@caddis/cli 0.4.55 → 0.4.56

package/bundles/antigravity-plugin/scripts/no_window.py

@@ -0,0 +1,49 @@
+"""Start subprocesses without a visible console window on Windows. No dependencies.
+
+Why this exists
+---------------
+A process that has NO console (a Claude session started by VS Code, the `claude daemon`, a
+background session) makes Windows open a NEW, VISIBLE console for every console program it starts
+(git.exe, cmd, python, npx, ruff). Hooks and the status line run in exactly such sessions, so each
+`subprocess.run(["git", ...])` flashed a window (owner report, 19 Oct).
+
+`CREATE_NO_WINDOW` fixes it. The child gets a hidden console, and output captured through pipes
+still works. When the parent already has a console the flag is harmless.
+
+Never add `DETACHED_PROCESS`: Windows then ignores `CREATE_NO_WINDOW`, the child has no console,
+and every program it starts opens its own visible window. `merge()` clears that bit.
+
+Use
+---
+    from no_window import run                  # a drop-in for subprocess.run
+    subprocess.run(argv, **NO_WINDOW_KW)       # or spread the keywords yourself
+
+On POSIX `NO_WINDOW_KW` is empty and `merge()` returns the keywords unchanged.
+"""
+from __future__ import annotations
+
+import os
+import subprocess
+
+CREATE_NO_WINDOW = 0x08000000
+DETACHED_PROCESS = 0x00000008
+
+NO_WINDOW_KW = {"creationflags": CREATE_NO_WINDOW} if os.name == "nt" else {}
+
+
+def merge(kwargs: dict) -> dict:
+    """A copy of `kwargs` with CREATE_NO_WINDOW ORed into `creationflags` (Windows only)."""
+    out = dict(kwargs)
+    if os.name == "nt":
+        out["creationflags"] = (int(out.get("creationflags") or 0) & ~DETACHED_PROCESS) | CREATE_NO_WINDOW
+    return out
+
+
+def run(*args, **kwargs):
+    """subprocess.run that never opens a console window on Windows."""
+    return subprocess.run(*args, **merge(kwargs))
+
+
+def popen(*args, **kwargs):
+    """subprocess.Popen that never opens a console window on Windows."""
+    return subprocess.Popen(*args, **merge(kwargs))

package/bundles/antigravity-plugin/scripts/oss_review.py

@@ -608,6 +608,9 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
         secret_filter.DEFAULT_DENY_GLOBS + cfg_deny,
         cfg_allow + list(args.allow_path),
     )
+    for warn_path, warn_line, warn_rule in filter_result.warnings:
+        # Context lines are already in the repo: sending them adds no exposure. Name them anyway.
+        print(f"WARN  {warn_path}:{warn_line} ({warn_rule}) — already in the repo, not refused")
     if filter_result.hits:
         print("REVIEW: REFUSED — possible secrets:")
         for hit_path, hit_line, hit_rule in filter_result.hits:

package/bundles/antigravity-plugin/scripts/secret_filter.py

@@ -10,9 +10,31 @@ passes through `filter_diff()` first. It does two independent things, both fail-
    paths were excluded so the drop is visible, not invisible.
 2. **Content rules** — every hunk line of a file that was NOT dropped is scanned against
    `SECRET_RULES` (AWS keys, GitHub/Slack tokens, JWTs, PEM private keys, `key = "..."`-shaped
-   assignments). A hit refuses the ENTIRE review (not just that file) — a secret slipping past
-   the path denylist is exactly the case this second layer exists for, and the safe response to
-   "something here looks like a credential" is "send nothing", not "guess which part is safe".
+   assignments). A hit on an ADDED line refuses the ENTIRE review (not just that file) — a
+   secret slipping past the path denylist is exactly the case this second layer exists for, and
+   the safe response to "something here looks like a credential" is "send nothing", not "guess
+   which part is safe".
+
+What counts as a refusal (the rest is a WARN, or nothing):
+  - Added line: any rule refuses.
+  - Removed line: only the high-confidence rules refuse (`HIGH_CONFIDENCE_RULES`). The two
+    assignment heuristics do not: the text is leaving the code, and they guess.
+  - Context line: a high-confidence hit refuses too (the line would be SENT to the provider,
+    and a real key must not leave the machine). A hit of an assignment heuristic only goes to
+    `FilterResult.warnings`; the caller prints a WARN line, because the line is already in the
+    repo and the heuristic guesses.
+  - `env-assignment` (an unquoted `NAME_TOKEN=value`) runs only on env-like files (`.env*`,
+    `*.env`, shell, ini, yaml, tfvars, service, Dockerfile, files with no extension, ...). In
+    code, that shape is an ordinary assignment (`tokens = _ga_tokens(text)`). The quoted
+    `assignment` rule still runs on every file.
+  - An unquoted value in an env-like file is exempt only as a shell variable or substitution
+    (`$VAR` as the whole value, `${VAR}`, `$(cmd)`, a backtick command, or `$(...)` / `${...}`
+    anywhere in the value) or as a placeholder. Code shape proves nothing there: `SECRET=YWJj==.sig`,
+    `SAS=sv=2022-11-02&sig=abc123` and `PASS=ab#cdefgh12` are secrets. A quoted value is exempt
+    only as a placeholder, or as a CSS custom-property block (`--bg:#282a36;--fg:#f8f8f2`).
+  - A trailing `# caddis: not-secret` or `// caddis: not-secret` comment exempts that line from
+    the two assignment rules only. It is ignored inside a string and never exempts a
+    high-confidence rule.
 
 Deliberately out of scope, by design (see the plan's "Design (decided)"):
   - Removed-line hits use old-file line numbers and are marked `removed line`.
@@ -54,6 +76,7 @@ DEFAULT_DENY_GLOBS: list[str] = [
     "id_rsa*", "**/id_rsa*",
     "secrets.*", "**/secrets.*",
     "keys.env", "**/keys.env",
+    "*.env",  # prod.env, config/app.env: a leading `*` matches at any depth
 ]
 
 # `.env.example` / `.env.sample` / `.env.template` / `.env.dist` are template files with no
@@ -70,15 +93,111 @@ SECRET_RULES: list[tuple[str, re.Pattern]] = [
     ("github-token", re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,}\b")),
     ("slack-token", re.compile(r"\bxox[abprs]-[A-Za-z0-9-]{10,}\b")),
     ("jwt", re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b")),
+    ("github-pat", re.compile(r"\bgithub_pat_[A-Za-z0-9_]{22,}")),
+    ("aws-session-key", re.compile(r"\bASIA[0-9A-Z]{16}\b")),
+    ("openai-key", re.compile(r"\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}")),
+    ("anthropic-key", re.compile(r"\bsk-ant-[A-Za-z0-9_-]{20,}")),
+    ("google-api-key", re.compile(r"\bAIza[0-9A-Za-z_-]{35}")),
+    ("npm-token", re.compile(r"\bnpm_[A-Za-z0-9]{36}\b")),
+    ("slack-webhook", re.compile(r"https://hooks\.slack\.com/services/[A-Za-z0-9_/]+")),
+    # user:password@host in a URL. `value` is the password; placeholders are exempted in code.
+    ("url-credentials", re.compile(
+        r"[a-z][a-z0-9+.-]*://[^/\s:@]*:(?P<value>[^/\s@]{3,})@", re.I)),
+    # `name = "v"`, `name: "v"`, and a quoted key: `"name": "v"`, `'name': 'v'`.
     ("assignment", re.compile(
-        r"(?i)[A-Za-z0-9_]*(password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*\s*[:=]\s*['\"](?P<value>[^'\"\s]{8,})['\"]"
+        r"(?i)[A-Za-z0-9_]*(password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*['\"]?\s*[:=]\s*['\"](?P<value>[^'\"\s]{8,})['\"]"
     )),
     ("env-assignment", re.compile(
         r"^\s*(?:export\s+)?[A-Za-z0-9_]*(?:PASSWORD|PASSWD|SECRET|API_KEY|APIKEY|TOKEN|PRIVATE_KEY)"
-        r"[A-Za-z0-9_]*\s*=\s*(?P<value>[^\s'\"#]{8,})", re.I
+        r"[A-Za-z0-9_]*\s*=\s*(?P<value>[^\s'\"]{8,})", re.I
     )),
 ]
 
+# Rules that match a fixed credential format. These refuse on added, removed AND context lines
+# and ignore the `caddis: not-secret` marker. The two assignment rules are heuristics and get none
+# of that.
+ASSIGNMENT_RULES = frozenset({"assignment", "env-assignment"})
+HIGH_CONFIDENCE_RULES = frozenset({
+    "private-key", "aws-key", "github-token", "slack-token", "jwt",
+    "github-pat", "aws-session-key", "openai-key", "anthropic-key", "google-api-key",
+    "npm-token", "slack-webhook", "url-credentials",
+})
+
+# A trailing comment only: `# caddis: not-secret` or `// caddis: not-secret` at the end of the
+# line, and not inside a string (see `_has_not_secret_marker`).
+_TRAILING_MARKER = re.compile(r"(?:#|//)\s*caddis:\s*not-secret\s*$", re.I)
+
+# `env-assignment` runs only on these files (matched on the file name, not the directory).
+_ENV_LIKE_SUFFIXES = frozenset({
+    ".sh", ".bash", ".zsh", ".ps1", ".psm1", ".bat", ".cmd", ".ini", ".cfg", ".conf", ".toml",
+    ".yaml", ".yml", ".properties", ".env", ".tfvars", ".service",
+})
+
+
+def _is_env_like(path: str) -> bool:
+    name = path.replace("\\", "/").rsplit("/", 1)[-1].lower()
+    if name.startswith((".env", "dockerfile")):
+        return True
+    suffix = Path(name).suffix
+    return suffix == "" or suffix in _ENV_LIKE_SUFFIXES
+
+
+def _inside_string(prefix: str) -> bool:
+    """True when `prefix` ends inside an open '...' or "..." string."""
+    quote = None
+    i = 0
+    while i < len(prefix):
+        c = prefix[i]
+        if quote:
+            if c == "\\":
+                i += 2
+                continue
+            if c == quote:
+                quote = None
+        elif c in "'\"":
+            quote = c
+        i += 1
+    return quote is not None
+
+
+def _has_not_secret_marker(content: str) -> bool:
+    match = _TRAILING_MARKER.search(content)
+    return bool(match) and not _inside_string(content[:match.start()])
+
+
+# `--bg:#282a36;--fg:#f8f8f2`: a CSS custom-property block held in a quoted string.
+_CSS_DECLARATIONS = re.compile(r"(?:--[A-Za-z0-9_-]+:[^;\s]+;?)+")
+# $(cmd) `cmd` ${VAR}. A bare `$VAR` is exempt only as the WHOLE value, through
+# `_is_placeholder`: a value that merely starts with `$` (`$ecretP@ss`, `$argon2id$...`) is a secret.
+_SHELL_START = re.compile(r"\$\(|`|\$\{")
+_SHELL_SUBSTITUTION = re.compile(r"\$\([^)]*\)|\$\{[^}]*\}")  # $(...) or ${...} anywhere
+
+
+def _is_not_secret_value(value: str, *, quoted: bool) -> bool:
+    """True when the value is a CSS block (quoted) or a shell variable or substitution (unquoted).
+
+    A QUOTED value is a string literal, so code shape proves nothing: `"Sec;ret(1)"` and
+    `"P@ssw0rd#2026!"` are passwords. Only a CSS custom-property block is exempt (the
+    placeholder check happens in the caller).
+
+    An UNQUOTED value reaches this rule only in an env-like file, where values are not code:
+    `SECRET=YWJj==.sig`, `SAS=sv=2022-11-02&sig=abc123`, `PASS=ab#cdefgh12` and
+    `KEY=correct_horse` are secrets. Only a shell reference is exempt: a value that starts with
+    `$(`, a backtick or `${`, or holds `$(...)` / `${...}` in any position. A bare `$name` is
+    exempt only as the whole value (a placeholder); `$argon2id$v=19$...` is a hash.
+    """
+    if quoted:
+        return bool(_CSS_DECLARATIONS.fullmatch(value))
+    return bool(_SHELL_START.match(value) or _SHELL_SUBSTITUTION.search(value))
+
+
+_URL_PASSWORD_PLACEHOLDERS = frozenset({"password", "pass", "passwd", "pwd", "secret", "token"})
+
+
+def _is_url_password_placeholder(value: str) -> bool:
+    return (_is_placeholder(value) or value.lower() in _URL_PASSWORD_PLACEHOLDERS
+            or bool(re.fullmatch(r"\{[^}]*\}|%s|%\([^)]*\)s", value)))
+
 
 def _is_placeholder(value: str) -> bool:
     """Exclude obvious template values from both assignment rules."""
@@ -99,6 +218,8 @@ class FilterResult:
     kept_diff: str
     dropped_paths: list[str] = field(default_factory=list)
     hits: list[tuple[str, int, str]] = field(default_factory=list)  # (path, side's line, rule/removed marker)
+    # Context-line matches: already in the repo, so reported (WARN) but never a refusal.
+    warnings: list[tuple[str, int, str]] = field(default_factory=list)
 
 
 # A new file block starts at a line beginning "diff --git a/..." (the common, unquoted case)
@@ -213,9 +334,38 @@ def _is_denied(path: str, deny_globs: list[str], allow_globs: list[str]) -> bool
     return not any(fnmatch.fnmatchcase(path, glob) for glob in allow_globs)
 
 
-def _scan_added_lines(block: str, path: str) -> list[tuple[str, int, str]]:
-    """Scan all hunk lines; removed hits use old-file line numbers."""
+def _line_matches(content: str, env_like: bool) -> list[str]:
+    """Names of the rules that match one line of content, after every exemption.
+
+    Every match of a rule is checked, so a real secret that follows a placeholder on the same
+    line (a JSON object with a placeholder key first and a real one second) is still caught.
+    """
+    marked = _has_not_secret_marker(content)
+    names: list[str] = []
+    for rule_name, pattern in SECRET_RULES:
+        if rule_name in ASSIGNMENT_RULES and marked:
+            continue
+        if rule_name == "env-assignment" and not env_like:
+            continue
+        for match in pattern.finditer(content):
+            if rule_name in ASSIGNMENT_RULES:
+                value = match.group("value")
+                if _is_placeholder(value) or _is_not_secret_value(
+                        value, quoted=rule_name == "assignment"):
+                    continue
+            elif rule_name == "url-credentials" and _is_url_password_placeholder(
+                    match.group("value")):
+                continue
+            names.append(rule_name)
+            break
+    return names
+
+
+def _scan_block(block: str, path: str, env_like: bool) -> tuple[list[tuple[str, int, str]],
+                                                                  list[tuple[str, int, str]]]:
+    """Scan all hunk lines; return (hits, warnings). Removed hits use old-file line numbers."""
     hits: list[tuple[str, int, str]] = []
+    warnings: list[tuple[str, int, str]] = []
     new_line: int | None = None
     old_line: int | None = None
     for line in block.splitlines():
@@ -231,16 +381,18 @@ def _scan_added_lines(block: str, path: str) -> list[tuple[str, int, str]]:
             content = line[1:]
             removed = line.startswith("-")
             context = line.startswith(" ")
-            for rule_name, pattern in SECRET_RULES:
-                match = pattern.search(content)
-                if match and not (rule_name in {"assignment", "env-assignment"}
-                                  and _is_placeholder(match.group("value"))) and not (
-                                      rule_name == "env-assignment" and
-                                      re.fullmatch(r"[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+",
-                                                   match.group("value"))):
-                    marker = (f"{rule_name}, removed line" if removed else
-                              f"{rule_name}, context line" if context else rule_name)
-                    hits.append((path, old_line if removed else new_line, marker))
+            for rule_name in _line_matches(content, env_like):
+                if context:
+                    # A real key on a context line is still SENT to the provider.
+                    if rule_name in HIGH_CONFIDENCE_RULES:
+                        hits.append((path, new_line, f"{rule_name}, context line"))
+                    else:
+                        warnings.append((path, new_line, f"{rule_name}, context line"))
+                elif removed:
+                    if rule_name in HIGH_CONFIDENCE_RULES:
+                        hits.append((path, old_line, f"{rule_name}, removed line"))
+                else:
+                    hits.append((path, new_line, rule_name))
             if removed:
                 old_line += 1
             elif not context:
@@ -251,13 +403,25 @@ def _scan_added_lines(block: str, path: str) -> list[tuple[str, int, str]]:
         else:
             old_line += 1
             new_line += 1  # context line exists in both files
-    return hits
+    return hits, warnings
+
+
+def _scan_added_lines(block: str, path: str,
+                      env_assignment_everywhere: bool = False) -> list[tuple[str, int, str]]:
+    """The refusing hits of `_scan_block` (kept for callers that want only those)."""
+    return _scan_block(block, path, env_assignment_everywhere or _is_env_like(path))[0]
 
 
-def filter_diff(diff_text: str, deny_globs: list[str], allow_globs: list[str]) -> FilterResult:
-    """Drop denylisted-path file blocks, then scan changed lines in kept blocks."""
+def filter_diff(diff_text: str, deny_globs: list[str], allow_globs: list[str],
+                env_assignment_everywhere: bool = False) -> FilterResult:
+    """Drop denylisted-path file blocks, then scan the hunk lines in kept blocks.
+
+    `env_assignment_everywhere` runs `env-assignment` on every file type. Use it for text that
+    is not a diff of real files (the relay note is prose in a synthetic `.md` file).
+    """
     dropped_paths: list[str] = []
     hits: list[tuple[str, int, str]] = []
+    warnings: list[tuple[str, int, str]] = []
     kept_parts: list[str] = []
     for block in _split_into_file_blocks(diff_text):
         first_line = block.splitlines()[0] if block else ""
@@ -268,9 +432,13 @@ def filter_diff(diff_text: str, deny_globs: list[str], allow_globs: list[str]) -
         if denied:
             dropped_paths.append(denied)
             continue
-        hits.extend(_scan_added_lines(block, path))
+        block_hits, block_warnings = _scan_block(
+            block, path, env_assignment_everywhere or _is_env_like(path))
+        hits.extend(block_hits)
+        warnings.extend(block_warnings)
         kept_parts.append(block)
-    return FilterResult(kept_diff="".join(kept_parts), dropped_paths=dropped_paths, hits=hits)
+    return FilterResult(kept_diff="".join(kept_parts), dropped_paths=dropped_paths, hits=hits,
+                        warnings=warnings)
 
 
 def load_config(repo: Path) -> tuple[list[str], list[str]]:

package/bundles/antigravity-plugin/scripts/setup_project_ai.py

@@ -369,7 +369,8 @@ def check_venv(target: Path, install: bool, dry: bool) -> list[str]:
         notes.append("venv: .venv present — ok")
     elif install and not dry:
         import subprocess
-        subprocess.run([sys.executable, "-m", "venv", str(venv)], check=False)
+        subprocess.run([sys.executable, "-m", "venv", str(venv)], check=False,
+                       creationflags=0x08000000 if os.name == "nt" else 0)
         notes.append("venv: created .venv (install dev deps: .venv/Scripts/pip install -e .[dev])")
     else:
         notes.append("venv: MISSING — create with `python -m venv .venv` then "

package/bundles/antigravity-plugin/session_end_agy.py

@@ -23,6 +23,19 @@ import subprocess
 import sys
 from datetime import datetime, timezone
 
+# No child process of this hook opens a console window on Windows (scripts/no_window.py). agy hooks ship
+# FLAT at the plugin root with scripts/ beside them; in the source repo scripts/ is one level up.
+try:
+    _nw_here = os.path.dirname(os.path.abspath(__file__))
+    for _nw_cand in (os.path.join(_nw_here, "scripts"), os.path.join(os.path.dirname(_nw_here), "scripts")):
+        if os.path.isfile(os.path.join(_nw_cand, "no_window.py")):
+            if _nw_cand not in sys.path:
+                sys.path.insert(0, _nw_cand)
+            break
+    from no_window import NO_WINDOW_KW  # noqa: E402
+except Exception:  # pragma: no cover - defensive
+    NO_WINDOW_KW = {"creationflags": 0x08000000} if os.name == "nt" else {}
+
 
 def _artifact_root(root: str) -> str:
     return os.path.join(str(root), ".caddis")
@@ -39,7 +52,7 @@ def _repo_root(path: str):
     try:
         done = subprocess.run(
             ["git", "-C", str(path), "rev-parse", "--show-toplevel"],
-            capture_output=True, text=True, timeout=5,
+            capture_output=True, text=True, timeout=5, **NO_WINDOW_KW,
         )
         top = done.stdout.strip()
         return os.path.normpath(top) if done.returncode == 0 and top else None

package/bundles/antigravity-plugin/skills/cloud-phases/SKILL.md

@@ -117,7 +117,8 @@ internal host names, no machine paths and no credentials.
 
 ```
 git add <each prompt file by name>
-git commit -m "docs(prompts): cloud prompts for <feature> phases <N, M>"
+git diff --cached --name-only   # must list only the prompt files; else stop and report
+git commit -m "docs(prompts): cloud prompts for <feature> phases <N, M>" -- <each prompt file>
 git push -u origin <feature branch>
 git rev-parse HEAD
 git ls-remote origin refs/heads/<feature branch>

package/bundles/antigravity-plugin/skills/gh-cli/SKILL.md

@@ -168,7 +168,7 @@ gh alias set review 'pr list --search "review-requested:@me"'
 ```bash
 gh issue develop 42 --branch fix/issue-42
 git add src/auth/login.py tests/test_login.py   # named files only, never `git add .`
-git commit -m "fix: resolve login bug" && git push -u origin HEAD
+git commit -m "fix: resolve login bug" -- src/auth/login.py tests/test_login.py && git push -u origin HEAD
 gh pr create --title "fix: resolve login bug" --body "Closes #42"
 gh pr checks --watch
 gh pr merge --squash --delete-branch

package/bundles/antigravity-plugin/skills/git-commit/SKILL.md

@@ -87,9 +87,8 @@ Optional area of change:
    # Stage specific files
    git add path/to/file1 path/to/file2
 
-   # Stage by pattern
-   git add *.test.*
-   git add src/components/*
+   # Never stage by pattern or folder (`*.test.*`, `src/components/`): a pattern also takes
+   # files you did not change, and the caddis guard denies it. Name each file.
    ```
 
    **Never stage secrets** (`.env`, `credentials.json`, private keys).

package/bundles/antigravity-plugin/skills/implement/SKILL.md

@@ -46,7 +46,9 @@ depend on them:
   the project's test command anywhere (config, CI, package scripts). The runner treats any such edit as
   tampering and fails the run. If the plan asks you to touch these, skip that step and note it in the
   review file instead.
-- **Commit per phase, on this branch, with a normal commit.** Use `git add <paths> && git commit -m "…"`.
+- **Commit per phase, on this branch, with a normal commit.** Use `git add <paths>`, then check `git diff --cached --name-only` lists only those paths (refuse on any
+  other staged path: a peer staged it; note it in the review file), then `git commit -m "…" -- <paths>`.
+  Never `git add -A`, `.`, `-u` or a folder, and never `git commit -a` (the guard denies them).
   Do not use `--no-verify` (a pre-commit hook guards the branch — let it run). Do not amend or rebase
   prior commits. One phase → one (or more) commit(s); never one giant end-of-run commit.
 - **Never ask a question, never pause, never wait for input.** No human will answer. Never use
@@ -164,8 +166,11 @@ row, visible to any later reader without anyone having to catch it live.
      so it proves timing by design.
 3. **ACCEPT** means run `caddis_lanes.py accept --plan <plan> --phase N --attempt K --message
    "<the phase's commit message>"`. It runs only on the programme branch, never on `main`. It
-   refuses a `BLOCKING` review. If you checked the finding and it is false, add
-   `--override-review "<why the finding is false>"`. The script records that reason in the packet.
+   refuses a `BLOCKING` review and a `MISSING` review (no verdict: provider down, 429, filter
+   refusal). If you checked the finding and it is false, add
+   `--override-review "<why the finding is false>"`. For a `MISSING` review, re-run the review
+   first; add the override only if the owner accepts a phase with no vendor verdict. The reason
+   must not be empty. The script records it in the packet.
 4. Allow at most **2 attempts** per phase on a non-Claude lane. An out-of-budget switch is not an
    attempt. The owner can request TAKEOVER at any time.
 5. A UI phase needs a `ui-design-reviewer` screenshot review before ACCEPT. This rule applies
@@ -234,7 +239,8 @@ report — do not redo completed work.
    - **REFACTOR** — clean names/structure/duplication while keeping green.
    - **VERIFY** — run the phase's exit-gate check (the literal command the plan names) and the relevant
      suite so you didn't regress. Do not claim a state you did not run.
-   - **COMMIT** — `git add` the phase's files and `git commit` with the phase's conventional-commit message
+   - **COMMIT** — `git add` the phase's files by name, check `git diff --cached --name-only` shows only
+     them, and `git commit -m "…" -- <files>` with the phase's conventional-commit message
      (from the plan, or a faithful equivalent). Stay on the current branch.
    - **UPDATE THE TRACKER** — edit the plan's `## Tracker` row for this phase: set Status to `done`, fill
      the short commit hash (`git rev-parse --short HEAD`), set the `Lane` column to the lane this phase
@@ -303,8 +309,9 @@ for a later session to clean up, and nothing is left uncommitted. Order matters:
    no other file. **Refuse** if it would touch anything else, or prints `ERROR` or `NOT MOVED`:
    stop, do not commit the move, and report the output in the review file.
 3. `git add` the moved plan by name (`.caddis/plans/done/<plan>.md`, so the status and Tracker edits
-   are staged with the rename), then make the final commit. The move, the status and the last
-   Tracker row land in one commit.
+   are staged with the rename), then make the final commit with
+   `git commit -m "…" -- .caddis/plans/<plan>.md .caddis/plans/done/<plan>.md` (both sides of the
+   rename). The move, the status and the last Tracker row land in one commit.
 
 (Falls back to `scripts/caddis_tidy.py` from a source checkout; **skip this step if the script is
 missing** — degrades open, same as the gates in Step 1.) A **collision** (`done/<name>` already

package/bundles/antigravity-plugin/skills/pr-merge/SKILL.md

@@ -168,7 +168,7 @@ Cleanup:       remote branch deleted / local branch deleted / backup ref dropped
 
 - Never merge a PR whose required checks are red or absent.
 - Never delete a feature branch before its merge is confirmed and any deploy validated.
-- Never `git add -A`, `git add .` or `git add <dir>`, even after reading `git status`: stage named files only (the guard denies the first two).
+- Never `git add -A`, `git add .` or `git add <dir>`, even after reading `git status`: stage named files only (the guard denies all three, and `git add -u` and `git commit -a`). Commit with `git commit -m "..." -- <files>`, after `git diff --cached --name-only` shows only those files.
 - Never force-push without a `backup/*-preship` recovery ref; force pushes are `--force-with-lease` only.
 - Never edit a workflow file (`.gitea/workflows/`, `.github/workflows/`) to make a gate pass — fix the source.
 - Local-only lane: refuse + point at `/ship`. On the default branch: stop + point at `/ship`.

package/bundles/antigravity-plugin/skills/refactoring/SKILL.md

@@ -128,7 +128,8 @@ Activate when:
    ```bash
    git status --short          # stage the files you changed, by name
    git add tests/test_<module>.py
-   git commit -m "chore: add tests before refactoring"
+   git diff --cached --name-only  # only the files you named
+   git commit -m "chore: add tests before refactoring" -- tests/test_<module>.py
    ```
 
 ---
@@ -387,7 +388,8 @@ DEPRECATED_VALUE = 5              # Not referenced
 
 2. **If tests pass, commit**
    ```bash
-   git commit -m "refactor: extract validation to separate method"
+   git add <files you changed>
+   git commit -m "refactor: extract validation to separate method" -- <files you changed>
    ```
 
 3. **If tests fail, revert**

package/bundles/antigravity-plugin/skills/roadmap/SKILL.md

@@ -89,8 +89,26 @@ python scripts/caddis_roadmap.py recheck --roadmap <slug>
   `Depends on` milestone `done` or `not-needed`, and no open blocker other than `data-condition` (exit 1 names it),
   then runs the Exit check (300 s): pass -> `done`; fail with a `data-condition` blocker -> `code-done/data-pending`;
   fail otherwise -> an `external` blocker
-  `exit check failing (exit <n>)` (never the command's output). A milestone with no phase refs and no Exit check is
-  refused (exit 4).
+  `exit check failing (exit <n>): <tail>` (the last 3 non-empty output lines on one line, the whole reason at most
+  200 characters, masked as below). The part before `: ` is the blocker's identity: a later rollup adds no second
+  row, and `unblock --reason "exit check failing (exit <n>)"` removes every row of that prefix. A check that fails
+  on a missing environment (exit 9009/127/126, or output in its last 40 lines such as `No module named`,
+  `Cannot find module`, `ENOENT`, `run npm run build first`) is exit 3: no blocker, no PR. Either way the last 64 KB
+  of output (masked the same way) go to `.local/exit-check-<id>-<utc>.log` (the newest 10 stay), and rollup prints
+  the path. A milestone with no phase refs and no Exit check is refused (exit 4).
+  **Masked** in the reason and the log: the values of secret-named variables (`caddis_redact`); a whole
+  `-----BEGIN ... PRIVATE KEY-----` block up to its END line (or the end of the output); AWS, GitHub, Slack and JWT
+  tokens; a quoted value after a `password`/`secret`/`api_key`/`token` name, spaces included; an unquoted
+  `*PASSWORD*=`/`*TOKEN*=`-style line value; URL credentials (`scheme://***@`); and absolute paths as `<path>`: a
+  drive or UNC path up to the end of the line, a quote, `<`, `>` or `|`, and a `/home/`, `/Users/`, `/tmp/`, `/root/`,
+  `/var/`, `/etc/` or `/opt/` path up to the end of the line or a quote. Other text is published as printed.
+- **`**Exit setup:** <command>`** (optional, one per roadmap, beside `Runner host:`; no `|`) runs in the temp worktree
+  before every Exit check (900 s). It must install fresh into that worktree, for example
+  `python -m venv .venv && .venv\Scripts\pip install -e .[dev]` or `npm ci && npm run build`. Each command runs in a
+  new shell, so the Exit check must call the venv itself: `.venv\Scripts\python -m pytest tests -q`, not
+  `python -m pytest`. Never link or junction a shared venv or `node_modules`: the worktree is removed with `--force`
+  after the check. A setup that fails or times out is exit 3 and writes nothing; the runner stops
+  `BLOCKED rollup not run` and the owner decides (the stop names a docs PR that was opened but not merged).
 - **Owner-only changes:** `set` Status `not-needed`, any `set` Owner, `unblock` of an `owner-gate`, and `block --check`
   (recheck runs that command unattended later). They need `--by-owner` and are refused headless: `CADDIS_HEADLESS`
   or `CLAUDECODE` in the environment (even empty), stdin not a terminal, or on
@@ -179,8 +197,8 @@ Stops (each one notifies and releases the lock): a STOP file (`~/.caddis/STOP` o
 `caddis_spend.py` still counts across runs), a lock or batch claim that cannot be written
 (`BLOCKED claim not written`, before any session), the agy spend cap refusing a reservation, three sessions
 with no newly merged phase, a roadmap write that fails, and the **snapshot guard**: one baseline for the whole run.
-The Milestones and Blockers tables (every cell of every row, rows added, removed or moved) and the `Runner host` line
-are frozen. Every origin read (each `next`, after the runner's own writes, after each session) is compared with the
+The Milestones and Blockers tables (every cell of every row, rows added, removed or moved), the `Runner host` line
+and the `**Exit setup:**` line are frozen. Every origin read (each `next`, after the runner's own writes, after each session) is compared with the
 previous one; the only differences allowed are the exact edits the runner itself made and recorded for that read: a
 Status it set, a blocker row it added, and what a rollup's audit entry (`changes.jsonl`) says it actually wrote.
 Anything else stops the run `FAILED roadmap changed`.
@@ -206,7 +224,10 @@ refuses a plan that a roadmap lock names, at start and before every session. `-D
 the session command, the worktree and any pending rollup, skips the host check, writes no files and starts nothing; it
 does run `git fetch`, which updates the remote-tracking refs. `-GhAccount <login>` (recorded in the launch options,
 passed on by the recheck task and in the printed task) makes every gh call of the runner and of `--last-stop` use
-GH_TOKEN from `gh auth token -u <login>`; on a machine with several gh logins, give the repo's account. A gh call that
+GH_TOKEN from `gh auth token -u <login>`; on a machine with several gh logins, give the repo's account. The sessions
+never get that token, nor GH_TOKEN, GITHUB_TOKEN, GH_ENTERPRISE_TOKEN, NPM_TOKEN or NODE_AUTH_TOKEN from the
+environment; with CADDIS_HEADLESS=1 the guard denies `git push`, `gh pr merge|create`, `gh release`, a write through
+`gh api`, `gh workflow run` and package publishes. Only the runner publishes. A gh call that
 cannot answer (gh missing, 401, 404) is an error, never "not merged": the run stops
 `BLOCKED gh cannot see <repo> with account <login>`, notified and recorded.
 
@@ -223,7 +244,8 @@ phases) holds the whole plan for every other roadmap and for plan mode. At the t
 every milestone that waits only for its rollup (Status not finished, every phase merged, and the same rule as
 `next`: no blocker, dependencies finished, Owner the runner); `--last-stop` says `rollup-ready:` for such a milestone,
 so recheck restarts the runner. A sweep rollup that writes nothing stops `BLOCKED rollup of <id> wrote nothing`
-(recorded, not restartable) and is not retried or reported until the roadmap changes. The dry run lists them first. If
+(recorded, not restartable) and is not retried or reported until the roadmap changes. A rollup that exits 3 (its
+exit check or Exit setup could not run) stops `BLOCKED rollup not run: <id> ...` (not restartable; the owner decides). The dry run lists them first. If
 the owner edits the roadmap during a merge wait, the restart stops `FAILED roadmap changed ...` and names the
 recovery: `roadmap-run.ps1 -Roadmap <slug> -AcceptRoadmap` (owner only, refused headless) takes the runner lock (a live
 runner refuses it), prints the diff from the published baseline, asks you to type `accept` (or `--yes`), and accepts

package/bundles/antigravity-plugin/skills/roadmap/assets/review-protocol.md

@@ -1,15 +1,15 @@
 ---
 type: reference
 title: Review protocol
-description: The review method one model can rely on - invariants, inputs and writers, shared state, execute what the change promises, tests, docs, then severity (only blocking stops the merge; each finding needs a reproduction), one FINDING line per finding and an END REVIEW line. caddis_review.py sends it to every review run.
+description: The review method one model can rely on - invariants, inputs and writers, shared state, check what the change promises, tests, docs, then severity (only blocking stops the merge; each finding needs a reproduction), one FINDING line per finding and an END REVIEW line. caddis_review.py sends it to every review run.
 status: current
 ---
 
 # Review protocol (generic, any diff)
 
-You review a diff. You do NOT edit, create or delete files, and you do not commit. You may read files and run commands
-(tests, dry runs, the commands that plans, cards and docs name). Work through ALL steps in order. Do not stop at the
-first finding. Include a short section per step, in order.
+You review a diff. You read only: you have Read, Grep and Glob and no shell, so you run no test and no command, and
+you do not edit, create or delete files. The diff is in the prompt. Tests are the implementer's and CI's job. Work
+through ALL steps in order. Do not stop at the first finding. Include a short section per step, in order.
 
 ## Step 1 - Purpose and invariants
 Read the card, the plan or design section it cites, and the diff. Write the list of INVARIANTS this change must keep:
@@ -26,12 +26,14 @@ accident or on purpose? This includes the agent or session the code is meant to
 List state that two runs, two kinds of target, or two processes could share (files, locks, relays, logs, caches).
 Can they collide? Can one read the other's output as its own?
 
-## Step 4 - Execute what the change promises
-Run the tests the card names. Then run every command that the plan, its exit gates, the docs or the skill text say
-should work for this change (dry runs, the documented usage lines), exactly as written. Use the repo's OWN fixtures
-and example files, not ones you build, and run unattended scripts (hooks, runners) as they are really run (as a script,
-with a real payload). Compare risky behaviour with the parent commit when the change claims to fix or tighten
-something. Report any that fail or that cannot work as documented.
+## Step 4 - Check what the change promises
+For every command that the plan, its exit gates, the docs or the skill text say should work for this change (the
+documented usage lines, exactly as written), follow it through the code by reading: the argument parsing, the paths it
+reads and writes, the repo's OWN fixtures and example files. Read unattended scripts (hooks, runners) as they are
+really run (as a script, with a real payload). Compare risky behaviour with the code before the change (the `-` lines
+of the diff) when the change claims to fix or tighten something. Report any that would fail or that cannot work as
+documented. For a check you cannot settle by reading, write one line `not executed: <command> (reviewer has no
+shell)`.
 
 ## Step 5 - Tests
 For each new or changed test: could it pass for the wrong reason (no assertion that can fail, mocked away the thing
@@ -52,9 +54,10 @@ Severity rule. Only **blocking** stops the merge, so use it with care:
   negative test, a doc that is wrong in a way that does not make a command fail, an error message that misleads.
 - **nit** = style and wording.
 
-Every finding needs a concrete reproduction: a command, an input or a test that shows the failure, written in the
-failure scenario. A finding without a reproduction is a **nit**, whatever its severity would otherwise be. Do not
-write "might", "could in theory" or "a future change may": show it or call it a nit.
+Every finding needs a concrete reproduction: a command, an input or a test that would show the failure, written in
+the failure scenario (you do not run it; the implementer does). A finding without a reproduction is a **nit**,
+whatever its severity would otherwise be. Do not write "might", "could in theory" or "a future change may": show it
+or call it a nit.
 
 The gate exits by the findings. A **blocking** finding fails it. **should-fix** and **nit** findings do not: they are
 listed in the report under "Follow-up (not blocking)". The tool allows 3 completed review rounds for a phase; the 4th completed round