             "model": data.get("modelName"),
         }
-        with open(os.path.join(art, "usage-log.jsonl"), "a", encoding="utf-8") as fh:
-            fh.write(json.dumps(record) + "\n")
+        for art in targets:
+            os.makedirs(art, exist_ok=True)
+            with open(os.path.join(art, "usage-log.jsonl"), "a", encoding="utf-8") as fh:
+                fh.write(json.dumps(record) + "\n")
     except Exception as _exc:
         _hook_note("agy usage-log write", _exc)  # never fail the turn
     # No stdout: agy interprets a Stop hook's stdout as a decision object.

package/bundles/antigravity-plugin/skills/advisory-hub/SKILL.md

@@ -93,6 +93,50 @@ A three-phase feature hits none of this. `/caddis:feature-plan` Step 3b runs thi
 it never creates the file silently. This is the test's only home — do not restate the thresholds
 elsewhere, or the copies drift.
 
+### Failing this test correctly does not mean "no discipline"
+
+A plan can fail the test above — properly, no Hub needed — and still be multi-phase, multi-session,
+and worth structuring. The trap is what happens next.
+
+The Hub's file conventions are *attractive*. Once one plan in a repo runs in Hub mode, its
+`phase-NN.prompt.md` / `phase-NN.report.md` / CONTINUE GATE artefacts are sitting right there as the
+most recent example of "how we structure a multi-session plan here." A second, smaller plan copies
+them by analogy. It gets the readability. It gets **none** of the safety, because the safety was
+never in the file names — it was in the role split and the verdict gate.
+
+That has happened. A six-phase UI plan borrowed the naming, and an implementing session filed its own
+batch report **and then wrote the next batch's prompt in the same session**, with nobody having
+looked at the work in between. Nothing was wrong that time. Nothing *checked*, either — and the good
+outcome is not evidence the mechanism worked, it is evidence nothing tested it.
+
+This skill already says why role separation is not decoration:
+
+> *An implementer that writes its own verdict has produced a self-assessment wearing a verdict's
+> name — worse than no verdict, because it looks like a check happened.*
+
+The same sentence holds with two words changed: **an implementer that writes the next phase's
+instructions** has produced a plan wearing an independently-authored prompt's name.
+
+### The one lightweight rule — cheap enough to always afford
+
+> **The session that files a phase's report must not also write the next phase's prompt without an
+> independent re-check in between.**
+
+That is the whole rule. It costs minutes, not a session:
+
+- re-run the test suite rather than trusting the report's claim that it passed
+- grep the source for the report's two or three load-bearing claims
+- open one or two of the screenshots it describes, rather than reading its description of them
+
+No switch file. No dedicated Hub session. No advisory-context doc. If the re-check finds nothing, you
+have lost ten minutes; if it finds something, it found it *before* the wrong instruction went into a
+fresh session that cannot know any better.
+
+**State which one you are doing, in the plan.** A plan that borrows Hub file conventions should say
+either "full Advisory Hub mode" or "Hub file conventions, lightweight re-check rule, no Hub" —
+because a reader six phases later cannot tell the two apart from the artefacts alone. That is the
+entire problem this section exists to prevent.
+
 ## Succession is not the same as a standing validator
 
 Two things look alike from outside and are not:

package/bundles/antigravity-plugin/skills/code-review/SKILL.md

@@ -8,6 +8,17 @@ license: Apache-2.0
 
 # Code Review
 
+> **On Claude Code, prefer the native `/code-review`.** It is a command, not a skill, so it always
+> fires — including headless — and it has grown capabilities this one does not have: effort levels
+> (`low`…`max`), an `ultra` mode that runs a multi-agent review in the cloud, `--comment` to post
+> findings as inline PR comments, and `--fix` to apply them to the working tree. Reach for it first.
+>
+> This surface remains because caddis ships to harnesses that have **no** native equivalent — agy,
+> Codex and Copilot. There it is the only review you get. Do not delete it to tidy up Claude Code.
+>
+> `/caddis:cross-review` is NOT replaced by either. It sends the diff to a **different vendor's**
+> model, which neither this nor the native reviewer can do.
+
 ## Review Categories
 
 ### 1. Security Review

package/bundles/antigravity-plugin/skills/feature-plan/SKILL.md

@@ -349,6 +349,27 @@ this. But **always record the determination in the plan, pass or fail**: one lin
 > `Advisory Hub: not applicable — no REQUIRED trigger (not a migration / security change /
 > production data correctness / numbers published to stakeholders).`
 
+### If the test FAILS but this repo already runs a Hub for another plan
+
+Check for an existing `*-advisory-context.md` in `.caddis/plans/` belonging to a **different** plan.
+If one exists, add a second line under `## Constraints & decisions`:
+
+> `Hub conventions: this repo runs Advisory Hub for <other-plan>. This plan does NOT — if it borrows
+> the phase-NN.prompt.md / .report.md / CONTINUE GATE conventions, the lightweight rule applies: the
+> session that files a report must not write the next prompt without an independent re-check.`
+
+**Why this line exists.** A repo with one Hub plan has its artefacts sitting there as the most recent
+example of "how we structure a multi-session plan here", and the next plan copies them by analogy.
+It inherits the file names and none of the safety, because the safety was never in the names.
+Measured once already: an implementing session filed its own batch report and then wrote the next
+batch's prompt in the same session, with nobody having looked in between. Nothing was wrong that
+time — and nothing checked either.
+
+This is the cheapest possible place to catch it: when the second plan is created, before any
+artefact-mimicry has happened. See *"Failing this test correctly does not mean no discipline"* in the
+`advisory-hub` skill for the rule itself. Do not restate the rule here — one home, or the copies
+drift.
+
 Silent to the human, auditable in the artifact. "Say nothing" once meant *leave no trace anywhere*,
 and a wrong negative was then invisible — no line in the plan, no line in the chat, nothing for
 anyone to challenge. A rule whose failures leave no artifact cannot be reviewed.

package/bundles/antigravity-plugin/skills/gate-review/SKILL.md

@@ -5,6 +5,17 @@ description: Deterministic headless code review — adversarial diff review, sel
 
 # /caddis:gate-review — headless adversarial code review (self-contained)
 
+> **On Claude Code, prefer the native `/code-review`.** It is a command, not a skill, so it always
+> fires — including headless — and it has grown capabilities this one does not have: effort levels
+> (`low`…`max`), an `ultra` mode that runs a multi-agent review in the cloud, `--comment` to post
+> findings as inline PR comments, and `--fix` to apply them to the working tree. Reach for it first.
+>
+> This surface remains because caddis ships to harnesses that have **no** native equivalent — agy,
+> Codex and Copilot. There it is the only review you get. Do not delete it to tidy up Claude Code.
+>
+> `/caddis:cross-review` is NOT replaced by either. It sends the diff to a **different vendor's**
+> model, which neither this nor the native reviewer can do.
+
 Perform an adversarial code review of **$ARGUMENTS** (a git range, e.g. `abc123..HEAD` — defaults
 to the current working diff when empty).
 

package/bundles/antigravity-plugin/skills/implement/SKILL.md

@@ -137,6 +137,42 @@ This is the Hub's central power and until now it ran on human discipline alone:
 whether the next phase could start, and *nothing read it*. Five lines of check make the claim true by
 machine.
 
+### Ringing the Hub, and waiting for it (Claude Code only, optional)
+
+Two moments in Advisory-Hub mode currently cost the user a copy-paste. Both are optional, both
+degrade to today's behaviour, and neither replaces a file.
+
+**After you file `phase-NN.report.md`** — if `ListAgents` is available, look for a peer session whose
+name starts with **this repo's directory name**. Sessions are auto-named `<repo-dir>-<hash>`, so a
+same-repo peer is the Hub:
+
+```
+SendMessage({to: "<peer-name>", summary: "phase-05 report filed",
+             message: "phase-05.report.md is filed and awaiting a verdict."})
+```
+
+**When you are BLOCKED on a verdict** — instead of stopping dead, subscribe once:
+
+```
+SendMessage({to: "<peer-name>", notify_when_idle: true,
+             message: "blocked on phase-05 verdict; ping me when you have written it"})
+```
+
+`notify_when_idle` is one-shot and costs the Hub nothing extra. **Never poll `ListAgents` in a loop,
+and never send "are you done yet?"** — that burns both sessions' context to no purpose.
+
+**The rules that keep this from becoming a mess:**
+
+- **The file is the decision; the message is a doorbell.** Never treat a chat message as a verdict.
+  If a peer says "accepted", still read `phase-NN.verdict.md` — the gate above checks the FILE, and
+  a message cannot be re-read next week or by a third session.
+- **No `ListAgents`, no peer, or more than one same-repo peer → do nothing and carry on.** caddis
+  also runs on agy and Codex, which have no cross-session messaging at all. Everything above is an
+  accelerant on one harness; the file protocol is the portable layer and is what actually works.
+- **Headless runs never message.** There is no copy-paste to save.
+- **Never ask a peer to perform work your own session was denied.** Permission boundaries are
+  per-session, and routing blocked work through another session launders the user's decision.
+
 **If a `phase-NN.prompt.md` exists for the phase you are about to run, it is the INSTRUCTION OF
 RECORD** — read it, and measure your DEVIATIONS against it, not against the plan alone. The Hub writes
 that file before the phase precisely so a deviation is falsifiable; an executor that never reads it

package/bundles/antigravity-plugin/skills/security-review/SKILL.md

@@ -6,6 +6,15 @@ description: "Security review workflow — OWASP, code scanning, cloud infrastru
 
 # Security Review
 
+> **On Claude Code, prefer the native `/security-review`.** It is a command, not a skill, so it always
+> fires — including headless — and it has grown capabilities this one does not have: Reach for it first.
+>
+> This surface remains because caddis ships to harnesses that have **no** native equivalent — agy,
+> Codex and Copilot. There it is the only review you get. Do not delete it to tidy up Claude Code.
+>
+> `/caddis:cross-review` is NOT replaced by either. It sends the diff to a **different vendor's**
+> model, which neither this nor the native reviewer can do.
+
 Security review workflow covering OWASP Top 10, code scanning, and cloud infrastructure.
 
 ## When to Use

package/bundles/antigravity-plugin/skills/validate-phase/SKILL.md

@@ -98,6 +98,37 @@ step, not just described.
 Add or update this phase's row in `.caddis/advisory-hub-reports/README.md` (Phase | Report | Verdict |
 Outcome | Date).
 
+## Step 8 — tell the implementing session (Claude Code only, optional)
+
+The verdict file is the decision. This step only saves the user from carrying it by hand.
+
+If `ListAgents` is available, look for a peer session whose name starts with **this repo's directory
+name** — sessions are auto-named `<repo-dir>-<hash>`, so in a repo directory called `acme-api`,
+`acme-api-91` is a session in this repo and `other-project-e8` is not. If exactly one such peer
+exists, it is the implementer:
+
+```
+SendMessage({to: "<peer-name>", summary: "phase-05 verdict",
+             message: "phase-05.verdict.md written — verdict: accept-with-correction. "
+                      "Corrections are in the file and in advisory-context.md."})
+```
+
+Send the **headline and the filename**, never the whole verdict. The file is the record; the message
+is a doorbell. A chat message cannot be re-read next week; `phase-05.verdict.md` can.
+
+**Do not do any of this if:**
+
+- there is no `ListAgents` — caddis also runs on agy and Codex, which have no cross-session
+  messaging. The file-based flow is the portable one and works everywhere. This step is an
+  accelerant, not a requirement.
+- **more than one** same-repo peer is listed. Guessing which is the implementer is worse than not
+  sending — say so to the user and let them name it.
+- you are headless. There is no one to save a copy-paste for.
+
+**Never ask the peer to run something your own session was denied.** Permission boundaries are
+per-session; routing blocked work through another session launders the user's decision. Route it back
+to the user instead.
+
 ## Rules
 
 - **Fail closed.** A gate you could not re-run is `NOT RE-RUN`, never `PASS`. A claim you could not

package/bundles/antigravity-plugin/warm_start_agy.py

@@ -150,6 +150,63 @@ def _hook_note(feature, exc, root=None):
     except Exception:
         pass
 
+
+
+def _injected_marker(root, conversation):
+    """Path of the per-conversation "relay already injected" marker, or None."""
+    try:
+        safe = "".join(c for c in str(conversation) if c.isalnum() or c in "-_")[:64]
+        if not safe:
+            return None
+        return os.path.join(str(root), ".caddis", ".relay-injected", safe)
+    except Exception:
+        return None
+
+
+def _already_injected(root, conversation):
+    """True when this conversation has had its relay injected before. Fail-open: on any
+    error return False, because a duplicate relay is a smaller harm than none at all."""
+    try:
+        marker = _injected_marker(root, conversation)
+        return bool(marker) and os.path.isfile(marker)
+    except Exception:
+        return False
+
+
+def _mark_injected(root, conversation):
+    """Record that this conversation received its relay. Never raises.
+
+    A failure here means the next truncation may re-inject — the pre-2026-08-22 behaviour,
+    which is exactly the fail-open direction we want.
+    """
+    try:
+        marker = _injected_marker(root, conversation)
+        if not marker:
+            return
+        os.makedirs(os.path.dirname(marker), exist_ok=True)
+        with open(marker, "w", encoding="utf-8") as fh:
+            fh.write("")
+    except Exception as _exc:
+        _hook_note("agy relay injection marker", _exc, root)
+
+def _workspace_roots(data):
+    """Every workspace root in the payload, as a list. Empty when the payload has none.
+
+    agy sends `workspacePaths` as a LIST. All three caddis agy hooks used to read
+    `workspacePaths[0]` and treat it as "the workspace" — silently, with no signal that a
+    choice had been made. In a single-root workspace that is correct and the behaviour here
+    is unchanged. In a MULTI-root workspace it is a coin toss: the hook acts on the first
+    root regardless of which one the session is actually working in.
+
+    Nothing on this machine is multi-root today, so this has never fired. It is a live trap
+    for exactly the multi-repo workspaces the leakage investigation was about, which is why
+    each caller below now handles the list rather than assuming its first element.
+    """
+    roots = data.get("workspacePaths") if isinstance(data, dict) else None
+    if not isinstance(roots, list):
+        return []
+    return [str(r) for r in roots if isinstance(r, (str, bytes)) and str(r).strip()]
+
 def main() -> None:
     try:
         _reconfig = getattr(sys.stdout, "reconfigure", None)
@@ -173,17 +230,47 @@ def main() -> None:
             return
         if is_headless():
             return
-        workspaces = data.get("workspacePaths") or []
-        if not (isinstance(workspaces, list) and workspaces):
+        roots = _workspace_roots(data)
+        if not roots:
             return
-        root = str(workspaces[0])
-        relay = resolve_relay(root)
-        if not relay:
-            return
-        text = open(relay, encoding="utf-8").read().strip()
-        if not text:
+
+        # DOUBLE-INJECTION GUARD (2026-08-22). The gate above is `invocationNum == 0`, and
+        # agy RESTARTS invocation numbering after a CHECKPOINT truncation. A long session
+        # therefore hits invocation 0 a second time mid-conversation and injected the relay
+        # again — observed at steps 53 and 56 of one transcript, after a truncation at 50.
+        # A relay injected mid-task is worse than noise: it carries a "next step" from a
+        # PREVIOUS session, and that has been seen executed in place of the real prompt.
+        #
+        # Conversation ids are unique per session, so a marker file per id is enough. Stale
+        # markers are harmless — they only ever suppress a re-injection into a conversation
+        # that already received one.
+        conversation = str(data.get("conversationId") or "").strip()
+
+        blocks = []
+        for root in roots:
+            relay = resolve_relay(root)
+            if not relay:
+                continue
+            try:
+                text = open(relay, encoding="utf-8").read().strip()
+            except Exception as _exc:
+                _hook_note("agy relay read", _exc, root)
+                continue
+            if not text:
+                continue
+            if conversation and _already_injected(root, conversation):
+                continue
+            # Label the block ONLY when there is more than one root. A single-root session
+            # must produce byte-identical output to before this change.
+            if len(roots) > 1:
+                blocks.append("relay for " + os.path.basename(root.rstrip("/\\")) + ":")
+            blocks.append(truncate_relay(text))
+            if conversation:
+                _mark_injected(root, conversation)
+
+        if not blocks:
             return
-        message = (RELAY_FRAME_HEADER + "\n" + truncate_relay(text)
+        message = (RELAY_FRAME_HEADER + "\n" + "\n\n".join(blocks)
                    + "\n\n" + RELAY_FRAME_FOOTER)
         payload = json.dumps({"injectSteps": [{"ephemeralMessage": message}]})
         sys.stdout.write(payload)

package/bundles/antigravity-plugin-extras/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis-extras",
-  "version": "1.3.25",
+  "version": "1.3.26",
   "description": "caddis-extras — the long-tail skills for the Antigravity (agy) caddis plugin; install alongside caddis for the full set."
 }

package/bundles/codex/.codex/config.toml.example

@@ -0,0 +1,36 @@
+# Codex CLI configuration example
+# Copy to ~/.codex/config.toml  (user-level, all projects)
+#       or <project>/.codex/config.toml  (project-level; project must be trusted)
+#
+# Add a server interactively: codex mcp add <name> -- <command> [args...]
+# Verify loaded servers:      codex mcp list
+
+# ── Model (adjust to your OpenAI tier) ───────────────────────────────────────
+# model = "codex-mini-latest"
+
+# ── Skills ────────────────────────────────────────────────────────────────────
+# Project skills:  <project>/.codex/skills/<category>/<name>/SKILL.md
+# User skills:     ~/.codex/skills/<name>/SKILL.md  (no category subdir)
+# (Paths probed from codex 0.137 — see docs/analysis/codex-cli-contract.md.
+#  .agents/ is codex's PLUGINS root, not a skills root.)
+#
+# Disable a skill without deleting it:
+# [[skills.config]]
+# path = ".codex/skills/devops/windows-deployment"
+# enabled = false
+
+# ── junai MCP (pipeline state + project context) ─────────────────────────────
+# OFF by default. The junai MCP server tracks pipeline stage and project state
+# across sessions. Enable when the server is available locally.
+#
+# Prerequisites:
+#   pip install junai-mcp   (or: uv tool install junai-mcp)
+#   codex mcp add junai -- python -m junai_mcp --project-root .
+#
+# Or add the block below manually and run `codex mcp list` to confirm:
+#
+# [[mcp_servers]]
+# name = "junai"
+# command = "python"
+# args = ["-m", "junai_mcp", "--project-root", "."]
+# env = {}