@caddis/cli 0.4.54 → 0.4.56

package/bundles/antigravity-plugin/repo_freshness.py

@@ -10,6 +10,14 @@ FAIL OPEN, ALWAYS. Every path exits 0 and every git call is wrapped. A hook that
 or fail a session start is worse than the staleness it prevents, so a failed or slow fetch
 reports and continues.
 
+NO LOCKS, NO PROMPTS, A TIME BUDGET (robustness audit #6, 18 Oct 2026). Every git call
+runs with GIT_OPTIONAL_LOCKS=0 (and `git status` with --no-optional-locks), so this hook never takes
+index.lock from a peer session mid-commit. Every call runs with GIT_TERMINAL_PROMPT=0 and
+GCM_INTERACTIVE=never, so a credential helper can never pop a sign-in window. The fetch runs in a
+job object (Windows) or process group (POSIX), so `git-remote-https` dies with `git` on a timeout
+instead of surviving it holding a ref lock. All git calls share one 18 s budget under the 25 s hook
+timeout; with less than the fetch timeout left, the fetch is skipped and the output says so.
+
 IT ONLY PRINTS. It never switches, stashes, resets, commits or creates anything except one
 throttle stamp inside .git/. A SessionStart hook cannot ask a question, and these checkouts
 are shared with other live sessions — acting without an answer could take work with it.
@@ -25,6 +33,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import signal
 import subprocess
 import sys
 import time
@@ -49,21 +58,158 @@ if _reconfig:
         pass
 
 FETCH_TIMEOUT_S = 15        # ceiling: a slow or unreachable remote must not stall a session
+TOTAL_BUDGET_S = 18         # all git calls together; the hook timeout in hooks.json is 25 s
 FETCH_MAX_AGE_S = 600       # a restart within 10 minutes reuses the last fetch
 PEER_FRESH_S = 1800         # live peer session-state threshold (30 minutes, matches inject_relay)
 STAMP_NAME = "caddis-freshness-stamp"
 
+# No git child opens a console window on Windows (a hook is not a place for flashing windows).
+_NO_WINDOW = 0x08000000 if os.name == "nt" else 0
+_NEW_PROCESS_GROUP = 0x00000200
+# Never take an optional lock, never ask for a credential, never open a credential-manager window.
+_GIT_ENV_OVERRIDES = {"GIT_OPTIONAL_LOCKS": "0", "GIT_TERMINAL_PROMPT": "0", "GCM_INTERACTIVE": "never"}
+
+_deadline: float | None = None      # time.monotonic() value that ends this run's git budget; None = no budget
+
+
+def _git_env() -> dict:
+    """os.environ plus the no-lock, no-prompt overrides. A fresh dict each call."""
+    return {**os.environ, **_GIT_ENV_OVERRIDES}
+
+
+def _remaining() -> float:
+    """Seconds left in the git budget. Effectively unbounded outside report()."""
+    return float("inf") if _deadline is None else _deadline - time.monotonic()
+
 
 def _git(cwd: str, *args: str, timeout: int = 15) -> tuple[int, str]:
-    """(exit code, stdout). Never raises; a timeout is just a non-zero code."""
+    """(exit code, stdout). Never raises; a timeout is just a non-zero code. No call starts once the budget is
+    gone, and no call may run past it."""
+    left = _remaining()
+    if left <= 0:
+        return 1, ""
     try:
         r = subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True,
-                           encoding="utf-8", errors="replace", timeout=timeout)
+                           encoding="utf-8", errors="replace", timeout=min(timeout, left),
+                           stdin=subprocess.DEVNULL, env=_git_env(), creationflags=_NO_WINDOW)
     except (OSError, subprocess.SubprocessError):
         return 1, ""
     return r.returncode, (r.stdout or "").strip()
 
 
+# -- the bounded runner for the fetch ---------------------------------------------------------------------------
+# Equivalent to caddis_roadmap.run_bounded (job object, tree kill), kept local on purpose: that module cannot take a
+# cwd or creation flags, costs ~120 ms to import, and agy ships this file in a bundle where scripts/ may not sit
+# beside it. A hook that cannot import its helper must still work.
+
+
+class _Job:
+    """A Windows job object holding one process and its children. KILL_ON_JOB_CLOSE: closing the handle (or the
+    death of this process) ends the whole tree, even after the first process has exited."""
+
+    def __init__(self, proc: "subprocess.Popen"):
+        import ctypes
+        from ctypes import wintypes
+
+        class _Basic(ctypes.Structure):
+            _fields_ = [("PerProcessUserTimeLimit", ctypes.c_int64), ("PerJobUserTimeLimit", ctypes.c_int64),
+                        ("LimitFlags", wintypes.DWORD), ("MinimumWorkingSetSize", ctypes.c_size_t),
+                        ("MaximumWorkingSetSize", ctypes.c_size_t), ("ActiveProcessLimit", wintypes.DWORD),
+                        ("Affinity", ctypes.c_size_t), ("PriorityClass", wintypes.DWORD),
+                        ("SchedulingClass", wintypes.DWORD)]
+
+        class _Io(ctypes.Structure):
+            _fields_ = [(n, ctypes.c_uint64) for n in (
+                "ReadOperationCount", "WriteOperationCount", "OtherOperationCount",
+                "ReadTransferCount", "WriteTransferCount", "OtherTransferCount")]
+
+        class _Extended(ctypes.Structure):
+            _fields_ = [("BasicLimitInformation", _Basic), ("IoInfo", _Io), ("ProcessMemoryLimit", ctypes.c_size_t),
+                        ("JobMemoryLimit", ctypes.c_size_t), ("PeakProcessMemoryUsed", ctypes.c_size_t),
+                        ("PeakJobMemoryUsed", ctypes.c_size_t)]
+
+        k = ctypes.WinDLL("kernel32", use_last_error=True)
+        k.CreateJobObjectW.argtypes = (ctypes.c_void_p, wintypes.LPCWSTR)
+        k.CreateJobObjectW.restype = wintypes.HANDLE
+        k.SetInformationJobObject.argtypes = (wintypes.HANDLE, ctypes.c_int, ctypes.c_void_p, wintypes.DWORD)
+        k.SetInformationJobObject.restype = wintypes.BOOL
+        k.AssignProcessToJobObject.argtypes = (wintypes.HANDLE, wintypes.HANDLE)
+        k.AssignProcessToJobObject.restype = wintypes.BOOL
+        k.TerminateJobObject.argtypes = (wintypes.HANDLE, wintypes.UINT)
+        k.TerminateJobObject.restype = wintypes.BOOL
+        k.CloseHandle.argtypes = (wintypes.HANDLE,)
+        k.CloseHandle.restype = wintypes.BOOL
+        self._k = k
+        self.handle = k.CreateJobObjectW(None, None)
+        if not self.handle:
+            raise OSError(ctypes.get_last_error(), "CreateJobObjectW failed")
+        info = _Extended()
+        info.BasicLimitInformation.LimitFlags = 0x2000          # JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+        if not k.SetInformationJobObject(self.handle, 9, ctypes.byref(info), ctypes.sizeof(info)):
+            err = ctypes.get_last_error()
+            k.CloseHandle(self.handle)
+            raise OSError(err, "SetInformationJobObject failed")
+        if not k.AssignProcessToJobObject(self.handle, int(proc._handle)):  # type: ignore[attr-defined]
+            err = ctypes.get_last_error()
+            k.CloseHandle(self.handle)
+            raise OSError(err, "AssignProcessToJobObject failed")
+
+    def terminate(self) -> None:
+        self._k.TerminateJobObject(self.handle, 1)
+
+    def close(self) -> None:
+        self._k.CloseHandle(self.handle)
+
+
+def _kill_tree(proc: "subprocess.Popen", job: "_Job | None") -> None:
+    try:
+        if job is not None:
+            job.terminate()
+        elif os.name == "nt":
+            subprocess.run(["taskkill", "/T", "/F", "/PID", str(proc.pid)], capture_output=True,
+                           stdin=subprocess.DEVNULL, creationflags=_NO_WINDOW, timeout=5)
+        else:
+            os.killpg(proc.pid, signal.SIGKILL)
+    except Exception:
+        pass            # the kill is best effort; the caller still reports the timeout
+
+
+def _run_bounded(argv: list[str], cwd: str, timeout: float, env: dict) -> "int | None":
+    """Run `argv` with no stdin and no output. Returns its exit code, 1 when it cannot start, or None on timeout.
+    On a timeout the whole process tree is killed (job object on Windows, process group elsewhere). The tree is
+    also killed on any other way out, Ctrl+C included, and when this process dies (Windows job)."""
+    kwargs: dict = {"cwd": cwd, "env": env, "stdin": subprocess.DEVNULL, "stdout": subprocess.DEVNULL,
+                    "stderr": subprocess.DEVNULL}
+    if os.name != "nt":
+        kwargs["start_new_session"] = True
+    try:
+        proc = subprocess.Popen(argv, creationflags=(_NO_WINDOW | _NEW_PROCESS_GROUP) if os.name == "nt" else 0, **kwargs)
+    except (OSError, subprocess.SubprocessError):
+        return 1
+    job = None
+    if os.name == "nt":
+        try:
+            job = _Job(proc)
+        except Exception:
+            job = None          # no job object: taskkill /T is the fallback
+    try:
+        try:
+            return proc.wait(timeout=max(timeout, 0))
+        except subprocess.TimeoutExpired:
+            _kill_tree(proc, job)
+            try:
+                proc.wait(timeout=5)
+            except subprocess.SubprocessError:
+                pass
+            return None
+    except BaseException:
+        _kill_tree(proc, job)
+        raise
+    finally:
+        if job is not None:
+            job.close()
+
+
 def _default_ref(cwd: str) -> str:
     """The remote's default branch, e.g. origin/main. '' when there is no usable one."""
     code, out = _git(cwd, "symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD")
@@ -108,7 +254,12 @@ def _status_entries(top: str) -> list[list[str]]:
     """`git status --porcelain -z` at the repo top: one list of paths per entry (a rename gives two).
     NUL-separated, so a path is never quoted. [] when git fails."""
     try:
-        r = subprocess.run(["git", "status", "--porcelain", "-z"], cwd=top, capture_output=True, timeout=15)
+        left = _remaining()
+        if left <= 0:
+            return []
+        r = subprocess.run(["git", "--no-optional-locks", "status", "--porcelain", "-z"], cwd=top,
+                           capture_output=True, timeout=min(15, left), stdin=subprocess.DEVNULL,
+                           env=_git_env(), creationflags=_NO_WINDOW)
     except (OSError, subprocess.SubprocessError):
         return []
     if r.returncode != 0:
@@ -201,8 +352,31 @@ def _dirty_owners(top: str, dirty_paths: set[str], own_session_id: str = "") ->
         return []
 
 
+def _fetch(cwd: str) -> "bool | None":
+    """`git fetch origin` through the bounded runner. True = fetched, False = failed or timed out, None = skipped
+    because less than FETCH_TIMEOUT_S of the budget is left. Never raises. Maintenance is off for this one call:
+    a background `gc --auto` would be killed with the job and could leave its lock behind."""
+    left = _remaining()
+    if left < FETCH_TIMEOUT_S:
+        return None
+    argv = ["git", "-c", "gc.auto=0", "-c", "maintenance.auto=false", "fetch", "origin", "--quiet"]
+    try:
+        return _run_bounded(argv, cwd, min(FETCH_TIMEOUT_S, left), _git_env()) == 0
+    except Exception:
+        return False
+
+
 def report(cwd: str, own_session_id: str = "") -> list[str]:
     """The lines to print. Empty when there is nothing worth saying."""
+    global _deadline
+    _deadline = time.monotonic() + TOTAL_BUDGET_S
+    try:
+        return _report(cwd, own_session_id)
+    finally:
+        _deadline = None
+
+
+def _report(cwd: str, own_session_id: str = "") -> list[str]:
     if _git(cwd, "rev-parse", "--is-inside-work-tree")[0] != 0:
         return []                                   # not a git repository
     branch = _git(cwd, "branch", "--show-current")[1]
@@ -214,8 +388,12 @@ def report(cwd: str, own_session_id: str = "") -> list[str]:
     has_origin = "origin" in _git(cwd, "remote")[1].split()
     git_dir = _git(cwd, "rev-parse", "--absolute-git-dir")[1] or os.path.join(cwd, ".git")
     if has_origin and _fetch_is_due(git_dir):
-        if _git(cwd, "fetch", "origin", "--quiet", timeout=FETCH_TIMEOUT_S)[0] == 0:
+        fetched = _fetch(cwd)
+        if fetched:
             _mark_fetched(git_dir)
+        elif fetched is None:
+            lines.append("[HARNESS] skipped the fetch - the session-start time budget was nearly spent. "
+                         "The figures below may be stale.")
         else:
             lines.append("[HARNESS] could not fetch origin - the figures below may be stale.")
 

package/bundles/antigravity-plugin/scripts/caddis_adhoc.py

@@ -26,6 +26,14 @@ except ModuleNotFoundError as exc:
     sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
     import caddis_exit
 
+try:
+    import caddis_worktree_safety
+except ModuleNotFoundError as exc:
+    if exc.name != "caddis_worktree_safety":
+        raise
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    import caddis_worktree_safety
+
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8", errors="replace")
     sys.stderr.reconfigure(encoding="utf-8", errors="replace")
@@ -467,12 +475,10 @@ def run_adhoc(
                 if branch_res.returncode != 0:
                     reason = f"branch update failed: {branch_res.stderr.strip()}"
                 else:
-                    remove_res = subprocess.run(
-                        ["git", "-C", str(repo), "worktree", "remove", "--force", str(wt_path)],
-                        capture_output=True, text=True, encoding="utf-8", errors="replace",
-                    )
-                    if remove_res.returncode != 0 or wt_path.exists():
-                        reason = f"worktree remove failed: {remove_res.stderr.strip() or wt_path}"
+                    # An OSError from the helper (git not runnable) lands in the `except OSError` below.
+                    problem = caddis_worktree_safety.safe_remove_worktree(repo, wt_path)
+                    if problem or wt_path.exists():
+                        reason = problem or f"worktree remove failed: {wt_path}"
                     else:
                         kept_worktree = None
                         subprocess.run(["git", "-C", str(repo), "worktree", "prune"], capture_output=True)
@@ -603,12 +609,14 @@ def drop_adhoc(repo: Path) -> int:
         print(f"[mmr] Refusing to remove {kept_worktree}: not a registered lane/* worktree")
         return EXIT_FAIL
     if kept_worktree:
-        removed = subprocess.run(
-            ["git", "-C", str(repo), "worktree", "remove", "--force", kept_worktree],
-            capture_output=True, text=True, encoding="utf-8", errors="replace",
-        )
-        if removed.returncode != 0:
-            print(f"[mmr] Could not remove kept worktree: {removed.stderr.strip()}")
+        try:
+            problem = caddis_worktree_safety.safe_remove_worktree(repo, Path(kept_worktree))
+        except OSError as exc:
+            problem = f"{type(exc).__name__}: {exc}"
+        if not problem and os.path.lexists(kept_worktree):
+            problem = f"{kept_worktree} still exists after git worktree remove"
+        if problem:
+            print(f"[mmr] Could not remove kept worktree: {problem}")
             return EXIT_FAIL
         pruned = subprocess.run(
             ["git", "-C", str(repo), "worktree", "prune"],

package/bundles/antigravity-plugin/scripts/caddis_docs_pr.py

@@ -31,7 +31,6 @@ import datetime
 import json
 import os
 import re
-import shutil
 import subprocess
 import sys
 import tempfile
@@ -41,14 +40,16 @@ try:
     import caddis_exit
     import caddis_checkout_guard
     import caddis_roadmap as roadmap
+    import caddis_worktree_safety
 except ModuleNotFoundError as exc:
-    if exc.name not in {"caddis_exit", "caddis_checkout_guard", "caddis_roadmap"}:
+    if exc.name not in {"caddis_exit", "caddis_checkout_guard", "caddis_roadmap", "caddis_worktree_safety"}:
         raise
     sys.path.insert(0, str(Path(__file__).resolve().parent))
     sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
     import caddis_exit
     import caddis_checkout_guard
     import caddis_roadmap as roadmap
+    import caddis_worktree_safety
 
 BRANCH_PREFIX = "docs/handoff-"
 DIR_PREFIX = "caddis-docs-pr-"
@@ -199,14 +200,22 @@ def _save_patch(worktree: Path) -> Path:
 
 
 def _remove(main: Path, worktree: Path, branch: str) -> None:
-    for args in (("worktree", "remove", "--force", "--force", str(worktree)), ("worktree", "prune"),
-                 ("branch", "-D", branch)):
+    """Remove the worktree (links first, so a junction's target survives), prune, delete the branch.
+
+    Best effort, as before: the result of each step is not checked. Every caller has already saved the session's
+    work as a patch or has none, so a step that fails leaves only a temp folder. A folder that git leaves is
+    removed below through remove_tree, which also removes links first."""
+    try:
+        caddis_worktree_safety.safe_remove_worktree(main, worktree, force_locked=True, env=roadmap._quiet_env())
+    except OSError:
+        pass
+    for args in (("worktree", "prune"), ("branch", "-D", branch)):
         try:
             _git(main, *args, check=False)
         except (roadmap.RoadmapError, OSError):
             pass
     if worktree.exists():
-        shutil.rmtree(worktree, ignore_errors=True)
+        caddis_worktree_safety.remove_tree(worktree)
 
 
 def finish(worktree: Path, title: str, body: str, out=print) -> int:

package/bundles/antigravity-plugin/scripts/caddis_gate.py

@@ -647,8 +647,13 @@ def _numstat(rng: str | None = None, repo_root: Path = Path(".")) -> list[tuple[
     if res.returncode != 0:
         reason = (res.stderr or "").strip().splitlines()
         raise RuntimeError(f"git diff --numstat exited {res.returncode}: {reason[0] if reason else 'no message'}")
+    return _parse_numstat(res.stdout)
+
+
+def _parse_numstat(stdout: str) -> list[tuple[str, int]]:
+    """(path, changed-lines) per file from `git diff --numstat` output; see `_numstat`."""
     files: list[tuple[str, int]] = []
-    for row in res.stdout.splitlines():
+    for row in stdout.splitlines():
         parts = row.split("\t")
         if len(parts) != 3:
             continue

package/bundles/antigravity-plugin/scripts/caddis_lanes.py

@@ -36,6 +36,7 @@ except ModuleNotFoundError as exc:
 import caddis_routing
 import caddis_redact
 import caddis_spend
+import caddis_worktree_safety
 
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8", errors="replace")
@@ -265,7 +266,14 @@ def remove_phase_worktree(
     if delete_branch and not wt.branch.startswith("lane/"):
         raise LaneConfigError(f"refusing to delete non-lane branch: {wt.branch}")
 
-    _git_output(repo_root, "worktree", "remove", "--force", str(resolved))
+    try:
+        problem = caddis_worktree_safety.safe_remove_worktree(repo_root, resolved)
+    except OSError as exc:
+        raise LaneConfigError(f"worktree remove failed: {exc}") from exc
+    if not problem and os.path.lexists(resolved):
+        problem = f"worktree remove left {resolved} on disk"
+    if problem:
+        raise LaneConfigError(problem)
     _git_output(repo_root, "worktree", "prune")
     if delete_branch:
         _git_output(repo_root, "branch", "-D", "--", wt.branch)
@@ -1244,8 +1252,19 @@ def validate_codex_argv(argv: list[str]) -> None:
             )
 
 
+# Robustness #4: a lane agent can be prompt-injected through a plan or a diff, so it gets no publish token and no
+# credential prompt, and cannot switch the guard off. The same list as caddis_roadmap_run.SESSION_SECRET_VARS. The
+# gh keyring login stays on the machine; the guard denies push, merge and publish when CADDIS_HEADLESS=1.
+LANE_SECRET_VARS = ("GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "NPM_TOKEN", "NODE_AUTH_TOKEN",
+                    "CADDIS_ALLOW_PUBLISH", "CADDIS_GUARD_DISABLED")
+LANE_NO_PROMPT_ENV = {"GH_PROMPT_DISABLED": "1", "GIT_TERMINAL_PROMPT": "0"}
+
+
 def child_env(base: dict, lane: str, model: str) -> dict:
     env = base.copy()
+    for name in LANE_SECRET_VARS:
+        env.pop(name, None)
+    env.update(LANE_NO_PROMPT_ENV)
     env["CADDIS_HEADLESS"] = "1"
     if lane == "glm":
         env["OSS_MODEL"] = model
@@ -2132,6 +2151,20 @@ def _check_command(
     return exit_code
 
 
+_TERMINAL_ESCAPES = re.compile(
+    r"\x1b\[[0-?]*[ -/]*[@-~]"  # CSI (colours, cursor)
+    r"|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?"  # OSC (titles, links)
+    r"|\x1b[@-Z\\-_]"  # other two-byte escapes
+)
+_CONTROL_CHARS = re.compile(r"[\x00-\x09\x0b-\x1f\x7f]")
+
+
+def _printable(value: object) -> str:
+    """Text safe to print: no ANSI escapes and no C0 control characters except newline."""
+    text = _TERMINAL_ESCAPES.sub("", str(value if value is not None else ""))
+    return _CONTROL_CHARS.sub("", text)
+
+
 def _accept_command(
     args,
     repo: Path,
@@ -2151,12 +2184,26 @@ def _accept_command(
     if packet.get("next") != "review":
         print(f"refusing: packet next={packet.get('next')}")
         return EXIT_USAGE
-    review_status = packet.get("review", {}).get("status")
-    if review_status == "BLOCKING" and not getattr(args, "override_review", None):
-        print("refusing: review BLOCKING; pass --override-review with a reason")
+    # Fail closed: only an exact CLEAN verdict merges without an owner override.
+    review = packet.get("review") or {}
+    if not isinstance(review, dict):
+        review = {}
+    review_status = review.get("status")
+    override_reason = (getattr(args, "override_review", None) or "").strip()
+    if review_status != "CLEAN" and not override_reason:
+        if review_status == "BLOCKING":
+            print("refusing: review BLOCKING; pass --override-review with a reason")
+        else:
+            # MISSING = no verdict (provider down, 429, secret-filter refusal). Anything else
+            # that is not CLEAN (absent, null, unknown, lowercase) is also no valid verdict.
+            cause = " ".join(_printable(review.get("tail")).split())[-300:] or "no reason recorded"
+            label = (
+                "MISSING" if review_status == "MISSING"
+                else f"status {_printable(review_status)!r}"
+            )
+            print(f"refusing: review {label} (no verdict: {cause}); re-run the review, "
+                  "or pass --override-review with a reason")
         return EXIT_USAGE
-    if review_status == "MISSING":
-        print("WARNING: review MISSING")
     if _git_output(repo, "rev-parse", "HEAD") != packet.get("base_sha"):
         print("refusing: programme branch moved since the attempt started")
         return EXIT_FAIL
@@ -2178,6 +2225,11 @@ def _accept_command(
         packet["override_review"] = args.override_review
         write_packet(packet_path, packet)
         print(f"OVERRIDE REVIEW: {args.override_review}")
+        if review_status != "CLEAN":
+            print(
+                f"WARNING: merged without a vendor review (status {_printable(review_status)}): "
+                f"{args.override_review}"
+            )
     _git_output(wt.path, "add", "--", *(str(path) for path in files))
     _git_output(wt.path, "commit", "-m", args.message)
     accepted_sha = _git_output(wt.path, "rev-parse", "HEAD")

package/bundles/antigravity-plugin/scripts/caddis_relay_git.py

@@ -20,13 +20,18 @@ except ModuleNotFoundError as exc:
     import secret_filter
 
 
+# No child process opens a console window on Windows (this runs under hooks and status lines that
+# have no console). Inline, not scripts/no_window.py: in the source tree this file does not sit beside it.
+_NO_WINDOW = 0x08000000 if os.name == "nt" else 0
+
 MAX_NOTE_CHARS = 4000
 
 
 def _git(repo: Path, *args: str, input_data: bytes | None = None,
          env: dict[str, str] | None = None) -> bytes:
     result = subprocess.run(["git", *args], cwd=repo, env=env, input=input_data,
-                            stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False)
+                            stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False,
+                            creationflags=_NO_WINDOW)
     if result.returncode:
         # Name the subcommand, not a leading "-c key=value" option.
         command = next((arg for i, arg in enumerate(args) if not arg.startswith("-") and (i == 0 or args[i - 1] != "-c")), "?")
@@ -53,7 +58,8 @@ def _pre_send(note: str) -> None:
             "--- /dev/null\n+++ b/relay.md\n"
             f"@@ -0,0 +1,{len(lines)} @@\n" +
             "".join("+" + line + "\n" for line in lines))
-    result = secret_filter.filter_diff(diff, list(secret_filter.DEFAULT_DENY_GLOBS), [])
+    result = secret_filter.filter_diff(diff, list(secret_filter.DEFAULT_DENY_GLOBS), [],
+                                       env_assignment_everywhere=True)
     if result.hits or result.dropped_paths or not result.kept_diff:
         raise ValueError("relay refused by pre-send filter")