@caddis/cli 0.4.57 → 0.4.59

package/bundles/antigravity-plugin/caddis_statusline.py

@@ -329,7 +329,12 @@ def ram_facts():
     return None
 
 
-def record_context(cwd: str, pct: float) -> None:
+def _safe_session_id(session_id) -> str:
+    """A file-name-safe form of a session id (letters, digits, - and _ only, 64 chars at most); "" when empty."""
+    return "".join(ch if (ch.isalnum() and ch.isascii()) or ch in "-_" else "_" for ch in str(session_id or ""))[:64].strip(".")
+
+
+def record_context(cwd: str, pct: float, session_id: str = "") -> None:
     """Cache the runtime context figure for tools that never see the statusline payload.
 
     Claude Code hands `context_window.used_percentage` to the statusline and to NOTHING else.
@@ -342,6 +347,11 @@ def record_context(cwd: str, pct: float) -> None:
     render. Only writes where `.caddis/` already exists, so cd-ing into an unrelated folder
     never scatters artifact dirs. Fail-open and silent: a status line must never break a
     prompt, and this is the least important thing it does.
+
+    One folder can host several sessions, so the figure is also kept per session, in
+    `.caddis/context-window/<session id>.json`; a reader that knows its session id reads that file and
+    never another session's figure. `context-window.json` stays as the shared "last writer" for a reader
+    that does not know its session (robustness #19). Per-session files older than 2 days are removed.
     """
     try:
         if not cwd:
@@ -349,20 +359,44 @@ def record_context(cwd: str, pct: float) -> None:
         art = os.path.join(cwd, ".caddis")
         if not os.path.isdir(art):
             return
-        target = os.path.join(art, "context-window.json")
         payload = {"used_percentage": round(float(pct), 1), "at": int(time.time())}
-        try:
-            with open(target, encoding="utf-8") as fh:
-                if json.load(fh).get("used_percentage") == payload["used_percentage"]:
-                    return
-        except Exception:
-            pass
-        tmp = target + ".tmp"
+        sid = _safe_session_id(session_id)
+        if sid:
+            per_dir = os.path.join(art, "context-window")
+            os.makedirs(per_dir, exist_ok=True)
+            _write_if_changed(os.path.join(per_dir, sid + ".json"), payload)
+            try:
+                cutoff = time.time() - 2 * 86400
+                for name in os.listdir(per_dir):
+                    old = os.path.join(per_dir, name)
+                    if os.path.getmtime(old) < cutoff:
+                        os.unlink(old)
+            except Exception:
+                pass
+        _write_if_changed(os.path.join(art, "context-window.json"), payload)
+    except Exception:
+        pass
+
+
+def _write_if_changed(target: str, payload: dict) -> None:
+    """Write the JSON `payload` atomically (a temp file named for this process), only when the figure changed."""
+    try:
+        with open(target, encoding="utf-8") as fh:
+            if json.load(fh).get("used_percentage") == payload["used_percentage"]:
+                return
+    except Exception:
+        pass
+    tmp = f"{target}.{os.getpid()}.tmp"
+    try:
         with open(tmp, "w", encoding="utf-8") as fh:
             json.dump(payload, fh)
         os.replace(tmp, target)
     except Exception:
-        pass
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
 
 
 def relay_present(cwd: str) -> bool:
@@ -501,7 +535,7 @@ def render_claude(data: dict, cfg: dict) -> str:
             used = as_int(cw.get("total_input_tokens"))
         max_tokens = as_int(cw.get("context_window_size"))
         pct = float(as_int(cw.get("used_percentage")))
-        record_context(cwd, pct)  # feeds /caddis:spawn-session's 95% gate; see record_context
+        record_context(cwd, pct, str(dig(data, "session_id") or ""))  # feeds /caddis:spawn-session's 95% gate; see record_context
         parts.append(context_segment(c, cfg, used, max_tokens, pct))
         loud = cached_segment(c, cfg, cached)
         if loud:

package/bundles/antigravity-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis",
-  "version": "1.3.143",
+  "version": "1.3.145",
   "description": "caddis — agent-agnostic dev harness as an Antigravity (agy) plugin: TDD skills + commands, single-sourced with the Claude Code plugin."
 }

package/bundles/antigravity-plugin/scripts/caddis_adhoc.py

@@ -12,6 +12,7 @@ import ast
 import json
 import os
 import re
+import secrets
 import shutil
 import subprocess
 import sys
@@ -131,7 +132,8 @@ def slugify_prompt(prompt: str) -> str:
     if not slug:
         slug = "task"
     date_str = datetime.now(timezone.utc).strftime("%Y-%m-%d")
-    return f"{date_str}-{slug}"
+    # Random suffix: two runs on the same day and topic must never share a branch, plan or run dir.
+    return f"{date_str}-{slug}-{secrets.token_hex(3)}"
 
 
 def synthesize_plan(
@@ -168,18 +170,73 @@ Task requirements are met, existing tests pass, and new test assertions verify t
     return plan_path, slug, title
 
 
+def session_key() -> str:
+    """Id of this agent session, safe in a file name. One checkout can host several sessions."""
+    for var in ("CADDIS_SESSION_ID", "CLAUDE_SESSION_ID", "CLAUDE_CODE_SESSION_ID"):
+        raw = os.environ.get(var, "").strip()
+        key = re.sub(r"[^A-Za-z0-9_-]", "-", raw)[:64].strip("-")
+        if key:
+            return key
+    return "nosession"
+
+
+def _adhoc_dir(repo: Path) -> Path:
+    return repo / ".caddis" / "orchestrator" / "adhoc"
+
+
 def adhoc_latest_path(repo: Path) -> Path:
-    return repo / ".caddis" / "orchestrator" / "adhoc" / "latest.json"
+    return _adhoc_dir(repo) / f"latest-{session_key()}.json"
+
+
+def write_latest(repo: Path, state: dict) -> None:
+    path = adhoc_latest_path(repo)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(state, indent=2) + "\n", encoding="utf-8")
 
 
 def read_latest(repo: Path) -> dict | None:
     path = adhoc_latest_path(repo)
     if not path.is_file():
-        return None
+        # Migration: the old single latest.json belongs to whoever reads it first. The rename is
+        # atomic, so exactly one session adopts it and no other session ever sees it.
+        legacy = _adhoc_dir(repo) / "latest.json"
+        if not legacy.is_file():
+            return None
+        try:
+            os.replace(legacy, path)
+        except OSError:
+            return None
     try:
-        return json.loads(path.read_text(encoding="utf-8"))
+        data = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
         return None
+    return data if isinstance(data, dict) else None
+
+
+def move_branch(repo: Path, branch: str, commit_sha: str, base_sha: str) -> str:
+    """Point `branch` at `commit_sha`. Return "" on success, else why it was refused.
+
+    An existing branch is moved only when its tip is merged into the base, equals the new commit, or
+    is the tip this session recorded for it. Otherwise it holds work that moving would orphan.
+    """
+    tip = git_output(repo, "rev-parse", "--verify", "--quiet", f"refs/heads/{branch}")
+    if tip and tip != commit_sha:
+        merged = subprocess.run(
+            ["git", "-C", str(repo), "merge-base", "--is-ancestor", tip, base_sha],
+            capture_output=True,
+        ).returncode == 0
+        state = read_latest(repo) or {}
+        own = state.get("branch") == branch and state.get("commit_sha") == tip
+        if not merged and not own:
+            return (f"branch '{branch}' has commits not merged into {base_sha[:7]} "
+                    f"(tip {tip[:7]}); refusing to move it. Delete or merge it first.")
+    res = subprocess.run(
+        ["git", "-C", str(repo), "branch", "-f", branch, commit_sha],
+        capture_output=True, text=True, encoding="utf-8", errors="replace",
+    )
+    if res.returncode != 0:
+        return f"branch update failed: {res.stderr.strip()}"
+    return ""
 
 
 # Tool caches every gate run regenerates. They are the only ignored files a worktree may be
@@ -355,7 +412,7 @@ def run_adhoc(
         }
         if len(kept_paths) > 1:
             state["kept_worktrees"] = [str(path) for path in kept_paths]
-        adhoc_latest_path(repo).write_text(json.dumps(state, indent=2) + "\n", encoding="utf-8")
+        write_latest(repo, state)
         return EXIT_FAIL
 
     worktree_str = packet.get("worktree")
@@ -468,20 +525,14 @@ def run_adhoc(
 
         if not reason:
             try:
-                branch_res = subprocess.run(
-                    ["git", "-C", str(repo), "branch", "-f", adhoc_branch, commit_sha],
-                    capture_output=True, text=True, encoding="utf-8", errors="replace",
-                )
-                if branch_res.returncode != 0:
-                    reason = f"branch update failed: {branch_res.stderr.strip()}"
-                else:
+                reason = move_branch(repo, adhoc_branch, commit_sha, base_sha)
+                if not reason:
                     # An OSError from the helper (git not runnable) lands in the `except OSError` below.
                     problem = caddis_worktree_safety.safe_remove_worktree(repo, wt_path)
                     if problem or wt_path.exists():
                         reason = problem or f"worktree remove failed: {wt_path}"
                     else:
-                        kept_worktree = None
-                        subprocess.run(["git", "-C", str(repo), "worktree", "prune"], capture_output=True)
+                        kept_worktree = None  # `git worktree remove` dropped its registration; no prune (robustness #19)
                         attempt_branch = packet.get("branch")
                         if attempt_branch and attempt_branch != adhoc_branch:
                             subprocess.run(
@@ -503,7 +554,7 @@ def run_adhoc(
     diff_stat = git_output(repo, "diff", "--shortstat", base_sha, diff_ref)
     diff_names = verified_names or changed_files
 
-    # Save state to latest.json
+    # Save this session's state (latest-<session>.json)
     state = {
         "slug": slug,
         "title": title,
@@ -525,7 +576,7 @@ def run_adhoc(
         "plan_path": plan_rel,
         "created": datetime.now(timezone.utc).isoformat(),
     }
-    adhoc_latest_path(repo).write_text(json.dumps(state, indent=2) + "\n", encoding="utf-8")
+    write_latest(repo, state)
 
     # Render Verdict Card
     is_success = not reason and kept_worktree is None
@@ -618,13 +669,8 @@ def drop_adhoc(repo: Path) -> int:
         if problem:
             print(f"[mmr] Could not remove kept worktree: {problem}")
             return EXIT_FAIL
-        pruned = subprocess.run(
-            ["git", "-C", str(repo), "worktree", "prune"],
-            capture_output=True, text=True, encoding="utf-8", errors="replace",
-        )
-        if pruned.returncode != 0:
-            print(f"[mmr] Could not prune worktrees: {pruned.stderr.strip()}")
-            return EXIT_FAIL
+        # No `git worktree prune` here: it drops the registrations of every other worktree whose folder is missing
+        # for the moment, and `git worktree remove` has already dropped this one (robustness #19).
 
     if branch:
         subprocess.run(["git", "-C", str(repo), "branch", "-D", branch], capture_output=True)

package/bundles/antigravity-plugin/scripts/caddis_docs_pr.py

@@ -209,11 +209,10 @@ def _remove(main: Path, worktree: Path, branch: str) -> None:
         caddis_worktree_safety.safe_remove_worktree(main, worktree, force_locked=True, env=roadmap._quiet_env())
     except OSError:
         pass
-    for args in (("worktree", "prune"), ("branch", "-D", branch)):
-        try:
-            _git(main, *args, check=False)
-        except (roadmap.RoadmapError, OSError):
-            pass
+    try:  # no `git worktree prune`: it would drop other tools' registrations too (robustness #19)
+        _git(main, "branch", "-D", branch, check=False)
+    except (roadmap.RoadmapError, OSError):
+        pass
     if worktree.exists():
         caddis_worktree_safety.remove_tree(worktree)
 
@@ -234,6 +233,7 @@ def finish(worktree: Path, title: str, body: str, out=print) -> int:
         out("PR: none")
         return caddis_exit.CLEAN
     pushed = False
+    pushed_tip = ""
     try:
         gh_repo = roadmap.gh_repo_of(main)
         if gh_repo is None:
@@ -242,14 +242,15 @@ def finish(worktree: Path, title: str, body: str, out=print) -> int:
         _git(worktree, "commit", "--quiet", "-m", title)
         _git(worktree, "push", "--quiet", "-u", "origin", branch)
         pushed = True
+        pushed_tip = _git(worktree, "rev-parse", "HEAD").stdout.strip()  # the only tip we may delete
         url = open_pr(gh_repo, branch, base, title, body)
     except (DocsPrError, roadmap.RoadmapError, OSError) as exc:
         out(f"docs PR failed: {exc}")
         out(f"PATCH: {patch}")
         if pushed:
-            try:
-                _git(main, "push", "--quiet", "origin", "--delete", branch, check=False)
-            except (roadmap.RoadmapError, OSError):
+            try:  # only while the remote tip is still the commit we pushed
+                _git(main, *caddis_worktree_safety.remote_delete_args(branch, pushed_tip), check=False)
+            except (roadmap.RoadmapError, OSError, ValueError):
                 pass
         _remove(main, worktree, branch)
         return getattr(exc, "code", caddis_exit.NOT_RUN)

package/bundles/antigravity-plugin/scripts/caddis_lanes.py

@@ -275,7 +275,6 @@ def remove_phase_worktree(
         problem = f"worktree remove left {resolved} on disk"
     if problem:
         raise LaneConfigError(problem)
-    _git_output(repo_root, "worktree", "prune")
     if delete_branch:
         _git_output(repo_root, "branch", "-D", "--", wt.branch)
 
@@ -1266,7 +1265,10 @@ def child_env(base: dict, lane: str, model: str) -> dict:
     for name in LANE_SECRET_VARS:
         env.pop(name, None)
     env.update(LANE_NO_PROMPT_ENV)
-    env["CADDIS_HEADLESS"] = "1"
+    try:
+        env = caddis_spend.bump_headless_depth(env)  # sets CADDIS_HEADLESS=1 and the depth (robustness #19)
+    except caddis_spend.HeadlessDepthExceeded as exc:
+        raise LaneConfigError(str(exc)) from exc
     if lane == "glm":
         env["OSS_MODEL"] = model
     return env

package/bundles/antigravity-plugin/scripts/caddis_review.py

@@ -684,6 +684,16 @@ def launch_claude(prompt: str, worktree: Path, out: Path) -> str:
     # there is no sandbox on native Windows. The diff comes in the prompt (`_diff_material`).
     # No `--allowedTools`: unscoped, it approves files outside the worktree (smoke run 18 Oct 2026: without it a
     # Read in the worktree ran, a Read of ~/.caddis/spend-cap.toml was refused).
+    try:
+        import caddis_spend  # the recursion guard lives beside the spend cap (robustness #19)
+        env_depth = caddis_spend.bump_headless_depth(os.environ)
+    except ImportError:
+        env_depth = None
+    except RuntimeError as exc:  # HeadlessDepthExceeded
+        output = f"{_PREFIX}{exc}\n"
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(output, encoding="utf-8")
+        return output
     exe = _claude_exe()
     if exe is None:
         output = f"{_PREFIX}claude could not start: not found on PATH (the current folder is not searched)\n"
@@ -697,11 +707,21 @@ def launch_claude(prompt: str, worktree: Path, out: Path) -> str:
     governor = default_governor()
     if governor:
         cmd = governor + cmd
+    elif os.environ.get("CADDIS_ALLOW_UNGOVERNED") == "1":  # the owner's explicit opt-out
+        print("WARNING: caddis_governor.py not found; the review runs without a CPU and memory cap "
+              "(CADDIS_ALLOW_UNGOVERNED=1)", file=sys.stderr)
     else:
-        print("WARNING: caddis_governor.py not found; the review runs without a CPU and memory cap", file=sys.stderr)
+        # The plan reviewer needs the governor, as the roadmap runner does (robustness #19): an ungoverned
+        # `claude -p` can fill the machine's CPU and memory, and a review that cannot run is only NOT_RUN.
+        output = (f"{_PREFIX}caddis_governor.py not found, so the review is not started without a CPU and memory "
+                  "cap (set CADDIS_ALLOW_UNGOVERNED=1 to run it ungoverned)\n")
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(output, encoding="utf-8")
+        return output
     # CADDIS_HEADLESS keeps relay and session-end hooks quiet (claude-oss.ps1 sets it too).
     # No program from the current folder (Windows searches it first), no git index rewrite by the reviewer's tools.
-    env = {**os.environ, "CADDIS_HEADLESS": "1", "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
+    env = {**(env_depth if env_depth is not None else os.environ), "CADDIS_HEADLESS": "1",
+           "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
            "NoDefaultCurrentDirectoryInExePath": "1", "GIT_OPTIONAL_LOCKS": "0"}
     # Its own process group (Windows) or session (POSIX), so a timeout kills the whole tree, not only the top process.
     group = ({"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP} if os.name == "nt"

package/bundles/antigravity-plugin/scripts/caddis_roadmap.py

@@ -148,12 +148,19 @@ OUTPUT_MASKS: list[tuple[re.Pattern, str]] = [
     (re.compile(r"\bgh[pousr]_[A-Za-z0-9]{36,}\b"), "***"),  # secret_filter github-token
     (re.compile(r"\bxox[abprs]-[A-Za-z0-9-]{10,}\b"), "***"),  # secret_filter slack-token
     (re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"), "***"),  # secret_filter jwt
-    # secret_filter assignment, widened: a quoted value may hold spaces (a passphrase of several words).
-    (re.compile(r"(?i)([A-Za-z0-9_]*(?:password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*\s*[:=]\s*)"
+    # secret_filter assignment, widened: a quoted value may hold spaces (a passphrase of several words). A match
+    # starts only at the start of a word: a match inside a word always has one from the word start too, and without
+    # the lookbehind each character of a long word started a new scan (quadratic: 50 KB of one word took 64 s).
+    (re.compile(r"(?i)(?<![A-Za-z0-9_])"
+                r"([A-Za-z0-9_]*(?:password|passwd|secret|api[_-]?key|token)[A-Za-z0-9_]*\s*[:=]\s*)"
                 r"(['\"])[^'\"\n]{8,}\2"), r"\1\2***\2"),
     (re.compile(r"(?im)^(\s*(?:export\s+)?[A-Za-z0-9_]*(?:PASSWORD|PASSWD|SECRET|API_KEY|APIKEY|TOKEN|PRIVATE_KEY)"
                 r"[A-Za-z0-9_]*\s*=\s*)[^\s'\"#]{8,}"), r"\1***"),  # secret_filter env-assignment
-    (re.compile(r"\b([A-Za-z][A-Za-z0-9+.-]*://)[^/\s:@]+:[^/\s@]+@"), r"\1***@"),  # URL credentials
+    # URL credentials. The scheme starts at a letter after a word boundary. Every such letter in one run of scheme
+    # characters reaches the same `://`, so only the first one is tried: group 1 skips, possessively, the run's
+    # digits, `+.-` and letters that follow a word character. Without that, `a.a.a.a...` was quadratic.
+    (re.compile(r"(?<![A-Za-z0-9+.-])((?:[0-9+.-]|(?<=\w)[A-Za-z])*+)([A-Za-z][A-Za-z0-9+.-]*://)"
+                r"[^/\s:@]+:[^/\s@]+@"), r"\1\2***@"),
     # Absolute paths, which can name a user or a host. A path may hold spaces, so each one runs to the end of the
     # line or a quote; a Windows drive or UNC path also stops at `<`, `>` or `|` (never part of a Windows path).
     (re.compile(r"(?<![A-Za-z0-9])[A-Za-z]:[\\/][^\r\n'\"<>|]*"), "<path>"),  # a Windows drive path
@@ -1072,7 +1079,6 @@ def merged_checkout(root: Path, branch: str):
         yield worktree
     finally:
         caddis_worktree_safety.safe_remove_worktree(root, worktree, force_locked=True, env=_quiet_env())
-        _git(root, "worktree", "prune", check=False)
         caddis_worktree_safety.remove_tree(tmp)     # links first: a junction's target survives
 
 
@@ -1822,11 +1828,12 @@ def write_change(root: Path, slug: str, mid: str, change: str, edit, dry_run: bo
             _git(worktree, "add", "--", path)
             _git(worktree, "commit", "--quiet", "-m", title)
             _git(worktree, "push", "--quiet", "-u", "origin", branch)
+            pushed_tip = _git(worktree, "rev-parse", "HEAD").stdout.strip()  # the tip we pushed: the only one we delete
             try:
                 pr = open_pr(root, gh_repo, branch, snap.branch, title,
                              f"Roadmap change by caddis_roadmap.py: {slug} {mid} {change}.")
             except Exception:
-                _git(root, "push", "--quiet", "origin", "--delete", branch, check=False)
+                _git(root, *caddis_worktree_safety.remote_delete_args(branch, pushed_tip), check=False)
                 raise
             try:
                 rc = merge_pr(root, pr, gh_repo)
@@ -1834,13 +1841,12 @@ def write_change(root: Path, slug: str, mid: str, change: str, edit, dry_run: bo
                 merge_exit = "timeout"
                 raise
             out(f"#{pr} {title}: " + ("merged" if rc == caddis_exit.CLEAN else f"not merged (merge chain exit {rc})"))
-            if rc == caddis_exit.CLEAN:
-                _git(root, "push", "--quiet", "origin", "--delete", branch, check=False)
+            if rc == caddis_exit.CLEAN:  # only while the remote tip is still the commit we pushed
+                _git(root, *caddis_worktree_safety.remote_delete_args(branch, pushed_tip), check=False)
             else:
                 rc = caddis_exit.NOT_RUN if rc == caddis_exit.NOT_RUN else caddis_exit.BLOCKED
         finally:
             caddis_worktree_safety.safe_remove_worktree(root, worktree, force_locked=True, env=_quiet_env())
-            _git(root, "worktree", "prune", check=False)
             _git(root, "branch", "-D", branch, check=False)
             caddis_worktree_safety.remove_tree(tmp)
             _audit(root, slug, {"utc": _utc(), "roadmap": slug, "id": mid, "change": change, "branch": branch,

package/bundles/antigravity-plugin/scripts/caddis_roadmap_run.py

@@ -200,6 +200,8 @@ def headless_env(base: dict | None = None) -> dict:
     console, so every session and every caddis_roadmap.py call the runner starts carries the marker."""
     env = dict(os.environ if base is None else base)
     env.update(HEADLESS_ENV)
+    # One level deeper for every session it starts. main() refuses to start past the limit (robustness #19).
+    env[caddis_spend.HEADLESS_DEPTH_VAR] = str(caddis_spend.headless_depth(env) + 1)
     return env
 
 
@@ -223,12 +225,19 @@ def runner_env() -> dict:
 
 
 def build_command(engine: str, model: str, prompt: str, *, usd: float, timeout_min: float,
-                  governor: Sequence[str], engine_cmd: Sequence[str] | None = None) -> list[str]:
+                  governor: Sequence[str], engine_cmd: Sequence[str] | None = None,
+                  worktree: Path | str | None = None) -> list[str]:
     """The full command line for one session: the governor prefix, then the engine's print-mode call.
 
     `claude` gets its prompt on stdin, not as an argument (PROMPT_ON_STDIN): on Windows `claude` is an npm `.cmd`
     shim, and cmd.exe cuts a multi-line argument at its first newline, which drops the rest of the prompt and every
-    argument after it."""
+    argument after it.
+
+    Every engine gets its permission mode on the command line (robustness #19), none is left to a settings file or
+    a default that a new version may change: `claude` bypassPermissions (with the deny rules), `agy` accept-edits
+    plus --dangerously-skip-permissions (as the lanes do; a print session cannot answer a prompt), `codex` the
+    workspace-write sandbox confined to `worktree` with `-C` (as the lanes do; the session's own folder, default
+    the current one). The boundary is the same for all three: no publish token (session_env) and the guard."""
     if engine not in ENGINES:
         raise ValueError(f"unknown engine {engine!r}; known: {', '.join(ENGINES)}")
     exe = list(engine_cmd) if engine_cmd else [engine]
@@ -240,10 +249,10 @@ def build_command(engine: str, model: str, prompt: str, *, usd: float, timeout_m
         tail = [*exe, "-p", "--disallowedTools", *SESSION_DENY_RULES, "--permission-mode", "bypassPermissions",
                 "--model", model, "--output-format", "json", "--max-budget-usd", _usd(usd)]
     elif engine == "agy":  # probe 5: --model must come before --print
-        tail = [*exe, "--model", model, "--print", prompt, "--output-format", "json",
-                "--print-timeout", f"{max(1, int(timeout_min))}m"]
+        tail = [*exe, "--model", model, "--mode", "accept-edits", "--dangerously-skip-permissions",
+                "--print", prompt, "--output-format", "json", "--print-timeout", f"{max(1, int(timeout_min))}m"]
     else:
-        tail = [*exe, "exec", "--model", model, "--json", prompt]
+        tail = [*exe, "exec", "--model", model, "-s", "workspace-write", "-C", str(worktree or "."), "--json", prompt]
     return [*governor, *tail]
 
 
@@ -888,7 +897,7 @@ def _one_session(ctx: _Ctx, prompt: str, relay_slug: str, n: int, spent: float,
     remaining_s = max(1.0, min(caps.session_timeout_min * 60, caps.max_hours * 3600 - elapsed))
     usd = min(caps.max_usd_per_session, caps.max_usd_total - spent)
     cmd = build_command(ctx.engine, ctx.model, prompt, usd=usd, timeout_min=remaining_s / 60, governor=ctx.governor,
-                        engine_cmd=ctx.engine_cmd)
+                        engine_cmd=ctx.engine_cmd, worktree=cwd)
     rid = _spend_reserve(ctx.home, spend_slug, ctx.now(), n > 1) if ctx.engine == "agy" else None
     launched, outcome = ctx.clock(), None
     try:
@@ -1273,7 +1282,8 @@ def _render_page(ctx: "_Ctx", roadmap_cmd: Sequence[str]) -> None:
 def _dry_run_tail(ctx: _Ctx, template: Path, prompt: str, cwd: Path | None = None) -> None:
     caps = ctx.caps
     cmd = build_command(ctx.engine, ctx.model, "<resume prompt>", usd=min(caps.max_usd_per_session, caps.max_usd_total),
-                        timeout_min=caps.session_timeout_min, governor=ctx.governor, engine_cmd=ctx.engine_cmd)
+                        timeout_min=caps.session_timeout_min, governor=ctx.governor, engine_cmd=ctx.engine_cmd,
+                        worktree=cwd or ctx.repo)
     print(f"would launch (cwd {cwd or ctx.repo}, CADDIS_HEADLESS=1): {subprocess.list2cmdline(cmd)}"
           + (" (resume prompt on stdin)" if ctx.engine in PROMPT_ON_STDIN else ""))
     print(f"resume prompt from {template}:\n{prompt}")
@@ -1552,7 +1562,10 @@ def ensure_worktree(repo: Path, slug: str, default: str, root: Path | None = Non
     if path.resolve() in _registered_worktrees(repo):
         if path.is_dir():
             return path
-        _git_out(repo, "worktree", "prune")  # listed, but its folder is gone (temp cleanup): prune, make it again
+        # Listed, but its folder is gone (temp cleanup): drop this one registration and make it again. Not
+        # `git worktree prune`: that would drop every other tool's registration with a missing folder too.
+        if caddis_worktree_safety.safe_remove_worktree(repo, path) is not None:
+            raise _Stop(f"FAILED cannot drop the registration of the missing worktree {path}", caddis_exit.BLOCKED)
     if path.exists():
         raise _Stop(f"FAILED worktree path {path} exists and is not a worktree of this repo", caddis_exit.BLOCKED)
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -1586,7 +1599,6 @@ def remove_worktree_if_clean(repo: Path, slug: str, root: Path | None = None) ->
         return f"worktree kept (not clean, {len(work)} change(s)): {path}"
     if caddis_worktree_safety.safe_remove_worktree(repo, path) is not None:
         return f"worktree kept (remove failed): {path}"
-    _git_out(repo, "worktree", "prune")
     _state_file(repo, slug, "worktree").unlink(missing_ok=True)
     return f"worktree removed: {path}"
 
@@ -2660,6 +2672,11 @@ def main(argv: list[str] | None = None) -> int:
         ok, why = last_stop_restartable(args.repo, args.roadmap)
         print(why)
         return caddis_exit.CLEAN if ok else caddis_exit.BLOCKED
+    try:
+        caddis_spend.bump_headless_depth(os.environ)  # a check only: the sessions get the bump in headless_env
+    except caddis_spend.HeadlessDepthExceeded as exc:
+        print(f"caddis_roadmap_run: {exc}", file=sys.stderr)
+        return caddis_exit.BLOCKED
     caps = Caps(args.max_hours, args.max_sessions, args.session_timeout_min, args.max_usd_per_session,
                 args.max_usd_total)
     return run(repo=args.repo, plan=args.plan, roadmap=args.roadmap, caps=caps, engine=args.engine, model=args.model,

package/bundles/antigravity-plugin/scripts/caddis_spawn.py

@@ -258,14 +258,32 @@ CONTEXT_NOTE_ABOVE = 85.0
 CONTEXT_MAX_AGE_S = 900
 
 
-def read_context_pct(repo_root: Path) -> tuple[float | None, str]:
+SESSION_ID_ENV = ("CLAUDE_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CADDIS_SESSION_ID")
+
+
+def _session_id(explicit: str | None = None) -> str:
+    """This session's id: the explicit one, else the first of SESSION_ID_ENV that is set. Made file-name safe."""
+    raw = explicit or next((os.environ[v] for v in SESSION_ID_ENV if os.environ.get(v)), "")
+    return "".join(ch if (ch.isalnum() and ch.isascii()) or ch in "-_" else "_" for ch in raw)[:64].strip(".")
+
+
+def read_context_pct(repo_root: Path, session_id: str | None = None) -> tuple[float | None, str]:
     """(percentage, provenance) from the statusline's cache, or (None, why not).
 
+    With a session id (the argument, or CLAUDE_SESSION_ID and the like) it reads that session's own file,
+    `.caddis/context-window/<id>.json`, so a second session in the same folder cannot change the figure.
+    Without one it reads the shared `context-window.json`, which any session may have written last; the
+    provenance then says "shared".
+
     Written by `caddis_statusline.record_context`. Claude Code gives the figure to the status
     line and to nothing else, so this file is the only runtime-sourced number a plain command
     can reach.
     """
-    target = repo_root / ART / "context-window.json"
+    sid = _session_id(session_id)
+    shared = repo_root / ART / "context-window.json"
+    target = repo_root / ART / "context-window" / f"{sid}.json" if sid else shared
+    if sid and not target.is_file():
+        target, sid = shared, ""  # the status line has not written this session's file yet (or is old)
     try:
         raw = json.loads(target.read_text(encoding="utf-8"))
         pct = float(raw["used_percentage"])
@@ -275,8 +293,10 @@ def read_context_pct(repo_root: Path) -> tuple[float | None, str]:
                       + f"{ART}/context-window.json — run `/caddis:install-statusline` to install the "
                       "status line that writes it")
     if age > CONTEXT_MAX_AGE_S:
-        return pct, f"runtime figure, STALE by {age}s (a lower bound — the real number is >= this)"
-    return pct, f"runtime figure, {age}s old"
+        scope = "this session's" if sid else "shared (session unknown)"
+        return pct, f"{scope} runtime figure, STALE by {age}s (a lower bound — the real number is >= this)"
+    scope = "this session's" if sid else "shared (session unknown)"
+    return pct, f"runtime figure, {scope}, {age}s old"
 
 
 @dataclass