@caddis/cli 0.4.56 → 0.4.58

package/bundles/antigravity-plugin/scripts/caddis_review.py

@@ -77,6 +77,33 @@ USAGE_LIMIT_RE = re.compile(
     r"Usage limit reached for|Limit Exhausted|Insufficient balance|You.ve hit your .*limit|RESOURCE_EXHAUSTED",
     re.IGNORECASE,
 )
+# A provider failure, not a review: HTTP 429, any 5xx, a rate-limit or overload error. Counts only when the run gave no
+# verdict line (a review may quote such text from the code). 18-19 Oct 2026: a GLM 429 was reported as
+# "FAILED no verdict line" = BLOCKED, which can start a fix session for nothing.
+PROVIDER_FAILURE_RE = re.compile(
+    r"API Error: (?:429|5\d\d)\b|\bHTTP (?:429|5\d\d)\b|Too Many Requests|rate_limit_error|overloaded_error"
+    r"|Service Unavailable|Bad Gateway|Gateway Time-?out|Internal Server Error",
+    re.IGNORECASE,
+)
+CARD_TIMEOUT_SECS = 30 * 60  # one card review; at the limit the launcher tree is killed and the run is NOT_RUN
+
+
+def _provider_failure(output: str, review_text: str) -> str | None:
+    """Why a run with no verdict line is a provider failure (NOT_RUN), or None when it is a real review."""
+    if _verdicts(review_text):
+        return None  # any verdict line, even two that conflict, means a model wrote a review: BLOCKED, never NOT_RUN
+    if not review_text.strip():
+        return "empty reply"
+    match = PROVIDER_FAILURE_RE.search(output)
+    if match:
+        return f"provider error ({match.group(0)})"
+    try:
+        data = _leading_json(output)
+    except ValueError:  # not JSON (JSONDecodeError is a ValueError)
+        data = None
+    if isinstance(data, dict) and data.get("is_error") is True:
+        return "the run reported is_error"
+    return None
 
 
 def _review_role(repo: Path) -> list[str]:
@@ -120,12 +147,30 @@ def launch(provider: str, prompt: str, cwd: Path) -> tuple[int, str]:
     # and the verdict is lost (seen with DeepSeek on 10 Oct 2026). claude-oss.ps1 sets this for GLM only.
     env = {**os.environ, "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1"}
     # stdin closed: started from a background shell with an open stdin, the launcher hung 40 minutes (10 Oct 2026).
-    res = subprocess.run(cmd, cwd=cwd, stdin=subprocess.DEVNULL, capture_output=True, text=True, encoding="utf-8",
-                         errors="replace", env=env)
-    if res.returncode != 0 and res.stderr:
+    # Its own process group (Windows) or session (POSIX), so the timeout kills the whole tree (pwsh, claude), not only
+    # the top process. A timeout is NOT_RUN (3): the run switches provider, never BLOCKED.
+    group = ({"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP} if os.name == "nt"
+             else {"start_new_session": True})
+    proc = subprocess.Popen(cmd, cwd=cwd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                            text=True, encoding="utf-8", errors="replace", env=env, **group)
+    try:
+        stdout, stderr = proc.communicate(timeout=CARD_TIMEOUT_SECS)
+    except subprocess.TimeoutExpired:
+        _kill_tree(proc)
+        try:
+            stdout, _stderr = proc.communicate(timeout=60)
+        except subprocess.TimeoutExpired:
+            stdout = ""
+        return caddis_exit.NOT_RUN, (f"caddis_review: card review timed out after {CARD_TIMEOUT_SECS} s; process tree "
+                                     f"killed\n{stdout or ''}")
+    except BaseException:
+        _kill_tree(proc)
+        raise
+    stdout, stderr = stdout or "", stderr or ""
+    if proc.returncode != 0 and stderr:
         # A limit or key message often comes on stderr; keep it for the switch decision.
-        return res.returncode, (res.stdout + "\n" + res.stderr).strip() + "\n"
-    return res.returncode, res.stdout
+        return proc.returncode, (stdout + "\n" + stderr).strip() + "\n"
+    return proc.returncode, stdout
 
 
 def _leading_json(output: str) -> object:
@@ -261,12 +306,15 @@ def run_review(
                     break
 
             # Limit text counts only when the run gave no verdict: a review may quote such text from the code.
-            has_usage_limit = bool(USAGE_LIMIT_RE.search(output)) and not (
-                code == 0 and _verdicts(_extract_review_text(output)))
-            needs_switch = (code == 3) or (code == 2) or has_usage_limit
+            extracted = _extract_review_text(output)
+            has_usage_limit = bool(USAGE_LIMIT_RE.search(output)) and not (code == 0 and _verdicts(extracted))
+            # A 429, a 5xx or an empty reply is the provider failing, not the reviewer finding nothing: switch, and
+            # NOT_RUN when no provider is left. Never "FAILED no verdict line" (BLOCKED).
+            provider_failed = _provider_failure(output, extracted)
+            needs_switch = (code == 3) or (code == 2) or has_usage_limit or provider_failed is not None
 
             # Again after the JSON decode: an escaped key form that survived in the raw JSON is plain text now.
-            review_text = caddis_redact.redact(_extract_review_text(output), masks)
+            review_text = caddis_redact.redact(extracted, masks)
             review_file = out_dir / f"{card.stem}-{provider}.txt"
             content = review_text.rstrip("\r\n") + f"\nEXIT {code} secs {duration}\n"
 
@@ -277,6 +325,8 @@ def run_review(
                     reason = "exit 2"
                 elif has_usage_limit:
                     reason = "usage limit reached"
+                elif provider_failed is not None:
+                    reason = provider_failed
                 else:
                     reason = f"exit {code}"
 
@@ -634,6 +684,16 @@ def launch_claude(prompt: str, worktree: Path, out: Path) -> str:
     # there is no sandbox on native Windows. The diff comes in the prompt (`_diff_material`).
     # No `--allowedTools`: unscoped, it approves files outside the worktree (smoke run 18 Oct 2026: without it a
     # Read in the worktree ran, a Read of ~/.caddis/spend-cap.toml was refused).
+    try:
+        import caddis_spend  # the recursion guard lives beside the spend cap (robustness #19)
+        env_depth = caddis_spend.bump_headless_depth(os.environ)
+    except ImportError:
+        env_depth = None
+    except RuntimeError as exc:  # HeadlessDepthExceeded
+        output = f"{_PREFIX}{exc}\n"
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(output, encoding="utf-8")
+        return output
     exe = _claude_exe()
     if exe is None:
         output = f"{_PREFIX}claude could not start: not found on PATH (the current folder is not searched)\n"
@@ -647,11 +707,21 @@ def launch_claude(prompt: str, worktree: Path, out: Path) -> str:
     governor = default_governor()
     if governor:
         cmd = governor + cmd
+    elif os.environ.get("CADDIS_ALLOW_UNGOVERNED") == "1":  # the owner's explicit opt-out
+        print("WARNING: caddis_governor.py not found; the review runs without a CPU and memory cap "
+              "(CADDIS_ALLOW_UNGOVERNED=1)", file=sys.stderr)
     else:
-        print("WARNING: caddis_governor.py not found; the review runs without a CPU and memory cap", file=sys.stderr)
+        # The plan reviewer needs the governor, as the roadmap runner does (robustness #19): an ungoverned
+        # `claude -p` can fill the machine's CPU and memory, and a review that cannot run is only NOT_RUN.
+        output = (f"{_PREFIX}caddis_governor.py not found, so the review is not started without a CPU and memory "
+                  "cap (set CADDIS_ALLOW_UNGOVERNED=1 to run it ungoverned)\n")
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(output, encoding="utf-8")
+        return output
     # CADDIS_HEADLESS keeps relay and session-end hooks quiet (claude-oss.ps1 sets it too).
     # No program from the current folder (Windows searches it first), no git index rewrite by the reviewer's tools.
-    env = {**os.environ, "CADDIS_HEADLESS": "1", "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
+    env = {**(env_depth if env_depth is not None else os.environ), "CADDIS_HEADLESS": "1",
+           "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
            "NoDefaultCurrentDirectoryInExePath": "1", "GIT_OPTIONAL_LOCKS": "0"}
     # Its own process group (Windows) or session (POSIX), so a timeout kills the whole tree, not only the top process.
     group = ({"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP} if os.name == "nt"

package/bundles/antigravity-plugin/scripts/caddis_roadmap.py

@@ -241,9 +241,13 @@ def default_branch(root: Path) -> str:
                        caddis_exit.NOT_RUN)
 
 
+FETCH = True  # `render --no-fetch` (the waiting hook) turns it off for one command: read the origin refs it has
+
+
 def fetch(root: Path) -> str:
     """Fetch origin and return the default branch name."""
-    _git(root, "fetch", "--quiet", "origin")
+    if FETCH:
+        _git(root, "fetch", "--quiet", "origin")
     return default_branch(root)
 
 
@@ -1068,7 +1072,6 @@ def merged_checkout(root: Path, branch: str):
         yield worktree
     finally:
         caddis_worktree_safety.safe_remove_worktree(root, worktree, force_locked=True, env=_quiet_env())
-        _git(root, "worktree", "prune", check=False)
         caddis_worktree_safety.remove_tree(tmp)     # links first: a junction's target survives
 
 
@@ -1818,11 +1821,12 @@ def write_change(root: Path, slug: str, mid: str, change: str, edit, dry_run: bo
             _git(worktree, "add", "--", path)
             _git(worktree, "commit", "--quiet", "-m", title)
             _git(worktree, "push", "--quiet", "-u", "origin", branch)
+            pushed_tip = _git(worktree, "rev-parse", "HEAD").stdout.strip()  # the tip we pushed: the only one we delete
             try:
                 pr = open_pr(root, gh_repo, branch, snap.branch, title,
                              f"Roadmap change by caddis_roadmap.py: {slug} {mid} {change}.")
             except Exception:
-                _git(root, "push", "--quiet", "origin", "--delete", branch, check=False)
+                _git(root, *caddis_worktree_safety.remote_delete_args(branch, pushed_tip), check=False)
                 raise
             try:
                 rc = merge_pr(root, pr, gh_repo)
@@ -1830,13 +1834,12 @@ def write_change(root: Path, slug: str, mid: str, change: str, edit, dry_run: bo
                 merge_exit = "timeout"
                 raise
             out(f"#{pr} {title}: " + ("merged" if rc == caddis_exit.CLEAN else f"not merged (merge chain exit {rc})"))
-            if rc == caddis_exit.CLEAN:
-                _git(root, "push", "--quiet", "origin", "--delete", branch, check=False)
+            if rc == caddis_exit.CLEAN:  # only while the remote tip is still the commit we pushed
+                _git(root, *caddis_worktree_safety.remote_delete_args(branch, pushed_tip), check=False)
             else:
                 rc = caddis_exit.NOT_RUN if rc == caddis_exit.NOT_RUN else caddis_exit.BLOCKED
         finally:
             caddis_worktree_safety.safe_remove_worktree(root, worktree, force_locked=True, env=_quiet_env())
-            _git(root, "worktree", "prune", check=False)
             _git(root, "branch", "-D", branch, check=False)
             caddis_worktree_safety.remove_tree(tmp)
             _audit(root, slug, {"utc": _utc(), "roadmap": slug, "id": mid, "change": change, "branch": branch,
@@ -2218,9 +2221,93 @@ def _build_parser() -> argparse.ArgumentParser:
     which.add_argument("--all", action="store_true", help="every roadmap on origin (used by hooks and commands)")
     p.add_argument("--root", default=".")
     p.add_argument("--out", default=None, help="the HTML file (default ~/.caddis/roadmap-pages/<repo>/<slug>.html)")
+    p.add_argument("--no-fetch", action="store_true",
+                   help="use the origin refs this checkout has; no git fetch (the waiting hook's background render)")
+    p.add_argument("--delay", type=int, default=0,
+                   help="wait this many seconds (at most 60) first: the waiting hook's follow-up render")
     return parser
 
 
+RENDER_LOCK_STALE_S = 600  # a render lock older than this is left by a killed render
+PENDING_NAME = ".roadmap-render.pending"  # session_waiting.py writes it beside its debounce stamp
+
+
+def _clear(path: Path | None) -> bool:
+    """Delete `path`; True when it was there."""
+    if path is None:
+        return False
+    try:
+        path.unlink()
+        return True
+    except FileNotFoundError:
+        return False
+    except OSError:
+        return path.exists()
+
+
+def _take_render_lock(lock: Path) -> bool:
+    """One render per repo at a time (robustness #8): create `lock` with O_EXCL, never wait. A lock older than
+    RENDER_LOCK_STALE_S is taken over once. False: another render holds it."""
+    lock.parent.mkdir(parents=True, exist_ok=True)
+    for attempt in range(2):
+        try:
+            fd = os.open(str(lock), os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+        except FileExistsError:
+            pass
+        except PermissionError:  # Windows: a deleted lock whose delete is still pending
+            return False
+        else:
+            with os.fdopen(fd, "w", encoding="utf-8") as fh:
+                fh.write(str(os.getpid()))
+            return True
+        try:
+            stale = time.time() - lock.stat().st_mtime > RENDER_LOCK_STALE_S
+        except FileNotFoundError:
+            stale = True  # released between the create and the stat: try again
+        except OSError:  # Windows: a lock being deleted cannot be read either
+            return False
+        if attempt or not stale:
+            return False
+        try:
+            lock.unlink()
+        except FileNotFoundError:
+            pass
+        except OSError:
+            return False
+    return False
+
+
+def _render(root: Path, args: argparse.Namespace) -> int:
+    """`render`: the pages, the prune and the hub. The caller holds the repo's render lock."""
+    import caddis_roadmap_page
+    slugs, on_origin = list_roadmaps_checked(root) if args.all else ([args.roadmap], None)
+    failed = written = pruned = 0
+    for slug in slugs:  # --all: one bad roadmap must not stop the others
+        try:
+            path = caddis_roadmap_page.write_page(root, slug, Path(args.out) if args.out else None,
+                                                  sys.modules[__name__])
+            if path is None:  # a newer caddis owns this page: kept, and neither written nor failed
+                continue
+            written += 1
+            print(f"[ROADMAP] page written: {path.resolve()}")
+        except Exception as exc:  # --all: one roadmap must never stop the others
+            if not args.all:
+                raise
+            failed += 1
+            print(f"[ROADMAP] {slug}: page not written: {exc}", file=sys.stderr)
+    try:  # the hub is a convenience: nothing below ever fails a render or changes its exit code
+        if args.all and on_origin is not None:  # a roadmap removed from origin leaves the hub too; a listing
+            # that failed removes nothing, and a folder still on origin keeps its page even if its render failed
+            pruned = caddis_roadmap_page.prune_folder(
+                caddis_roadmap_page.default_page_path(root, "_").parent, on_origin | set(slugs))
+        hub = caddis_roadmap_page.write_hub() if not args.out and (written or pruned) else None
+        if hub is not None:  # None: a newer caddis owns the hub (write_hub said so)
+            print(f"[ROADMAP] hub written: {hub.resolve()}")
+    except Exception as exc:
+        print(f"[ROADMAP] hub not written: {exc}", file=sys.stderr)
+    return caddis_exit.BLOCKED if failed else caddis_exit.CLEAN
+
+
 def _dispatch(args: argparse.Namespace) -> int:
     root = _repo_root(args.root)
     if args.cmd == "list":
@@ -2266,29 +2353,37 @@ def _dispatch(args: argparse.Namespace) -> int:
         import caddis_roadmap_page  # the page is separate; only `render` needs it
         if args.all and args.out:
             raise RoadmapError("--out works with one --roadmap, not with --all", caddis_exit.ERROR)
-        slugs, on_origin = list_roadmaps_checked(root) if args.all else ([args.roadmap], None)
-        failed = written = pruned = 0
-        for slug in slugs:  # --all: one bad roadmap must not stop the others
-            try:
-                path = caddis_roadmap_page.write_page(root, slug, Path(args.out) if args.out else None,
-                                                      sys.modules[__name__])
-                written += 1
-                print(f"[ROADMAP] page written: {path.resolve()}")
-            except Exception as exc:  # --all: one roadmap must never stop the others
-                if not args.all:
-                    raise
-                failed += 1
-                print(f"[ROADMAP] {slug}: page not written: {exc}", file=sys.stderr)
-        try:  # the hub is a convenience: nothing below ever fails a render or changes its exit code
-            if args.all and on_origin is not None:  # a roadmap removed from origin leaves the hub too; a listing
-                # that failed removes nothing, and a folder still on origin keeps its page even if its render failed
-                pruned = caddis_roadmap_page.prune_folder(
-                    caddis_roadmap_page.default_page_path(root, "_").parent, on_origin | set(slugs))
-            if not args.out and (written or pruned):
-                print(f"[ROADMAP] hub written: {caddis_roadmap_page.write_hub().resolve()}")
-        except Exception as exc:
-            print(f"[ROADMAP] hub not written: {exc}", file=sys.stderr)
-        return caddis_exit.BLOCKED if failed else caddis_exit.CLEAN
+        if args.delay > 0:
+            time.sleep(min(args.delay, 60))
+        folder = caddis_roadmap_page.default_page_path(root, "_").parent.name
+        lock = caddis_roadmap_page.pages_root() / ".locks" / f"{folder}.lock"
+        # The waiting hook's debounce (and a render that finds the lock held) leaves PENDING_NAME: the render that
+        # holds the lock renders once more at its end, so the last mark change always reaches the page.
+        state = caddis_roadmap_page.main_checkout(root) / ".caddis" / "session-state"
+        pending = state / PENDING_NAME if args.all and not args.out else None
+        if not _take_render_lock(lock):
+            if pending is not None and state.is_dir():
+                try:
+                    pending.write_text(str(os.getpid()), encoding="utf-8")
+                except OSError:
+                    pass
+            print("[ROADMAP] another render of this repo is running; skipped")
+            return caddis_exit.CLEAN
+        global FETCH
+        FETCH = not args.no_fetch
+        try:
+            _clear(pending)  # this render reads the marks as they are now
+            code = _render(root, args)
+            if _clear(pending):  # a mark changed while it ran: once more, under the same lock
+                code = _render(root, args)
+            return code
+        finally:
+            FETCH = True
+            try:  # only our own lock: a render that ran past the stale age may have been taken over
+                if lock.read_text(encoding="utf-8").strip() == str(os.getpid()):
+                    lock.unlink()
+            except (OSError, UnicodeDecodeError):
+                pass
     return caddis_exit.ERROR
 
 

package/bundles/antigravity-plugin/scripts/caddis_roadmap_page.py

@@ -19,6 +19,7 @@ from the files is escaped: a plan, a relay or a hook message can hold any text.
 from __future__ import annotations
 
 import datetime
+import functools
 import hashlib
 import html
 import json
@@ -452,11 +453,13 @@ def default_page_path(root: Path, slug: str, home: Path | None = None) -> Path:
     return pages_root(home) / f"{main.name}-{tag}" / f"{slug}.html"
 
 
-def write_page(root: Path, slug: str, out: Path | None, roadmap_mod) -> Path:
+def write_page(root: Path, slug: str, out: Path | None, roadmap_mod) -> Path | None:
     """The page. At the default path it also writes `<slug>.json`, the one-row summary the hub is built from; an
-    `--out` page is a one-off copy and stays out of the hub."""
-    model = build(root, slug, roadmap_mod)
+    `--out` page is a one-off copy and stays out of the hub. None: a newer caddis wrote this page, so it is kept."""
     path = Path(out) if out else default_page_path(root, slug)
+    if out is None and _owned_by_newer(slug, path.with_suffix(".json")):  # before build: a skip does no work
+        return None
+    model = build(root, slug, roadmap_mod)
     path.parent.mkdir(parents=True, exist_ok=True)
     _write_atomic(path, render_html(model))
     if out is None:
@@ -468,6 +471,66 @@ def write_page(root: Path, slug: str, out: Path | None, roadmap_mod) -> Path:
     return path
 
 
+# ---- the version gate: a session on an old plugin never overwrites what a newer caddis wrote (robustness #8) -------
+
+@functools.lru_cache(maxsize=8)
+def generator_version(here: Path | None = None) -> str:
+    """This caddis's version: the Claude plugin's `.claude-plugin/plugin.json` or the agy plugin's root
+    `plugin.json` (both beside `scripts/`), else the source checkout's `caddis` entry in
+    `.github/runtime-targets.json`, else "dev"."""
+    base = Path(here or Path(__file__).resolve().parent).parent
+    for manifest in (base / ".claude-plugin" / "plugin.json", base / "plugin.json"):
+        data, _ = _read_json(manifest)
+        if data and data.get("version"):
+            return str(data["version"])
+    data, _ = _read_json(base / ".github" / "runtime-targets.json")
+    for target in (data or {}).get("targets") or []:
+        plugin = target.get("plugin") if isinstance(target, dict) else None
+        if isinstance(plugin, dict) and plugin.get("name") == "caddis" and plugin.get("version"):
+            return str(plugin["version"])
+    return "dev"
+
+
+def _version_key(text) -> tuple[int, ...] | None:
+    parts = str(text or "").strip().split(".")
+    return tuple(int(p) for p in parts) if all(p.isdigit() for p in parts) else None
+
+
+def is_newer(theirs, mine) -> bool:
+    """True only when both are numeric versions and `theirs` is the higher one; "dev" or "" never blocks."""
+    a, b = _version_key(theirs), _version_key(mine)
+    return a is not None and b is not None and a > b
+
+
+GENERATOR_OWNERSHIP_S = 1800  # a newer caddis owns a page only while it keeps writing it (review of #71)
+
+
+def _newer_owner(summary: Path) -> tuple[str, bool]:
+    """(version, live): the newer caddis that wrote `summary` ("" when it is not newer), and whether it wrote it in
+    the last GENERATOR_OWNERSHIP_S. An unreadable time is not live: a downgrade must never freeze a page."""
+    data, _ = _read_json(summary)
+    theirs = str((data or {}).get("generator") or "")
+    if not is_newer(theirs, generator_version()):
+        return "", False
+    age_h = _age_h(str((data or {}).get("generated_utc") or ""), datetime.datetime.now(datetime.timezone.utc))
+    return theirs, age_h is not None and age_h * 3600 <= GENERATOR_OWNERSHIP_S
+
+
+def _gate(label: str, theirs: str, live: bool) -> bool:
+    """True: skip the write. Prints one line when a newer caddis owns it, or when this one takes it over."""
+    if theirs and live:
+        print(f"[ROADMAP] {label}: a newer caddis ({theirs}) owns this page; skipped")
+        return True
+    if theirs:
+        print(f"[ROADMAP] {label}: taking over from caddis {theirs} (it has not written for "
+              f"{GENERATOR_OWNERSHIP_S // 60} min)")
+    return False
+
+
+def _owned_by_newer(slug: str, summary: Path) -> bool:
+    return _gate(slug, *_newer_owner(summary))
+
+
 # ---- the hub: one page over every roadmap page on this machine, grouped per repo ---------------------------------
 
 HUB_STALE_H = 24  # a summary older than this is marked "not refreshed"
@@ -507,7 +570,7 @@ def page_summary(model: dict, main: Path, path: Path) -> dict:
               else f"stopped: {stop.get('reason')}" if stop.get("reason") else "")
     nxt = model.get("next") or {}
     return {
-        "version": 1, "repo": main.name, "checkout": str(main), "folder": path.parent.name, "slug": model["roadmap"],
+        "version": 1, "generator": generator_version(), "repo": main.name, "checkout": str(main), "folder": path.parent.name, "slug": model["roadmap"],
         "branch": model["branch"], "origin_commit": model.get("origin_commit", ""),
         "generated_utc": model["generated"],
         "milestones_done": model["done"], "milestones_total": model["total"],
@@ -530,7 +593,7 @@ def prune_folder(folder: Path, keep: set[str]) -> int:
     if not folder.is_dir():
         return removed
     for js in folder.glob("*.json"):
-        if js.stem in keep:
+        if js.stem in keep or _newer_owner(js)[1]:  # a live newer caddis may know a roadmap this one cannot list
             continue
         for f in (js, js.with_suffix(".html")):
             try:
@@ -667,11 +730,21 @@ def render_hub(rows: list[dict], errors: list[str], now: datetime.datetime) -> s
     return "".join(out)
 
 
-def write_hub(home: Path | None = None, now: datetime.datetime | None = None) -> Path:
-    """`~/.caddis/roadmap-pages/index.html`: every roadmap page on this machine, grouped per repo."""
+def write_hub(home: Path | None = None, now: datetime.datetime | None = None) -> Path | None:
+    """`~/.caddis/roadmap-pages/index.html`: every roadmap page on this machine, grouped per repo. None: a newer
+    caddis wrote the hub (its version is in `.hub-generator`), so it is kept."""
     root_dir = pages_root(home)
     root_dir.mkdir(parents=True, exist_ok=True)
+    stamp = root_dir / ".hub-generator"
+    try:
+        theirs = stamp.read_text(encoding="utf-8").strip()
+        live = time.time() - stamp.stat().st_mtime <= GENERATOR_OWNERSHIP_S
+    except (OSError, UnicodeDecodeError):
+        theirs, live = "", False
+    if _gate("hub", theirs if is_newer(theirs, generator_version()) else "", live):
+        return None
     rows, errors = read_summaries(root_dir)
     path = root_dir / "index.html"
     _write_atomic(path, render_hub(rows, errors, now or datetime.datetime.now(datetime.timezone.utc)))
+    _write_atomic(stamp, generator_version() + "\n")
     return path

package/bundles/antigravity-plugin/scripts/caddis_roadmap_run.py

@@ -200,6 +200,8 @@ def headless_env(base: dict | None = None) -> dict:
     console, so every session and every caddis_roadmap.py call the runner starts carries the marker."""
     env = dict(os.environ if base is None else base)
     env.update(HEADLESS_ENV)
+    # One level deeper for every session it starts. main() refuses to start past the limit (robustness #19).
+    env[caddis_spend.HEADLESS_DEPTH_VAR] = str(caddis_spend.headless_depth(env) + 1)
     return env
 
 
@@ -223,12 +225,19 @@ def runner_env() -> dict:
 
 
 def build_command(engine: str, model: str, prompt: str, *, usd: float, timeout_min: float,
-                  governor: Sequence[str], engine_cmd: Sequence[str] | None = None) -> list[str]:
+                  governor: Sequence[str], engine_cmd: Sequence[str] | None = None,
+                  worktree: Path | str | None = None) -> list[str]:
     """The full command line for one session: the governor prefix, then the engine's print-mode call.
 
     `claude` gets its prompt on stdin, not as an argument (PROMPT_ON_STDIN): on Windows `claude` is an npm `.cmd`
     shim, and cmd.exe cuts a multi-line argument at its first newline, which drops the rest of the prompt and every
-    argument after it."""
+    argument after it.
+
+    Every engine gets its permission mode on the command line (robustness #19), none is left to a settings file or
+    a default that a new version may change: `claude` bypassPermissions (with the deny rules), `agy` accept-edits
+    plus --dangerously-skip-permissions (as the lanes do; a print session cannot answer a prompt), `codex` the
+    workspace-write sandbox confined to `worktree` with `-C` (as the lanes do; the session's own folder, default
+    the current one). The boundary is the same for all three: no publish token (session_env) and the guard."""
     if engine not in ENGINES:
         raise ValueError(f"unknown engine {engine!r}; known: {', '.join(ENGINES)}")
     exe = list(engine_cmd) if engine_cmd else [engine]
@@ -240,10 +249,10 @@ def build_command(engine: str, model: str, prompt: str, *, usd: float, timeout_m
         tail = [*exe, "-p", "--disallowedTools", *SESSION_DENY_RULES, "--permission-mode", "bypassPermissions",
                 "--model", model, "--output-format", "json", "--max-budget-usd", _usd(usd)]
     elif engine == "agy":  # probe 5: --model must come before --print
-        tail = [*exe, "--model", model, "--print", prompt, "--output-format", "json",
-                "--print-timeout", f"{max(1, int(timeout_min))}m"]
+        tail = [*exe, "--model", model, "--mode", "accept-edits", "--dangerously-skip-permissions",
+                "--print", prompt, "--output-format", "json", "--print-timeout", f"{max(1, int(timeout_min))}m"]
     else:
-        tail = [*exe, "exec", "--model", model, "--json", prompt]
+        tail = [*exe, "exec", "--model", model, "-s", "workspace-write", "-C", str(worktree or "."), "--json", prompt]
     return [*governor, *tail]
 
 
@@ -888,7 +897,7 @@ def _one_session(ctx: _Ctx, prompt: str, relay_slug: str, n: int, spent: float,
     remaining_s = max(1.0, min(caps.session_timeout_min * 60, caps.max_hours * 3600 - elapsed))
     usd = min(caps.max_usd_per_session, caps.max_usd_total - spent)
     cmd = build_command(ctx.engine, ctx.model, prompt, usd=usd, timeout_min=remaining_s / 60, governor=ctx.governor,
-                        engine_cmd=ctx.engine_cmd)
+                        engine_cmd=ctx.engine_cmd, worktree=cwd)
     rid = _spend_reserve(ctx.home, spend_slug, ctx.now(), n > 1) if ctx.engine == "agy" else None
     launched, outcome = ctx.clock(), None
     try:
@@ -1273,7 +1282,8 @@ def _render_page(ctx: "_Ctx", roadmap_cmd: Sequence[str]) -> None:
 def _dry_run_tail(ctx: _Ctx, template: Path, prompt: str, cwd: Path | None = None) -> None:
     caps = ctx.caps
     cmd = build_command(ctx.engine, ctx.model, "<resume prompt>", usd=min(caps.max_usd_per_session, caps.max_usd_total),
-                        timeout_min=caps.session_timeout_min, governor=ctx.governor, engine_cmd=ctx.engine_cmd)
+                        timeout_min=caps.session_timeout_min, governor=ctx.governor, engine_cmd=ctx.engine_cmd,
+                        worktree=cwd or ctx.repo)
     print(f"would launch (cwd {cwd or ctx.repo}, CADDIS_HEADLESS=1): {subprocess.list2cmdline(cmd)}"
           + (" (resume prompt on stdin)" if ctx.engine in PROMPT_ON_STDIN else ""))
     print(f"resume prompt from {template}:\n{prompt}")
@@ -1552,7 +1562,10 @@ def ensure_worktree(repo: Path, slug: str, default: str, root: Path | None = Non
     if path.resolve() in _registered_worktrees(repo):
         if path.is_dir():
             return path
-        _git_out(repo, "worktree", "prune")  # listed, but its folder is gone (temp cleanup): prune, make it again
+        # Listed, but its folder is gone (temp cleanup): drop this one registration and make it again. Not
+        # `git worktree prune`: that would drop every other tool's registration with a missing folder too.
+        if caddis_worktree_safety.safe_remove_worktree(repo, path) is not None:
+            raise _Stop(f"FAILED cannot drop the registration of the missing worktree {path}", caddis_exit.BLOCKED)
     if path.exists():
         raise _Stop(f"FAILED worktree path {path} exists and is not a worktree of this repo", caddis_exit.BLOCKED)
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -1586,7 +1599,6 @@ def remove_worktree_if_clean(repo: Path, slug: str, root: Path | None = None) ->
         return f"worktree kept (not clean, {len(work)} change(s)): {path}"
     if caddis_worktree_safety.safe_remove_worktree(repo, path) is not None:
         return f"worktree kept (remove failed): {path}"
-    _git_out(repo, "worktree", "prune")
     _state_file(repo, slug, "worktree").unlink(missing_ok=True)
     return f"worktree removed: {path}"
 
@@ -2660,6 +2672,11 @@ def main(argv: list[str] | None = None) -> int:
         ok, why = last_stop_restartable(args.repo, args.roadmap)
         print(why)
         return caddis_exit.CLEAN if ok else caddis_exit.BLOCKED
+    try:
+        caddis_spend.bump_headless_depth(os.environ)  # a check only: the sessions get the bump in headless_env
+    except caddis_spend.HeadlessDepthExceeded as exc:
+        print(f"caddis_roadmap_run: {exc}", file=sys.stderr)
+        return caddis_exit.BLOCKED
     caps = Caps(args.max_hours, args.max_sessions, args.session_timeout_min, args.max_usd_per_session,
                 args.max_usd_total)
     return run(repo=args.repo, plan=args.plan, roadmap=args.roadmap, caps=caps, engine=args.engine, model=args.model,

package/bundles/antigravity-plugin/scripts/caddis_spawn.py

@@ -258,14 +258,32 @@ CONTEXT_NOTE_ABOVE = 85.0
 CONTEXT_MAX_AGE_S = 900
 
 
-def read_context_pct(repo_root: Path) -> tuple[float | None, str]:
+SESSION_ID_ENV = ("CLAUDE_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CADDIS_SESSION_ID")
+
+
+def _session_id(explicit: str | None = None) -> str:
+    """This session's id: the explicit one, else the first of SESSION_ID_ENV that is set. Made file-name safe."""
+    raw = explicit or next((os.environ[v] for v in SESSION_ID_ENV if os.environ.get(v)), "")
+    return "".join(ch if (ch.isalnum() and ch.isascii()) or ch in "-_" else "_" for ch in raw)[:64].strip(".")
+
+
+def read_context_pct(repo_root: Path, session_id: str | None = None) -> tuple[float | None, str]:
     """(percentage, provenance) from the statusline's cache, or (None, why not).
 
+    With a session id (the argument, or CLAUDE_SESSION_ID and the like) it reads that session's own file,
+    `.caddis/context-window/<id>.json`, so a second session in the same folder cannot change the figure.
+    Without one it reads the shared `context-window.json`, which any session may have written last; the
+    provenance then says "shared".
+
     Written by `caddis_statusline.record_context`. Claude Code gives the figure to the status
     line and to nothing else, so this file is the only runtime-sourced number a plain command
     can reach.
     """
-    target = repo_root / ART / "context-window.json"
+    sid = _session_id(session_id)
+    shared = repo_root / ART / "context-window.json"
+    target = repo_root / ART / "context-window" / f"{sid}.json" if sid else shared
+    if sid and not target.is_file():
+        target, sid = shared, ""  # the status line has not written this session's file yet (or is old)
     try:
         raw = json.loads(target.read_text(encoding="utf-8"))
         pct = float(raw["used_percentage"])
@@ -275,8 +293,10 @@ def read_context_pct(repo_root: Path) -> tuple[float | None, str]:
                       + f"{ART}/context-window.json — run `/caddis:install-statusline` to install the "
                       "status line that writes it")
     if age > CONTEXT_MAX_AGE_S:
-        return pct, f"runtime figure, STALE by {age}s (a lower bound — the real number is >= this)"
-    return pct, f"runtime figure, {age}s old"
+        scope = "this session's" if sid else "shared (session unknown)"
+        return pct, f"{scope} runtime figure, STALE by {age}s (a lower bound — the real number is >= this)"
+    scope = "this session's" if sid else "shared (session unknown)"
+    return pct, f"runtime figure, {scope}, {age}s old"
 
 
 @dataclass