@caddis/cli 0.4.29 → 0.4.32

package/bundles/antigravity-plugin/scripts/new-machine.ps1

@@ -129,7 +129,7 @@ if (Test-Path $statusline) {
     if ($PSCmdlet.ShouldProcess($statusline, 'install')) { python $statusline --install }
 } else {
     Missing "statusline.py not found at $statusline"
-    Note 'It ships with the plugin. Run `/caddis:statusline` in a Claude Code session, or'
+    Note 'It ships with the plugin. Run `/caddis:install-statusline` in a Claude Code session, or'
     Note 'python PLUGIN_ROOT/scripts/caddis_statusline.py --install'
 }
 

package/bundles/antigravity-plugin/scripts/oss_ask.py

@@ -10,7 +10,7 @@ in ~/.caddis/keys.env lights up every lane.
 Usage:
   python oss_ask.py <provider> <prompt...>  [--model M] [--base-url U] [--system S]
 
-Exit codes: 0 answer printed; 2 endpoint/parse error; 3 config error (message on stderr).
+Exit codes: 0 answer printed; 3 could not run due to config; 4 endpoint/parse error.
 """
 from __future__ import annotations
 
@@ -23,18 +23,19 @@ from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import oss_model  # noqa: E402  (same-directory import: shared key resolution)
+import caddis_exit  # noqa: E402
 
 # OpenAI-compatible chat endpoints — intentionally different from oss_model.PROVIDERS,
 # which holds the Anthropic-protocol endpoints for Claude Code.
 CHAT_PROVIDERS: dict[str, dict[str, str]] = {
-    "deepseek":   {"base_url": "https://api.deepseek.com",            "model": "deepseek-v4-flash",          "key_env": "DEEPSEEK_API_KEY"},
+    "deepseek":   {"base_url": "https://api.deepseek.com",            "model": "deepseek-flash",             "key_env": "DEEPSEEK_API_KEY"},
     "glm":        {"base_url": "https://api.z.ai/api/coding/paas/v4", "model": "glm-5.3",                    "key_env": "GLM_API_KEY"},
     "openrouter": {"base_url": "https://openrouter.ai/api/v1",        "model": "deepseek/deepseek-v4-flash", "key_env": "OPENROUTER_API_KEY"},
 }
 
-EXIT_OK = 0
-EXIT_ERROR = 2
-EXIT_CONFIG = 3
+EXIT_OK = caddis_exit.CLEAN
+EXIT_ERROR = caddis_exit.ERROR
+EXIT_CONFIG = caddis_exit.NOT_RUN
 
 
 def resolve_chat_config(provider: str, env: dict[str, str],

package/bundles/antigravity-plugin/scripts/oss_model.py

@@ -43,7 +43,7 @@ from pathlib import Path
 # NEVER put this suffix in the OpenAI-dialect tables (oss_review.py / oss_ask.py): those
 # send the id raw to /chat/completions, which would reject it.
 PROVIDERS: dict[str, dict[str, str]] = {
-    "deepseek":   {"base_url": "https://api.deepseek.com/anthropic",  "model": "deepseek-v4-flash[1m]",          "key_env": "DEEPSEEK_API_KEY"},
+    "deepseek":   {"base_url": "https://api.deepseek.com/anthropic",  "model": "deepseek-flash[1m]",          "key_env": "DEEPSEEK_API_KEY"},
     "glm":        {"base_url": "https://api.z.ai/api/anthropic",      "model": "glm-5.3[1m]",                    "key_env": "GLM_API_KEY"},
     "openrouter": {"base_url": "",                                    "model": "deepseek/deepseek-v4-flash", "key_env": "OPENROUTER_API_KEY"},
 }

package/bundles/antigravity-plugin/scripts/oss_review.py

@@ -18,23 +18,30 @@ vars always win, so you can point at any new id without touching code. Nothing h
 
 Usage:
   python oss_review.py [--range <git range>] [--cwd <repo>] [--provider P] [--base-url U] [--model M]
-    --range   e.g. origin/main..HEAD   (default: the working tree — staged, unstaged AND
-              untracked non-ignored files; a range excludes untracked by design)
+                        [--allow-path GLOB ...]
+    --range        e.g. origin/main..HEAD   (default: the working tree — staged, unstaged AND
+                   untracked non-ignored files; a range excludes untracked by design)
+    --allow-path   repeatable; re-admits a file the pre-send secret filter's deny list would
+                   otherwise drop (see secret_filter.py). `.caddis/config.toml`'s
+                   `[review] deny_paths` / `allow_paths` are layered on the same way.
 
 Exit codes (fail-closed):
   0  REVIEW: CLEAN      — no blocking issues
   1  REVIEW: BLOCKING   — one or more blocking issues
-  2  error              — no diff verdict parsed, git failure, endpoint/parse failure, or the diff
+  2  unused             — advisory is not a review verdict
+  3  misconfigured      — REVIEW_API_KEY missing, OR the pre-send secret filter refused (a
+                          denylisted path / possible secret; see secret_filter.py) — actionable
+                          message on stderr/stdout either way
+  4  error              — no diff verdict parsed, git failure, endpoint/parse failure, or the diff
                           exceeds REVIEW_MAX_DIFF_CHARS (see below — never silently downgraded to CLEAN)
-  3  misconfigured      — REVIEW_API_KEY missing (actionable message on stderr)
 
 Diff-size ceiling: an oversized diff sent to a chat-completions endpoint has been observed, live, to
 come back two different unsafe ways — an empty `content` field on an HTTP 200 (at least fails closed:
-no verdict line ⇒ exit 2), and, worse, a `REVIEW: CLEAN` verdict with no substantive engagement (a
+no verdict line ⇒ exit 4), and, worse, a `REVIEW: CLEAN` verdict with no substantive engagement (a
 silent false negative — the model was overwhelmed, not actually reviewing). Rather than risk the second
 case, a diff over REVIEW_MAX_DIFF_CHARS (default 60,000 chars; override via the env var or
 --max-diff-chars) is SPLIT INTO BATCHES on whole-file boundaries and each batch reviewed separately;
-the verdict is CLEAN only if every batch is clean (aggregation is fail-closed). Exit 2 is now the
+the verdict is CLEAN only if every batch is clean (aggregation is fail-closed). Exit 4 is the
 narrower case: a SINGLE file larger than the ceiling, which cannot be split, or more batches than
 MAX_REVIEW_BATCHES. Refusal was the original behaviour and is kept for those two - a silent false
 CLEAN is the worst outcome this tool has - but it no longer fires on an ordinary large phase diff.
@@ -53,6 +60,12 @@ import urllib.error
 import urllib.request
 from pathlib import Path
 
+# secret_filter.py ships beside this file in every export target (see
+# .github/runtime-targets.json) — import it from THIS script's own folder, not the caller's
+# cwd, so it resolves the same way whether this runs from the source repo or a plugin install.
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import secret_filter  # noqa: E402
+
 # ONE SCALE ACROSS caddis (see claude-harness/README.md):
 #   0 clean · 1 blocked · 2 advisory note · 3 could not run · 4 malformed
 # ERROR moved 2 -> 4 on 2026-09-09. It sat on 2, which caddis_gate uses for "proceed, this is
@@ -69,7 +82,7 @@ EXIT_ERROR = 4      # ran, produced nothing usable: no verdict line, transport f
 # Provider presets — the SINGLE place a renamed model id or moved endpoint is edited. Adding a new
 # provider (Qwen, a local vLLM, …) is one new row. Callers can always bypass this via env/flags.
 PROVIDERS: dict[str, dict[str, str]] = {
-    "deepseek":   {"base_url": "https://api.deepseek.com",            "model": "deepseek-v4-flash"},
+    "deepseek":   {"base_url": "https://api.deepseek.com",            "model": "deepseek-flash"},
     "glm":        {"base_url": "https://api.z.ai/api/coding/paas/v4", "model": "glm-5.3"},
     "openrouter": {"base_url": "https://openrouter.ai/api/v1",        "model": "deepseek/deepseek-v4-flash"},
 }
@@ -272,7 +285,8 @@ def _untracked_diff(path: str, cwd: str) -> str:
     """
     null = "/dev/null" if os.name != "nt" else "NUL"
     out = subprocess.run(
-        ["git", "diff", "--no-index", "--", null, path],
+        ["git", "diff", "--no-color", "--no-ext-diff", "--src-prefix=a/",
+         "--dst-prefix=b/", "--no-index", "--", null, path],
         cwd=cwd, capture_output=True, text=True,
         encoding="utf-8", errors="replace", timeout=30,
     )
@@ -295,7 +309,8 @@ def get_diff(rng: str | None, cwd: str, include_untracked: bool = True) -> str:
     Untracked files are NOT included for an explicit `rng` — a commit range is a span of
     history, and files that were never committed are correctly outside it.
     """
-    cmd = ["git", "diff", rng] if rng else ["git", "diff", "HEAD"]
+    cmd = ["git", "diff", "--no-color", "--no-ext-diff", "--src-prefix=a/",
+           "--dst-prefix=b/", rng or "HEAD"]
     # encoding pinned to UTF-8: git emits UTF-8, but text=True would decode with the locale
     # codepage (cp1252 on Windows) — a non-ASCII diff then kills the reader thread and
     # subprocess hands back stdout=None with returncode 0.
@@ -483,6 +498,29 @@ def _force_utf8_stdio() -> None:
             pass
 
 
+def _config_is_changed(diff_text: str) -> bool:
+    """True when either side of a changed file block names the review config."""
+    target = ".caddis/config.toml"
+    for block in secret_filter._split_into_file_blocks(diff_text):
+        for line in block.splitlines():
+            if line.startswith("@@"):
+                break
+            if line in (f"--- a/{target}", f"+++ b/{target}",
+                        f"rename from {target}", f"rename to {target}"):
+                return True
+            if line.startswith("diff --git "):
+                rest = line[len("diff --git "):]
+                quoted = secret_filter._QUOTED_HEADER_RE.match(rest)
+                if quoted:
+                    sides = (secret_filter._unescape_git_quoted(part)
+                             for part in quoted.groups())
+                    if any(side in (f"a/{target}", f"b/{target}") for side in sides):
+                        return True
+                elif rest.startswith(f"a/{target} b/") or rest.endswith(f" b/{target}"):
+                    return True
+    return False
+
+
 def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> int:
     _force_utf8_stdio()
     env = os.environ if env is None else env
@@ -499,6 +537,10 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
     parser.add_argument("--check-config", action="store_true",
                         help="report whether a usable key exists and exit — no diff, no LLM call. "
                              "Exit 0 = ready, 3 = nothing configured.")
+    parser.add_argument("--allow-path", dest="allow_path", action="append", default=[],
+                        metavar="GLOB",
+                        help="re-admit a file the secret-filter deny list would otherwise drop "
+                             "(repeatable)")
     args = parser.parse_args(argv)
 
     # --check-config is deliberately NON-INTERACTIVE. This script runs headless — from CI, from a
@@ -519,6 +561,39 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
         print(f"cross-review is ready. Providers with a key: {', '.join(available)}")
         return EXIT_CLEAN
 
+    try:
+        diff_text = get_diff(args.range, args.cwd)
+    except Exception as exc:
+        sys.stderr.write(f"could not read diff: {exc}\n")
+        return EXIT_ERROR
+
+    # Pre-send secret filter — runs on the FULL diff, before it is ever split into batches and
+    # before any provider is contacted, and BEFORE provider/key resolution below: a missing or
+    # misconfigured REVIEW_API_KEY must never race a secret refusal and print the wrong reason.
+    # A run with no key configured at all still refuses here first, on the merits, not because
+    # it couldn't have called anyone anyway.
+    cfg_deny, cfg_allow = secret_filter.load_config(Path(args.cwd))
+    if _config_is_changed(diff_text):
+        cfg_deny = list(dict.fromkeys(cfg_deny + secret_filter.load_head_deny_paths(Path(args.cwd))))
+        cfg_allow = []
+        print("note: .caddis/config.toml is part of this change; its allow_paths are ignored")
+    filter_result = secret_filter.filter_diff(
+        diff_text,
+        secret_filter.DEFAULT_DENY_GLOBS + cfg_deny,
+        cfg_allow + list(args.allow_path),
+    )
+    if filter_result.hits:
+        print("REVIEW: REFUSED — possible secrets:")
+        for hit_path, hit_line, hit_rule in filter_result.hits:
+            print(f"  {hit_path}:{hit_line} ({hit_rule})")
+        return EXIT_CONFIG
+    if filter_result.dropped_paths:
+        print(f"excluded from review: {', '.join(filter_result.dropped_paths)}")
+    if not filter_result.kept_diff.strip() and filter_result.dropped_paths:
+        print("REVIEW: REFUSED — every changed file is excluded")
+        return EXIT_CONFIG
+    diff_text = filter_result.kept_diff
+
     try:
         base_url, api_key, model = resolve_config(args, env)
         primary_provider = (
@@ -528,12 +603,6 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
         sys.stderr.write(f"{exc}\n")
         return EXIT_CONFIG
 
-    try:
-        diff_text = get_diff(args.range, args.cwd)
-    except Exception as exc:
-        sys.stderr.write(f"could not read diff: {exc}\n")
-        return EXIT_ERROR
-
     if not diff_text.strip():
         # Says what was scanned, not just that nothing was found. This branch used to fire
         # on a tree full of NEW files (they are invisible to `git diff HEAD`) and report

package/bundles/antigravity-plugin/scripts/secret_filter.py

@@ -0,0 +1,316 @@
+#!/usr/bin/env python3
+"""Pre-send secret filter for `oss_review.py`.
+
+Everything `oss_review.py` sends to an external review vendor (DeepSeek/GLM/OpenRouter/etc.)
+passes through `filter_diff()` first. It does two independent things, both fail-closed:
+
+1. **Path denylist** — a whole file's diff block is dropped when its path matches a deny glob
+   (`.env`, `secrets.yaml`, `id_rsa`, a private key, ...) and no allow glob re-admits it. This
+   is silent-by-default: the file simply never reaches the model, and the caller is told which
+   paths were excluded so the drop is visible, not invisible.
+2. **Content rules** — every hunk line of a file that was NOT dropped is scanned against
+   `SECRET_RULES` (AWS keys, GitHub/Slack tokens, JWTs, PEM private keys, `key = "..."`-shaped
+   assignments). A hit refuses the ENTIRE review (not just that file) — a secret slipping past
+   the path denylist is exactly the case this second layer exists for, and the safe response to
+   "something here looks like a credential" is "send nothing", not "guess which part is safe".
+
+Deliberately out of scope, by design (see the plan's "Design (decided)"):
+  - Removed-line hits use old-file line numbers and are marked `removed line`.
+  - `+++`/`---` file headers never fire because they precede the first hunk.
+  - Content rules run only on files the path denylist did NOT already drop; a dropped file's
+    block is never scanned (nothing in it reaches the model either way).
+
+Nothing here ever prints a matched secret value: hits are reported as (path, line, rule name)
+only. Stdlib-only (`tomllib` needs Python 3.11+, matching the rest of caddis's `.github/tools/`).
+"""
+from __future__ import annotations
+
+import fnmatch
+import re
+import subprocess
+import tomllib
+from dataclasses import dataclass, field
+from pathlib import Path
+
+# ── path denylist ─────────────────────────────────────────────────────────────
+#
+# fnmatch's `*` matches `/` too (it is not a directory-aware glob), which cuts both ways and
+# is the reason for the paired entries below:
+#   - "*.pem" / "*.key" / "*.pfx" / "*.p12" already match at ANY depth (root or nested) because
+#     the leading `*` freely absorbs any prefix, slashes included.
+#   - ".env" (a literal, no wildcard) matches ONLY a root ".env" — fnmatch requires an exact
+#     whole-string match when there is no wildcard, and "config/.env" is a different string.
+#   - "**/.env" matches ONLY a nested path — translated to a regex it requires a literal "/"
+#     immediately before ".env", so a root ".env" (no slash anywhere) does NOT match it.
+#   - "id_rsa*" / "secrets.*" / "keys.env" are anchored at the start of the string (no leading
+#     wildcard), so — like ".env" — they match only at the repo root; "**/id_rsa*" etc. cover
+#     the nested case.
+# Every root-only pattern therefore needs an explicit "**/" sibling, or a nested secret file
+# of that shape is invisible to this filter. Verified live, not assumed — see
+# scripts/tests/test_secret_filter.py.
+DEFAULT_DENY_GLOBS: list[str] = [
+    ".env", ".env.*", "**/.env", "**/.env.*",
+    "*.pem", "*.key", "*.pfx", "*.p12",
+    "id_rsa*", "**/id_rsa*",
+    "secrets.*", "**/secrets.*",
+    "keys.env", "**/keys.env",
+]
+
+# `.env.example` / `.env.sample` / `.env.template` / `.env.dist` are template files with no
+# real values in them and are conventionally committed and reviewed like any other source file.
+# Checked BEFORE the deny glob match, so it wins even though ".env.*" would otherwise catch it.
+ENV_EXAMPLE = re.compile(r"\.env\.(example|sample|template|dist)$", re.I)
+
+# ── content rules ───────────────────────────────────────────────────────────
+#
+# Each pattern is checked against the content of each changed line in a kept file.
+SECRET_RULES: list[tuple[str, re.Pattern]] = [
+    ("private-key", re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")),
+    ("aws-key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
+    ("github-token", re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,}\b")),
+    ("slack-token", re.compile(r"\bxox[abprs]-[A-Za-z0-9-]{10,}\b")),
+    ("jwt", re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b")),
+    ("assignment", re.compile(
+        r"(?i)[A-Za-z0-9_]*(password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*\s*[:=]\s*['\"](?P<value>[^'\"\s]{8,})['\"]"
+    )),
+    ("env-assignment", re.compile(
+        r"^\s*(?:export\s+)?[A-Za-z0-9_]*(?:PASSWORD|PASSWD|SECRET|API_KEY|APIKEY|TOKEN|PRIVATE_KEY)"
+        r"[A-Za-z0-9_]*\s*=\s*(?P<value>[^\s'\"#]{8,})", re.I
+    )),
+]
+
+
+def _is_placeholder(value: str) -> bool:
+    """Exclude obvious template values from both assignment rules."""
+    lowered = value.lower()
+    return (
+        lowered in {"your_key_here", "your-api-key", "changeme", "placeholder", "example"}
+        or bool(re.fullmatch(r"x+", lowered))
+        or bool(re.fullmatch(r"<[^>]*>", value))
+        or bool(re.fullmatch(r"\$\{[^}]*\}", value))
+        or bool(re.fullmatch(r"\$[A-Za-z_][A-Za-z0-9_]*", value))
+        or value.startswith("***")
+        or lowered.startswith(("your_", "your-"))
+    )
+
+
+@dataclass
+class FilterResult:
+    kept_diff: str
+    dropped_paths: list[str] = field(default_factory=list)
+    hits: list[tuple[str, int, str]] = field(default_factory=list)  # (path, side's line, rule/removed marker)
+
+
+# A new file block starts at a line beginning "diff --git a/..." (the common, unquoted case)
+# or "diff --git "a/..." (git double-quotes a path that needs escaping — spaces alone do NOT
+# trigger quoting, but non-ASCII characters, embedded quotes/backslashes, and control
+# characters do). Matched at line start only, never mid-line.
+_BLOCK_START_RE = re.compile(r'^diff --git (?:"|a/)')
+
+# The common (non-rename) case: "diff --git a/<P> b/<P>" with the OLD and NEW path identical.
+# A backreference handles a path containing spaces correctly (the naive "split on ' b/'"
+# approach is ambiguous when the path itself contains " b/"-shaped substrings and can't tell
+# unquoted-with-a-space apart from a genuine rename without this).
+_IDENTICAL_HEADER_RE = re.compile(r'^a/(.+) b/\1$')
+
+# Both sides double-quoted (git always quotes both together, never just one).
+_QUOTED_HEADER_RE = re.compile(r'^"((?:[^"\\]|\\.)*)" "((?:[^"\\]|\\.)*)"$')
+
+_HUNK_RE = re.compile(r'^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@')
+
+
+def _unescape_git_quoted(s: str) -> str:
+    """Undo git's C-style quoting: \\", \\\\, \\t, \\n, and \\NNN octal byte escapes.
+
+    git quotes a path by escaping each byte that needs it; multi-byte (UTF-8) characters come
+    out as a run of \\NNN octal escapes, one per byte, so the escapes are collected as raw
+    bytes and decoded as UTF-8 at the end rather than character-by-character.
+    """
+    out = bytearray()
+    i, n = 0, len(s)
+    while i < n:
+        c = s[i]
+        if c == "\\" and i + 1 < n:
+            nxt = s[i + 1]
+            if nxt in ('"', "\\"):
+                out.append(ord(nxt))
+                i += 2
+            elif nxt == "n":
+                out.append(10)
+                i += 2
+            elif nxt == "t":
+                out.append(9)
+                i += 2
+            elif "0" <= nxt <= "7":
+                j, digits = i + 1, 0
+                val = 0
+                while j < n and digits < 3 and "0" <= s[j] <= "7":
+                    val = val * 8 + int(s[j])
+                    j += 1
+                    digits += 1
+                out.append(val & 0xFF)
+                i = j
+            else:
+                out.append(ord(nxt))
+                i += 2
+        else:
+            out.extend(c.encode("utf-8", "surrogatepass"))
+            i += 1
+    return out.decode("utf-8", "replace")
+
+
+def _extract_paths(header_line: str) -> tuple[str | None, str | None]:
+    """Return old and new paths from a git diff header."""
+    line = header_line.rstrip("\r\n")
+    if not line.startswith("diff --git "):
+        return (None, None)
+    rest = line[len("diff --git "):]
+    m = _QUOTED_HEADER_RE.match(rest)
+    if m:
+        a_path, b_path = (_unescape_git_quoted(part) for part in m.groups())
+        return (a_path[2:] if a_path.startswith("a/") else a_path,
+                b_path[2:] if b_path.startswith("b/") else b_path)
+    m = _IDENTICAL_HEADER_RE.match(rest)
+    if m:
+        return (m.group(1), m.group(1))
+    # Rename/copy to a genuinely different, unquoted path: paths with spaces are ambiguous
+    # here in principle, but git does not quote for a space alone, so this is best-effort for
+    # the common no-space rename case (e.g. "diff --git a/x b/.env").
+    idx = rest.rfind(" b/")
+    if idx != -1:
+        return (rest[2:idx], rest[idx + 3:])
+    return (None, None)
+
+
+def _extract_new_path(header_line: str) -> str | None:
+    return _extract_paths(header_line)[1]
+
+
+def _split_into_file_blocks(diff_text: str) -> list[str]:
+    if not diff_text:
+        return []
+    blocks: list[str] = []
+    current: list[str] = []
+    for line in diff_text.splitlines(keepends=True):
+        if _BLOCK_START_RE.match(line) and current:
+            blocks.append("".join(current))
+            current = [line]
+        else:
+            current.append(line)
+    if current:
+        blocks.append("".join(current))
+    return blocks
+
+
+def _is_denied(path: str, deny_globs: list[str], allow_globs: list[str]) -> bool:
+    if ENV_EXAMPLE.search(path):
+        return False
+    # fnmatchcase, not fnmatch: fnmatch() runs os.path.normcase() first, which on Windows
+    # lowercases AND rewrites "/" to "\\" — silently breaking every POSIX-style glob above.
+    # fnmatchcase never touches the string, so matching is identical on every OS.
+    if not any(fnmatch.fnmatchcase(path, glob) for glob in deny_globs):
+        return False
+    return not any(fnmatch.fnmatchcase(path, glob) for glob in allow_globs)
+
+
+def _scan_added_lines(block: str, path: str) -> list[tuple[str, int, str]]:
+    """Scan all hunk lines; removed hits use old-file line numbers."""
+    hits: list[tuple[str, int, str]] = []
+    new_line: int | None = None
+    old_line: int | None = None
+    for line in block.splitlines():
+        m = _HUNK_RE.match(line)
+        if m:
+            old_line, new_line = int(m.group(1)), int(m.group(2))
+            continue
+        if new_line is None:
+            continue  # still in the file header (index/mode/---/+++ lines), before any hunk
+        if line.startswith("\\"):
+            continue  # "" — not a line, does not advance the count
+        if line.startswith(("+", "-", " ")):
+            content = line[1:]
+            removed = line.startswith("-")
+            context = line.startswith(" ")
+            for rule_name, pattern in SECRET_RULES:
+                match = pattern.search(content)
+                if match and not (rule_name in {"assignment", "env-assignment"}
+                                  and _is_placeholder(match.group("value"))) and not (
+                                      rule_name == "env-assignment" and
+                                      re.fullmatch(r"[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+",
+                                                   match.group("value"))):
+                    marker = (f"{rule_name}, removed line" if removed else
+                              f"{rule_name}, context line" if context else rule_name)
+                    hits.append((path, old_line if removed else new_line, marker))
+            if removed:
+                old_line += 1
+            elif not context:
+                new_line += 1
+            else:
+                old_line += 1
+                new_line += 1
+        else:
+            old_line += 1
+            new_line += 1  # context line exists in both files
+    return hits
+
+
+def filter_diff(diff_text: str, deny_globs: list[str], allow_globs: list[str]) -> FilterResult:
+    """Drop denylisted-path file blocks, then scan changed lines in kept blocks."""
+    dropped_paths: list[str] = []
+    hits: list[tuple[str, int, str]] = []
+    kept_parts: list[str] = []
+    for block in _split_into_file_blocks(diff_text):
+        first_line = block.splitlines()[0] if block else ""
+        old_path, new_path = _extract_paths(first_line)
+        path = new_path or old_path or "(unparseable path)"
+        denied = next((candidate for candidate in (old_path, new_path)
+                       if candidate and _is_denied(candidate, deny_globs, allow_globs)), None)
+        if denied:
+            dropped_paths.append(denied)
+            continue
+        hits.extend(_scan_added_lines(block, path))
+        kept_parts.append(block)
+    return FilterResult(kept_diff="".join(kept_parts), dropped_paths=dropped_paths, hits=hits)
+
+
+def load_config(repo: Path) -> tuple[list[str], list[str]]:
+    """`[review] deny_paths` / `allow_paths` from `<repo>/.caddis/config.toml`.
+
+    A missing file, a missing `[review]` table, or a malformed TOML file all yield `([], [])`
+    — this is additive configuration layered onto DEFAULT_DENY_GLOBS, never the sole source of
+    truth, so failing to read it must never silently widen what gets sent.
+    """
+    cfg_path = Path(repo) / ".caddis" / "config.toml"
+    if not cfg_path.is_file():
+        return ([], [])
+    try:
+        with cfg_path.open("rb") as f:
+            return _parse_config(f.read())
+    except (tomllib.TOMLDecodeError, OSError, UnicodeError):
+        return ([], [])
+
+
+def _parse_config(contents: bytes) -> tuple[list[str], list[str]]:
+    data = tomllib.loads(contents.decode("utf-8"))
+    review = data.get("review") if isinstance(data, dict) else None
+    if not isinstance(review, dict):
+        return ([], [])
+    deny = review.get("deny_paths", [])
+    allow = review.get("allow_paths", [])
+    deny_out = [str(p) for p in deny] if isinstance(deny, list) else []
+    allow_out = [str(p) for p in allow] if isinstance(allow, list) else []
+    return (deny_out, allow_out)
+
+
+def load_head_deny_paths(repo: Path) -> list[str]:
+    """Read the committed deny list; a missing or unreadable HEAD config contributes nothing."""
+    try:
+        out = subprocess.run(
+            ["git", "show", "HEAD:.caddis/config.toml"], cwd=repo,
+            capture_output=True, timeout=30,
+        )
+        if out.returncode == 0:
+            return _parse_config(out.stdout)[0]
+    except (OSError, subprocess.TimeoutExpired, UnicodeError, tomllib.TOMLDecodeError):
+        pass
+    return []

package/bundles/antigravity-plugin/scripts/setup_project_ai.py

@@ -291,6 +291,10 @@ def merge_settings(target: Path, stack: dict, dry: bool) -> str:
             if a not in ex_allow:
                 ex_allow.append(a)
         existing.setdefault("permissions", {})["allow"] = ex_allow
+        ex_deny = existing["permissions"].setdefault("deny", [])
+        for rule in base["permissions"]["deny"]:
+            if rule not in ex_deny:
+                ex_deny.append(rule)
         # Self-heal: prune legacy harness-injected `ask` rules that override bypassPermissions.
         ex_ask = existing["permissions"].get("ask", [])
         pruned_ask = [a for a in ex_ask if a not in _LEGACY_HARNESS_ASK]
@@ -308,7 +312,7 @@ def merge_settings(target: Path, stack: dict, dry: bool) -> str:
     else:
         base["permissions"]["allow"] = allow
         # No statusLine here on purpose: it is user-scope now, installed once per machine
-        # by `/caddis:statusline`. A per-project copy is exactly how four status-line
+        # by `/caddis:install-statusline`. A per-project copy is exactly how four status-line
         # scripts came to exist and drift apart.
         out = base
         verb = "write"
@@ -799,7 +803,7 @@ items?" has no answer when one state has three spellings.
 | Not this | Where it goes | Why |
 |---|---|---|
 | Work in flight right now | `.caddis/plans/<feature>.md` | A plan is being executed. A parking-lot item is not. |
-| A task interrupted mid-session | `/caddis:digress` stack | That is a pause, not a backlog item. `/caddis:resume` pops it. |
+| A task interrupted mid-session | `/caddis:digress` stack | That is a pause, not a backlog item. `/caddis:catchup` pops it. |
 | An ask only an outsider can resolve | `.caddis/comms/register.md` | Blocked on a human, not on us. |
 | Board cards | `.caddis/backlog/` | **docket writes that directory.** It is a projection of the board, not a hand-written register. Never edit it by hand. |
 
@@ -910,6 +914,7 @@ session-state.md
 session-state/
 context-window.json
 PROJECT-FACTS.md
+# retired writer; ignored so old files stay untracked
 memory.jsonl
 """
 
@@ -1178,7 +1183,7 @@ def scaffold_artifact_dir(target: Path, dry: bool) -> list[str]:
 
     Committed subdirs: plans, handoffs, agent-docs, prd, kb, prompts, comms. Transient state
     (reviews/*.html, usage-log.jsonl, .last-usage-review, relay*, session-state.md,
-    PROJECT-FACTS.md, memory.jsonl) is gitignored. .caddis/ is the default home for every working-artifact kind (Track A
+    PROJECT-FACTS.md) is gitignored. .caddis/ is the default home for every working-artifact kind (Track A
     Phase A3) — kb/ and prompts/ round out plans/prd/agent-docs/reviews so nothing has to
     scatter to the repo root or .github/. Also drops a documented `config.toml.example`
     (guard/doc_coverage). Idempotent. An existing .caddis/.gitignore is never clobbered or
@@ -1493,7 +1498,7 @@ def main() -> int:
     print(f"   {merge_settings(target, stack, args.dry_run)}")
 
     print("-- status line")
-    print("   user-scope now — run /caddis:statusline once per machine (not per project)")
+    print("   user-scope now — run /caddis:install-statusline once per machine (not per project)")
 
     print("-- git hooks")
     for line in install_git_hooks(target, args.force, args.dry_run):

package/bundles/antigravity-plugin/skills/_registry.md

@@ -85,6 +85,7 @@
 | Glossary | `glossary/` | Define the words this project invented, in one place — .caddis/kb/GLOSSARY.md |
 | Handoff | `handoff/` | End-of-session handoff — capture exact state so the next session resumes with zero re-discovery |
 | Implement | `implement/` | Headless plan executor — implement an approved plan phase-by-phase on the current feature branch, TDD-first, committing per phase |
+| Install Statusline | `install-statusline/` | Install the caddis status line into Claude Code and agy — one renderer, once per machine |
 | Kb | `kb/` | Rebuild the KB index (.caddis/kb/DOC-MAP.md) — create it if missing, index un-indexed notes, report dangling links |
 | Mermaid Db | `mermaid-db/` | Turn a SQL artifact (proc, view, query, .sql file, or table name) into a Mermaid diagram that explains it — git-diffable, saved as .md |
 | Migrate Dir | `migrate-dir/` | Rename this repo's legacy `.claudster/` artifact dir to `.caddis/` — dry-run first, `git mv` to keep history, merges a straggler dir, rewrites live refs. Opt-in, never automatic. |
@@ -92,14 +93,15 @@
 | Park | `park/` | File a future-work item in the one backlog — .caddis/parking-lot/ — or list what is open |
 | Pr Merge | `pr-merge/` | End-to-end pull request and merge lane — push feature branch, open or update PR, monitor CI to green, merge to default branch, and clean up the feature branch. |
 | Prd | `prd/` | Capture requirements through structured discovery and write a PRD |
-| Resume | `resume/` | Pop the most recently parked workstream off the stack and resume it at its exact resume point |
-| Review | `review/` | Review someone else's OPEN pull request end to end — what changed, what CI says, what is risky — then approve or request changes. Never approves on its own. |
+| Resume | `resume/` | Renamed to /caddis:catchup (alias, removed next release) |
+| Review | `review/` | Renamed to /caddis:review-pr (alias, removed next release) |
+| Review Pr | `review-pr/` | Review someone else's OPEN pull request end to end — what changed, what CI says, what is risky — then approve or request changes. Never approves on its own. |
 | Ship | `ship/` | Commit, push, and monitor the deploy pipeline (auto-detects Gitea, GitHub Actions, or local-only) |
 | Ship Merge | `ship-merge/` | Merge an already-green, already-reviewed PR behind an explicit deploy-confirm, monitor the deploy, validate prod, then clean up the branch — only on green. |
 | Ship Pr | `ship-pr/` | Open a reviewed PR for the current feature branch — rebase-safe push, PR create/update, monitor CI, STOP at green. Never merges, never deploys (that's /ship-merge). |
 | Spawn Hub | `spawn-hub/` | Hand the Advisory Hub role to a fresh session — run the mechanical audit, then generate the succession prompt with a context self-check the new Hub must pass |
 | Spawn Session | `spawn-session/` | Hand the WORK to a fresh session — generate the handover from the repo, then validate the successor by re-deriving its answers |
-| Statusline | `statusline/` | Install the caddis status line into Claude Code and agy — one renderer, once per machine |
+| Statusline | `statusline/` | Renamed to /caddis:install-statusline (alias, removed next release) |
 | Tdd | `tdd/` | Run a strict red-green-refactor TDD cycle for a unit of behavior |
 | Ui Brief | `ui-brief/` | Design-first UI brief — lock the aesthetic before writing any code |
 | Usage Review | `usage-review/` | Review local caddis usage over a window, surface prioritised recommendations, and apply config changes in one step |