@caddis/cli 0.4.55 → 0.4.57

package/bundles/antigravity-plugin/scripts/caddis_lanes.py

@@ -33,9 +33,11 @@ except ModuleNotFoundError as exc:
     import caddis_exit
     from caddis_heavy_slot import HeavySlotBusy, heavy_slot
 
+import caddis_checkout_guard
 import caddis_routing
 import caddis_redact
 import caddis_spend
+import caddis_worktree_safety
 
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8", errors="replace")
@@ -265,7 +267,14 @@ def remove_phase_worktree(
     if delete_branch and not wt.branch.startswith("lane/"):
         raise LaneConfigError(f"refusing to delete non-lane branch: {wt.branch}")
 
-    _git_output(repo_root, "worktree", "remove", "--force", str(resolved))
+    try:
+        problem = caddis_worktree_safety.safe_remove_worktree(repo_root, resolved)
+    except OSError as exc:
+        raise LaneConfigError(f"worktree remove failed: {exc}") from exc
+    if not problem and os.path.lexists(resolved):
+        problem = f"worktree remove left {resolved} on disk"
+    if problem:
+        raise LaneConfigError(problem)
     _git_output(repo_root, "worktree", "prune")
     if delete_branch:
         _git_output(repo_root, "branch", "-D", "--", wt.branch)
@@ -1244,8 +1253,19 @@ def validate_codex_argv(argv: list[str]) -> None:
             )
 
 
+# Robustness #4: a lane agent can be prompt-injected through a plan or a diff, so it gets no publish token and no
+# credential prompt, and cannot switch the guard off. The same list as caddis_roadmap_run.SESSION_SECRET_VARS. The
+# gh keyring login stays on the machine; the guard denies push, merge and publish when CADDIS_HEADLESS=1.
+LANE_SECRET_VARS = ("GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN", "NPM_TOKEN", "NODE_AUTH_TOKEN",
+                    "CADDIS_ALLOW_PUBLISH", "CADDIS_GUARD_DISABLED")
+LANE_NO_PROMPT_ENV = {"GH_PROMPT_DISABLED": "1", "GIT_TERMINAL_PROMPT": "0"}
+
+
 def child_env(base: dict, lane: str, model: str) -> dict:
     env = base.copy()
+    for name in LANE_SECRET_VARS:
+        env.pop(name, None)
+    env.update(LANE_NO_PROMPT_ENV)
     env["CADDIS_HEADLESS"] = "1"
     if lane == "glm":
         env["OSS_MODEL"] = model
@@ -2132,6 +2152,42 @@ def _check_command(
     return exit_code
 
 
+_TERMINAL_ESCAPES = re.compile(
+    r"\x1b\[[0-?]*[ -/]*[@-~]"  # CSI (colours, cursor)
+    r"|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?"  # OSC (titles, links)
+    r"|\x1b[@-Z\\-_]"  # other two-byte escapes
+)
+_CONTROL_CHARS = re.compile(r"[\x00-\x09\x0b-\x1f\x7f]")
+
+
+def _printable(value: object) -> str:
+    """Text safe to print: no ANSI escapes and no C0 control characters except newline."""
+    text = _TERMINAL_ESCAPES.sub("", str(value if value is not None else ""))
+    return _CONTROL_CHARS.sub("", text)
+
+
+# Accept fast-forwards the SESSION checkout. In a checkout a dev service serves from, or one that holds a peer's
+# uncommitted edits, that moves files under them (robustness #11). The lane's own scaffolding is not a peer's change.
+_LANE_OWN_PREFIX = ".caddis/orchestrator/"
+
+
+def shared_checkout_reason(repo: Path) -> str:
+    """Why accept must not fast-forward `repo`, or ''. Shared (AGENTS.md) and/or foreign changes (git status):
+    every reason that holds, joined with "; ", so an --allow-shared audit records all of them."""
+    reasons = []
+    if caddis_checkout_guard.checkout_is_shared(repo):
+        reasons.append("AGENTS.md says Shared checkout: yes")
+    try:
+        dirty = caddis_checkout_guard.foreign_changes(repo)
+    except caddis_checkout_guard.CheckoutStatusError:
+        reasons.append("git status failed, so changes by other sessions cannot be ruled out")
+        dirty = []
+    foreign = [path for path in dirty if not path.replace("\\", "/").startswith(_LANE_OWN_PREFIX)]
+    if foreign:
+        reasons.append("changes not made by this lane: " + ", ".join(foreign[:3]))
+    return "; ".join(reasons)
+
+
 def _accept_command(
     args,
     repo: Path,
@@ -2151,12 +2207,26 @@ def _accept_command(
     if packet.get("next") != "review":
         print(f"refusing: packet next={packet.get('next')}")
         return EXIT_USAGE
-    review_status = packet.get("review", {}).get("status")
-    if review_status == "BLOCKING" and not getattr(args, "override_review", None):
-        print("refusing: review BLOCKING; pass --override-review with a reason")
+    # Fail closed: only an exact CLEAN verdict merges without an owner override.
+    review = packet.get("review") or {}
+    if not isinstance(review, dict):
+        review = {}
+    review_status = review.get("status")
+    override_reason = (getattr(args, "override_review", None) or "").strip()
+    if review_status != "CLEAN" and not override_reason:
+        if review_status == "BLOCKING":
+            print("refusing: review BLOCKING; pass --override-review with a reason")
+        else:
+            # MISSING = no verdict (provider down, 429, secret-filter refusal). Anything else
+            # that is not CLEAN (absent, null, unknown, lowercase) is also no valid verdict.
+            cause = " ".join(_printable(review.get("tail")).split())[-300:] or "no reason recorded"
+            label = (
+                "MISSING" if review_status == "MISSING"
+                else f"status {_printable(review_status)!r}"
+            )
+            print(f"refusing: review {label} (no verdict: {cause}); re-run the review, "
+                  "or pass --override-review with a reason")
         return EXIT_USAGE
-    if review_status == "MISSING":
-        print("WARNING: review MISSING")
     if _git_output(repo, "rev-parse", "HEAD") != packet.get("base_sha"):
         print("refusing: programme branch moved since the attempt started")
         return EXIT_FAIL
@@ -2174,10 +2244,25 @@ def _accept_command(
             or packet["worktree_digest"] != worktree_digest(wt.path, files)):
         print("refusing: worktree changed since check")
         return EXIT_FAIL
+    unsafe = shared_checkout_reason(repo)
+    if unsafe and not getattr(args, "allow_shared", False):
+        print(f"refusing: the session checkout is not safe to fast-forward ({_printable(unsafe)}). "
+              "Run the programme from a worktree of origin/<default> under %TEMP% (git worktree add), "
+              "or pass --allow-shared to fast-forward here anyway")
+        return EXIT_USAGE
+    if unsafe:
+        packet["allow_shared"] = unsafe
+        write_packet(packet_path, packet)
+        print(f"ALLOW SHARED: {_printable(unsafe)}")
     if args.override_review is not None:
         packet["override_review"] = args.override_review
         write_packet(packet_path, packet)
         print(f"OVERRIDE REVIEW: {args.override_review}")
+        if review_status != "CLEAN":
+            print(
+                f"WARNING: merged without a vendor review (status {_printable(review_status)}): "
+                f"{args.override_review}"
+            )
     _git_output(wt.path, "add", "--", *(str(path) for path in files))
     _git_output(wt.path, "commit", "-m", args.message)
     accepted_sha = _git_output(wt.path, "rev-parse", "HEAD")
@@ -2406,6 +2491,8 @@ def main(argv: list[str] | None = None) -> int:
     _add_phase_arguments(accept)
     accept.add_argument("--message", required=True)
     accept.add_argument("--override-review")
+    accept.add_argument("--allow-shared", action="store_true",
+                        help="fast-forward a shared checkout or one with foreign changes anyway (recorded)")
     abandon = subparsers.add_parser("abandon")
     _add_phase_arguments(abandon)
     finish = subparsers.add_parser("finish")

package/bundles/antigravity-plugin/scripts/caddis_merge_chain.py

@@ -1,14 +1,16 @@
 """Merge pull requests one at a time, from green CI to a verified deploy, and stop the line at the first problem.
 
 For each PR (design section 11): when BEHIND, update the branch and cancel the old head's runs (force-cancel after
-2 minutes); a cancelled run on the head is re-run, never merged on; "no checks reported" waits; a failed check stops;
-no merge while a push run is in progress on the default branch; squash merge with --match-head-commit; then the merge
-SHA must get a push run, and `caddis_prod_check.py` must pass before the next PR starts. A STOP file is checked before
-each update-branch and each merge. --dry-run makes read-only `gh` calls and prints what it would do.
+2 minutes); a cancelled run on the head is re-run, never merged on; "checks green" is ci-watch's verdict on the
+`statusCheckRollup` of the PR's `headRefOid` (never the `gh pr checks` table, which can show an older head); "no
+checks reported" waits, then stops; every check skipped stops (no job ran), both unless --allow-no-checks; a failed
+check stops; no merge while a push run is in progress on the default branch; squash merge with --match-head-commit;
+then the merge SHA must get a push run, and `caddis_prod_check.py` must pass before the next PR starts. A STOP file is
+checked before each update-branch and each merge. --dry-run makes read-only `gh` calls and prints what it would do.
 
 Exit 0 when every PR merged and verified; 1 at the first stop; 3 when the profile cannot be read.
 
-Usage: caddis_merge_chain.py [--repo PATH] [--gh-repo OWNER/NAME] [--docs-only] [--dry-run]
+Usage: caddis_merge_chain.py [--repo PATH] [--gh-repo OWNER/NAME] [--docs-only] [--dry-run] [--allow-no-checks]
                              [--stop-file PATH ...] <pr> [<pr> ...]
 """
 
@@ -21,13 +23,15 @@ from pathlib import Path
 
 try:
     import caddis_exit
+    import caddis_lanes
     import caddis_prod_check as prod
 except ModuleNotFoundError as exc:
-    if exc.name not in {"caddis_exit", "caddis_prod_check"}:
+    if exc.name not in {"caddis_exit", "caddis_lanes", "caddis_prod_check", "caddis_heavy_slot", "caddis_routing"}:
         raise
     sys.path.insert(0, str(Path(__file__).resolve().parent))
     sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
     import caddis_exit
+    import caddis_lanes
     import caddis_prod_check as prod
 
 MAX_ATTEMPTS = 8
@@ -45,6 +49,7 @@ class Stop(Exception):
 class ChainContext(prod.Context):
     stop_files: list[Path] = field(default_factory=list)
     docs_only: bool = False
+    allow_no_checks: bool = False
 
 
 def _stop_check(ctx: ChainContext, before: str) -> None:
@@ -90,26 +95,63 @@ def _head_run(ctx: ChainContext, branch: str, head: str) -> dict | None:
     return next((r for r in runs if r.get("headSha") == head), None)  # type: ignore[union-attr]
 
 
-def _wait_checks(ctx: ChainContext, pr: int) -> str:
-    """Return 'pass', 'fail' or 'cancel'. Raise Stop when no check reports in time."""
+def _rollup_state(rollup: object, allow_no_checks: bool) -> tuple[str, str]:
+    """(state, detail) from the head's `statusCheckRollup`, by ci-watch's own verdict (`caddis_lanes._rollup_verdict`).
+
+    state is 'pass', 'fail', 'cancel', 'pending', 'none' (no check reported) or 'skipped' (every check skipped).
+    A check that only SKIPPED or NEUTRAL ran no job, so a rollup with no SUCCESS proves nothing: 'skipped', unless
+    the owner passed --allow-no-checks for a repo that has no CI at all.
+    """
+    verdict = caddis_lanes._rollup_verdict(rollup)
+    if verdict is None:
+        return ("pass", "no checks reported (--allow-no-checks)") if allow_no_checks else ("none", "")
+    _green, failed, unfinished = verdict
+    if failed:
+        cancelled = {str(i.get("name") or i.get("context") or "?") for i in rollup  # type: ignore[union-attr]
+                     if isinstance(i, dict) and str(i.get("conclusion") or "").upper() == "CANCELLED"}
+        return ("cancel" if set(failed) <= cancelled else "fail"), ", ".join(failed)
+    if unfinished:
+        return "pending", ", ".join(unfinished)
+    ran = sum(1 for i in rollup if isinstance(i, dict)  # type: ignore[union-attr]
+              and str(i.get("conclusion") or i.get("state") or "").upper() == "SUCCESS")
+    if not ran:
+        return ("pass", "every check skipped (--allow-no-checks)") if allow_no_checks else ("skipped", "")
+    return "pass", ""
+
+
+def _wait_checks(ctx: ChainContext, pr: int, head: str) -> str:
+    """Return 'pass', 'fail', 'cancel' or 'moved' for the commit `head`. Raise Stop when no proof comes in time.
+
+    The verdict is ci-watch's: the `statusCheckRollup` of the PR's `headRefOid`, read in one `gh pr view`. The
+    `gh pr checks` table is never read: it can still show an older head's checks.
+    """
     deadline = ctx.clock.now() + CHECKS_WAIT_MINUTES * 60
     while True:
-        proc = ctx.gh("pr", "checks", str(pr), "--json", "name,bucket")
-        if proc.rc != 0 and not proc.out.strip() and "no checks reported" not in proc.err + proc.out:
+        proc = ctx.gh("pr", "view", "--json", "headRefOid,statusCheckRollup", str(pr))
+        if proc.rc != 0:
             # Auth or network failure: say so now instead of waiting 30 minutes as if no check had started.
-            raise Stop(f"#{pr}: gh pr checks failed: {(proc.err or proc.out).strip()[:300]}")
-        buckets: list[str] = []
+            raise Stop(f"#{pr}: gh pr view failed: {(proc.err or proc.out).strip()[:300]}")
         try:
-            buckets = [c.get("bucket", "") for c in prod.json.loads(proc.out)] if proc.out.strip() else []
+            data = prod.json.loads(proc.out) if proc.out.strip() else {}
         except ValueError:
-            buckets = []
-        if "fail" in buckets:
-            return "fail"
-        if "cancel" in buckets:
-            return "cancel"
-        if buckets and "pending" not in buckets:
+            data = {}
+        if not isinstance(data, dict):
+            data = {}
+        if data.get("headRefOid") != head:
+            ctx.out(f"  #{pr}: the head is now {str(data.get('headRefOid'))[:12]}, not {head[:12]}; reading again")
+            return "moved"
+        state, detail = _rollup_state(data.get("statusCheckRollup"), ctx.allow_no_checks)
+        if state == "pass":
+            if detail:
+                ctx.out(f"  #{pr}: WARNING: {detail} on head {head[:12]}")
             return "pass"
-        waiting = "no checks reported yet" if not buckets else "checks pending"
+        if state in ("fail", "cancel"):
+            return state
+        if state == "skipped":
+            raise Stop(f"#{pr}: every check on head {head[:12]} was skipped: no job ran, so this is not a pass. "
+                       "If this repo has no CI at all, run again with --allow-no-checks")
+        waiting = (f"checks pending ({detail})" if state == "pending" else
+                   "no checks reported yet (if this repo has no CI at all, run again with --allow-no-checks)")
         if ctx.clock.now() >= deadline:
             raise Stop(f"#{pr}: {waiting} after {CHECKS_WAIT_MINUTES} min")
         if ctx.dry_run:
@@ -159,10 +201,10 @@ def merge_one(ctx: ChainContext, pr: int) -> str | None:
                 ctx.out(f"  WARNING: re-run of {run['databaseId']} refused: {(rerun.err or rerun.out).strip()[:200]}")
             ctx.clock.sleep(60)
             continue
-        result = _wait_checks(ctx, pr)
+        result = _wait_checks(ctx, pr, head)
         if result == "fail":
             raise Stop(f"#{pr}: CI failed on head {head[:12]}")
-        if result == "cancel":
+        if result in ("cancel", "moved"):
             continue
         if ctx.dry_run:
             ctx.out(f"#{pr} ({merge_state}): checks green; would wait for idle push runs, then squash-merge {head[:12]}")
@@ -219,6 +261,8 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--profile", type=Path, help="default: <repo>/.caddis/prod-check.toml")
     parser.add_argument("--docs-only", action="store_true", help="the PRs change docs only: expect no deploy")
     parser.add_argument("--dry-run", action="store_true", help="read-only gh calls; print the steps")
+    parser.add_argument("--allow-no-checks", action="store_true",
+                        help="the repo has no CI: accept a head with no check, or with every check skipped")
     parser.add_argument("--stop-file", type=Path, action="append", default=[],
                         help="extra STOP file (~/.caddis/STOP is always checked)")
     args = parser.parse_args(argv)
@@ -229,6 +273,7 @@ def main(argv: list[str] | None = None) -> int:
         return caddis_exit.NOT_RUN
     ctx = ChainContext(run=prod.real_runner(args.repo), clock=prod.Clock(), profile=profile, repo=args.repo,
                        gh_repo=args.gh_repo, dry_run=args.dry_run, docs_only=args.docs_only,
+                       allow_no_checks=args.allow_no_checks,
                        stop_files=[Path.home() / ".caddis" / "STOP", *args.stop_file])
     return merge_chain(ctx, args.prs)
 

package/bundles/antigravity-plugin/scripts/caddis_relay_git.py

@@ -20,13 +20,18 @@ except ModuleNotFoundError as exc:
     import secret_filter
 
 
+# No child process opens a console window on Windows (this runs under hooks and status lines that
+# have no console). Inline, not scripts/no_window.py: in the source tree this file does not sit beside it.
+_NO_WINDOW = 0x08000000 if os.name == "nt" else 0
+
 MAX_NOTE_CHARS = 4000
 
 
 def _git(repo: Path, *args: str, input_data: bytes | None = None,
          env: dict[str, str] | None = None) -> bytes:
     result = subprocess.run(["git", *args], cwd=repo, env=env, input=input_data,
-                            stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False)
+                            stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False,
+                            creationflags=_NO_WINDOW)
     if result.returncode:
         # Name the subcommand, not a leading "-c key=value" option.
         command = next((arg for i, arg in enumerate(args) if not arg.startswith("-") and (i == 0 or args[i - 1] != "-c")), "?")
@@ -53,7 +58,8 @@ def _pre_send(note: str) -> None:
             "--- /dev/null\n+++ b/relay.md\n"
             f"@@ -0,0 +1,{len(lines)} @@\n" +
             "".join("+" + line + "\n" for line in lines))
-    result = secret_filter.filter_diff(diff, list(secret_filter.DEFAULT_DENY_GLOBS), [])
+    result = secret_filter.filter_diff(diff, list(secret_filter.DEFAULT_DENY_GLOBS), [],
+                                       env_assignment_everywhere=True)
     if result.hits or result.dropped_paths or not result.kept_diff:
         raise ValueError("relay refused by pre-send filter")