@caddis/cli 0.4.30 → 0.4.32

package/bundles/antigravity-plugin/scripts/secret_filter.py

@@ -0,0 +1,316 @@
+#!/usr/bin/env python3
+"""Pre-send secret filter for `oss_review.py`.
+
+Everything `oss_review.py` sends to an external review vendor (DeepSeek/GLM/OpenRouter/etc.)
+passes through `filter_diff()` first. It does two independent things, both fail-closed:
+
+1. **Path denylist** — a whole file's diff block is dropped when its path matches a deny glob
+   (`.env`, `secrets.yaml`, `id_rsa`, a private key, ...) and no allow glob re-admits it. This
+   is silent-by-default: the file simply never reaches the model, and the caller is told which
+   paths were excluded so the drop is visible, not invisible.
+2. **Content rules** — every hunk line of a file that was NOT dropped is scanned against
+   `SECRET_RULES` (AWS keys, GitHub/Slack tokens, JWTs, PEM private keys, `key = "..."`-shaped
+   assignments). A hit refuses the ENTIRE review (not just that file) — a secret slipping past
+   the path denylist is exactly the case this second layer exists for, and the safe response to
+   "something here looks like a credential" is "send nothing", not "guess which part is safe".
+
+Deliberately out of scope, by design (see the plan's "Design (decided)"):
+  - Removed-line hits use old-file line numbers and are marked `removed line`.
+  - `+++`/`---` file headers never fire because they precede the first hunk.
+  - Content rules run only on files the path denylist did NOT already drop; a dropped file's
+    block is never scanned (nothing in it reaches the model either way).
+
+Nothing here ever prints a matched secret value: hits are reported as (path, line, rule name)
+only. Stdlib-only (`tomllib` needs Python 3.11+, matching the rest of caddis's `.github/tools/`).
+"""
+from __future__ import annotations
+
+import fnmatch
+import re
+import subprocess
+import tomllib
+from dataclasses import dataclass, field
+from pathlib import Path
+
+# ── path denylist ─────────────────────────────────────────────────────────────
+#
+# fnmatch's `*` matches `/` too (it is not a directory-aware glob), which cuts both ways and
+# is the reason for the paired entries below:
+#   - "*.pem" / "*.key" / "*.pfx" / "*.p12" already match at ANY depth (root or nested) because
+#     the leading `*` freely absorbs any prefix, slashes included.
+#   - ".env" (a literal, no wildcard) matches ONLY a root ".env" — fnmatch requires an exact
+#     whole-string match when there is no wildcard, and "config/.env" is a different string.
+#   - "**/.env" matches ONLY a nested path — translated to a regex it requires a literal "/"
+#     immediately before ".env", so a root ".env" (no slash anywhere) does NOT match it.
+#   - "id_rsa*" / "secrets.*" / "keys.env" are anchored at the start of the string (no leading
+#     wildcard), so — like ".env" — they match only at the repo root; "**/id_rsa*" etc. cover
+#     the nested case.
+# Every root-only pattern therefore needs an explicit "**/" sibling, or a nested secret file
+# of that shape is invisible to this filter. Verified live, not assumed — see
+# scripts/tests/test_secret_filter.py.
+DEFAULT_DENY_GLOBS: list[str] = [
+    ".env", ".env.*", "**/.env", "**/.env.*",
+    "*.pem", "*.key", "*.pfx", "*.p12",
+    "id_rsa*", "**/id_rsa*",
+    "secrets.*", "**/secrets.*",
+    "keys.env", "**/keys.env",
+]
+
+# `.env.example` / `.env.sample` / `.env.template` / `.env.dist` are template files with no
+# real values in them and are conventionally committed and reviewed like any other source file.
+# Checked BEFORE the deny glob match, so it wins even though ".env.*" would otherwise catch it.
+ENV_EXAMPLE = re.compile(r"\.env\.(example|sample|template|dist)$", re.I)
+
+# ── content rules ───────────────────────────────────────────────────────────
+#
+# Each pattern is checked against the content of each changed line in a kept file.
+SECRET_RULES: list[tuple[str, re.Pattern]] = [
+    ("private-key", re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")),
+    ("aws-key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
+    ("github-token", re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,}\b")),
+    ("slack-token", re.compile(r"\bxox[abprs]-[A-Za-z0-9-]{10,}\b")),
+    ("jwt", re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b")),
+    ("assignment", re.compile(
+        r"(?i)[A-Za-z0-9_]*(password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*\s*[:=]\s*['\"](?P<value>[^'\"\s]{8,})['\"]"
+    )),
+    ("env-assignment", re.compile(
+        r"^\s*(?:export\s+)?[A-Za-z0-9_]*(?:PASSWORD|PASSWD|SECRET|API_KEY|APIKEY|TOKEN|PRIVATE_KEY)"
+        r"[A-Za-z0-9_]*\s*=\s*(?P<value>[^\s'\"#]{8,})", re.I
+    )),
+]
+
+
+def _is_placeholder(value: str) -> bool:
+    """Exclude obvious template values from both assignment rules."""
+    lowered = value.lower()
+    return (
+        lowered in {"your_key_here", "your-api-key", "changeme", "placeholder", "example"}
+        or bool(re.fullmatch(r"x+", lowered))
+        or bool(re.fullmatch(r"<[^>]*>", value))
+        or bool(re.fullmatch(r"\$\{[^}]*\}", value))
+        or bool(re.fullmatch(r"\$[A-Za-z_][A-Za-z0-9_]*", value))
+        or value.startswith("***")
+        or lowered.startswith(("your_", "your-"))
+    )
+
+
+@dataclass
+class FilterResult:
+    kept_diff: str
+    dropped_paths: list[str] = field(default_factory=list)
+    hits: list[tuple[str, int, str]] = field(default_factory=list)  # (path, side's line, rule/removed marker)
+
+
+# A new file block starts at a line beginning "diff --git a/..." (the common, unquoted case)
+# or "diff --git "a/..." (git double-quotes a path that needs escaping — spaces alone do NOT
+# trigger quoting, but non-ASCII characters, embedded quotes/backslashes, and control
+# characters do). Matched at line start only, never mid-line.
+_BLOCK_START_RE = re.compile(r'^diff --git (?:"|a/)')
+
+# The common (non-rename) case: "diff --git a/<P> b/<P>" with the OLD and NEW path identical.
+# A backreference handles a path containing spaces correctly (the naive "split on ' b/'"
+# approach is ambiguous when the path itself contains " b/"-shaped substrings and can't tell
+# unquoted-with-a-space apart from a genuine rename without this).
+_IDENTICAL_HEADER_RE = re.compile(r'^a/(.+) b/\1$')
+
+# Both sides double-quoted (git always quotes both together, never just one).
+_QUOTED_HEADER_RE = re.compile(r'^"((?:[^"\\]|\\.)*)" "((?:[^"\\]|\\.)*)"$')
+
+_HUNK_RE = re.compile(r'^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@')
+
+
+def _unescape_git_quoted(s: str) -> str:
+    """Undo git's C-style quoting: \\", \\\\, \\t, \\n, and \\NNN octal byte escapes.
+
+    git quotes a path by escaping each byte that needs it; multi-byte (UTF-8) characters come
+    out as a run of \\NNN octal escapes, one per byte, so the escapes are collected as raw
+    bytes and decoded as UTF-8 at the end rather than character-by-character.
+    """
+    out = bytearray()
+    i, n = 0, len(s)
+    while i < n:
+        c = s[i]
+        if c == "\\" and i + 1 < n:
+            nxt = s[i + 1]
+            if nxt in ('"', "\\"):
+                out.append(ord(nxt))
+                i += 2
+            elif nxt == "n":
+                out.append(10)
+                i += 2
+            elif nxt == "t":
+                out.append(9)
+                i += 2
+            elif "0" <= nxt <= "7":
+                j, digits = i + 1, 0
+                val = 0
+                while j < n and digits < 3 and "0" <= s[j] <= "7":
+                    val = val * 8 + int(s[j])
+                    j += 1
+                    digits += 1
+                out.append(val & 0xFF)
+                i = j
+            else:
+                out.append(ord(nxt))
+                i += 2
+        else:
+            out.extend(c.encode("utf-8", "surrogatepass"))
+            i += 1
+    return out.decode("utf-8", "replace")
+
+
+def _extract_paths(header_line: str) -> tuple[str | None, str | None]:
+    """Return old and new paths from a git diff header."""
+    line = header_line.rstrip("\r\n")
+    if not line.startswith("diff --git "):
+        return (None, None)
+    rest = line[len("diff --git "):]
+    m = _QUOTED_HEADER_RE.match(rest)
+    if m:
+        a_path, b_path = (_unescape_git_quoted(part) for part in m.groups())
+        return (a_path[2:] if a_path.startswith("a/") else a_path,
+                b_path[2:] if b_path.startswith("b/") else b_path)
+    m = _IDENTICAL_HEADER_RE.match(rest)
+    if m:
+        return (m.group(1), m.group(1))
+    # Rename/copy to a genuinely different, unquoted path: paths with spaces are ambiguous
+    # here in principle, but git does not quote for a space alone, so this is best-effort for
+    # the common no-space rename case (e.g. "diff --git a/x b/.env").
+    idx = rest.rfind(" b/")
+    if idx != -1:
+        return (rest[2:idx], rest[idx + 3:])
+    return (None, None)
+
+
+def _extract_new_path(header_line: str) -> str | None:
+    return _extract_paths(header_line)[1]
+
+
+def _split_into_file_blocks(diff_text: str) -> list[str]:
+    if not diff_text:
+        return []
+    blocks: list[str] = []
+    current: list[str] = []
+    for line in diff_text.splitlines(keepends=True):
+        if _BLOCK_START_RE.match(line) and current:
+            blocks.append("".join(current))
+            current = [line]
+        else:
+            current.append(line)
+    if current:
+        blocks.append("".join(current))
+    return blocks
+
+
+def _is_denied(path: str, deny_globs: list[str], allow_globs: list[str]) -> bool:
+    if ENV_EXAMPLE.search(path):
+        return False
+    # fnmatchcase, not fnmatch: fnmatch() runs os.path.normcase() first, which on Windows
+    # lowercases AND rewrites "/" to "\\" — silently breaking every POSIX-style glob above.
+    # fnmatchcase never touches the string, so matching is identical on every OS.
+    if not any(fnmatch.fnmatchcase(path, glob) for glob in deny_globs):
+        return False
+    return not any(fnmatch.fnmatchcase(path, glob) for glob in allow_globs)
+
+
+def _scan_added_lines(block: str, path: str) -> list[tuple[str, int, str]]:
+    """Scan all hunk lines; removed hits use old-file line numbers."""
+    hits: list[tuple[str, int, str]] = []
+    new_line: int | None = None
+    old_line: int | None = None
+    for line in block.splitlines():
+        m = _HUNK_RE.match(line)
+        if m:
+            old_line, new_line = int(m.group(1)), int(m.group(2))
+            continue
+        if new_line is None:
+            continue  # still in the file header (index/mode/---/+++ lines), before any hunk
+        if line.startswith("\\"):
+            continue  # "" — not a line, does not advance the count
+        if line.startswith(("+", "-", " ")):
+            content = line[1:]
+            removed = line.startswith("-")
+            context = line.startswith(" ")
+            for rule_name, pattern in SECRET_RULES:
+                match = pattern.search(content)
+                if match and not (rule_name in {"assignment", "env-assignment"}
+                                  and _is_placeholder(match.group("value"))) and not (
+                                      rule_name == "env-assignment" and
+                                      re.fullmatch(r"[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+",
+                                                   match.group("value"))):
+                    marker = (f"{rule_name}, removed line" if removed else
+                              f"{rule_name}, context line" if context else rule_name)
+                    hits.append((path, old_line if removed else new_line, marker))
+            if removed:
+                old_line += 1
+            elif not context:
+                new_line += 1
+            else:
+                old_line += 1
+                new_line += 1
+        else:
+            old_line += 1
+            new_line += 1  # context line exists in both files
+    return hits
+
+
+def filter_diff(diff_text: str, deny_globs: list[str], allow_globs: list[str]) -> FilterResult:
+    """Drop denylisted-path file blocks, then scan changed lines in kept blocks."""
+    dropped_paths: list[str] = []
+    hits: list[tuple[str, int, str]] = []
+    kept_parts: list[str] = []
+    for block in _split_into_file_blocks(diff_text):
+        first_line = block.splitlines()[0] if block else ""
+        old_path, new_path = _extract_paths(first_line)
+        path = new_path or old_path or "(unparseable path)"
+        denied = next((candidate for candidate in (old_path, new_path)
+                       if candidate and _is_denied(candidate, deny_globs, allow_globs)), None)
+        if denied:
+            dropped_paths.append(denied)
+            continue
+        hits.extend(_scan_added_lines(block, path))
+        kept_parts.append(block)
+    return FilterResult(kept_diff="".join(kept_parts), dropped_paths=dropped_paths, hits=hits)
+
+
+def load_config(repo: Path) -> tuple[list[str], list[str]]:
+    """`[review] deny_paths` / `allow_paths` from `<repo>/.caddis/config.toml`.
+
+    A missing file, a missing `[review]` table, or a malformed TOML file all yield `([], [])`
+    — this is additive configuration layered onto DEFAULT_DENY_GLOBS, never the sole source of
+    truth, so failing to read it must never silently widen what gets sent.
+    """
+    cfg_path = Path(repo) / ".caddis" / "config.toml"
+    if not cfg_path.is_file():
+        return ([], [])
+    try:
+        with cfg_path.open("rb") as f:
+            return _parse_config(f.read())
+    except (tomllib.TOMLDecodeError, OSError, UnicodeError):
+        return ([], [])
+
+
+def _parse_config(contents: bytes) -> tuple[list[str], list[str]]:
+    data = tomllib.loads(contents.decode("utf-8"))
+    review = data.get("review") if isinstance(data, dict) else None
+    if not isinstance(review, dict):
+        return ([], [])
+    deny = review.get("deny_paths", [])
+    allow = review.get("allow_paths", [])
+    deny_out = [str(p) for p in deny] if isinstance(deny, list) else []
+    allow_out = [str(p) for p in allow] if isinstance(allow, list) else []
+    return (deny_out, allow_out)
+
+
+def load_head_deny_paths(repo: Path) -> list[str]:
+    """Read the committed deny list; a missing or unreadable HEAD config contributes nothing."""
+    try:
+        out = subprocess.run(
+            ["git", "show", "HEAD:.caddis/config.toml"], cwd=repo,
+            capture_output=True, timeout=30,
+        )
+        if out.returncode == 0:
+            return _parse_config(out.stdout)[0]
+    except (OSError, subprocess.TimeoutExpired, UnicodeError, tomllib.TOMLDecodeError):
+        pass
+    return []

package/bundles/antigravity-plugin/scripts/setup_project_ai.py

@@ -291,6 +291,10 @@ def merge_settings(target: Path, stack: dict, dry: bool) -> str:
             if a not in ex_allow:
                 ex_allow.append(a)
         existing.setdefault("permissions", {})["allow"] = ex_allow
+        ex_deny = existing["permissions"].setdefault("deny", [])
+        for rule in base["permissions"]["deny"]:
+            if rule not in ex_deny:
+                ex_deny.append(rule)
         # Self-heal: prune legacy harness-injected `ask` rules that override bypassPermissions.
         ex_ask = existing["permissions"].get("ask", [])
         pruned_ask = [a for a in ex_ask if a not in _LEGACY_HARNESS_ASK]
@@ -308,7 +312,7 @@ def merge_settings(target: Path, stack: dict, dry: bool) -> str:
     else:
         base["permissions"]["allow"] = allow
         # No statusLine here on purpose: it is user-scope now, installed once per machine
-        # by `/caddis:statusline`. A per-project copy is exactly how four status-line
+        # by `/caddis:install-statusline`. A per-project copy is exactly how four status-line
         # scripts came to exist and drift apart.
         out = base
         verb = "write"
@@ -799,7 +803,7 @@ items?" has no answer when one state has three spellings.
 | Not this | Where it goes | Why |
 |---|---|---|
 | Work in flight right now | `.caddis/plans/<feature>.md` | A plan is being executed. A parking-lot item is not. |
-| A task interrupted mid-session | `/caddis:digress` stack | That is a pause, not a backlog item. `/caddis:resume` pops it. |
+| A task interrupted mid-session | `/caddis:digress` stack | That is a pause, not a backlog item. `/caddis:catchup` pops it. |
 | An ask only an outsider can resolve | `.caddis/comms/register.md` | Blocked on a human, not on us. |
 | Board cards | `.caddis/backlog/` | **docket writes that directory.** It is a projection of the board, not a hand-written register. Never edit it by hand. |
 
@@ -910,6 +914,7 @@ session-state.md
 session-state/
 context-window.json
 PROJECT-FACTS.md
+# retired writer; ignored so old files stay untracked
 memory.jsonl
 """
 
@@ -1178,7 +1183,7 @@ def scaffold_artifact_dir(target: Path, dry: bool) -> list[str]:
 
     Committed subdirs: plans, handoffs, agent-docs, prd, kb, prompts, comms. Transient state
     (reviews/*.html, usage-log.jsonl, .last-usage-review, relay*, session-state.md,
-    PROJECT-FACTS.md, memory.jsonl) is gitignored. .caddis/ is the default home for every working-artifact kind (Track A
+    PROJECT-FACTS.md) is gitignored. .caddis/ is the default home for every working-artifact kind (Track A
     Phase A3) — kb/ and prompts/ round out plans/prd/agent-docs/reviews so nothing has to
     scatter to the repo root or .github/. Also drops a documented `config.toml.example`
     (guard/doc_coverage). Idempotent. An existing .caddis/.gitignore is never clobbered or
@@ -1493,7 +1498,7 @@ def main() -> int:
     print(f"   {merge_settings(target, stack, args.dry_run)}")
 
     print("-- status line")
-    print("   user-scope now — run /caddis:statusline once per machine (not per project)")
+    print("   user-scope now — run /caddis:install-statusline once per machine (not per project)")
 
     print("-- git hooks")
     for line in install_git_hooks(target, args.force, args.dry_run):

package/bundles/antigravity-plugin/skills/_registry.md

@@ -85,6 +85,7 @@
 | Glossary | `glossary/` | Define the words this project invented, in one place — .caddis/kb/GLOSSARY.md |
 | Handoff | `handoff/` | End-of-session handoff — capture exact state so the next session resumes with zero re-discovery |
 | Implement | `implement/` | Headless plan executor — implement an approved plan phase-by-phase on the current feature branch, TDD-first, committing per phase |
+| Install Statusline | `install-statusline/` | Install the caddis status line into Claude Code and agy — one renderer, once per machine |
 | Kb | `kb/` | Rebuild the KB index (.caddis/kb/DOC-MAP.md) — create it if missing, index un-indexed notes, report dangling links |
 | Mermaid Db | `mermaid-db/` | Turn a SQL artifact (proc, view, query, .sql file, or table name) into a Mermaid diagram that explains it — git-diffable, saved as .md |
 | Migrate Dir | `migrate-dir/` | Rename this repo's legacy `.claudster/` artifact dir to `.caddis/` — dry-run first, `git mv` to keep history, merges a straggler dir, rewrites live refs. Opt-in, never automatic. |
@@ -92,14 +93,15 @@
 | Park | `park/` | File a future-work item in the one backlog — .caddis/parking-lot/ — or list what is open |
 | Pr Merge | `pr-merge/` | End-to-end pull request and merge lane — push feature branch, open or update PR, monitor CI to green, merge to default branch, and clean up the feature branch. |
 | Prd | `prd/` | Capture requirements through structured discovery and write a PRD |
-| Resume | `resume/` | Pop the most recently parked workstream off the stack and resume it at its exact resume point |
-| Review | `review/` | Review someone else's OPEN pull request end to end — what changed, what CI says, what is risky — then approve or request changes. Never approves on its own. |
+| Resume | `resume/` | Renamed to /caddis:catchup (alias, removed next release) |
+| Review | `review/` | Renamed to /caddis:review-pr (alias, removed next release) |
+| Review Pr | `review-pr/` | Review someone else's OPEN pull request end to end — what changed, what CI says, what is risky — then approve or request changes. Never approves on its own. |
 | Ship | `ship/` | Commit, push, and monitor the deploy pipeline (auto-detects Gitea, GitHub Actions, or local-only) |
 | Ship Merge | `ship-merge/` | Merge an already-green, already-reviewed PR behind an explicit deploy-confirm, monitor the deploy, validate prod, then clean up the branch — only on green. |
 | Ship Pr | `ship-pr/` | Open a reviewed PR for the current feature branch — rebase-safe push, PR create/update, monitor CI, STOP at green. Never merges, never deploys (that's /ship-merge). |
 | Spawn Hub | `spawn-hub/` | Hand the Advisory Hub role to a fresh session — run the mechanical audit, then generate the succession prompt with a context self-check the new Hub must pass |
 | Spawn Session | `spawn-session/` | Hand the WORK to a fresh session — generate the handover from the repo, then validate the successor by re-deriving its answers |
-| Statusline | `statusline/` | Install the caddis status line into Claude Code and agy — one renderer, once per machine |
+| Statusline | `statusline/` | Renamed to /caddis:install-statusline (alias, removed next release) |
 | Tdd | `tdd/` | Run a strict red-green-refactor TDD cycle for a unit of behavior |
 | Ui Brief | `ui-brief/` | Design-first UI brief — lock the aesthetic before writing any code |
 | Usage Review | `usage-review/` | Review local caddis usage over a window, surface prioritised recommendations, and apply config changes in one step |

package/bundles/antigravity-plugin/skills/catchup/SKILL.md

@@ -5,6 +5,10 @@ description: Where were we? A quick list of what this session was doing and what
 
 # /catchup — where are we?
 
+If $ARGUMENTS is empty, follow the catchup procedure below. If a name is given, follow
+the pop-and-resume procedure at the end of this file. The name selects this mode; the
+procedure still pops the last parked frame.
+
 Answer one question: **what were we doing, and what is still open?**
 
 Not named `/recap` on purpose — Claude Code has a built-in `/recap` that produces a one-line
@@ -58,5 +62,36 @@ on is worse than one sentence admitting there is nothing to recap.
   folder, or `claude --resume` to pick an older session. Mention this only if the recap is thin,
   or if they ask for detail the files do not hold.
 - To **write** a durable resume doc rather than read one: `/caddis:handoff`.
-- To **pop a parked workstream** off the digress stack: `/caddis:resume`. That is a different
-  mechanism — it restores work deliberately set aside, not the last session's state.
+- To **pop a parked workstream** off the digress stack: `/caddis:catchup [name]`. This restores work deliberately set aside.
+
+# /caddis:catchup [name] — pop the parked task and pick it back up
+
+A digression is finished; return to the task you parked with `/digress`. This pops the top frame off the
+workstream stack, restates where you were, realigns `relay.md`, and immediately continues the work — the
+user should not have to remember or re-state anything.
+
+## Step 1 — read the stack
+Read `.caddis/workstreams.json`. If it is **absent, unparseable, `version != 1`, or `stack` is empty**,
+say exactly `Nothing is parked.` and stop. Do nothing else.
+
+## Step 2 — pop the top frame
+The top of stack is the **last** element of `stack` (LIFO — most recently parked). Remove it and write the
+rest of the file back (preserve `version` and any other frames + unknown fields). This is the one write
+this command makes to the state file.
+
+## Step 3 — restate + realign relay.md
+Restate the popped frame to the user: its `plan`, `phase`, and `resumePointer` (and `repo` if set — the
+parked task lives in another repo, so say which). Then edit `.caddis/relay.md`'s `## Next step` section
+**in place** so it matches the popped frame's `resumePointer` — preserve every other section of relay.md
+untouched. (If relay.md or that section is absent, skip this edit silently; the restatement above is enough.)
+
+## Step 4 — resume the work
+Begin executing the `resumePointer` immediately. Ask nothing — the frame already carries the next action.
+If the parked plan lives in another `repo`, note that the user may need to open that repo first, then
+proceed there.
+
+## Rules
+- **Never** run a destructive or history-rewriting git action (no `git checkout`, `git reset`, `git stash`,
+  branch switches). Resuming is metadata-only.
+- Pop exactly one frame per invocation (the LIFO top). Run `/caddis:catchup [name]` again to pop the next.
+- Only real paths and verified facts — restate the frame as written; do not embellish the resume point.

package/bundles/antigravity-plugin/skills/cross-review/SKILL.md

@@ -97,7 +97,7 @@ as a diff that silently is not read. Name a provider explicitly only when you ha
 - **0 — REVIEW: CLEAN** → no blocking issues. Proceed.
 - **1 — REVIEW: BLOCKING** → read the printed findings, then **FIX each blocking item** (or explicitly
   justify why one is a false positive). Re-run until CLEAN.
-- **2 — error** → no verdict parsed, or a git/endpoint failure. Read stderr; do NOT treat as clean.
+- **4 — error** → no verdict parsed, or a git/endpoint failure. Read stderr; do NOT treat as clean.
 - **3 — misconfigured** → `REVIEW_API_KEY` is unset. Set it (see Prerequisite) and re-run.
 
 ## Rules

package/bundles/antigravity-plugin/skills/digress/SKILL.md

@@ -7,7 +7,7 @@ description: Park the current workstream on the stack and switch to a new task
 
 You are about to leave the current task for a related-but-different one (a design decision, a sub-feature,
 or a blocker that must be fixed first). This command **records the original task on a workstream stack** so
-neither you nor the user has to remember and re-state it later — `/resume` pops it back with its exact
+neither you nor the user has to remember and re-state it later — `/catchup [name]` pops it back with its exact
 resume point, and every SessionStart surfaces it (`⛏ Parked workstream: …`).
 
 The reason for the detour is **$ARGUMENTS** (if empty, derive a one-line reason yourself from what the

package/bundles/antigravity-plugin/skills/handoff/SKILL.md

@@ -51,7 +51,7 @@ clean phase boundary and lose or double-do the work.
 
 **Digression check.** If this session abandoned a mid-flight plan for a *different* one (relay.md or the
 tracker shows plan A in progress, but the work moved to plan B), suggest the user run `/digress` to park
-plan A on the workstream stack — so its exact resume point survives and `/resume` can pop it back later.
+plan A on the workstream stack — so its exact resume point survives and `/catchup [name]` can pop it back later.
 
 ## Step 2b — Advisory-Hub handoff audit (conditional — skip silently if not applicable)
 
@@ -113,6 +113,13 @@ Nothing to say is the normal answer. Say nothing and move on — this must not b
 > `/caddis:migrate-dir` does that.
 
 ```markdown
+---
+type: relay
+workstream: <name>
+branch: <branch>
+generated: { by: <model>, at: <ISO time> }
+---
+
 # Relay — <feature>
 **Updated:** <ISO timestamp>
 

package/bundles/antigravity-plugin/skills/implement/SKILL.md

@@ -51,7 +51,9 @@ python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" verdict-gate  --plan <plan
 python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" tracker-vs-git --plan <plan>
 ```
 
-Obey the exit code: **0** proceed · **1** STOP and report why · **2** proceed but record the note it
+Use the shared scale in `caddis_exit.py`: 0 clean, 1 blocked, 2 advisory, 3 could not run,
+4 error or bad usage. For `caddis_gate.py`, obey the exit code: **0** proceed · **1** STOP and report
+why · **2** proceed but record the note it
 printed · **3** wrong lane — the launch command is on stdout, spawn it · **4** the launch command is
 malformed, do not run it.
 

package/bundles/antigravity-plugin/skills/install-statusline/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: install-statusline
+description: Install the caddis status line into Claude Code and agy — one renderer, once per machine
+---
+
+# /install-statusline — set up the status bar
+
+Wire the caddis status line into every coding agent on this machine. One Python renderer serves
+both hosts. It installs at **user scope**, so every project gets the line and no project holds a
+copy that can drift.
+
+## What the user gets
+
+Claude Code:
+
+```
+⌂ claudster-source | saajunaid/caddis ⎇ main +2 ●1 ?3 ↑1 | ◆ Opus 5 (1M context) v2.1.239 |
+◉ 412k/1M [███░░░░░]  41%  | ⚡ 386k cached | effort:high | style:Plain | thinking |
+5h:12% 7d:40% | 💻 57% (37 GB) | ⏺ relay | ◷ 07:58
+```
+
+agy (Antigravity):
+
+```
+▛▜ agy | ● idle | 🧠 Gemini 3.6 Flash (High) (high) | 📁 claudster-source | ⎇ main ?3 |
+◉ 48.5k/1M [░░░░░░░░]  5%  | ⚡ 40k cached | q 62% | 💻 57% (37 GB) | ⏺ relay | ◷ 08:01
+```
+
+Both lines come from `caddis_statusline.py`. It has two profiles, because the two hosts send
+different field names — agy's payload is a sibling of Claude Code's, not a copy.
+
+## Run it
+
+Find the renderer in this install and run it. Try these paths in order and use the first that exists:
+
+- `${CLAUDE_PLUGIN_ROOT}/scripts/caddis_statusline.py`
+- `claude-harness/scripts/caddis_statusline.py` (working inside the caddis source repo)
+
+Then:
+
+```bash
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_statusline.py" --install          # both hosts
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_statusline.py" --install --host claude
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_statusline.py" --install --host agy
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_statusline.py" --install --dry-run # print, write nothing
+```
+
+`--install` does four things:
+
+1. Copies the renderer to `~/.caddis/statusline.py` — a **stable** path. Pointing the host
+   settings at the plugin cache would break on every caddis upgrade, because the version number
+   is in that path.
+2. Creates `~/.caddis/statusline.json` with the default toggles. It never overwrites an existing one.
+3. Backs up each host's `settings.json` to `settings.json.bak-caddis-statusline`.
+4. Sets `statusLine` in `~/.claude/settings.json` and `~/.gemini/antigravity-cli/settings.json`,
+   preserving every other key. A host that is not installed is skipped, not failed.
+
+Report the tool's own output to the user. Then tell them the line appears on the **next** session —
+neither host re-reads `settings.json` mid-session.
+
+## Verify
+
+```bash
+python ~/.caddis/statusline.py --check                        # what is wired where
+python ~/.caddis/statusline.py --sample --profile claude      # preview, no host needed
+python ~/.caddis/statusline.py --sample --profile agy
+```
+
+`--check` exits non-zero when a host's `statusLine` is missing or points somewhere else.
+
+## Change the look
+
+Edit `~/.caddis/statusline.json`. Every key is optional; a missing file means defaults.
+
+| key | default | what it controls |
+|---|---|---|
+| `color` | `true` | ANSI colour |
+| `icons` | `true` | Unicode segment icons. These are plain Unicode, **not** Nerd Font glyphs |
+| `progress_bar` | `true` | the `[███░░░░░]` context bar |
+| `bar_width` | `8` | bar cells |
+| `token_counts` | `true` | `◉ 412k/1M` |
+| `cached_tokens` | `true` | `⚡ 386k cached` — bold and bright by design, never width-gated |
+| `ram` | `true` | `💻 57% (37 GB)` |
+| `ram_min_width` | `0` | hide RAM below this terminal width; `0` always shows it |
+| `clock` | `true` | `◷ 07:58` |
+| `relay` | `true` | `⏺ relay` when a parked resume pointer exists |
+| `rate_limits` | `true` | `5h:12% 7d:40%` (Claude Code only) |
+| `session_id` | `false` | `#a1b2c3d4` |
+| `git` | `true` | branch, staged/unstaged/untracked counts, ahead/behind |
+| `separator` | `"\|"` | segment separator |
+
+Config changes take effect on the next render. No reinstall needed.
+
+## Notes for you, not the user
+
+- Do **not** hand-edit either `settings.json` to wire this. `--install` reads, merges and writes
+  back, so it cannot drop an unrelated key. Hand edits have dropped `trustedWorkspaces` before.
+- The renderer never crashes the host. A bad payload, a missing field, or an unreadable config
+  degrades to fewer segments; a hard failure degrades to the directory name.
+- RAM on Windows uses `ctypes` `GlobalMemoryStatusEx`, an in-process call. Do not replace it with
+  `Get-CimInstance Win32_OperatingSystem` — that cost about 300 ms on **every** render in the
+  PowerShell line this replaced.
+- If the user asks why their old `~/.claude/statusline-custom.sh` or
+  `~/.gemini/statusline/statusline.ps1` no longer runs: nothing points at them any more. They are
+  superseded, not deleted. Both are safe to remove once the user is happy with the new line.