code-context-control 2.115.0__tar.gz → 2.118.0__tar.gz

{code_context_control-2.115.0 → code_context_control-2.118.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.115.0
+Version: 2.118.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.115.0 → code_context_control-2.118.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.115.0"
+__version__ = "2.118.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -6338,7 +6338,16 @@ def _creds_entry_line(name: str, entry: dict) -> str:
     return "  ".join(parts)
 
 
-_CREDS_HIDDEN_FIELDS = {"number", "cvc", "ssn"}  # prompted via getpass
+#: Fields prompted with getpass instead of input(). This list was missing
+#: `password` and `totp_secret` from v2.90.0 to v2.118.0, so
+#: `c3 creds set X --type login` echoed the password to the terminal — both
+#: JS UIs masked it and nothing asserted the CLI. tests/test_creds_cli.py now
+#: derives the expected set from _SCHEMAS, so a future kind cannot reopen it.
+_CREDS_HIDDEN_FIELDS = {"number", "cvc", "ssn", "password", "private_key",
+                        "passphrase", "totp_secret"}
+#: A private key is pasted as many lines; getpass reads one. Read these until
+#: a blank line instead of silently storing the first line of a PEM.
+_CREDS_MULTILINE_FIELDS = {"private_key"}
 
 
 def _creds_prompt_structured(name: str, ctype: str) -> str:
@@ -6355,7 +6364,16 @@ def _creds_prompt_structured(name: str, ctype: str) -> str:
     fields: dict = {}
     for fname in list(required) + list(optional):
         tag = "" if fname in required else " (optional)"
-        if fname in _CREDS_HIDDEN_FIELDS:
+        if fname in _CREDS_MULTILINE_FIELDS:
+            print(f"  {fname}{tag} — paste it, then a blank line:")
+            lines = []
+            while True:
+                line = input()
+                if not line.strip():
+                    break
+                lines.append(line)
+            raw = "\n".join(lines)
+        elif fname in _CREDS_HIDDEN_FIELDS:
             raw = getpass.getpass(f"  {fname}{tag}: ")
         else:
             raw = input(f"  {fname}{tag}: ")
@@ -7031,12 +7049,14 @@ def _override_requests(args, project_path: str) -> None:
 def _override_decide(args, decision: str, project_path: str) -> None:
     from services import override_requests as orq
 
+    mode = getattr(args, "mode", None) or orq.MODE_ONCE
     try:
         row = orq.decide(getattr(args, "request_id", ""), decision,
                          uses=getattr(args, "uses", None),
                          ttl_s=getattr(args, "ttl_s", None),
                          note=getattr(args, "note", "") or "",
-                         decided_by="cli",
+                         decided_by="cli", mode=mode,
+                         mute=bool(getattr(args, "mute", False)),
                          confirm=getattr(args, "confirm", None))
     except orq.OverrideError as exc:
         print(f"  {exc}")
@@ -7046,15 +7066,29 @@ def _override_decide(args, decision: str, project_path: str) -> None:
         return
 
     if decision == "deny":
-        print(f"  Denied {row['id']}. The block stands.")
+        muted = " This session will not be asked again." \
+            if row.get("muted") else ""
+        print(f"  Denied {row['id']}. The block stands.{muted}")
         return
     print_header("Override approved")
     print(f"  Request : {row['id']}   Grant: {row.get('grant_id', '?')}")
     print(f"  Allows  : {row['tool']} {row['op']} on {row['path']}")
     print(f"  Session : {row['session_id']}")
-    print(f"\n  The rule {row['rule']} is still in force. One retry of this "
-          "exact call, in")
-    print("  that session, on that exact path — nothing else.")
+    # The reach line is the whole point of printing anything here: a session
+    # or rule grant is a standing capability, and saying "one retry" for one
+    # would be a lie the user acts on.
+    print(f"\n  The rule {row['rule']} is still in force.")
+    if mode == orq.MODE_RULE:
+        print("  This grant covers EVERY path that rule matches, for any tool")
+        print("  in the same op class, in that session — until it expires or")
+        print("  the session stops using it. `c3 override list` shows it;")
+        print("  `c3 override revoke <grant_id>` ends it.")
+    elif mode == orq.MODE_SESSION:
+        print("  Unlimited retries of this exact call, in that session, on")
+        print("  that exact path, until the grant expires.")
+    else:
+        print("  One retry of this exact call, in that session, on that exact")
+        print("  path — nothing else.")
 
 
 def _override_show(policy, project_path: str, opol) -> None:
@@ -7074,6 +7108,14 @@ def _override_show(policy, project_path: str, opol) -> None:
           f"{opol.HARD_MAX_TTL_S}s)")
     print(f"    uses        : {policy.default_uses} "
           f"(session grants: {'allowed' if policy.allow_session_grants else 'off'})")
+    if policy.allow_rule_grants:
+        print(f"    rule grants : allowed — <= {policy.rule_grant_ttl_s}s "
+              f"(hard ceiling {opol.HARD_MAX_RULE_TTL_S}s), idle cap "
+              f"{policy.rule_grant_idle_s}s")
+        print("                  one approval covers every path the rule "
+              "matches")
+    else:
+        print("    rule grants : off")
     print(f"    request TTL : {policy.request_ttl_s}s")
     print(f"    rate        : {policy.max_pending_per_session} pending/session, "
           f"{policy.max_requests_per_hour}/hour")
@@ -7185,11 +7227,22 @@ def _override_list(args, project_path: str, og) -> None:
     if not grants:
         print("  (none)")
     for g in grants:
-        print(f"  {g.get('id', '?'):18s} {g.get('tool', '?')} "
-              f"{g.get('op', '?')} {g.get('path_key', '?')}")
+        wide = g.get("scope") == og.SCOPE_RULE
+        left = ("unlimited use" if g.get("uses_remaining") is None
+                else f"{g.get('uses_remaining', 0)} use(s) left")
+        # A rule grant's path_key is where it was MINTED, not what it covers.
+        # Printing it in the same column as a call grant's target would read
+        # as a much smaller capability than it is.
+        reach = (f"any path matching {g.get('rule', '?')}" if wide
+                 else g.get("path_key", "?"))
+        print(f"  {g.get('id', '?'):18s} [{'rule' if wide else 'call'}] "
+              f"{g.get('tool', '?')} {g.get('op', '?')} {reach}")
         print(f"  {'':18s} rule {g.get('rule', '?')} · session "
               f"{g.get('session_id', '?')} · expires {g.get('expires_at', '?')}"
-              f" · {g.get('uses_remaining', 0)} use(s) left")
+              f" · {left}"
+              + (f" · idle cap {g.get('idle_s')}s" if g.get("idle_s") else ""))
+        if wide:
+            print(f"  {'':18s} minted from {g.get('path_key', '?')}")
     tail = int(getattr(args, "audit", 0) or 0)
     if tail:
         print("\n  Audit (.c3/overrides.jsonl):")
@@ -7212,8 +7265,10 @@ def _override_check(args, policy, project_path: str, og, opol) -> None:
                   layer=gate, rule=rule, tool=tool, op=op,
                   path=getattr(args, "target", ""))
     if hit:
-        print(f"  Allowed by {hit['id']} — {hit['uses_remaining']} use(s) "
-              f"left, expires {hit['expires_at']}.")
+        left = ("unlimited use" if hit.get("uses_remaining") is None
+                else f"{hit['uses_remaining']} use(s) left")
+        print(f"  Allowed by {hit['id']} ({hit.get('scope', 'call')} scope) "
+              f"— {left}, expires {hit['expires_at']}.")
         print("  (`check` never consumes a use.)")
     else:
         print("  Denied — no live grant matches this exact "
@@ -7392,19 +7447,30 @@ def _access_cmd_list(args, project_path: str) -> None:
             print("  [warn] access section invalid — scope fails closed "
                   "(deny-all); fix config.json 'access' by hand")
         if scope == "builtin":
+            # Which SCOPE set each live mode. Printing a project-set opt-out
+            # as if it were machine-wide (or the reverse) is the exact
+            # confusion the realm split exists to prevent.
+            realms = sec.get("mode_realms") or {}
+
+            def _where(glob):
+                r = realms.get(access_guard._norm_builtin(glob), "")
+                return f"  [{r}]" if r else ""
+
             off = sec.get("disabled") or []
             if off:
                 print("  DISABLED by you (not enforced):")
                 for glob in off:
-                    print(f"    {'off':<10} {glob}")
-                print("    re-enable: c3 access builtin enable <glob>")
+                    print(f"    {'off':<10} {glob}{_where(glob)}")
+                print("    re-enable: c3 access builtin enable <glob> "
+                      "[--project]")
             moded = {g: m for g, m in (sec.get("modes") or {}).items()
                      if m not in ("default", "allow")}
             if moded:
                 print("  MODE set by you (departs from the shipped default):")
                 for glob, m in sorted(moded.items()):
-                    print(f"    {m:<10} {glob}")
-                print("    reset: c3 access builtin mode <glob> default")
+                    print(f"    {m:<10} {glob}{_where(glob)}")
+                print("    reset: c3 access builtin mode <glob> default "
+                      "[--project]")
             can = [g for g in (sec.get("disableable") or [])
                    if access_guard._norm_builtin(g) not in set(off)
                    and access_guard._norm_builtin(g) not in moded]
@@ -7414,6 +7480,8 @@ def _access_cmd_list(args, project_path: str) -> None:
                 print("    disable: c3 access builtin disable <glob>  ·  "
                       "granular: c3 access builtin mode <glob> "
                       "{deny,confirm,allow}")
+                print("    add --project to scope it to this project only "
+                      "(attested under its own keyring realm)")
             if sec.get("absolute"):
                 print("  absolute (credential vault, cannot be disabled): "
                       + ", ".join(sec["absolute"]))
@@ -7430,7 +7498,8 @@ def _access_cmd_list(args, project_path: str) -> None:
 
 
 def _access_cmd_builtin(args, project_path: str) -> None:
-    """Switch a Tier-1 builtin off or back on. Human-only; always global scope.
+    """Switch a Tier-1 builtin off or back on. Human-only; global scope by
+    default, this project only with --project (v2.118.0).
 
     Disabling asks for typed confirmation unless --yes: these guards are what
     stop an agent rewriting its own hooks, settings or git history, and the
@@ -7452,8 +7521,11 @@ def _access_cmd_builtin(args, project_path: str) -> None:
         return
 
     disabling = action == "disable"
+    scope = "project" if getattr(args, "project_scope", False) else "global"
     if disabling and not getattr(args, "yes", False):
-        print(f"About to STOP enforcing the builtin guard on: {glob}")
+        where = (f"in THIS project only ({project_path})" if scope == "project"
+                 else "on EVERY project on this machine")
+        print(f"About to STOP enforcing the builtin guard on: {glob} {where}")
         print("  While off, any agent with C3 tools can write those paths.")
         if glob.endswith("settings*.json") or ".claude" in glob:
             print("  This is the file that configures the agent itself — hooks,")
@@ -7464,23 +7536,29 @@ def _access_cmd_builtin(args, project_path: str) -> None:
             return
 
     try:
-        result = access_guard.set_builtin_disabled(glob, disabling)
+        result = access_guard.set_builtin_disabled(glob, disabling, scope,
+                                                   project_path)
     except ValueError as exc:
         print(f"[error] {exc}")
         return
 
-    _access_audit(f"builtin_{action}", result["glob"], "builtin", "global",
-                  project_path)
+    _access_audit(f"builtin_{action}", result["glob"], "builtin",
+                  result["scope"], project_path)
     if not result["changed"]:
         state = "already disabled" if disabling else "already enforced"
-        print(f"[=] {result['glob']} — {state}")
+        print(f"[=] {result['glob']} — {state} ({result['scope']} scope)")
         return
+    flag = " --project" if result["scope"] == "project" else ""
     if disabling:
-        print(f"[OK] Builtin '{result['glob']}' DISABLED (global scope).")
+        print(f"[OK] Builtin '{result['glob']}' DISABLED "
+              f"({result['scope']} scope).")
         print("     Re-enable with: c3 access builtin enable "
-              f"{result['glob']}")
+              f"{result['glob']}{flag}")
+        if result["glob"].endswith(".env*"):
+            print(_ENV_VAULT_HINT)
     else:
-        print(f"[OK] Builtin '{result['glob']}' re-enforced.")
+        print(f"[OK] Builtin '{result['glob']}' re-enforced "
+              f"({result['scope']} scope).")
         if not result["attested"]:
             print("     [warn] keyring attestation could not be cleared; the "
                   "builtin is enforced anyway (config entry removed).")
@@ -7496,8 +7574,18 @@ _BUILTIN_MODE_HELP = {
 }
 
 
+#: Shown whenever someone loosens the `.env` guard. `.env` is the one Tier-1
+#: builtin whose whole content is secrets, and C3 already has a place to put
+#: them that the agent cannot read. Advisory — never a refusal.
+_ENV_VAULT_HINT = (
+    "     [note] .env values are better held in the vault: "
+    "`c3_credentials import_env` reads the file server-side, so the agent\n"
+    "            gets names, lengths and fingerprints and never a value."
+)
+
+
 def _access_cmd_builtin_mode(args, glob: str, project_path: str) -> None:
-    """`c3 access builtin mode <glob> <mode>` — granular builtin control.
+    """`c3 access builtin mode <glob> <mode> [--project]` — granular control.
 
     `deny` and `default` never prompt (tightening / reset). `confirm` and
     `allow` weaken the guard, so they get the same typed-glob beat of
@@ -7506,10 +7594,13 @@ def _access_cmd_builtin_mode(args, glob: str, project_path: str) -> None:
     from services import access_guard
 
     mode = getattr(args, "mode", None)
+    scope = "project" if getattr(args, "project_scope", False) else "global"
+    where = (f"in THIS project only ({project_path})" if scope == "project"
+             else "on EVERY project on this machine")
     if mode in ("confirm", "allow") and not getattr(args, "yes", False):
         widening = ("STOP enforcing" if mode == "allow"
                     else "PAUSE (not block) and ask you to approve")
-        print(f"About to make the builtin guard on {glob} {widening}.")
+        print(f"About to make the builtin guard on {glob} {widening} {where}.")
         if mode == "allow":
             print("  While off, any agent with C3 tools can touch those paths.")
         else:
@@ -7524,20 +7615,30 @@ def _access_cmd_builtin_mode(args, glob: str, project_path: str) -> None:
             return
 
     try:
-        result = access_guard.set_builtin_mode(glob, mode)
+        result = access_guard.set_builtin_mode(glob, mode, scope, project_path)
     except ValueError as exc:
         print(f"[error] {exc}")
         return
 
     _access_audit(f"builtin_mode_{result['mode']}", result["glob"],
-                  "builtin", "global", project_path)
+                  "builtin", result["scope"], project_path)
     if not result["changed"]:
-        print(f"[=] {result['glob']} — already {result['mode']}")
+        print(f"[=] {result['glob']} — already {result['mode']} "
+              f"({result['scope']} scope)")
         return
     print(f"[OK] Builtin '{result['glob']}' mode = {result['mode']} "
-          f"(global scope): {_BUILTIN_MODE_HELP[result['mode']]}.")
+          f"({result['scope']} scope): {_BUILTIN_MODE_HELP[result['mode']]}.")
+    if result["scope"] == "project":
+        print("     Bound to this project's keyring realm — a clone of this "
+              "repo carries the config\n     but not the attestation, so the "
+              "builtin stays enforced there.")
     if result["mode"] != "default":
-        print(f"     Reset with: c3 access builtin mode {result['glob']} default")
+        flag = " --project" if result["scope"] == "project" else ""
+        print(f"     Reset with: c3 access builtin mode {result['glob']} "
+              f"default{flag}")
+    if result["glob"].endswith(".env*") and result["mode"] in ("allow",
+                                                              "confirm"):
+        print(_ENV_VAULT_HINT)
     if not result["attested"]:
         print("     [warn] keyring attestation could not be cleared; the "
               "default is enforced anyway (config entry removed).")

{code_context_control-2.115.0 → code_context_control-2.118.0}/cli/commands/parser.py

@@ -735,10 +735,18 @@ def build_parser(version: str, parse_cli_ide_arg):
                             help="Seconds until the grant expires (clamped to override.max_ttl_s)")
     ov_approve.add_argument("--uses", type=int, default=None,
                             help="Uses allowed (default 1)")
+    ov_approve.add_argument(
+        "--mode", choices=("once", "session", "rule"), default="once",
+        help="once (default) | session: unlimited uses on THIS call until the "
+             "grant expires (needs override.allow_session_grants and "
+             "--confirm session) | rule: every path the rule matches, any "
+             "tool in the same op class (needs override.allow_rule_grants "
+             "and the rule glob in --confirm)")
     ov_approve.add_argument("--note", default="",
                             help="Note recorded with the decision")
     ov_approve.add_argument("--confirm", default=None,
-                            help="Required for deny/builtin rules: retype the rule glob by hand")
+                            help="Required for deny/builtin rules and for --mode rule: "
+                                 "retype the rule glob by hand ('session' for --mode session)")
     ov_approve.add_argument("--path", dest="project_path", default=".",
                             help="Project directory (default: current)")
 
@@ -746,6 +754,8 @@ def build_parser(version: str, parse_cli_ide_arg):
     ov_deny.add_argument("request_id", help="Request id (ovr_…)")
     ov_deny.add_argument("--note", default="",
                          help="Note the agent will see with the refusal")
+    ov_deny.add_argument("--mute", action="store_true",
+                         help="Also stop this session asking the same thing again")
     ov_deny.add_argument("--path", dest="project_path", default=".",
                          help="Project directory (default: current)")
 
@@ -830,10 +840,12 @@ def build_parser(version: str, parse_cli_ide_arg):
     # ── Builtin opt-out (two-key) ───────────────────────────────────────
     # Builtins are on by default. Switching one off needs a config entry AND
     # a keyring attestation, so an agent that writes config.json alone still
-    # cannot loosen the guard. Global scope only — project scopes may only
-    # ever tighten. The credential-vault builtins are never disableable.
+    # cannot loosen the guard. Since v2.118.0 the pair may be written at
+    # PROJECT scope too, because the attestation is realm-bound: a cloned
+    # repo carries the config half and changes nothing. The credential-vault
+    # builtins are never disableable at any scope.
     ac_builtin = access_subs.add_parser(
-        "builtin", help="Disable or re-enable a built-in guard (global, needs confirmation)")
+        "builtin", help="Disable or re-enable a built-in guard (needs confirmation)")
     builtin_subs = ac_builtin.add_subparsers(dest="builtin_cmd")
     for _name, _help in (("disable", "Stop enforcing a built-in guard"),
                          ("enable", "Re-enforce a built-in guard")):
@@ -841,6 +853,8 @@ def build_parser(version: str, parse_cli_ide_arg):
         _p.add_argument("glob", help="One of: **/.env*, **/.c3/**, **/.claude/settings*.json, **/.git/**")
         _p.add_argument("--path", dest="project_path", default=".",
                         help="Project directory used for the audit log (default: current)")
+        _p.add_argument("--project", dest="project_scope", action="store_true",
+                        help="This project only (default: every project on this machine)")
         if _name == "disable":
             _p.add_argument("--yes", action="store_true",
                             help="Skip the typed confirmation (scripts/CI)")
@@ -857,6 +871,9 @@ def build_parser(version: str, parse_cli_ide_arg):
                          "approval; allow = off (two-key); default = shipped behaviour")
     bm.add_argument("--path", dest="project_path", default=".",
                     help="Project directory used for the audit log (default: current)")
+    bm.add_argument("--project", dest="project_scope", action="store_true",
+                    help="Set the mode for THIS project only, attested under "
+                         "its own keyring realm (default: every project)")
     bm.add_argument("--yes", action="store_true",
                     help="Skip the typed confirmation (scripts/CI)")
 

{code_context_control-2.115.0 → code_context_control-2.118.0}/cli/guide/credentials.html

@@ -308,8 +308,9 @@ c3_shell(cmd=<span class="str">'terraform apply'</span>, env_creds=<span class="
       <code>card</code> (cardholder, number, expiry, optional cvc/billing_zip — Luhn-checked),
       <code>address</code> (street1, city, state, zip, optional recipient/street2/country/phone),
       <code>identity</code> (full_name, optional dob/ssn/phone/email) and
-      <code>login</code> (site_id, canonical_origin, username, password, optional totp_secret —
-      v2.90.0). The payload is stored as one
+      <code>login</code> (site_id, canonical_target, username, optional
+      password/private_key/passphrase/totp_secret — v2.90.0, generalized v2.118.0).
+      The payload is stored as one
       canonical JSON object through the same keyring / encrypted-sidecar path as any other value.</p>
 
       <p>They are <strong>inject-only by construction</strong>, which is stricter than a normal secret:</p>
@@ -323,9 +324,10 @@ c3_shell(cmd=<span class="str">'terraform apply'</span>, env_creds=<span class="
         <li><strong>The registry shows a projection, not the data.</strong> Lists and the UI display
         <code>visa ••••4242</code> for a card (brand + last4, deliberately <em>not</em> expiry),
         city/state for an address, the name for an identity, and
-        <code>github · https://github.com · 2FA</code> for a login — site, origin and a 2FA
-        boolean, with the <em>username withheld on purpose</em>, because username + origin is
-        half the credential. Field <em>names</em> are public;
+        <code>github · https://github.com · 2FA</code> or
+        <code>build01 · ssh://build01.lan:22 · key</code> for a login — site, target and
+        2FA/key booleans, with the <em>username withheld on purpose</em>, because username +
+        target is half the credential. Field <em>names</em> are public;
         field <em>values</em> never transit any HTTP response — a sweep test enforces this.</li>
         <li><strong>Echoes redact per field</strong> to <code>[cred:NAME.field]</code>. Caveat: the
         redactor only tracks values of 4+ characters, so a 3-digit CVC or 2-letter state that a
@@ -346,15 +348,34 @@ c3_shell(cmd=<span class="str">'terraform apply'</span>, env_creds=<span class="
 
       <p><strong><code>login</code> is storage only, and that is a design constraint, not a
       gap.</strong> C3 has no browser surface and must not grow one: a login runner in which the
-      <em>agent</em> picks the destination URL turns page-content prompt injection into credential
+      <em>agent</em> picks the destination turns page-content prompt injection into credential
       exfiltration, and a check written into a script that already holds the plaintext in its own
       environment is not a boundary — the script can simply not call it. That is what
-      <code>canonical_origin</code> is for: https-only, stored normalized
+      <code>canonical_target</code> is for: stored normalized
       (<code>scheme://host[:port]</code>, no path/query/fragment/userinfo, host lowercased), so a
       separate <em>out-of-process</em> runner that the agent does not author can pin a credential to
-      exactly one origin and check the live top-level frame before typing. That runner is
-      deliberately not shipped in this package. <code>totp_secret</code> must be base32 — a
-      malformed seed produces wrong codes that look exactly like a wrong password.</p>
+      exactly one destination and check where it is actually about to authenticate before typing.
+      That runner is deliberately not shipped in this package. <code>totp_secret</code> must be
+      base32 — a malformed seed produces wrong codes that look exactly like a wrong password.</p>
+
+      <p><strong>Not just websites (v2.118.0).</strong> A <code>login</code> holds any target with
+      one unambiguous destination: <code>ssh://build01.lan:22</code>,
+      <code>postgres://db.internal:5432</code>, <code>rdp://jump.corp</code>,
+      <code>smb://files.lan</code>. The scheme comes from an allowlist (https, ssh, sftp, ftps,
+      rdp, smb, vnc, winrm, ldaps, imaps, smtps, amqps, postgres, mysql, mariadb, mssql, mongodb,
+      redis); <strong>cleartext schemes are refused by name</strong> and told which TLS variant to
+      use instead, for the same reason http:// always was. A server login may carry a
+      <code>private_key</code> (PEM/OpenSSH, checked, with its own size allowance and an optional
+      <code>passphrase</code>) instead of a password — one of the two is required, because a login
+      with neither is not a credential.</p>
+
+      <p>The origin-pinning property is <em>preserved, not weakened</em>:
+      <code>canonical_origin</code> is still a valid field name and still reads back — but
+      <strong>only when the target is https</strong>. A browser broker that pins a credential by
+      asking for <code>canonical_origin</code> gets nothing for an <code>ssh://</code> entry and
+      fails closed, rather than being handed a string it cannot compare to a top-level frame.
+      Entries stored before v2.118.0 need no migration: the old field name is accepted on input
+      and resolves on read.</p>
     </section>
 
     <hr class="divider">

{code_context_control-2.115.0 → code_context_control-2.118.0}/cli/hub_server.py

@@ -3111,7 +3111,7 @@ def _hub_override_row(row: dict) -> dict:
     quoted under the untrusted-input label, never as markup.
     """
     out = {k: row.get(k) for k in _OVERRIDE_ROW_FIELDS}
-    for extra in ("grant_id", "grant_mode", "muted"):
+    for extra in ("grant_id", "grant_mode", "grant_scope", "muted"):
         if row.get(extra) is not None:
             out[extra] = row.get(extra)
     return out
@@ -3160,6 +3160,7 @@ def api_hub_overrides():
     whether the layer is still escalatable and which typed challenge (if any)
     an approval demands.
     """
+    from services import override_grants as orq_grants
     from services import override_policy as opol
     from services import override_requests as orq
     project_path = ""
@@ -3199,6 +3200,12 @@ def api_hub_overrides():
             if policy is not None else False
         entry["allow_session_grants"] = bool(policy.allow_session_grants) \
             if policy is not None else False
+        # A rule grant is only offerable when policy allows it AND the rule is
+        # a real glob — the synthetic discipline/shell tokens have no path set
+        # to widen along, so the card must not show a button that would 400.
+        entry["allow_rule_grants"] = bool(
+            policy is not None and policy.allow_rule_grants
+            and orq_grants.rule_is_globbable(row.get("rule", "")))
         entry["project_name"] = Path(proj).name
         out.append(entry)
     return jsonify({"requests": out, "count": len(out),
@@ -3234,12 +3241,18 @@ def api_hub_override_decide(request_id):
 
     rule_class = str(row.get("rule_class") or "")
     confirm = data.get("confirm")
-    if (decision == orq.DECISION_APPROVE
-            and rule_class in opol.TYPED_CONFIRM_LAYERS
+    # A rule-scoped approval demands the glob retyped on EVERY layer, not just
+    # the two that already do — it is a standing capability, so the layers
+    # that are one-tap for `once` are deliberately not one-tap for `rule`.
+    needs_glob = (rule_class in opol.TYPED_CONFIRM_LAYERS
+                  or mode == orq.MODE_RULE)
+    if (decision == orq.DECISION_APPROVE and needs_glob
             and confirm != row.get("rule")):
         return jsonify({
-            "error": f"approving an {rule_class} request needs the rule "
-                     "glob retyped by hand",
+            "error": ("a rule-scoped approval needs the rule glob retyped by "
+                      "hand" if mode == orq.MODE_RULE else
+                      f"approving an {rule_class} request needs the rule "
+                      "glob retyped by hand"),
             "needs_confirmation": True,
             "confirm_with": row.get("rule"),
         }), 400
@@ -3261,14 +3274,73 @@ def api_hub_override_decide(request_id):
     except Exception as exc:
         return jsonify({"error": str(exc)}), 500
 
-    _hub_override_audit(decision, result,
-                        confirmed=rule_class in opol.TYPED_CONFIRM_LAYERS,
+    _hub_override_audit(decision, result, confirmed=needs_glob,
                         detail_extra={"mode": mode,
                                       "grant_id": result.get("grant_id", "")})
     return jsonify({"request": _hub_override_row(result),
                     "decision": decision})
 
 
+#: Grant fields the hub may render. `path_key` is a canon identity, not a
+#: display string, but a rule grant's whole point is that it is NOT bound to
+#: that one path — so the card leads with the rule and shows the path only as
+#: "minted from", which is what the user was looking at when they approved.
+_GRANT_ROW_FIELDS = (
+    "id", "request_id", "session_id", "scope", "layer", "rule", "tool", "op",
+    "path_key", "expires_at", "uses_remaining", "idle_s", "granted_at",
+    "granted_by", "last_used_at",
+)
+
+
+@app.route("/api/hub/grants", methods=["GET"])
+def api_hub_grants():
+    """Live grants for one project — the standing capabilities, visible.
+
+    A rule-scoped grant can authorise many calls over hours, so it must be
+    inspectable and killable from the same screen that minted it. Without
+    this the only evidence a grant exists is a line in the agent's own
+    transcript, which is the wrong place to police it from.
+    """
+    from services import override_grants as og
+    raw = (request.args.get("path") or "").strip()
+    if not raw:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = _resolve_project_path(raw)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    session_id = (request.args.get("session") or "").strip()
+    try:
+        grants = og.active(str(resolved), session_id=session_id)
+    except Exception as exc:
+        return jsonify({"error": str(exc)}), 500
+    out = [{k: g.get(k) for k in _GRANT_ROW_FIELDS} for g in grants]
+    return jsonify({"path": str(resolved), "grants": out, "count": len(out)})
+
+
+@app.route("/api/hub/grants/<grant_id>", methods=["DELETE"])
+def api_hub_grant_revoke(grant_id):
+    """Revoke one live grant. Human surface; ledger-logged like a decision."""
+    from services import override_grants as og
+    raw = (request.args.get("path") or "").strip()
+    if not raw:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = _resolve_project_path(raw)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    try:
+        gone = og.revoke(str(resolved), grant_id=str(grant_id))
+    except Exception as exc:
+        return jsonify({"error": str(exc)}), 500
+    if not gone:
+        return jsonify({"error": "unknown or already-expired grant"}), 404
+    _hub_override_audit("grant_revoke",
+                        {"id": "", "project_path": str(resolved), "rule": ""},
+                        detail_extra={"grant_id": str(grant_id)})
+    return jsonify({"revoked": str(grant_id)})
+
+
 @app.route("/api/hub/access", methods=["GET"])
 def api_hub_access():
     """Effective Access Guard rules + override policy for one project.