@caddis/cli 0.4.55 → 0.4.57

package/bundles/antigravity-plugin/scripts/secret_filter.py

@@ -10,9 +10,31 @@ passes through `filter_diff()` first. It does two independent things, both fail-
    paths were excluded so the drop is visible, not invisible.
 2. **Content rules** — every hunk line of a file that was NOT dropped is scanned against
    `SECRET_RULES` (AWS keys, GitHub/Slack tokens, JWTs, PEM private keys, `key = "..."`-shaped
-   assignments). A hit refuses the ENTIRE review (not just that file) — a secret slipping past
-   the path denylist is exactly the case this second layer exists for, and the safe response to
-   "something here looks like a credential" is "send nothing", not "guess which part is safe".
+   assignments). A hit on an ADDED line refuses the ENTIRE review (not just that file) — a
+   secret slipping past the path denylist is exactly the case this second layer exists for, and
+   the safe response to "something here looks like a credential" is "send nothing", not "guess
+   which part is safe".
+
+What counts as a refusal (the rest is a WARN, or nothing):
+  - Added line: any rule refuses.
+  - Removed line: only the high-confidence rules refuse (`HIGH_CONFIDENCE_RULES`). The two
+    assignment heuristics do not: the text is leaving the code, and they guess.
+  - Context line: a high-confidence hit refuses too (the line would be SENT to the provider,
+    and a real key must not leave the machine). A hit of an assignment heuristic only goes to
+    `FilterResult.warnings`; the caller prints a WARN line, because the line is already in the
+    repo and the heuristic guesses.
+  - `env-assignment` (an unquoted `NAME_TOKEN=value`) runs only on env-like files (`.env*`,
+    `*.env`, shell, ini, yaml, tfvars, service, Dockerfile, files with no extension, ...). In
+    code, that shape is an ordinary assignment (`tokens = _ga_tokens(text)`). The quoted
+    `assignment` rule still runs on every file.
+  - An unquoted value in an env-like file is exempt only as a shell variable or substitution
+    (`$VAR` as the whole value, `${VAR}`, `$(cmd)`, a backtick command, or `$(...)` / `${...}`
+    anywhere in the value) or as a placeholder. Code shape proves nothing there: `SECRET=YWJj==.sig`,
+    `SAS=sv=2022-11-02&sig=abc123` and `PASS=ab#cdefgh12` are secrets. A quoted value is exempt
+    only as a placeholder, or as a CSS custom-property block (`--bg:#282a36;--fg:#f8f8f2`).
+  - A trailing `# caddis: not-secret` or `// caddis: not-secret` comment exempts that line from
+    the two assignment rules only. It is ignored inside a string and never exempts a
+    high-confidence rule.
 
 Deliberately out of scope, by design (see the plan's "Design (decided)"):
   - Removed-line hits use old-file line numbers and are marked `removed line`.
@@ -54,6 +76,7 @@ DEFAULT_DENY_GLOBS: list[str] = [
     "id_rsa*", "**/id_rsa*",
     "secrets.*", "**/secrets.*",
     "keys.env", "**/keys.env",
+    "*.env",  # prod.env, config/app.env: a leading `*` matches at any depth
 ]
 
 # `.env.example` / `.env.sample` / `.env.template` / `.env.dist` are template files with no
@@ -70,15 +93,111 @@ SECRET_RULES: list[tuple[str, re.Pattern]] = [
     ("github-token", re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,}\b")),
     ("slack-token", re.compile(r"\bxox[abprs]-[A-Za-z0-9-]{10,}\b")),
     ("jwt", re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b")),
+    ("github-pat", re.compile(r"\bgithub_pat_[A-Za-z0-9_]{22,}")),
+    ("aws-session-key", re.compile(r"\bASIA[0-9A-Z]{16}\b")),
+    ("openai-key", re.compile(r"\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}")),
+    ("anthropic-key", re.compile(r"\bsk-ant-[A-Za-z0-9_-]{20,}")),
+    ("google-api-key", re.compile(r"\bAIza[0-9A-Za-z_-]{35}")),
+    ("npm-token", re.compile(r"\bnpm_[A-Za-z0-9]{36}\b")),
+    ("slack-webhook", re.compile(r"https://hooks\.slack\.com/services/[A-Za-z0-9_/]+")),
+    # user:password@host in a URL. `value` is the password; placeholders are exempted in code.
+    ("url-credentials", re.compile(
+        r"[a-z][a-z0-9+.-]*://[^/\s:@]*:(?P<value>[^/\s@]{3,})@", re.I)),
+    # `name = "v"`, `name: "v"`, and a quoted key: `"name": "v"`, `'name': 'v'`.
     ("assignment", re.compile(
-        r"(?i)[A-Za-z0-9_]*(password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*\s*[:=]\s*['\"](?P<value>[^'\"\s]{8,})['\"]"
+        r"(?i)[A-Za-z0-9_]*(password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*['\"]?\s*[:=]\s*['\"](?P<value>[^'\"\s]{8,})['\"]"
     )),
     ("env-assignment", re.compile(
         r"^\s*(?:export\s+)?[A-Za-z0-9_]*(?:PASSWORD|PASSWD|SECRET|API_KEY|APIKEY|TOKEN|PRIVATE_KEY)"
-        r"[A-Za-z0-9_]*\s*=\s*(?P<value>[^\s'\"#]{8,})", re.I
+        r"[A-Za-z0-9_]*\s*=\s*(?P<value>[^\s'\"]{8,})", re.I
     )),
 ]
 
+# Rules that match a fixed credential format. These refuse on added, removed AND context lines
+# and ignore the `caddis: not-secret` marker. The two assignment rules are heuristics and get none
+# of that.
+ASSIGNMENT_RULES = frozenset({"assignment", "env-assignment"})
+HIGH_CONFIDENCE_RULES = frozenset({
+    "private-key", "aws-key", "github-token", "slack-token", "jwt",
+    "github-pat", "aws-session-key", "openai-key", "anthropic-key", "google-api-key",
+    "npm-token", "slack-webhook", "url-credentials",
+})
+
+# A trailing comment only: `# caddis: not-secret` or `// caddis: not-secret` at the end of the
+# line, and not inside a string (see `_has_not_secret_marker`).
+_TRAILING_MARKER = re.compile(r"(?:#|//)\s*caddis:\s*not-secret\s*$", re.I)
+
+# `env-assignment` runs only on these files (matched on the file name, not the directory).
+_ENV_LIKE_SUFFIXES = frozenset({
+    ".sh", ".bash", ".zsh", ".ps1", ".psm1", ".bat", ".cmd", ".ini", ".cfg", ".conf", ".toml",
+    ".yaml", ".yml", ".properties", ".env", ".tfvars", ".service",
+})
+
+
+def _is_env_like(path: str) -> bool:
+    name = path.replace("\\", "/").rsplit("/", 1)[-1].lower()
+    if name.startswith((".env", "dockerfile")):
+        return True
+    suffix = Path(name).suffix
+    return suffix == "" or suffix in _ENV_LIKE_SUFFIXES
+
+
+def _inside_string(prefix: str) -> bool:
+    """True when `prefix` ends inside an open '...' or "..." string."""
+    quote = None
+    i = 0
+    while i < len(prefix):
+        c = prefix[i]
+        if quote:
+            if c == "\\":
+                i += 2
+                continue
+            if c == quote:
+                quote = None
+        elif c in "'\"":
+            quote = c
+        i += 1
+    return quote is not None
+
+
+def _has_not_secret_marker(content: str) -> bool:
+    match = _TRAILING_MARKER.search(content)
+    return bool(match) and not _inside_string(content[:match.start()])
+
+
+# `--bg:#282a36;--fg:#f8f8f2`: a CSS custom-property block held in a quoted string.
+_CSS_DECLARATIONS = re.compile(r"(?:--[A-Za-z0-9_-]+:[^;\s]+;?)+")
+# $(cmd) `cmd` ${VAR}. A bare `$VAR` is exempt only as the WHOLE value, through
+# `_is_placeholder`: a value that merely starts with `$` (`$ecretP@ss`, `$argon2id$...`) is a secret.
+_SHELL_START = re.compile(r"\$\(|`|\$\{")
+_SHELL_SUBSTITUTION = re.compile(r"\$\([^)]*\)|\$\{[^}]*\}")  # $(...) or ${...} anywhere
+
+
+def _is_not_secret_value(value: str, *, quoted: bool) -> bool:
+    """True when the value is a CSS block (quoted) or a shell variable or substitution (unquoted).
+
+    A QUOTED value is a string literal, so code shape proves nothing: `"Sec;ret(1)"` and
+    `"P@ssw0rd#2026!"` are passwords. Only a CSS custom-property block is exempt (the
+    placeholder check happens in the caller).
+
+    An UNQUOTED value reaches this rule only in an env-like file, where values are not code:
+    `SECRET=YWJj==.sig`, `SAS=sv=2022-11-02&sig=abc123`, `PASS=ab#cdefgh12` and
+    `KEY=correct_horse` are secrets. Only a shell reference is exempt: a value that starts with
+    `$(`, a backtick or `${`, or holds `$(...)` / `${...}` in any position. A bare `$name` is
+    exempt only as the whole value (a placeholder); `$argon2id$v=19$...` is a hash.
+    """
+    if quoted:
+        return bool(_CSS_DECLARATIONS.fullmatch(value))
+    return bool(_SHELL_START.match(value) or _SHELL_SUBSTITUTION.search(value))
+
+
+_URL_PASSWORD_PLACEHOLDERS = frozenset({"password", "pass", "passwd", "pwd", "secret", "token"})
+
+
+def _is_url_password_placeholder(value: str) -> bool:
+    return (_is_placeholder(value) or value.lower() in _URL_PASSWORD_PLACEHOLDERS
+            or bool(re.fullmatch(r"\{[^}]*\}|%s|%\([^)]*\)s", value)))
+
 
 def _is_placeholder(value: str) -> bool:
     """Exclude obvious template values from both assignment rules."""
@@ -99,6 +218,8 @@ class FilterResult:
     kept_diff: str
     dropped_paths: list[str] = field(default_factory=list)
     hits: list[tuple[str, int, str]] = field(default_factory=list)  # (path, side's line, rule/removed marker)
+    # Context-line matches: already in the repo, so reported (WARN) but never a refusal.
+    warnings: list[tuple[str, int, str]] = field(default_factory=list)
 
 
 # A new file block starts at a line beginning "diff --git a/..." (the common, unquoted case)
@@ -213,9 +334,38 @@ def _is_denied(path: str, deny_globs: list[str], allow_globs: list[str]) -> bool
     return not any(fnmatch.fnmatchcase(path, glob) for glob in allow_globs)
 
 
-def _scan_added_lines(block: str, path: str) -> list[tuple[str, int, str]]:
-    """Scan all hunk lines; removed hits use old-file line numbers."""
+def _line_matches(content: str, env_like: bool) -> list[str]:
+    """Names of the rules that match one line of content, after every exemption.
+
+    Every match of a rule is checked, so a real secret that follows a placeholder on the same
+    line (a JSON object with a placeholder key first and a real one second) is still caught.
+    """
+    marked = _has_not_secret_marker(content)
+    names: list[str] = []
+    for rule_name, pattern in SECRET_RULES:
+        if rule_name in ASSIGNMENT_RULES and marked:
+            continue
+        if rule_name == "env-assignment" and not env_like:
+            continue
+        for match in pattern.finditer(content):
+            if rule_name in ASSIGNMENT_RULES:
+                value = match.group("value")
+                if _is_placeholder(value) or _is_not_secret_value(
+                        value, quoted=rule_name == "assignment"):
+                    continue
+            elif rule_name == "url-credentials" and _is_url_password_placeholder(
+                    match.group("value")):
+                continue
+            names.append(rule_name)
+            break
+    return names
+
+
+def _scan_block(block: str, path: str, env_like: bool) -> tuple[list[tuple[str, int, str]],
+                                                                  list[tuple[str, int, str]]]:
+    """Scan all hunk lines; return (hits, warnings). Removed hits use old-file line numbers."""
     hits: list[tuple[str, int, str]] = []
+    warnings: list[tuple[str, int, str]] = []
     new_line: int | None = None
     old_line: int | None = None
     for line in block.splitlines():
@@ -231,16 +381,18 @@ def _scan_added_lines(block: str, path: str) -> list[tuple[str, int, str]]:
             content = line[1:]
             removed = line.startswith("-")
             context = line.startswith(" ")
-            for rule_name, pattern in SECRET_RULES:
-                match = pattern.search(content)
-                if match and not (rule_name in {"assignment", "env-assignment"}
-                                  and _is_placeholder(match.group("value"))) and not (
-                                      rule_name == "env-assignment" and
-                                      re.fullmatch(r"[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+",
-                                                   match.group("value"))):
-                    marker = (f"{rule_name}, removed line" if removed else
-                              f"{rule_name}, context line" if context else rule_name)
-                    hits.append((path, old_line if removed else new_line, marker))
+            for rule_name in _line_matches(content, env_like):
+                if context:
+                    # A real key on a context line is still SENT to the provider.
+                    if rule_name in HIGH_CONFIDENCE_RULES:
+                        hits.append((path, new_line, f"{rule_name}, context line"))
+                    else:
+                        warnings.append((path, new_line, f"{rule_name}, context line"))
+                elif removed:
+                    if rule_name in HIGH_CONFIDENCE_RULES:
+                        hits.append((path, old_line, f"{rule_name}, removed line"))
+                else:
+                    hits.append((path, new_line, rule_name))
             if removed:
                 old_line += 1
             elif not context:
@@ -251,13 +403,25 @@ def _scan_added_lines(block: str, path: str) -> list[tuple[str, int, str]]:
         else:
             old_line += 1
             new_line += 1  # context line exists in both files
-    return hits
+    return hits, warnings
+
+
+def _scan_added_lines(block: str, path: str,
+                      env_assignment_everywhere: bool = False) -> list[tuple[str, int, str]]:
+    """The refusing hits of `_scan_block` (kept for callers that want only those)."""
+    return _scan_block(block, path, env_assignment_everywhere or _is_env_like(path))[0]
 
 
-def filter_diff(diff_text: str, deny_globs: list[str], allow_globs: list[str]) -> FilterResult:
-    """Drop denylisted-path file blocks, then scan changed lines in kept blocks."""
+def filter_diff(diff_text: str, deny_globs: list[str], allow_globs: list[str],
+                env_assignment_everywhere: bool = False) -> FilterResult:
+    """Drop denylisted-path file blocks, then scan the hunk lines in kept blocks.
+
+    `env_assignment_everywhere` runs `env-assignment` on every file type. Use it for text that
+    is not a diff of real files (the relay note is prose in a synthetic `.md` file).
+    """
     dropped_paths: list[str] = []
     hits: list[tuple[str, int, str]] = []
+    warnings: list[tuple[str, int, str]] = []
     kept_parts: list[str] = []
     for block in _split_into_file_blocks(diff_text):
         first_line = block.splitlines()[0] if block else ""
@@ -268,9 +432,13 @@ def filter_diff(diff_text: str, deny_globs: list[str], allow_globs: list[str]) -
         if denied:
             dropped_paths.append(denied)
             continue
-        hits.extend(_scan_added_lines(block, path))
+        block_hits, block_warnings = _scan_block(
+            block, path, env_assignment_everywhere or _is_env_like(path))
+        hits.extend(block_hits)
+        warnings.extend(block_warnings)
         kept_parts.append(block)
-    return FilterResult(kept_diff="".join(kept_parts), dropped_paths=dropped_paths, hits=hits)
+    return FilterResult(kept_diff="".join(kept_parts), dropped_paths=dropped_paths, hits=hits,
+                        warnings=warnings)
 
 
 def load_config(repo: Path) -> tuple[list[str], list[str]]:

package/bundles/antigravity-plugin/scripts/setup_project_ai.py

@@ -369,7 +369,8 @@ def check_venv(target: Path, install: bool, dry: bool) -> list[str]:
         notes.append("venv: .venv present — ok")
     elif install and not dry:
         import subprocess
-        subprocess.run([sys.executable, "-m", "venv", str(venv)], check=False)
+        subprocess.run([sys.executable, "-m", "venv", str(venv)], check=False,
+                       creationflags=0x08000000 if os.name == "nt" else 0)
         notes.append("venv: created .venv (install dev deps: .venv/Scripts/pip install -e .[dev])")
     else:
         notes.append("venv: MISSING — create with `python -m venv .venv` then "
@@ -1205,6 +1206,10 @@ relay/
 session-state.md
 session-state/
 context-window.json
+context-window.json.tmp
+.session-state-*.tmp
+hook-errors.jsonl
+.relay-injected/
 PROJECT-FACTS.md
 # lock files beside locked documents, and migration backups (never commit these)
 *.lock

package/bundles/antigravity-plugin/session_end_agy.py

@@ -23,6 +23,19 @@ import subprocess
 import sys
 from datetime import datetime, timezone
 
+# No child process of this hook opens a console window on Windows (scripts/no_window.py). agy hooks ship
+# FLAT at the plugin root with scripts/ beside them; in the source repo scripts/ is one level up.
+try:
+    _nw_here = os.path.dirname(os.path.abspath(__file__))
+    for _nw_cand in (os.path.join(_nw_here, "scripts"), os.path.join(os.path.dirname(_nw_here), "scripts")):
+        if os.path.isfile(os.path.join(_nw_cand, "no_window.py")):
+            if _nw_cand not in sys.path:
+                sys.path.insert(0, _nw_cand)
+            break
+    from no_window import NO_WINDOW_KW  # noqa: E402
+except Exception:  # pragma: no cover - defensive
+    NO_WINDOW_KW = {"creationflags": 0x08000000} if os.name == "nt" else {}
+
 
 def _artifact_root(root: str) -> str:
     return os.path.join(str(root), ".caddis")
@@ -39,7 +52,7 @@ def _repo_root(path: str):
     try:
         done = subprocess.run(
             ["git", "-C", str(path), "rev-parse", "--show-toplevel"],
-            capture_output=True, text=True, timeout=5,
+            capture_output=True, text=True, timeout=5, **NO_WINDOW_KW,
         )
         top = done.stdout.strip()
         return os.path.normpath(top) if done.returncode == 0 and top else None
@@ -48,7 +61,8 @@ def _repo_root(path: str):
 
 
 def _user_artifact_root() -> str:
-    """Where usage goes when the workspace is in no repository: the user's own folder, never the cwd."""
+    """Where usage goes when the workspace is in no repository: the user's own folder, never the cwd.
+    The caller writes there only when it already exists."""
     return _artifact_root(os.path.expanduser("~"))
 
 
@@ -108,21 +122,24 @@ def main() -> None:
     try:
         roots = _workspace_roots(data) or [os.getcwd()]
         # A workspace folder may sit inside a repo: the artifact dir is the REPO ROOT's, not the sub-folder's.
-        resolved = [(_repo_root(r) or str(r)) for r in roots]
-        # Write the record to every root that ALREADY has a .caddis dir, rather than to
-        # whichever root happened to be first. A multi-root session's usage belongs to each
-        # repo that participates in it, and creating .caddis in a repo that never opted in
+        # A folder in no repository is skipped: it has no project, and its cwd is never a fallback.
+        resolved = [top for top in (_repo_root(r) for r in roots) if top]
+        # Write the record only to roots that ALREADY have a .caddis dir. A multi-root session's usage
+        # belongs to each repo that participates in it, and creating .caddis in a repo that never opted in
         # would be caddis littering someone else's tree.
         targets = []
         for root in resolved:
             art = _artifact_root(root)
             if os.path.isdir(art) and art not in targets:
                 targets.append(art)
+        if not resolved:
+            # No workspace is in a repository. Usage goes to the user's own folder, and only when
+            # that folder already exists. It is never created and never the cwd.
+            user_art = _user_artifact_root()
+            if os.path.isdir(user_art):
+                targets = [user_art]
         if not targets:
-            # Nothing has opted in. In a repo, the first root's repo root is the default. Outside any
-            # repo there is no project to attach usage to, so it goes to the user's folder, not the cwd.
-            first_repo = _repo_root(roots[0])
-            targets = [_artifact_root(first_repo) if first_repo else _user_artifact_root()]
+            return  # nothing has opted in: write nothing
         record = {
             "ts": datetime.now(timezone.utc).isoformat(),
             "event": "session_end",
@@ -133,7 +150,6 @@ def main() -> None:
             "model": data.get("modelName"),
         }
         for art in targets:
-            os.makedirs(art, exist_ok=True)
             with open(os.path.join(art, "usage-log.jsonl"), "a", encoding="utf-8") as fh:
                 fh.write(json.dumps(record) + "\n")
     except Exception as _exc:

package/bundles/antigravity-plugin/skills/cloud-phases/SKILL.md

@@ -23,6 +23,35 @@ Two modes:
 With no plan argument, use the active plan (`python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_todo.py" active-plan`,
 or the one `status: current` plan in `.caddis/plans/`). If there is none, or more than one, ask.
 
+## Step 0 — Is this checkout safe to move?
+
+<!-- checkout-safety: keep byte-identical in pr-merge, ship-pr, ship-merge and cloud-phases; a test pins it -->
+Some steps below move the files of this checkout (`git rebase`, `switch`, `checkout <branch>`, `pull`, `merge`,
+`stash`, `reset --hard`). Before the first of them, run:
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_checkout_guard.py" shared --root .
+```
+It prints `SHARED: yes <reason>` or `SHARED: no` and exits 0. It says yes when the repo's `AGENTS.md` has a line
+`Shared checkout: yes` (a dev service serves from this checkout), or when `git status` lists a change. With no
+`--own-files`, every change counts as another session's. A linked worktree is never shared.
+
+- **On `SHARED: no`,** do the steps as written, in this checkout.
+- **On `SHARED: yes`,** never move this checkout. Leave its changes as they are, and report them. Instead:
+  - **Rebase:** `git worktree add --detach "$TEMP/<repo>-rebase" <branch>`, then
+    `git -C <worktree> rebase origin/<default>` and `git -C <worktree> push --force-with-lease origin HEAD:<branch>`.
+  - **Pull a branch to test it:** `git fetch origin`, then
+    `git worktree add --detach "$TEMP/<repo>-<branch>" origin/<branch>` (for the default branch,
+    `origin/<default>`), and run the gates there. Install dependencies fresh; never link `node_modules` or a venv.
+  - **Clean up after a merge:** do not switch or pull. Run `git fetch --prune`, then
+    `git fetch origin <default>:<default>`: it fast-forwards the default branch with no checkout. Git refuses when a
+    checkout has the default branch out; then leave it and report it. Delete the local feature branch only when no
+    checkout has it out.
+  - Remove each worktree you made when its step ends: `git worktree remove <worktree>`.
+
+`$TEMP` is `%TEMP%` (`$env:TEMP` in PowerShell). The caddis guard checks only the `Shared checkout: yes` line in
+`AGENTS.md`, not a dirty tree: with that line, it asks before a tree move, and denies it in a headless session.
+<!-- /checkout-safety -->
+
 ## Step 1 — check the preconditions (stop on any failure)
 
 ```
@@ -35,7 +64,11 @@ gh auth status
 - `origin` must be a GitHub repository. Cloud sessions clone from GitHub; a repo with no GitHub
   remote cannot use this command. Say so and stop.
 - The current branch must be the plan's feature branch, never the default branch. The cloud PRs
-  target this branch, and it goes to `main` later through the normal `/caddis:ship-pr`.
+  target this branch, and it goes to the default branch later through the normal `/caddis:ship-pr`.
+  Read the default branch as a bare name: `git rev-parse --abbrev-ref origin/HEAD` prints
+  `origin/<default>`, so strip the `origin/` prefix before you compare
+  (`d=$(git rev-parse --abbrev-ref origin/HEAD) && d=${d#origin/}`; when origin/HEAD is not set,
+  `gh repo view --json defaultBranchRef -q .defaultBranchRef.name`).
 - Tracked changes must be committed. A cloud session cannot see uncommitted work.
 - `gh` must be signed in as an account that can push to the repository and open PRs.
 
@@ -117,7 +150,8 @@ internal host names, no machine paths and no credentials.
 
 ```
 git add <each prompt file by name>
-git commit -m "docs(prompts): cloud prompts for <feature> phases <N, M>"
+git diff --cached --name-only   # must list only the prompt files; else stop and report
+git commit -m "docs(prompts): cloud prompts for <feature> phases <N, M>" -- <each prompt file>
 git push -u origin <feature branch>
 git rev-parse HEAD
 git ls-remote origin refs/heads/<feature branch>
@@ -151,14 +185,26 @@ gh pr list --base <feature branch> --state open --json number,title,headRefName,
 For each PR from a `<prefix>/phase-<NN>` branch, one at a time:
 1. Read the whole diff (`gh pr diff <N>`). Check it against the phase's Design and Touches. A file
    outside Touches is a finding.
-2. Wait for CI: `gh pr checks <N> --watch` (or the ci-watch lane, if this caddis has it).
+2. Wait for CI outside the session:
+   `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_lanes.py" ci-watch --pr <N>`. Only `RESULT: pass`
+   counts; `HEAD:` names the watched head. A `gh pr checks` table is not proof: it can show an older
+   head's checks.
 3. Review under the three rules (rule 3, review by tier): stop at the first CLEAN; after 3 rounds,
-   ask the owner. A fix goes back to the same cloud session or is made locally on the PR branch.
-4. Just before merging, re-read `gh pr view <N> --json headRefOid,mergeStateStatus`. Merge only if
-   the head SHA is the one you reviewed and CI passed on it:
-   `gh pr merge <N> --squash --delete-branch`.
-5. Pull: `git pull --ff-only origin <feature branch>`.
-6. Run the phase's exit gate locally, and after the last PR, the full test suite.
+   ask the owner. A fix goes back to the same cloud session or is made locally on the PR branch. A
+   fix pushes a new head: run ci-watch again.
+4. Just before merging, check all three, then merge that head only:
+   - the last ci-watch printed `RESULT: pass`, and its `HEAD:` is the head you reviewed;
+   - `gh pr view <N> --json headRefOid,mergeStateStatus` still shows that head;
+   - no CI run on the default branch is in progress:
+     `gh run list --branch <default branch> --json status` lists no `in_progress` or `queued` run
+     (wait, then check again).
+
+   `gh pr merge <N> --squash --delete-branch --match-head-commit <watched head>` (the full SHA).
+   GitHub refuses the merge if the head moved. A merge on a head match alone merged a red PR (#34).
+5. Pull: `git pull --ff-only origin <feature branch>`. In a shared checkout (Step 0 says `SHARED: yes`), never
+   pull here: make a detached worktree of `origin/<feature branch>`, as Step 0 says, and run point 6 there.
+6. Run the phase's exit gate locally: the tests of the touched files, in the foreground, each command under
+   10 minutes. Do not start the full suite in the background. CI runs it on every PR.
 7. Update the phase's Tracker row: status, PR number, merge commit, review result. Set the prompt's
    frontmatter `status: done` so `/caddis:handoff` tidies it.
 

package/bundles/antigravity-plugin/skills/cross-review/SKILL.md

@@ -86,23 +86,26 @@ now means the narrower case — a **single file** too big to split, or more batc
 see it, the fix is usually to review that one file separately, not to narrow `--range`; don't raise
 `--max-diff-chars` blind.
 
-**Do not alternate providers on a schedule.** DeepSeek is the default because it has actually found real
-bugs that same-vendor passes missed; GLM is the documented fallback, used automatically when DeepSeek is
-unavailable and you did not name a provider. The policy lives in `oss_review.py`'s `FALLBACK_PROVIDERS`
-comment — a rota that sends half your phases to a provider observed timing out three phases running buys
-variety it never actually collects, and a review that silently does not happen is the same failure class
-as a diff that silently is not read. Name a provider explicitly only when you have a reason.
+**Do not alternate providers on a schedule.** The order is the owner policy: **DeepSeek, then agy Argon,
+then GLM** (`REVIEW_ORDER` in `oss_review.py`). A named `--provider` goes first; on a provider failure
+(HTTP 429, any 5xx, a timeout, a connection error, an empty reply) the tool moves to the next one in
+that order and prints which provider gave the verdict. A provider with no key is skipped. agy runs
+through `caddis_spend.py run` (the spend cap); if the cap refuses, agy is skipped. On a 429 the tool
+waits for `Retry-After` once (at most 60 s); it never splits the diff because of a 429 or an empty
+reply. A custom endpoint (`--base-url`/`--model`) never falls back. Name a provider only when you have
+a reason.
 
 ## Interpret the exit code
 - **0 — REVIEW: CLEAN** → no blocking issues. Proceed.
 - **1 — REVIEW: BLOCKING** → read the printed findings, then **FIX each blocking item** (or explicitly
   justify why one is a false positive). Fix it, then re-review only the fix diff. After 3 rounds, ask the owner (rule 3).
 - **4 — error** → no verdict parsed, or a git/endpoint failure. Read stderr; do NOT treat as clean.
-- **3 — misconfigured** → `REVIEW_API_KEY` is unset. Set it (see Prerequisite) and re-run.
+- **3 — could not run** → no key (see Prerequisite), the secret filter refused, or every provider
+  failed (429, 5xx, timeout, empty reply). Read stderr. A provider failure is not a verdict: re-run later.
 
 ## Three rules: one attempt, one review
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
-2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
+2. **Run it before review.** The coder runs only the tests of the files it touched, in the foreground, each command under 10 minutes (split into parts if needed). Name the exact commands in the task. Never start the full suite in the background and never wait on a monitor for it: CI runs the full suite on every PR. Then run the change once on real data.
 3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
    Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
    the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;

package/bundles/antigravity-plugin/skills/feature-plan/SKILL.md

@@ -270,7 +270,7 @@ yourself (relay + Tracker) before stopping — do not hand back "run `/caddis:ha
 ## Execution protocol (standing rules — this plan is the memory, not anyone's head)
 Three rules: one attempt, one review.
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
-2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
+2. **Run it before review.** The coder runs only the tests of the files it touched, in the foreground, each command under 10 minutes (split into parts if needed). Name the exact commands in the task. Never start the full suite in the background and never wait on a monitor for it: CI runs the full suite on every PR. Then run the change once on real data.
 3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
    Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
    the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;

package/bundles/antigravity-plugin/skills/gh-cli/SKILL.md

@@ -73,7 +73,10 @@ gh pr diff 55
 gh pr checkout 55
 gh pr review 55 --approve --body "LGTM!"
 gh pr review 55 --request-changes --body "Please fix error handling"
-gh pr merge 55 --squash --delete-branch
+# merge only on ci-watch RESULT: pass, only its HEAD:, with no default-branch run in progress
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_lanes.py" ci-watch --pr 55
+gh run list --branch main --json status       # no in_progress or queued run (main = the default branch)
+gh pr merge 55 --squash --delete-branch --match-head-commit <watched head>
 
 # Manage
 gh pr ready 55             # Mark draft as ready
@@ -168,10 +171,11 @@ gh alias set review 'pr list --search "review-requested:@me"'
 ```bash
 gh issue develop 42 --branch fix/issue-42
 git add src/auth/login.py tests/test_login.py   # named files only, never `git add .`
-git commit -m "fix: resolve login bug" && git push -u origin HEAD
+git commit -m "fix: resolve login bug" -- src/auth/login.py tests/test_login.py && git push -u origin HEAD
 gh pr create --title "fix: resolve login bug" --body "Closes #42"
-gh pr checks --watch
-gh pr merge --squash --delete-branch
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_lanes.py" ci-watch --pr <n>   # RESULT: pass, HEAD: <watched head>
+gh run list --branch main --json status       # wait while a default-branch run is in progress
+gh pr merge <n> --squash --delete-branch --match-head-commit <watched head>
 ```
 
 ### Release Workflow
@@ -189,8 +193,8 @@ gh release upload v1.3.0 ./dist/*.tar.gz
 | Create repo       | `gh repo create name --public`                 |
 | Create issue      | `gh issue create --title "..." --labels bug`   |
 | Create PR         | `gh pr create --title "..." --reviewer user`   |
-| Merge PR          | `gh pr merge 55 --squash --delete-branch`      |
+| Merge PR          | `gh pr merge 55 --squash --delete-branch --match-head-commit <watched head>`, only after ci-watch `RESULT: pass` |
 | Create release    | `gh release create v1.0.0 --generate-notes`    |
-| Watch CI          | `gh run watch`                                 |
+| Watch CI          | `caddis_lanes.py ci-watch --pr 55` (fallback: `gh run watch`) |
 | Set secret        | `echo "val" \| gh secret set KEY`              |
 | API call          | `gh api /repos/o/r --jq '.description'`        |

package/bundles/antigravity-plugin/skills/git-commit/SKILL.md

@@ -87,9 +87,8 @@ Optional area of change:
    # Stage specific files
    git add path/to/file1 path/to/file2
 
-   # Stage by pattern
-   git add *.test.*
-   git add src/components/*
+   # Never stage by pattern or folder (`*.test.*`, `src/components/`): a pattern also takes
+   # files you did not change, and the caddis guard denies it. Name each file.
    ```
 
    **Never stage secrets** (`.env`, `credentials.json`, private keys).