@caddis/cli 0.4.28 → 0.4.30

package/bundles/antigravity-plugin/skills/adopt-app/SKILL.md

@@ -74,6 +74,13 @@ facts - services, scheduled tasks, web sites - can only be read on the box itsel
   flag yourself.** A credential that was ever committed must be ROTATED, not only deleted.
 - **What runs it.** If nothing on the host references the folder and the app is live, it runs
   somewhere you have not looked. Find out where before planning anything.
+- **COMMITS NO PORT WOULD CARRY.** A worktree is an extra folder, not an extra repository, so
+  its branch travels with a clone like any other. A **detached HEAD** does not: a clone copies
+  `refs/heads/*` and `refs/tags/*`, and a detached HEAD is neither. Nothing points at those
+  commits, so git may also collect them. If this section appears, fix it before anything else -
+  the report prints the exact `git branch` command, it changes nothing else, and it is the
+  difference between porting the work and losing it. Stashes are the same problem: `refs/stash`
+  is not copied by a clone or a push.
 
 Junctions and symlinks are reported and never followed. A junction inside a tree that git manages
 is a data-loss hazard: git's recursive remove follows it and deletes the target's contents.

package/bundles/antigravity-plugin/skills/adopt-app/references/standard.md

@@ -1,6 +1,6 @@
 # The adoption standard
 
-`Test-AppConformance.ps1` (phase 3) measures an app against 20 items, in the order below - the
+`Test-AppConformance.ps1` (phase 3) measures an app against 21 items, in the order below - the
 same order the script adds them in. Each one gets a verdict, never a guess:
 
 | Verdict | Means |
@@ -247,7 +247,40 @@ run it - should not require finding and interrupting someone.
 **Why it is on the list:** without it, every coding agent that touches the app re-derives its
 non-obvious rules from scratch, and different agents derive them differently.
 
-### 19. `no-junctions` - No junction or symlink inside the tree git manages
+### 19. `work-is-in-a-ref` - Every commit is reachable from a branch or a tag
+
+**Blocking.**
+
+**Decided by:** `GAP` when a worktree is on a DETACHED HEAD that no branch and no tag contains.
+`ASK` when there are no unreachable commits but there are stashes, or worktrees with
+uncommitted files. `ASK` when git could not be run. `PASS` otherwise.
+
+**Why it is on the list.** A port copies refs. A clone takes `refs/heads/*` and `refs/tags/*`,
+so a worktree's BRANCH travels with it like any other - a worktree is an extra folder, not an
+extra repository. A **detached HEAD is neither a branch nor a tag**, so its commits are not
+copied, and because nothing points at them git is free to collect them. The work is not
+protected by being on disk; it is protected by being in a ref.
+
+Measured on a real app: two detached worktrees under a temporary path that the app's own
+documents called a "recurring external cleanup hazard", with three recorded incidents. They
+held **200 commits** of certified work. `branch --contains` returned 0 for both. Every other
+check passed; a port would have carried 127 branches and left behind the only copy of the part
+that mattered.
+
+**The fix costs nothing** and the report prints it per worktree:
+
+```
+git -C <repo> branch rescue/<worktree-name> <sha>
+```
+
+It creates a branch name and changes nothing else. After it, `branch --contains` returns 1 and
+the commits port like anything else.
+
+Stashes are the same class of problem for a smaller amount of work: `refs/stash` is not copied
+by a clone or a push. Uncommitted files in a worktree are invisible to the main checkout's
+`git status`, which is why the inventory reports each worktree's own count.
+
+### 20. `no-junctions` - No junction or symlink inside the tree git manages
 
 **Not blocking.**
 
@@ -261,7 +294,7 @@ Ordinary Windows delete operations (`Remove-Item -Recurse`, `cmd /c rmdir /s /q`
 this trap easy to miss: a delete you tested yourself can look completely safe right up until git
 does the deleting instead.
 
-### 20. `profile` - The stack is declared, not assumed
+### 21. `profile` - The stack is declared, not assumed
 
 **Blocking.**
 
@@ -308,9 +341,9 @@ what it really is.
 | `1` | At least one blocking item is `GAP` and not waived. Checked first - if both a blocking `GAP` and a blocking unanswered `ASK` exist at once, exit code `1` wins. |
 | `2` | No blocking `GAP` remains, but at least one blocking item is still an unanswered `ASK` and not waived. |
 
-The eight blocking items, as the code actually enforces them, are: `git-repo`,
-`remote-on-team-host`, `canonical-branch`, `source-only`, `no-secrets`, `run-declared`, `owner`,
-and `profile`. Which items block is decided in the script, by the `Blocking` argument to each
+The nine blocking items, as the code actually enforces them, are: `git-repo`,
+`remote-on-team-host`, `canonical-branch`, `source-only`, `no-secrets`, `work-is-in-a-ref`,
+`run-declared`, `owner` and `profile`. Which items block is decided in the script, by the `Blocking` argument to each
 item, and not by the project config. An earlier draft of the config carried a `blockingItems`
 list that nothing read and that had drifted out of step with this set; it was removed from the
 code and from `config.example.json` together, rather than documented as a thing that looks

package/bundles/antigravity-plugin/skills/adopt-app/scripts/AdoptCommon.ps1

@@ -196,7 +196,8 @@ $script:AdoptScanBlock = {
         # a key that is missing because one git call did not run.
         $g = @{ isRepo = $true; gitAvailable = $gitAvailable; gitError = $gitError; commits = $null; branch = $null
                 localBranches = 0; remoteBranches = 0; tags = 0; dirtyFiles = $null
-                remotes = @(); upstream = $null; unpushed = $null; lastCommit = $null }
+                remotes = @(); upstream = $null; unpushed = $null; lastCommit = $null
+                worktrees = @(); unreachableCommits = @(); stashes = 0 }
         $result.git = $g
         if (-not $gitAvailable) {
             $result.partial = $true
@@ -231,6 +232,63 @@ $script:AdoptScanBlock = {
             if ($ahead) { $g.unpushed = [int]"$ahead" }
         }
         else { $g.upstream = $null; $g.unpushed = $null }
+
+        # ---- worktrees, and the commits a port would silently leave behind ----------
+        #
+        # A worktree is an extra FOLDER, not an extra repository: its branch lives in
+        # this same .git, so a mirror clone carries it. What a mirror does NOT carry is
+        # a DETACHED HEAD, because a mirror copies refs/heads/* and refs/tags/* and a
+        # detached HEAD is neither. Nothing points at those commits, so git is also free
+        # to collect them.
+        #
+        # This is not hypothetical. A real app had two detached worktrees on a temp path
+        # its own documents called a "recurring cleanup hazard", holding 200 commits of
+        # certified work. `branches containing it` was 0 for both. One `git worktree add`
+        # months earlier, and a port would have taken everything except the part that
+        # mattered.
+        $g.worktrees = @()
+        $g.unreachableCommits = @()
+        $wtOut = & $runGit @('worktree', 'list', '--porcelain')
+        if ($wtOut) {
+            $cur = $null
+            foreach ($line in @($wtOut)) {
+                $s = "$line"
+                if ($s -match '^worktree\s+(.+)$') {
+                    if ($cur) { $g.worktrees += $cur }
+                    $cur = @{ path = $Matches[1]; branch = $null; head = $null; detached = $false; dirtyFiles = $null; isMain = $false }
+                }
+                elseif ($s -match '^HEAD\s+([0-9a-f]{40})$' -and $cur) { $cur.head = $Matches[1] }
+                elseif ($s -match '^branch\s+refs/heads/(.+)$' -and $cur) { $cur.branch = $Matches[1] }
+                elseif ($s -eq 'detached' -and $cur) { $cur.detached = $true }
+            }
+            if ($cur) { $g.worktrees += $cur }
+        }
+
+        foreach ($w in @($g.worktrees)) {
+            $w.isMain = ($w.path.TrimEnd('\', '/') -eq $root)
+            # Its OWN uncommitted files. A worktree has a separate working tree, so the
+            # main checkout's `git status` says nothing about it.
+            if (Test-Path -LiteralPath $w.path) {
+                $st = & git -c safe.directory=* -C $w.path status --porcelain 2>&1
+                if ($LASTEXITCODE -eq 0) { $w.dirtyFiles = @($st | Where-Object { "$_" -ne '' }).Count }
+            }
+            # The finding that matters: is this HEAD reachable from any branch or tag?
+            if ($w.detached -and $w.head) {
+                $containing = @(& git -c safe.directory=* -C $root branch --contains $w.head 2>&1 | Where-Object { "$_" -notmatch '^(error|fatal)' -and "$_" -ne '' })
+                $tagged = @(& git -c safe.directory=* -C $root tag --contains $w.head 2>&1 | Where-Object { "$_" -notmatch '^(error|fatal)' -and "$_" -ne '' })
+                if ($containing.Count -eq 0 -and $tagged.Count -eq 0) {
+                    $ahead = & git -c safe.directory=* -C $root rev-list --count "$($w.head)" 2>&1
+                    $g.unreachableCommits += @{
+                        path = $w.path; head = $w.head
+                        commits = $(if ($LASTEXITCODE -eq 0) { [int]"$ahead" } else { $null })
+                    }
+                }
+            }
+        }
+
+        # A stash is a ref, but `refs/stash` is not copied by a normal clone or push.
+        $stash = & $runGit @('stash', 'list')
+        $g.stashes = @($stash | Where-Object { "$_" -ne '' }).Count
     }
 
     # ---- which files git actually tracks ---------------------------------------------

package/bundles/antigravity-plugin/skills/adopt-app/scripts/Get-AppInventory.ps1

@@ -166,6 +166,45 @@ elseif ($inventory.git.isRepo) {
 }
 else { Write-Host "  repo     : NO - there is no history to port; adoption starts with one import commit" -ForegroundColor Yellow }
 
+if ($inventory.git.isRepo) {
+    $wts = @(Get-AdoptProp $inventory.git 'worktrees' @())
+    $stashes = [int](Get-AdoptProp $inventory.git 'stashes' 0)
+    if ($wts.Count -gt 1 -or $stashes -gt 0) {
+        Write-AdoptHeading 'Worktrees and stashes'
+        foreach ($w in $wts) {
+            $what = if ($w.branch) { "on $($w.branch)" } else { "DETACHED at $("$($w.head)".Substring(0,9))" }
+            $dirty = if ($null -eq $w.dirtyFiles) { 'unreadable' } else { "$($w.dirtyFiles) uncommitted" }
+            $tag = if ($w.isMain) { '  (the main checkout)' } else { '' }
+            Write-Host ("    {0,-58} {1,-34} {2}{3}" -f $w.path, $what, $dirty, $tag)
+        }
+        if ($stashes -gt 0) {
+            Write-Host "    $stashes stash entr(ies) - `refs/stash` is NOT copied by a clone or a push." -ForegroundColor Yellow
+        }
+    }
+
+    # THE ONE THAT LOSES WORK. A mirror copies refs/heads/* and refs/tags/*; a detached
+    # HEAD is neither, so its commits are not carried - and with nothing pointing at them,
+    # git may collect them. Found on a real app: 200 commits of certified work on two
+    # detached worktrees, under a path its own docs called a recurring cleanup hazard.
+    $unreachable = @(Get-AdoptProp $inventory.git 'unreachableCommits' @())
+    if ($unreachable.Count -gt 0) {
+        Write-AdoptHeading 'COMMITS NO PORT WOULD CARRY'
+        Write-Host "  These worktrees are on a DETACHED HEAD that no branch and no tag points at." -ForegroundColor Red
+        Write-Host "  A clone copies branches and tags. These are neither, so they would be left" -ForegroundColor Red
+        Write-Host "  behind - and git is free to delete them." -ForegroundColor Red
+        foreach ($u in $unreachable) {
+            $n = if ($u.commits) { "$($u.commits) commits" } else { 'unknown depth' }
+            Write-Host ("    {0}`n      HEAD {1}  ({2})" -f $u.path, "$($u.head)".Substring(0,9), $n) -ForegroundColor Red
+        }
+        Write-Host ""
+        Write-Host "  FIX IT BEFORE PORTING - one command each, and it changes nothing else:" -ForegroundColor Yellow
+        foreach ($u in $unreachable) {
+            $leaf = (Split-Path $u.path -Leaf) -replace '[^A-Za-z0-9._-]', '-'
+            Write-Host "    git -C <repo> branch rescue/$leaf $("$($u.head)".Substring(0,9))" -ForegroundColor Yellow
+        }
+    }
+}
+
 # Neither committed nor ignored. This is the state that turns one careless `git add -A`
 # into gigabytes of runtime data in the history for ever, and no filename pattern finds
 # it - only git can tell an undeclared data tree from a source folder.

package/bundles/antigravity-plugin/skills/adopt-app/scripts/Test-AppConformance.ps1

@@ -254,6 +254,22 @@ Add-Item 'agent-rules' 'A rules file the coding agents read' $false `
     $(if ($hasAgentRules) { (@($inv.docs | Where-Object { $_ -match '(?i)^(agents|claude)\.md$' }) -join ', ') } else { 'none' }) `
     '' 'Without it every agent re-derives the project rules, and each one derives them differently.'
 
+# A port copies refs. Work that is in no ref is work a port silently drops.
+$unreachable = @(Get-AdoptProp $inv.git 'unreachableCommits' @())
+$stashCount  = [int](Get-AdoptProp $inv.git 'stashes' 0)
+$wtDirty     = @(@(Get-AdoptProp $inv.git 'worktrees' @()) | Where-Object { $_.dirtyFiles -and $_.dirtyFiles -gt 0 })
+Add-Item 'work-is-in-a-ref' 'Every commit is reachable from a branch or a tag' $true `
+    $(if (-not $gitUsable) { 'ASK' } elseif ($unreachable.Count -gt 0) { 'GAP' } elseif ($stashCount -gt 0 -or $wtDirty.Count -gt 0) { 'ASK' } else { 'PASS' }) `
+    $(if ($unreachable.Count -gt 0) {
+            "DETACHED and unreferenced: " + ((@($unreachable | ForEach-Object { "$($_.path) ($($_.commits) commits)" })) -join '; ')
+        }
+        elseif ($stashCount -gt 0 -or $wtDirty.Count -gt 0) {
+            "no unreachable commits, but $stashCount stash(es) and $($wtDirty.Count) worktree(s) with uncommitted files - none of that is in a ref either"
+        }
+        else { 'every worktree is on a branch; no stashes' }) `
+    'For each stash and each uncommitted file: does that work matter? Anything that does needs a branch before the port.' `
+    'A clone copies refs/heads/* and refs/tags/*. A detached HEAD is neither, so its commits are not carried - and nothing points at them, so git may collect them. `git branch <name> <sha>` costs nothing and fixes it.'
+
 Add-Item 'no-junctions' 'No junction or symlink inside the tree git manages' $false `
     $(if ($junctionsInTree.Count -eq 0) { 'PASS' } else { 'GAP' }) `
     $(if ($junctionsInTree.Count -eq 0) { 'none outside dependency folders' } else { "$($junctionsInTree.Count): $((@($junctionsInTree | Select-Object -First 3 | ForEach-Object { $_.path })) -join ', ')" }) `

package/bundles/antigravity-plugin/skills/data-lineage/SKILL.md

@@ -26,7 +26,7 @@ Run the End-to-End Data Lineage generation procedure:
 3. **Convert to Confluence Storage Format XHTML:**
    - Run the PlantUML-enabled converter:
      ```powershell
-     python scripts/convert_doc_to_confluence.py docs/<app>/<app>-data-lineage.md --output docs/<app>/<app>-data-lineage.html --diagram-type plantuml
+     python "${CLAUDE_PLUGIN_ROOT}/scripts/convert_doc_to_confluence.py" docs/<app>/<app>-data-lineage.md --output docs/<app>/<app>-data-lineage.html --diagram-type plantuml
      ```
    - Verify that all diagrams convert to native `<ac:structured-macro ac:name="plantuml">` blocks with scale 1.2, natural splines, auto-wrapped edge labels, crimson red borders on impacted components, and embedded Creole legends.
    - Verify that output validates as 100% well-formed XML.

package/bundles/antigravity-plugin/skills/hld/SKILL.md

@@ -32,7 +32,7 @@ Run the High-Level Design (HLD) generation procedure:
 4. **Convert to Confluence Storage Format XHTML:**
    - Run the PlantUML-enabled converter:
      ```powershell
-     python scripts/convert_doc_to_confluence.py docs/<app>/<app>-hld.md --output docs/<app>/<app>-hld.html --diagram-type plantuml
+     python "${CLAUDE_PLUGIN_ROOT}/scripts/convert_doc_to_confluence.py" docs/<app>/<app>-hld.md --output docs/<app>/<app>-hld.html --diagram-type plantuml
      ```
    - Verify that all diagrams are converted to native `<ac:structured-macro ac:name="plantuml">` blocks with scale 1.2, natural splines, auto-wrapped edge labels, crimson red borders on impacted components, and embedded Creole legends.
    - Ensure multi-stage operational flows use horizontal side-by-side stages (`flowchart LR`) and architecture topologies follow clean 3-tier hierarchies (`flowchart TD`).

package/bundles/antigravity-plugin/skills/lld/SKILL.md

@@ -39,7 +39,7 @@ Run the Lower-Level Design (LLD) generation procedure:
 4. **Convert to Confluence Storage Format XHTML:**
    - Run the PlantUML-enabled converter:
      ```powershell
-     python scripts/convert_doc_to_confluence.py docs/<app>/<app>-lld.md --output docs/<app>/<app>-lld.html --diagram-type plantuml
+     python "${CLAUDE_PLUGIN_ROOT}/scripts/convert_doc_to_confluence.py" docs/<app>/<app>-lld.md --output docs/<app>/<app>-lld.html --diagram-type plantuml
      ```
    - Verify that all diagrams are converted to native `<ac:structured-macro ac:name="plantuml">` blocks with scale 1.2, natural splines, auto-wrapped edge labels, crimson red borders on impacted components, and embedded Creole legends.
    - Verify that output validates as well-formed XML.

package/bundles/antigravity-plugin/skills/mmr/SKILL.md

@@ -12,6 +12,9 @@ simple Verdict Card.
 
 When invoked without a task prompt (or with a git range), `/mmr` runs a direct cross-model diff review.
 
+The user typed: **$ARGUMENTS**. Route it to one of the commands below: `keep`, `drop` or `status`
+as given; a git range to `review --range`; empty to `review`; anything else is the task for `run`.
+
 ## Natural Language Triggers
 You can trigger MMR naturally without typing the full slash command:
 - *"Run this on another lane: &lt;task&gt;"* &rarr; `/mmr "<task>"`
@@ -27,9 +30,9 @@ You can trigger MMR naturally without typing the full slash command:
 
 ### 1. Run an Ad-Hoc Task
 ```bash
-python scripts/caddis_adhoc.py run "<task description>" [--type backend|tests|docs|ui|hard]
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_adhoc.py" run "<task description>" [--type backend|tests|docs|ui|hard]
 # Shorthand:
-python scripts/caddis_adhoc.py "<task description>"
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_adhoc.py" "<task description>"
 ```
 - **Sandbox Isolation:** Creates an ephemeral 1-phase plan at `.caddis/orchestrator/adhoc/<slug>.md`.
 - **Pre-flight Checks:** Verifies dirty tree and API keys. Warns if local edits exist.
@@ -41,7 +44,7 @@ python scripts/caddis_adhoc.py "<task description>"
 
 ### 2. Keep the Result
 ```bash
-python scripts/caddis_adhoc.py keep
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_adhoc.py" keep
 ```
 - Keeps the output branch `lane/adhoc-<slug>`.
 - **Main Branch Protection:** If you are on `main` or `master`, direct merge is disabled to protect trunk. Recommends running `/ship-pr`.
@@ -49,7 +52,7 @@ python scripts/caddis_adhoc.py keep
 
 ### 3. Drop the Result
 ```bash
-python scripts/caddis_adhoc.py drop
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_adhoc.py" drop
 ```
 - Deletes the branch `lane/adhoc-<slug>`.
 - Deletes the ephemeral plan file and run logs.
@@ -57,7 +60,7 @@ python scripts/caddis_adhoc.py drop
 
 ### 4. Check Status
 ```bash
-python scripts/caddis_adhoc.py status
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_adhoc.py" status
 ```
 - Displays API key readiness for all lanes (`Anthropic`, `DeepSeek`, `GLM`, `OpenAI`).
 - Shows the latest task status, model used, and gates/review verdicts.
@@ -65,9 +68,9 @@ python scripts/caddis_adhoc.py status
 
 ### 5. Review Diff Only
 ```bash
-python scripts/caddis_adhoc.py review [--range <range>]
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_adhoc.py" review [--range <range>]
 # Shorthand (no args):
-python scripts/caddis_adhoc.py
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_adhoc.py"
 ```
 - Fast cross-model review of working tree or git range (e.g., `origin/main..HEAD`).
 

package/bundles/antigravity-plugin-extras/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis-extras",
-  "version": "1.3.36",
+  "version": "1.3.37",
   "description": "caddis-extras — the long-tail skills for the Antigravity (agy) caddis plugin; install alongside caddis for the full set."
 }

package/bundles/codex/.codex/skills/devops/adopt-app/SKILL.md

@@ -74,6 +74,13 @@ facts - services, scheduled tasks, web sites - can only be read on the box itsel
   flag yourself.** A credential that was ever committed must be ROTATED, not only deleted.
 - **What runs it.** If nothing on the host references the folder and the app is live, it runs
   somewhere you have not looked. Find out where before planning anything.
+- **COMMITS NO PORT WOULD CARRY.** A worktree is an extra folder, not an extra repository, so
+  its branch travels with a clone like any other. A **detached HEAD** does not: a clone copies
+  `refs/heads/*` and `refs/tags/*`, and a detached HEAD is neither. Nothing points at those
+  commits, so git may also collect them. If this section appears, fix it before anything else -
+  the report prints the exact `git branch` command, it changes nothing else, and it is the
+  difference between porting the work and losing it. Stashes are the same problem: `refs/stash`
+  is not copied by a clone or a push.
 
 Junctions and symlinks are reported and never followed. A junction inside a tree that git manages
 is a data-loss hazard: git's recursive remove follows it and deletes the target's contents.

package/bundles/codex/.codex/skills/devops/adopt-app/references/standard.md

@@ -1,6 +1,6 @@
 # The adoption standard
 
-`Test-AppConformance.ps1` (phase 3) measures an app against 20 items, in the order below - the
+`Test-AppConformance.ps1` (phase 3) measures an app against 21 items, in the order below - the
 same order the script adds them in. Each one gets a verdict, never a guess:
 
 | Verdict | Means |
@@ -247,7 +247,40 @@ run it - should not require finding and interrupting someone.
 **Why it is on the list:** without it, every coding agent that touches the app re-derives its
 non-obvious rules from scratch, and different agents derive them differently.
 
-### 19. `no-junctions` - No junction or symlink inside the tree git manages
+### 19. `work-is-in-a-ref` - Every commit is reachable from a branch or a tag
+
+**Blocking.**
+
+**Decided by:** `GAP` when a worktree is on a DETACHED HEAD that no branch and no tag contains.
+`ASK` when there are no unreachable commits but there are stashes, or worktrees with
+uncommitted files. `ASK` when git could not be run. `PASS` otherwise.
+
+**Why it is on the list.** A port copies refs. A clone takes `refs/heads/*` and `refs/tags/*`,
+so a worktree's BRANCH travels with it like any other - a worktree is an extra folder, not an
+extra repository. A **detached HEAD is neither a branch nor a tag**, so its commits are not
+copied, and because nothing points at them git is free to collect them. The work is not
+protected by being on disk; it is protected by being in a ref.
+
+Measured on a real app: two detached worktrees under a temporary path that the app's own
+documents called a "recurring external cleanup hazard", with three recorded incidents. They
+held **200 commits** of certified work. `branch --contains` returned 0 for both. Every other
+check passed; a port would have carried 127 branches and left behind the only copy of the part
+that mattered.
+
+**The fix costs nothing** and the report prints it per worktree:
+
+```
+git -C <repo> branch rescue/<worktree-name> <sha>
+```
+
+It creates a branch name and changes nothing else. After it, `branch --contains` returns 1 and
+the commits port like anything else.
+
+Stashes are the same class of problem for a smaller amount of work: `refs/stash` is not copied
+by a clone or a push. Uncommitted files in a worktree are invisible to the main checkout's
+`git status`, which is why the inventory reports each worktree's own count.
+
+### 20. `no-junctions` - No junction or symlink inside the tree git manages
 
 **Not blocking.**
 
@@ -261,7 +294,7 @@ Ordinary Windows delete operations (`Remove-Item -Recurse`, `cmd /c rmdir /s /q`
 this trap easy to miss: a delete you tested yourself can look completely safe right up until git
 does the deleting instead.
 
-### 20. `profile` - The stack is declared, not assumed
+### 21. `profile` - The stack is declared, not assumed
 
 **Blocking.**
 
@@ -308,9 +341,9 @@ what it really is.
 | `1` | At least one blocking item is `GAP` and not waived. Checked first - if both a blocking `GAP` and a blocking unanswered `ASK` exist at once, exit code `1` wins. |
 | `2` | No blocking `GAP` remains, but at least one blocking item is still an unanswered `ASK` and not waived. |
 
-The eight blocking items, as the code actually enforces them, are: `git-repo`,
-`remote-on-team-host`, `canonical-branch`, `source-only`, `no-secrets`, `run-declared`, `owner`,
-and `profile`. Which items block is decided in the script, by the `Blocking` argument to each
+The nine blocking items, as the code actually enforces them, are: `git-repo`,
+`remote-on-team-host`, `canonical-branch`, `source-only`, `no-secrets`, `work-is-in-a-ref`,
+`run-declared`, `owner` and `profile`. Which items block is decided in the script, by the `Blocking` argument to each
 item, and not by the project config. An earlier draft of the config carried a `blockingItems`
 list that nothing read and that had drifted out of step with this set; it was removed from the
 code and from `config.example.json` together, rather than documented as a thing that looks

package/bundles/codex/.codex/skills/devops/adopt-app/scripts/AdoptCommon.ps1

@@ -196,7 +196,8 @@ $script:AdoptScanBlock = {
         # a key that is missing because one git call did not run.
         $g = @{ isRepo = $true; gitAvailable = $gitAvailable; gitError = $gitError; commits = $null; branch = $null
                 localBranches = 0; remoteBranches = 0; tags = 0; dirtyFiles = $null
-                remotes = @(); upstream = $null; unpushed = $null; lastCommit = $null }
+                remotes = @(); upstream = $null; unpushed = $null; lastCommit = $null
+                worktrees = @(); unreachableCommits = @(); stashes = 0 }
         $result.git = $g
         if (-not $gitAvailable) {
             $result.partial = $true
@@ -231,6 +232,63 @@ $script:AdoptScanBlock = {
             if ($ahead) { $g.unpushed = [int]"$ahead" }
         }
         else { $g.upstream = $null; $g.unpushed = $null }
+
+        # ---- worktrees, and the commits a port would silently leave behind ----------
+        #
+        # A worktree is an extra FOLDER, not an extra repository: its branch lives in
+        # this same .git, so a mirror clone carries it. What a mirror does NOT carry is
+        # a DETACHED HEAD, because a mirror copies refs/heads/* and refs/tags/* and a
+        # detached HEAD is neither. Nothing points at those commits, so git is also free
+        # to collect them.
+        #
+        # This is not hypothetical. A real app had two detached worktrees on a temp path
+        # its own documents called a "recurring cleanup hazard", holding 200 commits of
+        # certified work. `branches containing it` was 0 for both. One `git worktree add`
+        # months earlier, and a port would have taken everything except the part that
+        # mattered.
+        $g.worktrees = @()
+        $g.unreachableCommits = @()
+        $wtOut = & $runGit @('worktree', 'list', '--porcelain')
+        if ($wtOut) {
+            $cur = $null
+            foreach ($line in @($wtOut)) {
+                $s = "$line"
+                if ($s -match '^worktree\s+(.+)$') {
+                    if ($cur) { $g.worktrees += $cur }
+                    $cur = @{ path = $Matches[1]; branch = $null; head = $null; detached = $false; dirtyFiles = $null; isMain = $false }
+                }
+                elseif ($s -match '^HEAD\s+([0-9a-f]{40})$' -and $cur) { $cur.head = $Matches[1] }
+                elseif ($s -match '^branch\s+refs/heads/(.+)$' -and $cur) { $cur.branch = $Matches[1] }
+                elseif ($s -eq 'detached' -and $cur) { $cur.detached = $true }
+            }
+            if ($cur) { $g.worktrees += $cur }
+        }
+
+        foreach ($w in @($g.worktrees)) {
+            $w.isMain = ($w.path.TrimEnd('\', '/') -eq $root)
+            # Its OWN uncommitted files. A worktree has a separate working tree, so the
+            # main checkout's `git status` says nothing about it.
+            if (Test-Path -LiteralPath $w.path) {
+                $st = & git -c safe.directory=* -C $w.path status --porcelain 2>&1
+                if ($LASTEXITCODE -eq 0) { $w.dirtyFiles = @($st | Where-Object { "$_" -ne '' }).Count }
+            }
+            # The finding that matters: is this HEAD reachable from any branch or tag?
+            if ($w.detached -and $w.head) {
+                $containing = @(& git -c safe.directory=* -C $root branch --contains $w.head 2>&1 | Where-Object { "$_" -notmatch '^(error|fatal)' -and "$_" -ne '' })
+                $tagged = @(& git -c safe.directory=* -C $root tag --contains $w.head 2>&1 | Where-Object { "$_" -notmatch '^(error|fatal)' -and "$_" -ne '' })
+                if ($containing.Count -eq 0 -and $tagged.Count -eq 0) {
+                    $ahead = & git -c safe.directory=* -C $root rev-list --count "$($w.head)" 2>&1
+                    $g.unreachableCommits += @{
+                        path = $w.path; head = $w.head
+                        commits = $(if ($LASTEXITCODE -eq 0) { [int]"$ahead" } else { $null })
+                    }
+                }
+            }
+        }
+
+        # A stash is a ref, but `refs/stash` is not copied by a normal clone or push.
+        $stash = & $runGit @('stash', 'list')
+        $g.stashes = @($stash | Where-Object { "$_" -ne '' }).Count
     }
 
     # ---- which files git actually tracks ---------------------------------------------

package/bundles/codex/.codex/skills/devops/adopt-app/scripts/Get-AppInventory.ps1

@@ -166,6 +166,45 @@ elseif ($inventory.git.isRepo) {
 }
 else { Write-Host "  repo     : NO - there is no history to port; adoption starts with one import commit" -ForegroundColor Yellow }
 
+if ($inventory.git.isRepo) {
+    $wts = @(Get-AdoptProp $inventory.git 'worktrees' @())
+    $stashes = [int](Get-AdoptProp $inventory.git 'stashes' 0)
+    if ($wts.Count -gt 1 -or $stashes -gt 0) {
+        Write-AdoptHeading 'Worktrees and stashes'
+        foreach ($w in $wts) {
+            $what = if ($w.branch) { "on $($w.branch)" } else { "DETACHED at $("$($w.head)".Substring(0,9))" }
+            $dirty = if ($null -eq $w.dirtyFiles) { 'unreadable' } else { "$($w.dirtyFiles) uncommitted" }
+            $tag = if ($w.isMain) { '  (the main checkout)' } else { '' }
+            Write-Host ("    {0,-58} {1,-34} {2}{3}" -f $w.path, $what, $dirty, $tag)
+        }
+        if ($stashes -gt 0) {
+            Write-Host "    $stashes stash entr(ies) - `refs/stash` is NOT copied by a clone or a push." -ForegroundColor Yellow
+        }
+    }
+
+    # THE ONE THAT LOSES WORK. A mirror copies refs/heads/* and refs/tags/*; a detached
+    # HEAD is neither, so its commits are not carried - and with nothing pointing at them,
+    # git may collect them. Found on a real app: 200 commits of certified work on two
+    # detached worktrees, under a path its own docs called a recurring cleanup hazard.
+    $unreachable = @(Get-AdoptProp $inventory.git 'unreachableCommits' @())
+    if ($unreachable.Count -gt 0) {
+        Write-AdoptHeading 'COMMITS NO PORT WOULD CARRY'
+        Write-Host "  These worktrees are on a DETACHED HEAD that no branch and no tag points at." -ForegroundColor Red
+        Write-Host "  A clone copies branches and tags. These are neither, so they would be left" -ForegroundColor Red
+        Write-Host "  behind - and git is free to delete them." -ForegroundColor Red
+        foreach ($u in $unreachable) {
+            $n = if ($u.commits) { "$($u.commits) commits" } else { 'unknown depth' }
+            Write-Host ("    {0}`n      HEAD {1}  ({2})" -f $u.path, "$($u.head)".Substring(0,9), $n) -ForegroundColor Red
+        }
+        Write-Host ""
+        Write-Host "  FIX IT BEFORE PORTING - one command each, and it changes nothing else:" -ForegroundColor Yellow
+        foreach ($u in $unreachable) {
+            $leaf = (Split-Path $u.path -Leaf) -replace '[^A-Za-z0-9._-]', '-'
+            Write-Host "    git -C <repo> branch rescue/$leaf $("$($u.head)".Substring(0,9))" -ForegroundColor Yellow
+        }
+    }
+}
+
 # Neither committed nor ignored. This is the state that turns one careless `git add -A`
 # into gigabytes of runtime data in the history for ever, and no filename pattern finds
 # it - only git can tell an undeclared data tree from a source folder.

package/bundles/codex/.codex/skills/devops/adopt-app/scripts/Test-AppConformance.ps1

@@ -254,6 +254,22 @@ Add-Item 'agent-rules' 'A rules file the coding agents read' $false `
     $(if ($hasAgentRules) { (@($inv.docs | Where-Object { $_ -match '(?i)^(agents|claude)\.md$' }) -join ', ') } else { 'none' }) `
     '' 'Without it every agent re-derives the project rules, and each one derives them differently.'
 
+# A port copies refs. Work that is in no ref is work a port silently drops.
+$unreachable = @(Get-AdoptProp $inv.git 'unreachableCommits' @())
+$stashCount  = [int](Get-AdoptProp $inv.git 'stashes' 0)
+$wtDirty     = @(@(Get-AdoptProp $inv.git 'worktrees' @()) | Where-Object { $_.dirtyFiles -and $_.dirtyFiles -gt 0 })
+Add-Item 'work-is-in-a-ref' 'Every commit is reachable from a branch or a tag' $true `
+    $(if (-not $gitUsable) { 'ASK' } elseif ($unreachable.Count -gt 0) { 'GAP' } elseif ($stashCount -gt 0 -or $wtDirty.Count -gt 0) { 'ASK' } else { 'PASS' }) `
+    $(if ($unreachable.Count -gt 0) {
+            "DETACHED and unreferenced: " + ((@($unreachable | ForEach-Object { "$($_.path) ($($_.commits) commits)" })) -join '; ')
+        }
+        elseif ($stashCount -gt 0 -or $wtDirty.Count -gt 0) {
+            "no unreachable commits, but $stashCount stash(es) and $($wtDirty.Count) worktree(s) with uncommitted files - none of that is in a ref either"
+        }
+        else { 'every worktree is on a branch; no stashes' }) `
+    'For each stash and each uncommitted file: does that work matter? Anything that does needs a branch before the port.' `
+    'A clone copies refs/heads/* and refs/tags/*. A detached HEAD is neither, so its commits are not carried - and nothing points at them, so git may collect them. `git branch <name> <sha>` costs nothing and fixes it.'
+
 Add-Item 'no-junctions' 'No junction or symlink inside the tree git manages' $false `
     $(if ($junctionsInTree.Count -eq 0) { 'PASS' } else { 'GAP' }) `
     $(if ($junctionsInTree.Count -eq 0) { 'none outside dependency folders' } else { "$($junctionsInTree.Count): $((@($junctionsInTree | Select-Object -First 3 | ForEach-Object { $_.path })) -join ', ')" }) `

package/bundles/manifest.json

@@ -1,8 +1,8 @@
 {
-  "poolVersion": "1.3.116",
+  "poolVersion": "1.3.119",
   "bundles": {
-    "antigravity-plugin": "1.3.116",
-    "antigravity-plugin-extras": "1.3.36",
+    "antigravity-plugin": "1.3.119",
+    "antigravity-plugin-extras": "1.3.37",
     "codex": "unknown"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caddis/cli",
-  "version": "0.4.28",
+  "version": "0.4.30",
   "description": "Install, update and diagnose the caddis dev harness across every coding agent you use (Claude Code, agy/Antigravity, and more).",
   "keywords": [
     "caddis",