@caddis/cli 0.4.30 → 0.4.33

package/bundles/antigravity-plugin/scripts/caddis_gate.py

@@ -37,6 +37,14 @@ import subprocess
 import sys
 from pathlib import Path
 
+try:
+    import caddis_frontmatter
+except ModuleNotFoundError as exc:
+    if exc.name != "caddis_frontmatter":
+        raise
+    sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
+    import caddis_frontmatter
+
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8", errors="replace")
     sys.stderr.reconfigure(encoding="utf-8", errors="replace")
@@ -145,16 +153,7 @@ def gate_lane(plan: Path, phase: int) -> int:
 # ── gate: verdict-gate ──────────────────────────────────────────────────────
 
 def _frontmatter(p: Path) -> dict:
-    t = p.read_text(encoding="utf-8", errors="ignore")
-    if not t.startswith("---"):
-        return {}
-    end = t.find("\n---", 3)
-    out = {}
-    for line in t[3:end if end > 0 else 400].splitlines():
-        if ":" in line:
-            k, _, v = line.partition(":")
-            out[k.strip()] = v.strip()
-    return out
+    return caddis_frontmatter.parse(p.read_text(encoding="utf-8", errors="ignore"))
 
 
 def _covers(phase_field: str, n: int) -> bool:
@@ -602,6 +601,22 @@ def gate_review_trigger(repo_root: Path, rev_range: str | None = None) -> int:
     return EXIT_NOTE
 
 
+def gate_docs_check(root: Path) -> int:
+    """Report every typed .caddis Markdown document with an invalid header."""
+    failures = 0
+    for path in sorted((root / ".caddis").rglob("*.md")):
+        relative = path.relative_to(root).as_posix()
+        if not caddis_frontmatter.doc_in_scope(relative, root):
+            continue
+        error = caddis_frontmatter.validate(
+            path.read_text(encoding="utf-8"), caddis_frontmatter.ALLOWED_TYPES
+        )
+        if error:
+            print(f"{relative}: {error}")
+            failures += 1
+    return EXIT_BLOCKED if failures else EXIT_OK
+
+
 def main(argv: list[str] | None = None) -> int:
     ap = argparse.ArgumentParser(description="caddis machine gates")
     sub = ap.add_subparsers(dest="cmd", required=True)
@@ -625,9 +640,17 @@ def main(argv: list[str] | None = None) -> int:
     hc = sub.add_parser("handover-check")
     hc.add_argument("--doc", required=True)
     hc.add_argument("--repo-root", default=".")
+    dc = sub.add_parser("docs-check")
+    dc.add_argument("--root", default=".")
     a = ap.parse_args(argv)
 
     plan = Path(getattr(a, "plan", "") or ".")
+    if a.cmd == "docs-check":
+        try:
+            return gate_docs_check(Path(a.root).resolve())
+        except Exception as exc:
+            sys.stderr.write(f"[caddis-gate] docs-check cannot evaluate: {type(exc).__name__}: {exc}\n")
+            return EXIT_BLOCKED  # CI must not pass without completing the scan.
     try:
         if a.cmd == "lane-check":
             return gate_lane(plan, a.phase)

package/bundles/antigravity-plugin/scripts/caddis_governor.py

@@ -55,8 +55,11 @@ import sys
 from dataclasses import dataclass
 from pathlib import Path
 
-EXIT_USAGE = 2
-EXIT_CONFIG = 3
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import caddis_exit  # noqa: E402
+
+EXIT_USAGE = caddis_exit.ERROR
+EXIT_CONFIG = caddis_exit.NOT_RUN
 SCOPES = ("session", "lane")
 MAX_CPU_PERCENT = 100
 MAX_MEMORY_MB = 1_048_576

package/bundles/antigravity-plugin/scripts/caddis_lanes.py

@@ -20,11 +20,23 @@ from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
 
+try:
+    import caddis_exit
+except ModuleNotFoundError as exc:
+    if exc.name != "caddis_exit":
+        raise
+    sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
+    import caddis_exit
+
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8", errors="replace")
     sys.stderr.reconfigure(encoding="utf-8", errors="replace")
 
-EXIT_OK, EXIT_FAIL, EXIT_USAGE, EXIT_CONFIG, EXIT_ALL_OUT = 0, 1, 2, 3, 4
+EXIT_OK = caddis_exit.CLEAN
+EXIT_FAIL = caddis_exit.BLOCKED
+EXIT_USAGE = caddis_exit.ERROR
+EXIT_CONFIG = caddis_exit.NOT_RUN
+EXIT_ALL_OUT = caddis_exit.NOT_RUN
 RESULT_OK = "OK"
 RESULT_LANE_FAILED = "LANE-FAILED"
 RESULT_OUT_OF_BUDGET = "OUT-OF-BUDGET"

package/bundles/antigravity-plugin/scripts/caddis_migrate_dir.py

@@ -45,7 +45,7 @@ NEW_DIR = ".caddis"
 OLD_DIR = ".claudster"
 
 #: Append-only JSONL logs: safe to concatenate when both dirs carry one (legacy lines first).
-JSONL_MERGE_NAMES = frozenset({"usage-log.jsonl", "agent-log.jsonl", "memory.jsonl"})
+JSONL_MERGE_NAMES = frozenset({"usage-log.jsonl", "agent-log.jsonl"})
 
 #: Files whose CONTENT may name the old dir and is read live after the migration. Historical
 #: artifacts (plans, handoffs, past reviews) are deliberately NOT rewritten — they are a record of

package/bundles/antigravity-plugin/scripts/caddis_spawn.py

@@ -273,7 +273,7 @@ def read_context_pct(repo_root: Path) -> tuple[float | None, str]:
         age = max(0, int(time.time()) - int(raw.get("at", 0)))
     except Exception:
         return None, ("no runtime context figure at "
-                      + f"{ART}/context-window.json — run `/caddis:statusline` to install the "
+                      + f"{ART}/context-window.json — run `/caddis:install-statusline` to install the "
                       "status line that writes it")
     if age > CONTEXT_MAX_AGE_S:
         return pct, f"runtime figure, STALE by {age}s (a lower bound — the real number is >= this)"
@@ -386,7 +386,7 @@ def _gate_context(p: Preflight, repo_root: Path, self_reported: float | None) ->
     if pct is None:
         p.refusals.append(
             "no context figure, so the 95% gate cannot be applied — and a gate that defaults to "
-            "proceed is not a gate. Either run `/caddis:statusline` (its status line caches the "
+            "proceed is not a gate. Either run `/caddis:install-statusline` (its status line caches the "
             "runtime figure for this repo), or pass `--context-pct <n>` with the number your "
             "harness reports. A self-reported figure is accepted and recorded as such.")
         return

package/bundles/antigravity-plugin/scripts/caddis_tidy.py

@@ -38,6 +38,14 @@ import sys
 from dataclasses import dataclass, field
 from pathlib import Path
 
+try:
+    import caddis_frontmatter
+except ModuleNotFoundError as exc:
+    if exc.name != "caddis_frontmatter":
+        raise
+    sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
+    import caddis_frontmatter
+
 TERMINAL_STATUSES = {"done", "superseded", "shipped", "implemented"}
 
 # Legacy prompts written before the frontmatter convention existed (2026-07-23). They were
@@ -95,20 +103,7 @@ PARKING_LOT_MAX_BYTES = 20_000
 
 
 def _parse_frontmatter(text: str) -> dict:
-    text = text.lstrip("")
-    if not text.startswith("---"):
-        return {}
-    lines = text.splitlines()
-    if lines[0].strip() != "---":
-        return {}
-    fm: dict[str, str] = {}
-    for line in lines[1:]:
-        if line.strip() == "---":
-            break
-        if ":" in line:
-            k, _, v = line.partition(":")
-            fm[k.strip()] = v.strip()
-    return fm
+    return caddis_frontmatter.parse(text)
 
 
 def _phases_all_done(text: str) -> bool:

package/bundles/antigravity-plugin/scripts/claudster_doctor.py

@@ -15,11 +15,14 @@ Usage:
 from __future__ import annotations
 
 import argparse
+import importlib.util
 import json
 import os
+import re
 import shutil
 import subprocess
 import sys
+import time
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -97,6 +100,28 @@ def rules_findings(dest: Path) -> list[str]:
     return out
 
 
+def has_document_frontmatter_rule(dest: Path) -> bool:
+    """True when root AGENTS.md puts type: in its Document frontmatter section."""
+    path = Path(dest) / "AGENTS.md"
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+    except OSError:
+        return False
+    section = False
+    for line in lines:
+        if re.match(r"^\s*(?:#{1,6}\s+|[-*]\s+\*\*)Document frontmatter(?:\*\*)?\s*:?.*$", line):
+            section = True
+            if "type:" in line:
+                return True
+            continue
+        if section and ("type:" in line or re.match(r"^\s*[-*]\s+\*\*type\*\*\s*:", line)):
+            return True
+        if section and (re.match(r"^#{1,6}\s+", line) or
+                        re.match(r"^\s*[-*]\s+\*\*[^*]+\*\*\s*:", line)):
+            section = False
+    return False
+
+
 def oversize_rules_files(dest: Path, budget: int = AGENTS_MD_BUDGET) -> list[tuple[str, int]]:
     """Always-loaded rules files (AGENTS.md, or CLAUDE.md pre-migration) over the line budget."""
     dest = Path(dest)
@@ -287,6 +312,36 @@ def nudge_line(dest: Path) -> str | None:
     return f"[caddis] {head}{more}"
 
 
+def hook_errors(dest: Path) -> str:
+    """Recent hook failures, counted by hook. Empty when the ledger is clean."""
+    scripts = Path(__file__).resolve().parent
+    hook_log_path = scripts / "hook_log.py"
+    if not hook_log_path.is_file():  # source checkout; installed copies are siblings
+        hook_log_path = scripts.parent / "claude-harness" / "scripts" / "hook_log.py"
+    try:
+        spec = importlib.util.spec_from_file_location("caddis_hook_log", hook_log_path)
+        if spec is None or spec.loader is None:
+            return ""
+        hook_log = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(hook_log)
+        if not hook_log.summarise(str(dest), days=7):
+            return ""
+        cutoff = time.strftime("%Y-%m-%d", time.localtime(time.time() - 7 * 86400))
+        counts: dict[str, int] = {}
+        with (dest / ".caddis" / "hook-errors.jsonl").open(encoding="utf-8", errors="replace") as fh:
+            for line in fh:
+                try:
+                    row = json.loads(line)
+                except (ValueError, TypeError):
+                    continue
+                if isinstance(row, dict) and str(row.get("ts", ""))[:10] >= cutoff:
+                    hook = str(row.get("hook", "?"))
+                    counts[hook] = counts.get(hook, 0) + 1
+        return ", ".join(f"{hook} x{count}" for hook, count in sorted(counts.items()))
+    except Exception:
+        return ""  # a damaged ledger must not break the doctor
+
+
 # ── report ───────────────────────────────────────────────────────────────────
 def run(dest: Path, quiet: bool) -> int:
     if quiet:  # SessionStart mode: only the nudge, never non-zero
@@ -316,6 +371,11 @@ def run(dest: Path, quiet: bool) -> int:
         root = dest / "AGENTS.md"
         print(f"  OK   root AGENTS.md {'present' if root.is_file() else 'ABSENT (not migrated yet?)'}; shims are shims")
 
+    if has_document_frontmatter_rule(dest):
+        print("  OK   AGENTS.md carries the document-header rule")
+    else:
+        print("  WARN AGENTS.md carries the document-header rule: missing Document frontmatter section with type:")
+
     print("-- maintenance signals (deterministic — read-only)")
     sig = maintenance_signals(dest)
     if sig:
@@ -324,6 +384,12 @@ def run(dest: Path, quiet: bool) -> int:
     else:
         print("  none")
 
+    errors = hook_errors(dest)
+    if errors:
+        print(f"  WARN hook errors (7 days): {errors}")
+    else:
+        print("  OK   hook errors (7 days): 0")
+
     print("-- install registry")
     reg = _user_scope_path("installs.json")
     if reg.is_file():

package/bundles/antigravity-plugin/scripts/new-machine.ps1

@@ -129,7 +129,7 @@ if (Test-Path $statusline) {
     if ($PSCmdlet.ShouldProcess($statusline, 'install')) { python $statusline --install }
 } else {
     Missing "statusline.py not found at $statusline"
-    Note 'It ships with the plugin. Run `/caddis:statusline` in a Claude Code session, or'
+    Note 'It ships with the plugin. Run `/caddis:install-statusline` in a Claude Code session, or'
     Note 'python PLUGIN_ROOT/scripts/caddis_statusline.py --install'
 }
 

package/bundles/antigravity-plugin/scripts/oss_ask.py

@@ -10,7 +10,7 @@ in ~/.caddis/keys.env lights up every lane.
 Usage:
   python oss_ask.py <provider> <prompt...>  [--model M] [--base-url U] [--system S]
 
-Exit codes: 0 answer printed; 2 endpoint/parse error; 3 config error (message on stderr).
+Exit codes: 0 answer printed; 3 could not run due to config; 4 endpoint/parse error.
 """
 from __future__ import annotations
 
@@ -23,18 +23,19 @@ from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import oss_model  # noqa: E402  (same-directory import: shared key resolution)
+import caddis_exit  # noqa: E402
 
 # OpenAI-compatible chat endpoints — intentionally different from oss_model.PROVIDERS,
 # which holds the Anthropic-protocol endpoints for Claude Code.
 CHAT_PROVIDERS: dict[str, dict[str, str]] = {
-    "deepseek":   {"base_url": "https://api.deepseek.com",            "model": "deepseek-v4-flash",          "key_env": "DEEPSEEK_API_KEY"},
+    "deepseek":   {"base_url": "https://api.deepseek.com",            "model": "deepseek-flash",             "key_env": "DEEPSEEK_API_KEY"},
     "glm":        {"base_url": "https://api.z.ai/api/coding/paas/v4", "model": "glm-5.3",                    "key_env": "GLM_API_KEY"},
     "openrouter": {"base_url": "https://openrouter.ai/api/v1",        "model": "deepseek/deepseek-v4-flash", "key_env": "OPENROUTER_API_KEY"},
 }
 
-EXIT_OK = 0
-EXIT_ERROR = 2
-EXIT_CONFIG = 3
+EXIT_OK = caddis_exit.CLEAN
+EXIT_ERROR = caddis_exit.ERROR
+EXIT_CONFIG = caddis_exit.NOT_RUN
 
 
 def resolve_chat_config(provider: str, env: dict[str, str],

package/bundles/antigravity-plugin/scripts/oss_model.py

@@ -43,7 +43,7 @@ from pathlib import Path
 # NEVER put this suffix in the OpenAI-dialect tables (oss_review.py / oss_ask.py): those
 # send the id raw to /chat/completions, which would reject it.
 PROVIDERS: dict[str, dict[str, str]] = {
-    "deepseek":   {"base_url": "https://api.deepseek.com/anthropic",  "model": "deepseek-v4-flash[1m]",          "key_env": "DEEPSEEK_API_KEY"},
+    "deepseek":   {"base_url": "https://api.deepseek.com/anthropic",  "model": "deepseek-flash[1m]",          "key_env": "DEEPSEEK_API_KEY"},
     "glm":        {"base_url": "https://api.z.ai/api/anthropic",      "model": "glm-5.3[1m]",                    "key_env": "GLM_API_KEY"},
     "openrouter": {"base_url": "",                                    "model": "deepseek/deepseek-v4-flash", "key_env": "OPENROUTER_API_KEY"},
 }

package/bundles/antigravity-plugin/scripts/oss_review.py

@@ -18,23 +18,30 @@ vars always win, so you can point at any new id without touching code. Nothing h
 
 Usage:
   python oss_review.py [--range <git range>] [--cwd <repo>] [--provider P] [--base-url U] [--model M]
-    --range   e.g. origin/main..HEAD   (default: the working tree — staged, unstaged AND
-              untracked non-ignored files; a range excludes untracked by design)
+                        [--allow-path GLOB ...]
+    --range        e.g. origin/main..HEAD   (default: the working tree — staged, unstaged AND
+                   untracked non-ignored files; a range excludes untracked by design)
+    --allow-path   repeatable; re-admits a file the pre-send secret filter's deny list would
+                   otherwise drop (see secret_filter.py). `.caddis/config.toml`'s
+                   `[review] deny_paths` / `allow_paths` are layered on the same way.
 
 Exit codes (fail-closed):
   0  REVIEW: CLEAN      — no blocking issues
   1  REVIEW: BLOCKING   — one or more blocking issues
-  2  error              — no diff verdict parsed, git failure, endpoint/parse failure, or the diff
+  2  unused             — advisory is not a review verdict
+  3  misconfigured      — REVIEW_API_KEY missing, OR the pre-send secret filter refused (a
+                          denylisted path / possible secret; see secret_filter.py) — actionable
+                          message on stderr/stdout either way
+  4  error              — no diff verdict parsed, git failure, endpoint/parse failure, or the diff
                           exceeds REVIEW_MAX_DIFF_CHARS (see below — never silently downgraded to CLEAN)
-  3  misconfigured      — REVIEW_API_KEY missing (actionable message on stderr)
 
 Diff-size ceiling: an oversized diff sent to a chat-completions endpoint has been observed, live, to
 come back two different unsafe ways — an empty `content` field on an HTTP 200 (at least fails closed:
-no verdict line ⇒ exit 2), and, worse, a `REVIEW: CLEAN` verdict with no substantive engagement (a
+no verdict line ⇒ exit 4), and, worse, a `REVIEW: CLEAN` verdict with no substantive engagement (a
 silent false negative — the model was overwhelmed, not actually reviewing). Rather than risk the second
 case, a diff over REVIEW_MAX_DIFF_CHARS (default 60,000 chars; override via the env var or
 --max-diff-chars) is SPLIT INTO BATCHES on whole-file boundaries and each batch reviewed separately;
-the verdict is CLEAN only if every batch is clean (aggregation is fail-closed). Exit 2 is now the
+the verdict is CLEAN only if every batch is clean (aggregation is fail-closed). Exit 4 is the
 narrower case: a SINGLE file larger than the ceiling, which cannot be split, or more batches than
 MAX_REVIEW_BATCHES. Refusal was the original behaviour and is kept for those two - a silent false
 CLEAN is the worst outcome this tool has - but it no longer fires on an ordinary large phase diff.
@@ -53,6 +60,12 @@ import urllib.error
 import urllib.request
 from pathlib import Path
 
+# secret_filter.py ships beside this file in every export target (see
+# .github/runtime-targets.json) — import it from THIS script's own folder, not the caller's
+# cwd, so it resolves the same way whether this runs from the source repo or a plugin install.
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import secret_filter  # noqa: E402
+
 # ONE SCALE ACROSS caddis (see claude-harness/README.md):
 #   0 clean · 1 blocked · 2 advisory note · 3 could not run · 4 malformed
 # ERROR moved 2 -> 4 on 2026-09-09. It sat on 2, which caddis_gate uses for "proceed, this is
@@ -69,7 +82,7 @@ EXIT_ERROR = 4      # ran, produced nothing usable: no verdict line, transport f
 # Provider presets — the SINGLE place a renamed model id or moved endpoint is edited. Adding a new
 # provider (Qwen, a local vLLM, …) is one new row. Callers can always bypass this via env/flags.
 PROVIDERS: dict[str, dict[str, str]] = {
-    "deepseek":   {"base_url": "https://api.deepseek.com",            "model": "deepseek-v4-flash"},
+    "deepseek":   {"base_url": "https://api.deepseek.com",            "model": "deepseek-flash"},
     "glm":        {"base_url": "https://api.z.ai/api/coding/paas/v4", "model": "glm-5.3"},
     "openrouter": {"base_url": "https://openrouter.ai/api/v1",        "model": "deepseek/deepseek-v4-flash"},
 }
@@ -272,7 +285,8 @@ def _untracked_diff(path: str, cwd: str) -> str:
     """
     null = "/dev/null" if os.name != "nt" else "NUL"
     out = subprocess.run(
-        ["git", "diff", "--no-index", "--", null, path],
+        ["git", "diff", "--no-color", "--no-ext-diff", "--src-prefix=a/",
+         "--dst-prefix=b/", "--no-index", "--", null, path],
         cwd=cwd, capture_output=True, text=True,
         encoding="utf-8", errors="replace", timeout=30,
     )
@@ -295,7 +309,8 @@ def get_diff(rng: str | None, cwd: str, include_untracked: bool = True) -> str:
     Untracked files are NOT included for an explicit `rng` — a commit range is a span of
     history, and files that were never committed are correctly outside it.
     """
-    cmd = ["git", "diff", rng] if rng else ["git", "diff", "HEAD"]
+    cmd = ["git", "diff", "--no-color", "--no-ext-diff", "--src-prefix=a/",
+           "--dst-prefix=b/", rng or "HEAD"]
     # encoding pinned to UTF-8: git emits UTF-8, but text=True would decode with the locale
     # codepage (cp1252 on Windows) — a non-ASCII diff then kills the reader thread and
     # subprocess hands back stdout=None with returncode 0.
@@ -483,6 +498,29 @@ def _force_utf8_stdio() -> None:
             pass
 
 
+def _config_is_changed(diff_text: str) -> bool:
+    """True when either side of a changed file block names the review config."""
+    target = ".caddis/config.toml"
+    for block in secret_filter._split_into_file_blocks(diff_text):
+        for line in block.splitlines():
+            if line.startswith("@@"):
+                break
+            if line in (f"--- a/{target}", f"+++ b/{target}",
+                        f"rename from {target}", f"rename to {target}"):
+                return True
+            if line.startswith("diff --git "):
+                rest = line[len("diff --git "):]
+                quoted = secret_filter._QUOTED_HEADER_RE.match(rest)
+                if quoted:
+                    sides = (secret_filter._unescape_git_quoted(part)
+                             for part in quoted.groups())
+                    if any(side in (f"a/{target}", f"b/{target}") for side in sides):
+                        return True
+                elif rest.startswith(f"a/{target} b/") or rest.endswith(f" b/{target}"):
+                    return True
+    return False
+
+
 def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> int:
     _force_utf8_stdio()
     env = os.environ if env is None else env
@@ -499,6 +537,10 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
     parser.add_argument("--check-config", action="store_true",
                         help="report whether a usable key exists and exit — no diff, no LLM call. "
                              "Exit 0 = ready, 3 = nothing configured.")
+    parser.add_argument("--allow-path", dest="allow_path", action="append", default=[],
+                        metavar="GLOB",
+                        help="re-admit a file the secret-filter deny list would otherwise drop "
+                             "(repeatable)")
     args = parser.parse_args(argv)
 
     # --check-config is deliberately NON-INTERACTIVE. This script runs headless — from CI, from a
@@ -519,6 +561,39 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
         print(f"cross-review is ready. Providers with a key: {', '.join(available)}")
         return EXIT_CLEAN
 
+    try:
+        diff_text = get_diff(args.range, args.cwd)
+    except Exception as exc:
+        sys.stderr.write(f"could not read diff: {exc}\n")
+        return EXIT_ERROR
+
+    # Pre-send secret filter — runs on the FULL diff, before it is ever split into batches and
+    # before any provider is contacted, and BEFORE provider/key resolution below: a missing or
+    # misconfigured REVIEW_API_KEY must never race a secret refusal and print the wrong reason.
+    # A run with no key configured at all still refuses here first, on the merits, not because
+    # it couldn't have called anyone anyway.
+    cfg_deny, cfg_allow = secret_filter.load_config(Path(args.cwd))
+    if _config_is_changed(diff_text):
+        cfg_deny = list(dict.fromkeys(cfg_deny + secret_filter.load_head_deny_paths(Path(args.cwd))))
+        cfg_allow = []
+        print("note: .caddis/config.toml is part of this change; its allow_paths are ignored")
+    filter_result = secret_filter.filter_diff(
+        diff_text,
+        secret_filter.DEFAULT_DENY_GLOBS + cfg_deny,
+        cfg_allow + list(args.allow_path),
+    )
+    if filter_result.hits:
+        print("REVIEW: REFUSED — possible secrets:")
+        for hit_path, hit_line, hit_rule in filter_result.hits:
+            print(f"  {hit_path}:{hit_line} ({hit_rule})")
+        return EXIT_CONFIG
+    if filter_result.dropped_paths:
+        print(f"excluded from review: {', '.join(filter_result.dropped_paths)}")
+    if not filter_result.kept_diff.strip() and filter_result.dropped_paths:
+        print("REVIEW: REFUSED — every changed file is excluded")
+        return EXIT_CONFIG
+    diff_text = filter_result.kept_diff
+
     try:
         base_url, api_key, model = resolve_config(args, env)
         primary_provider = (
@@ -528,12 +603,6 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
         sys.stderr.write(f"{exc}\n")
         return EXIT_CONFIG
 
-    try:
-        diff_text = get_diff(args.range, args.cwd)
-    except Exception as exc:
-        sys.stderr.write(f"could not read diff: {exc}\n")
-        return EXIT_ERROR
-
     if not diff_text.strip():
         # Says what was scanned, not just that nothing was found. This branch used to fire
         # on a tree full of NEW files (they are invisible to `git diff HEAD`) and report