code-context-control 2.101.0__tar.gz → 2.102.0__tar.gz

{code_context_control-2.101.0/code_context_control.egg-info → code_context_control-2.102.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.101.0
+Version: 2.102.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.101.0 → code_context_control-2.102.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.101.0"
+__version__ = "2.102.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -4212,6 +4212,7 @@ def cmd_pipe(args):
 
 
 from services.claude_md import C3_COMPACT_WORKFLOW as _SHARED_C3_COMPACT_WORKFLOW
+from services.claude_md import VSCODE_INSTRUCTIONS_FILE
 from services.claude_md import VSCODE_SESSION_INIT as _VSCODE_SESSION_INIT
 from services.claude_md import adapt_workflow_for_ide as _adapt_workflow_for_ide
 
@@ -4433,14 +4434,27 @@ def _toml_section_bool_value(toml_path: Path, section: str, key: str) -> bool |
     return None
 
 
-def _ensure_instruction_workflow(instructions_path: Path, template: str, required_markers: list[str]) -> str:
-    """Ensure an instructions file has required C3 workflow markers.
+def _ensure_instruction_workflow(instructions_path: Path, template: str,
+                                 required_markers: list[str],
+                                 project_path: str = "") -> str:
+    """Ensure an instructions file carries the CURRENT C3 workflow.
 
     Returns one of: "written", "updated", "kept".
+
+    Marker PRESENCE used to mean "up to date", which is why this function
+    could report `kept` on a doc generated four releases ago: the markers are
+    stable words like "SEARCH FIRST" and "c3_edit", so they survive every
+    template change. A doc carrying the managed sentinels is now refreshed
+    through ``merge_c3_block`` — the same non-destructive regeneration
+    CLAUDE.md and AGENTS.md get — and `kept` means the block already matches
+    byte for byte (v2.102.0). A marker-less legacy doc keeps the old
+    prepend-and-preserve path, which ``write_c3_instruction_doc`` handles.
     """
+    from services.claude_md import C3_BLOCK_BEGIN, merge_c3_block, wrap_c3_block, write_c3_instruction_doc
+
     if not instructions_path.exists():
-        instructions_path.parent.mkdir(parents=True, exist_ok=True)
-        instructions_path.write_text(template, encoding="utf-8")
+        write_c3_instruction_doc(instructions_path, template,
+                                 project_path=project_path or None)
         return "written"
 
     try:
@@ -4448,6 +4462,14 @@ def _ensure_instruction_workflow(instructions_path: Path, template: str, require
     except Exception:
         existing = ""
 
+    # Managed doc → regenerate the block in place, preserving user content.
+    if C3_BLOCK_BEGIN in existing:
+        if merge_c3_block(existing, wrap_c3_block(template)) == existing:
+            return "kept"
+        write_c3_instruction_doc(instructions_path, template,
+                                 project_path=project_path or None)
+        return "updated"
+
     if all(marker in existing for marker in required_markers):
         return "kept"
 
@@ -4460,7 +4482,8 @@ def _ensure_instruction_workflow(instructions_path: Path, template: str, require
     return "updated"
 
 
-def _ensure_codex_agents_workflow(agents_md_path: Path) -> str:
+def _ensure_codex_agents_workflow(agents_md_path: Path,
+                                  project_path: str = "") -> str:
     """Ensure AGENTS.md contains the mandatory C3 workflow for Codex sessions."""
     required_markers = [
         "C3 Tools",
@@ -4474,10 +4497,12 @@ def _ensure_codex_agents_workflow(agents_md_path: Path) -> str:
         "c3_memory",
         "c3_filter",
     ]
-    return _ensure_instruction_workflow(agents_md_path, _AGENTS_MD_CONTENT, required_markers)
+    return _ensure_instruction_workflow(agents_md_path, _AGENTS_MD_CONTENT,
+                                        required_markers, project_path)
 
 
-def _ensure_vscode_instructions_workflow(instructions_path: Path) -> str:
+def _ensure_vscode_instructions_workflow(instructions_path: Path,
+                                         project_path: str = "") -> str:
     """Ensure VS Code Copilot instructions include the latest C3 workflow markers."""
     required_markers = [
         "C3 Tools",
@@ -4491,7 +4516,9 @@ def _ensure_vscode_instructions_workflow(instructions_path: Path) -> str:
         "c3_memory",
         "c3_filter",
     ]
-    return _ensure_instruction_workflow(instructions_path, _COPILOT_INSTRUCTIONS_CONTENT, required_markers)
+    return _ensure_instruction_workflow(instructions_path,
+                                        _COPILOT_INSTRUCTIONS_CONTENT,
+                                        required_markers, project_path)
 
 
 def _safe_read_json(path: Path, label: str = "") -> dict:
@@ -4957,6 +4984,7 @@ back to native tools as the task progresses.
 - **Bitbucket** (v2.30.0+, when `c3 bitbucket login` has run): `c3_bitbucket(action='list_prs|get_pr|merge_pr|...')` — self-hosted Bitbucket Data Center / Server. Token in OS keyring; mutating actions auto-log to the edit ledger.
 - **Cross-project** (v2.31.0+): `c3_project(action='list|scan|search|read|edit|...', project='<name|path>')` — discover and operate on OTHER c3-installed projects. Reads run freely; writes (edit/shell/memory) need `allow_write=true`.
 - **Masked paths** (v2.63.0+): content prefixed `[c3-mask:transformed]` is a policy-transformed VIEW, not the file. Values may be synthetic, rows withheld, bodies stripped — don't copy literals out of it or infer completeness from it. Masked paths are read-only and refuse shell/git/validate/impact/filter/delegate (`[c3-mask:unsupported]`). That's policy, not a transient error — report the block instead of routing around it.
+- **Confirm holds** (v2.97.0+): `[c3-access:confirm]` is a PAUSE, not a block — a human must approve this exact write. Since v2.100.0 the agent-config files (`.mcp.json`, instruction docs, `.claude` hook/skill/agent/command bodies) hold by default in EVERY C3 project, reads stay open. Read the S8 tail: it names the filed request (`c3_override(action='wait', request_id='...', timeout_s=180)`, then retry the same call once if approved), or names a surface that files one, or gives a reason to obey. Never retry before a decision and never route around a hold via the shell.
 
 ## Self-Check
 If you haven't called a c3_* tool in several turns during active development, re-engage
@@ -5034,10 +5062,20 @@ def _instruction_documents_for_project() -> list[tuple[str, str]]:
 
     Used by uninstall/cleanup paths, so it must keep listing legacy docs
     (GEMINI.md — profile removed in v2.52; empty template, never generated).
+
+    ``.github/copilot-instructions.md`` was absent from this list until
+    v2.102.0, and that absence was the whole bug: the managed-block sync
+    that regenerates CLAUDE.md and AGENTS.md on every install-mcp never
+    touched it, while ``_ensure_vscode_instructions_workflow`` reported
+    `kept` on marker presence alone. In a vscode-primary project the third
+    git-tracked instruction doc silently drifted a release behind on every
+    template change — v2.100.0's agent-config confirm tier reached the
+    Claude Code and Codex docs and never reached Copilot's.
     """
     return [
         ("CLAUDE.md", _CLAUDE_MD_CONTENT),
         ("AGENTS.md", _AGENTS_MD_CONTENT),
+        (VSCODE_INSTRUCTIONS_FILE, _COPILOT_INSTRUCTIONS_CONTENT),
         ("GEMINI.md", ""),
     ]
 
@@ -5692,7 +5730,8 @@ def cmd_install_mcp(args):
     if profile.name == "vscode":
         # 1. Ensure copilot-instructions.md has the latest C3 workflow markers
         instructions_path = target / ".github" / "copilot-instructions.md"
-        vs_state = _ensure_vscode_instructions_workflow(instructions_path)
+        vs_state = _ensure_vscode_instructions_workflow(instructions_path,
+                                                        str(target))
         if vs_state == "written":
             print(f"Wrote {instructions_path}")
         elif vs_state == "updated":
@@ -5731,7 +5770,8 @@ def cmd_install_mcp(args):
     # ── Codex AGENTS.md enforcement file ──────────────────────
     if profile.name == "codex":
         agents_md_path = target / "AGENTS.md"
-        agents_state = _ensure_codex_agents_workflow(agents_md_path)
+        agents_state = _ensure_codex_agents_workflow(agents_md_path,
+                                                     str(target))
         if agents_state == "written":
             print(f"Wrote {agents_md_path}")
         elif agents_state == "updated":

{code_context_control-2.101.0 → code_context_control-2.102.0}/cli/hook_access_guard.py

@@ -6,9 +6,11 @@ dispatcher's deny-beats-allow merge makes a deny here final. hook_dispatch
 treats this module as _FAIL_CLOSED: if it fails to import or raises, write-
 class native tools are denied instead of sailing through.
 
-Bash coverage is a best-effort, existence-gated token scan — advisory by
-design (docs/access-guard.md §3/§6); it catches an agent naming a denied
-path, not an adversary hiding one.
+Bash coverage is a best-effort token scan — advisory by design
+(docs/access-guard.md §3/§6); it catches an agent naming a denied path, not
+an adversary hiding one. Two passes: every path-shaped token as a READ
+(existence-gated), then the command's WRITE targets as writes (v2.102.0), so
+a redirect into a confirm-held or read-only file holds like any other write.
 """
 import os
 import re
@@ -29,6 +31,16 @@ try:
 except Exception:  # pragma: no cover — telemetry is never load-bearing
     access_telemetry = None
 
+# The same write-target extractor the edit ledger uses after the fact. Its
+# absence degrades the shell branch to the read-only scan, never to a crash.
+try:
+    from _shell_writes import shell_write_targets
+except Exception:  # pragma: no cover — package-style import (dispatcher, tests)
+    try:
+        from cli._shell_writes import shell_write_targets
+    except Exception:
+        shell_write_targets = None
+
 _WRITE_TOOLS = {"Edit", "Write", "MultiEdit", "NotebookEdit"}
 _READ_TOOLS = {"Read", "SearchText"}
 _SEARCH_TOOLS = {"Grep", "Glob", "FindFiles"}
@@ -206,21 +218,41 @@ def _record(denial, tool: str, operation: str, path: str,
 
 
 def _override_allows(base: str, denial, *, tool: str, op: str, path: str,
-                     session_id: str):
+                     session_id: str, peek: bool = False):
     """A live override grant covering this exact call, or None (spec §5).
 
     Lazy import and policy-before-grants ordering keep the hot path free: a
     project that never turned overrides on pays one dict lookup and never
     opens the grants file. Any failure returns None — the denial stands.
+
+    ``peek`` looks without consuming; see ``_granted`` for why.
     """
     try:
         from services import override_grants as og  # noqa: PLC0415 — lazy
         return og.gate_access(base, denial, tool=tool, op=op, path=path,
-                              session_id=session_id)
+                              session_id=session_id, peek=peek)
     except Exception:
         return None  # fail closed: no grant, ordinary denial
 
 
+def _granted(line: str, defer: bool, consume) -> dict:
+    """The allow-by-grant output.
+
+    Under the dispatcher (``defer`` True) the use is NOT burned here: the
+    provisional line goes out with an ``_on_allow`` callable, and
+    hook_dispatch runs it only once every PreToolUse sub-hook has voted
+    allow. Before v2.102.0 this hook consumed first and a strict-mode
+    discipline deny from hook_pretool_enforce then won the merge — grant
+    spent, nothing written, and the user asked twice for one edit. Run
+    standalone (``defer`` False) the use was already consumed by the peek-
+    less lookup, so the line is final.
+    """
+    out = {"additionalContext": line}
+    if defer:
+        out["_on_allow"] = consume
+    return out
+
+
 def _confirm_request(base: str, denial, *, tool: str, op: str, path: str,
                      session_id: str) -> tuple:
     """Auto-file an Override Request for a ``confirm`` denial (S8).
@@ -349,7 +381,68 @@ def _scan_shell(cmd: str, base: str):
     return None, ""
 
 
-def run(payload: dict, project_path: Path | None = None) -> dict | None:
+def _scan_shell_writes(cmd: str, base: str, session_id: str,
+                       defer: bool) -> dict | None:
+    """WRITE-class verdict for the files a shell command writes (v2.102.0).
+
+    ``_scan_shell`` evaluates every token as a READ. Confirm holds, read_only
+    rules and the builtin write-denies are all write-class, so ``cat >>
+    CLAUDE.md``, ``sed -i`` on .mcp.json or a heredoc into a hook body sailed
+    through with no hold — the one bypass docs/confirm-guard.md could only
+    ask the agent not to use. Targets come from the extractor the edit
+    ledger already trusts after the fact (cli/_shell_writes), with the same
+    best-effort caveat: a missed target costs a missed hold, a false one
+    costs a hold the human clears in one tap. Synthetic spelling denials are
+    skipped exactly as the read scan skips them (a token that is not a path
+    must not veto the command); the corrupt-config deny-all still refuses.
+
+    Grant identity is ``tool="Bash", op="write", path=<target>`` — bound to
+    the file, not the command text, the same stated limitation as the
+    shell_warn layer. Several held targets need several grants; the command
+    runs only when every one is covered, and the uses are burned together
+    (or not at all) by the dispatcher's settle step.
+    """
+    if shell_write_targets is None:
+        return None
+    lines, consumers = [], []
+    for target in shell_write_targets(cmd, base):
+        denial = ag.check(target, "write", base)
+        if denial is None:
+            continue
+        if denial.rule.startswith("<") and denial.rule != "<corrupt-config>":
+            continue
+        granted = _override_allows(base, denial, tool="Bash", op="write",
+                                   path=target, session_id=session_id,
+                                   peek=defer)
+        if granted:
+            lines.append(granted)
+            if defer:
+                consumers.append(lambda t=target, d=denial: _override_allows(
+                    base, d, tool="Bash", op="write", path=t,
+                    session_id=session_id))
+            continue
+        _record(denial, "Bash", "write", target, base, session_id)
+        if denial.kind == "confirm":
+            rid, note = _confirm_request(base, denial, tool="Bash", op="write",
+                                         path=target, session_id=session_id)
+            return _deny(ag.refusal(denial, target, "write", surface="hook",
+                                    tool="Bash", request_id=rid,
+                                    request_note=note)
+                         + " (best-effort shell scan)")
+        return _deny(ag.refusal(denial, target, "write", surface="hook",
+                                tool="Bash") + " (best-effort shell scan)")
+    if not lines:
+        return None
+
+    def _settle():
+        got = [fn() for fn in consumers]
+        return "\n".join(got) if all(got) else None
+
+    return _granted("\n".join(lines), bool(consumers), _settle)
+
+
+def run(payload: dict, project_path: Path | None = None,
+        defer_consume: bool = False) -> dict | None:
     tool = normalize_tool_name(payload.get("tool_name", ""))
     tool_input = payload.get("tool_input", {}) or {}
     base = str(project_path if project_path is not None else Path.cwd())
@@ -363,9 +456,13 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
         denial = ag.check(fp, op, base)
         if denial:
             granted = _override_allows(base, denial, tool=tool, op=op,
-                                       path=fp, session_id=session_id)
+                                       path=fp, session_id=session_id,
+                                       peek=defer_consume)
             if granted:
-                return {"additionalContext": granted}
+                return _granted(granted, defer_consume,
+                                lambda: _override_allows(
+                                    base, denial, tool=tool, op=op, path=fp,
+                                    session_id=session_id))
             _record(denial, tool, op, fp, base, session_id)
             if denial.kind == "confirm":
                 # A confirm hold files its own request (grants were consulted
@@ -401,6 +498,6 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
             return _deny(ag.refusal(denial, tok, "read",
                                     surface="hook", tool=tool)
                          + " (best-effort shell scan)")
-        return None
+        return _scan_shell_writes(cmd, base, session_id, defer_consume)
 
     return None

{code_context_control-2.101.0 → code_context_control-2.102.0}/cli/hook_dispatch.py

@@ -36,6 +36,7 @@ emit a short "[c3:hook-error] ..." additionalContext warning so enforcement
 cannot silently stop enforcing.
 """
 import importlib
+import inspect
 import json
 import sys
 from pathlib import Path
@@ -166,6 +167,16 @@ def _routes(event: str, raw_tool: str, norm_tool: str, host: str = HOST_CLAUDE):
 
 _RUN_CACHE: dict = {}
 
+# PreToolUse sub-hooks that consult override grants. Under the dispatcher
+# they are asked to DEFER consumption (`defer_consume=True`): each returns a
+# provisional allow carrying an `_on_allow` callable, and `_settle_grants`
+# runs those only once every sub-hook has voted allow. Before v2.102.0 the
+# access guard consumed a grant first and a strict-mode discipline deny from
+# the next sub-hook then won the merge — grant spent, nothing written, the
+# user asked twice for one edit. The same hole ran the other way for a
+# discipline grant followed by a policy deny.
+_DEFER_CONSUME = {"hook_access_guard", "hook_pretool_enforce"}
+
 # Modules whose failure must DENY rather than fall through (fail closed).
 # Scoped to write-class tools + shell: a broken guard must not let mutations
 # sail through, but read-class fail-open avoids bricking whole sessions.
@@ -189,6 +200,77 @@ def _fail_closed_deny(module_name: str, err: str) -> dict:
     }
 
 
+def _is_deny(out) -> bool:
+    hso = out.get("hookSpecificOutput") if isinstance(out, dict) else None
+    return isinstance(hso, dict) and hso.get("permissionDecision") == "deny"
+
+
+def _call_run(run_fn, module_name: str, event: str, payload: dict,
+              project_path):
+    """Invoke a sub-hook, asking the grant-aware ones to defer consumption.
+
+    Signature-checked rather than assumed: tests stub these modules with
+    two-argument lambdas, and a legacy single-file hook must keep working.
+    """
+    if event == "pretool" and module_name in _DEFER_CONSUME:
+        try:
+            accepts = "defer_consume" in inspect.signature(run_fn).parameters
+        except (TypeError, ValueError):
+            accepts = False
+        if accepts:
+            return run_fn(payload, project_path, defer_consume=True)
+    return run_fn(payload, project_path)
+
+
+def _grant_lost_deny() -> dict:
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": (
+                "[c3-override:spent] the override grant that would have "
+                "allowed this call was used up between check and use (a "
+                "concurrent call spent it). The rule stands — ask again "
+                "with c3_override if it is still needed."
+            ),
+        }
+    }
+
+
+def _settle_grants(outputs: list) -> list:
+    """Burn deferred grant uses — only when the merged verdict is allow.
+
+    Any deny among the outputs means the call will not run, so every
+    `_on_allow` is dropped unrun and the grants stay live for the retry. On
+    an allow each consumer runs; the line it returns replaces the
+    provisional one (it carries the post-consumption uses count). A consumer
+    that finds nothing left — the grant was spent by a concurrent call
+    between peek and settle — turns its allow into a deny: the call must
+    not proceed on a grant that no longer exists.
+    """
+    denied = any(_is_deny(o) for o in outputs)
+    settled = []
+    for out in outputs:
+        if not isinstance(out, dict):
+            settled.append(out)
+            continue
+        consume = out.pop("_on_allow", None)
+        if consume is None or denied:
+            settled.append(out)
+            continue
+        try:
+            line = consume()
+        except Exception as exc:
+            log_hook_error("hook_dispatch:settle", exc)
+            line = None
+        if line:
+            out["additionalContext"] = str(line)
+            settled.append(out)
+        else:
+            settled.append(_grant_lost_deny())
+    return settled
+
+
 def _load_run(module_name: str):
     """Import cli.<module_name> and return its run() (cached).
 
@@ -353,7 +435,7 @@ def dispatch(event: str, payload: dict, project_path: Path | None = None) -> dic
                 outputs.append(_fail_closed_deny(module_name, err))
             continue
         try:
-            out = run_fn(payload, project_path)
+            out = _call_run(run_fn, module_name, event, payload, project_path)
             if out:
                 outputs.append(out)
         except Exception as exc:
@@ -368,7 +450,15 @@ def dispatch(event: str, payload: dict, project_path: Path | None = None) -> dic
         # Critical state-layer warnings (corrupt enforcement_state.json)
         # become visible instead of silently disabling enforcement.
         warnings.extend(_hook_utils.drain_state_warnings())
+        # A PreToolUse deny is final — merge keeps the first deny and no
+        # allow readmits it — so the sub-hooks after it have nothing to add,
+        # and running them could only spend a grant or log a block for a
+        # call that will not happen.
+        if event == "pretool" and outputs and _is_deny(outputs[-1]):
+            break
 
+    if event == "pretool":
+        outputs = _settle_grants(outputs)
     return merge_outputs(outputs, warnings, event=event, host=host)
 
 

{code_context_control-2.101.0 → code_context_control-2.102.0}/cli/hook_pretool_enforce.py

@@ -504,11 +504,12 @@ def _agent_cannot_comply(payload: dict, base: Path) -> str | None:
 
 
 def _override_allows(base: Path, tool_name: str, tool_input: dict,
-                     session_id: str) -> str | None:
+                     session_id: str, peek: bool = False) -> str | None:
     """A live discipline grant for this exact write, or None (spec §5).
 
     Runs AFTER `_vault_denial`, which stays unconditional: no grant, no
     config value and no approval can open a native write path to the vault.
+    ``peek`` looks without consuming (see hook_dispatch's settle step).
     """
     target = str(tool_input.get("file_path")
                  or tool_input.get("notebook_path") or "")
@@ -517,16 +518,23 @@ def _override_allows(base: Path, tool_name: str, tool_input: dict,
     try:
         from services import override_grants as og  # noqa: PLC0415 — lazy
         return og.gate_discipline(base, tool=tool_name, path=target,
-                                  session_id=session_id)
+                                  session_id=session_id, peek=peek)
     except Exception:
         return None  # fail closed: no grant, ordinary block
 
 
-def run(payload: dict, project_path: Path | None = None) -> dict | None:
+def run(payload: dict, project_path: Path | None = None,
+        defer_consume: bool = False) -> dict | None:
     """Core enforcement logic — importable by the dispatcher and tests.
 
     Returns a hook-output dict ({"additionalContext": ...} or a deny
     {"hookSpecificOutput": ...}) or None when the call passes silently.
+
+    ``defer_consume`` (dispatcher only): a discipline grant is peeked, not
+    burned, and the output carries an ``_on_allow`` callable the dispatcher
+    runs once the whole PreToolUse verdict is allow — so a policy deny from
+    hook_access_guard can no longer spend a grant on a write that never
+    happens (v2.102.0).
     """
     tool_name = normalize_tool_name(payload.get("tool_name", ""))
 
@@ -591,9 +599,20 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     # the ledger stays complete either way; what is lost is the pre-edit
     # snapshot c3_edit would have taken.
     if tool_name in blocked_tools and mode == "strict":
-        granted = _override_allows(base, tool_name, tool_input, session_id)
+        granted = _override_allows(base, tool_name, tool_input, session_id,
+                                   peek=defer_consume)
         if granted:
-            return _with_warnings({"additionalContext": granted}, policy)
+            out = _with_warnings({"additionalContext": granted}, policy)
+            if defer_consume:
+                def _consume():
+                    line = _override_allows(base, tool_name, tool_input,
+                                            session_id)
+                    if not line:
+                        return None
+                    return _with_warnings({"additionalContext": line},
+                                          policy)["additionalContext"]
+                out["_on_allow"] = _consume
+            return out
         cannot = _agent_cannot_comply(payload, base)
         if cannot:
             return _with_warnings({

{code_context_control-2.101.0 → code_context_control-2.102.0}/cli/mcp_server.py

@@ -832,7 +832,7 @@ async def c3_override(action: str = "list", path: str = "", tool: str = "",
                       layer: str = "", timeout_s: int = 60,
                       ctx: Context = None) -> str:
     """ASK A HUMAN to allow ONE blocked call — never a policy change.
-    actions: request, status, wait (blocks <=180s), list, withdraw.
+    actions: request, status, wait (blocks timeout_s: default 60, max 180), list, withdraw.
     request: path = the exact blocked path; why = one concrete sentence for the human.
     A yes mints a single-use, session-bound, path-exact grant with a short TTL; the
     rule that blocked you stays in force. There is NO approve action here — only the

{code_context_control-2.101.0 → code_context_control-2.102.0}/cli/tools/_grants.py

@@ -25,27 +25,43 @@ import os
 def session_id(svc) -> str:
     """This agent's identity, for leases and for grants.
 
-    Falls back to the process id, never to "". Two agents that both resolved
-    to "" would count as ONE session and stop blocking each other — the exact
-    opposite of what a lock is for. Each Claude Code session runs its own
-    c3-mcp process, so the pid is a faithful stand-in.
+    Prefers the HOST session id (``current_session["host_session_id"]``,
+    from ``CLAUDE_CODE_SESSION_ID`` — services.session_manager) over C3's
+    own timestamp id. The PreToolUse hooks file requests and consume grants
+    under the id the host puts in every hook payload, which is that same
+    value; until v2.102.0 this surface used C3's own id instead, so every
+    hook-filed confirm hold answered ``c3_override(action='wait')`` with
+    "belongs to another session" and the flow CLAUDE.md mandates could not
+    complete. One id on both surfaces is what makes it true.
+
+    Falls back to C3's session id, then to the process id, never to "". Two
+    agents that both resolved to "" would count as ONE session and stop
+    blocking each other — the exact opposite of what a lock is for. Each
+    Claude Code session runs its own c3-mcp process, so the pid is a
+    faithful stand-in.
 
     It is also the right identity for c3_project: that proxy builds a runtime
     for the TARGET project but runs inside the CALLER's process, so the pid
     keeps the edit attributed to the agent that actually asked for it.
     """
     session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
+    host = str(session.get("host_session_id") or "").strip()
+    if host:
+        return host
     return str(session.get("id", "") or "") or f"pid-{os.getpid()}"
 
 
-def allow(svc, denial, *, tool: str, op: str, path) -> str | None:
+def allow(svc, denial, *, tool: str, op: str, path,
+          peek: bool = False) -> str | None:
     """The `[c3-override:granted]` line when a live grant permits this exact
     call, or None to stay denied.
 
     Consumes a use on success — so callers must invoke this only when they
-    are about to proceed, never speculatively. Ordering inside `gate_access`
-    is policy first, grants second, so a grant is void the instant the policy
-    or its layer is switched off (§12.8).
+    are about to proceed, never speculatively; ``peek=True`` is the
+    speculative form (a look, no burn) for a caller that has to check
+    several targets before it knows whether the call runs at all. Ordering
+    inside `gate_access` is policy first, grants second, so a grant is void
+    the instant the policy or its layer is switched off (§12.8).
 
     Fail-closed by construction: any error resolving the grant store leaves
     the caller on its ordinary refusal path. A grant that cannot be read is
@@ -56,7 +72,8 @@ def allow(svc, denial, *, tool: str, op: str, path) -> str | None:
     try:
         from services import override_grants as og  # noqa: PLC0415 — lazy
         return og.gate_access(svc.project_path, denial, tool=tool, op=op,
-                              path=str(path), session_id=session_id(svc))
+                              path=str(path), session_id=session_id(svc),
+                              peek=peek)
     except Exception:
         return None
 

{code_context_control-2.101.0 → code_context_control-2.102.0}/cli/tools/artifacts.py

@@ -1,5 +1,8 @@
 """c3_artifacts — agent-config tracking: inventory, history, diff, restore."""
 
+from pathlib import Path
+
+from cli.tools import _grants
 from services import access_guard
 
 READ_ACTIONS = {"scan", "list", "history", "show", "diff", "status"}
@@ -139,8 +142,35 @@ def handle_artifacts(action, svc, finalize, *, artifact="", cls="", provider="",
         if not version:
             return done_resp("[artifacts:error] restore requires version.", "error")
         session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
+        sid = session.get("id", "")
+        granted = ""
         try:
-            res = store.restore(artifact, version, session_id=session.get("id", ""))
+            try:
+                res = store.restore(artifact, version, session_id=sid,
+                                    confirm="hold")
+            except access_guard.AccessDenied as exc:
+                if exc.denial.kind != "confirm":
+                    raise
+                # An agent-issued restore of a held file pauses like any
+                # other agent write to it (v2.102.0): the hold is filed
+                # against the artifact's ROOT so one approval covers a
+                # multi-file unit (a skill directory), and the retry — this
+                # same call — consumes that grant and restores under it.
+                entry = store.resolve(artifact) or {}
+                root = str(Path(str(svc.project_path))
+                           / str(entry.get("root") or artifact))
+                granted = _grants.allow(svc, exc.denial, tool="c3_artifacts",
+                                        op="write", path=root) or ""
+                if not granted:
+                    rid, note = _grants.confirm_request(
+                        svc, exc.denial, tool="c3_artifacts", op="write",
+                        path=root)
+                    return done_resp(
+                        access_guard.refusal(exc.denial, root, "write",
+                                             request_id=rid, request_note=note),
+                        "access-confirm")
+                res = store.restore(artifact, version, session_id=sid,
+                                    confirm="approved")
         except access_guard.AccessDenied as exc:
             # Service layer raises; the tool boundary converts to the S1/S2
             # refusal string (docs/access-guard.md §3).
@@ -157,7 +187,8 @@ def handle_artifacts(action, svc, finalize, *, artifact="", cls="", provider="",
                                     session_id=session.get("id", ""))
             except Exception:
                 pass
-        lines = [f"[artifacts:restored] {res['id']} v{version} -> live as "
+        lines = ([granted] if granted else []) + [
+                 f"[artifacts:restored] {res['id']} v{version} -> live as "
                  f"v{res['new_version']} — {len(res['files_written'])} file(s) written"
                  + (f", {len(res['files_removed'])} removed" if res["files_removed"] else "")]
         for w in res["warnings"]: