code-context-control 2.118.0__py3-none-any.whl → 2.118.2__py3-none-any.whl

cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.118.0"
+__version__ = "2.118.2"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

cli/hub_server.py

@@ -32,6 +32,7 @@ sys.path.insert(0, str(Path(__file__).parent.parent))
 from core.ide import PROFILES, detect_ide, get_profile, load_ide_config, normalize_ide_name
 from services import access_guard
 from services.activity_log import ActivityLog
+from services.atomic_json import write_json_atomic
 from services.project_manager import ProjectManager
 from services.tool_classifier import CATEGORIES
 
@@ -3078,9 +3079,10 @@ def api_projects_config_put():
         else:
             merged[key] = val
     cfg[section] = merged
-    tmp = cfg_file.with_name("config.json.tmp")
-    tmp.write_text(json.dumps(cfg, indent=2), encoding="utf-8")
-    os.replace(tmp, cfg_file)
+    # Not `config.json.tmp`: the CLI (services.access_guard) and the mobile
+    # API write this same file, and the hub itself is threaded — one shared
+    # temp name is a name they all pick at once. See services.atomic_json.
+    write_json_atomic(cfg_file, cfg, trailing_newline=False)
     try:
         ActivityLog(str(resolved)).log("hub_config_write", {
             "section": section, "keys": sorted(values.keys()), "source": "hub"})

{code_context_control-2.118.0.dist-info → code_context_control-2.118.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.118.0
+Version: 2.118.2
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.118.0.dist-info → code_context_control-2.118.2.dist-info}/RECORD

@@ -1,7 +1,7 @@
 cli/__init__.py,sha256=ec66drCZGNMRU4V6ov0zVhYZph1us12Vn8OvG_LJyRY,22
 cli/_hook_utils.py,sha256=lxYVHSqK4FTiFU2avXW2hbOheMbaaZhnAZqqwqtrZHI,20862
 cli/_shell_writes.py,sha256=XzUNlUDljmg-wZxK03xHnRe36WeQxe4tpO9HKVFwP5o,5090
-cli/c3.py,sha256=CwR3bZWG4u7WKNOzjU8c5X823iDqGU5Ra2pleDjgCOs,417916
+cli/c3.py,sha256=7qtAuI6yD-23IZoP5aq78nG8lAdZ1FEQ7if9wcfplAc,417916
 cli/docs.html,sha256=X9M7qC7LWi8pPJNF-4yEM57jhuZ3WeTESECbdDOeNaA,143172
 cli/edits.html,sha256=UjAhoCmBmQ89cklGvJqzC6eyNP2tc8H6T-e01DVkLvE,43418
 cli/hook_access_guard.py,sha256=ba8-un6G9Ap8HCzx7nyhVq3c_G4sOtiVXRy0BzzX8-Y,23349
@@ -19,7 +19,7 @@ cli/hook_prompt_recall.py,sha256=LHyubu36pf5h3hbLBe0yH-yGhAlwLJdsc7hfa7WB1h4,347
 cli/hook_read.py,sha256=ZWZldgqGSNz78COhlgETQ7yxdOW5vWIIHUet9gZKhxk,8176
 cli/hook_session_stats.py,sha256=NbB6_JqUjC2HBfWQTyVLibTqB74s89dhUDvTG6APvcM,5479
 cli/hook_terse_advisor.py,sha256=W_zaTfX2akgX-ifuUTsLu2H1atM8XmWt6jpPoeU7Pm0,6252
-cli/hub_server.py,sha256=MKoquU5-r4oZJHTi7KCBivBZI0jJuwoHkg_HarQIy5c,184349
+cli/hub_server.py,sha256=4BxvRHCGNc87jOtWankOVjQLYNk-GhWI2OY1harC8ro,184548
 cli/hub_ui.html,sha256=nnGqWhWGCLfNisGUnoAlQFcBr6wPNsq-AEOR7uFtVkE,2942
 cli/mcp_proxy.py,sha256=92htuT-p0j-cDTbyqlIJpGoQ85_Aw7UuB8L_Toi_u20,17511
 cli/mcp_server.py,sha256=ZkYkCAchuxEaVyU4kxOQHmQj5xDy_Sj4JElCQmrp2VY,64517
@@ -122,7 +122,7 @@ cli/ui/components/sessions.js,sha256=FIKtil76B8tCkAmcFV7hlj6GQ_DCJK2jCzvEmdK7NBE
 cli/ui/components/settings.js,sha256=ATbAjBlVIwCNpxq7s191b49a_INQV38iwmySqtJLYwY,79066
 cli/ui/components/sidebar.js,sha256=K2ym2kUgpbyG-EBA_wBIIiqQY8qTatsiBZwzseMWuIQ,9939
 cli/ui/components/tasks.js,sha256=vyKQ3uwoppMwvdEaHlhWXW4oWcAisx4NveqzMhsYqHo,38438
-code_context_control-2.118.0.dist-info/licenses/LICENSE,sha256=l8Kh5QCNWNvR6kIt8L0BUZvc2LAFiHv2c-FnsGnUZf4,11301
+code_context_control-2.118.2.dist-info/licenses/LICENSE,sha256=l8Kh5QCNWNvR6kIt8L0BUZvc2LAFiHv2c-FnsGnUZf4,11301
 core/__init__.py,sha256=TSDCEcM4V7gcZVM3w2ykJaqEUch4Dkon-rivV17T73s,2501
 core/config.py,sha256=YmkcZwedz_lfDM0ZuI_f4xpe98ixPLcSQFcTCHgRiRg,19206
 core/ide.py,sha256=V6VVMVsFdmmcsMyxikjQp7z9xa42CWiHKS-ya-MAcG4,6172
@@ -148,7 +148,7 @@ oracle/services/insight_engine.py,sha256=lwcdXtjt3CSZLqHVpXx6SG5gDhZYUKwXt4Z8dGy
 oracle/services/local_session.py,sha256=nkawOjDbotUp5wtZQnC1wPDw3HopNYMkoYqWpP5ToCU,9227
 oracle/services/memory_reader.py,sha256=rSEmoIXQu2JkolHJIQWpn0piPJpyuf1KZvW_9liQwkU,3727
 oracle/services/memory_writer.py,sha256=hpvYsxjhl293jEjGcRKfjG5njUaAOXKqbmJaUu1WdUU,6997
-oracle/services/mobile_api.py,sha256=TqlGQLpeXu9c8cFi0yNNqUTc2gM5_LA8mJVzi8q2IcA,120130
+oracle/services/mobile_api.py,sha256=9nYE84FRHtgiwv6b9Hs17o3pKYXtPlYCn1Xny_gMLhk,120326
 oracle/services/project_scanner.py,sha256=PkYJtwOLRME1EzwRy3GIkYk6Xw0u1_BzFcaMJ5gJ1_s,6118
 oracle/services/review_agent.py,sha256=m_fzoHowpiibf0_iz3dF72LWSrwB_FbDd1am-SbeWXg,11273
 oracle/services/tool_executor.py,sha256=xtAkBWkclh_FwOgzprjGkyRIV8-A7Lc3bz0UFPShrv0,1113
@@ -173,14 +173,15 @@ oracle/ui/chat/send.js,sha256=X_Uc6EuuIxkUTlRWGGYOq6gQkJCQeCE3p5NMyxx7RzQ,11911
 oracle/ui/chat/stream_renderer.js,sha256=RZndI2mu5xbzZF-4NG9jeOqXTcmIqfZqxgkrBvTzWmk,29861
 oracle/ui/chat/toolbar.js,sha256=ZDexIIpGwsQ6XsY4Tyo082rJoofdD_JBTV97-mLQUVM,12027
 services/__init__.py,sha256=3Kn4cZweLm7at8wFdBdZ-Zwo8hHcnVIsmY5f29nzi2Y,116
-services/access_guard.py,sha256=14SH4aoqgX5CcX6uMC4XBvx6l4tEqMvRM8S83nrAE_c,77070
+services/access_guard.py,sha256=fzK6Uagc-pKmMYykXsDKZVQTV78RE8b3zyLAgFAHc1U,77455
 services/access_telemetry.py,sha256=9pOCLS9LgDtM7Z4cCEyl7osxhj-m3wsPubcXolBKuV4,9568
 services/activity_log.py,sha256=PNGeEYlw1Aux-mRU4pKCQdbsSuzLvOg7MYiq-cb4n8g,4473
 services/agent_base.py,sha256=a-gdSd_jtZtbjXo1WS8CnWCagXgKaGZd5ShcG6s0kT4,4809
-services/agent_locks.py,sha256=qkZ7Fdh3DSlRFBKG4zTe4bmkRg8eJ8B8eTc4-SNDmcY,21964
+services/agent_locks.py,sha256=nRAPuRSoet7BG9oOsNyA5WhlNy-UMhpsq6z5ggIPmLA,22421
 services/agents.py,sha256=vwfqs8mOlJDXQcGnWOFLPlXnrXraKjiF6lQRsEb0uB4,84469
 services/artifact_defs.py,sha256=M3blGvW3QhKxoVL1bwU7x9DlnXw1_TUHiOahiyp_Wm0,9749
 services/artifact_store.py,sha256=vCHpOzOcZmR5VF_BxcvIh6G0rPMl07c1W6Wdu2OkVVA,31098
+services/atomic_json.py,sha256=ZJ64TGw0ft0o8ypqcmye7Pzs_A2XzJ5jcdahoJGslEs,5299
 services/auto_memory.py,sha256=LAQZtz5qbnn5FSw8hapO9kwbhqLpnQi70IWdNoNQ1V0,15258
 services/background_service.py,sha256=Hn-vjAUq_wPm0cUiwwzyr-D7Xxkygjuy7s3_9XuLaOs,26866
 services/benchmark_dashboard.py,sha256=iR-DnqnoKbqHMJ4d-ZkIvJBYfzwTa7r-jzO6j2BYDfQ,27711
@@ -261,7 +262,7 @@ services/session_benchmark.py,sha256=KUcWWC5X088p_ao6DgglUMwj7jCzdecPKxJ7XiGKob0
 services/session_manager.py,sha256=jX3rQmilylZJrGnxLjghltoi2rs0k5jszIDQ1iTAGpQ,57025
 services/session_preloader.py,sha256=DsTAXMKVtrX9yu1sEFojYDi9-jkSAj1Ylt9JTy57Dow,9883
 services/shell_jobs.py,sha256=p95Sr_lCA04ZkZh3UezeIxxw72_ClDzASaH-T9CV8CA,48581
-services/shell_output.py,sha256=y-o_DblNdOl-kBal4cYgUiWZAHa7TLLw6znAA_xABrQ,41828
+services/shell_output.py,sha256=lLvENKqS9N7-hsVw9M7fWUXhBVPaaGRmU9dRx3Vr4Dk,42558
 services/subprojects.py,sha256=pjGbuWLqC81QxYMai9ZbNxmTJTuwzM7QNiyAqeZG-Yg,41218
 services/task_store.py,sha256=QoyhLcAyd-JZxn1nMfnZ11tTLgFqY-xwmlx1q8w_1p8,49477
 services/telemetry.py,sha256=_m7z-RMy_iWQlVYTb52xtJqvvYMbql4MspVvpddOIVg,20176
@@ -297,8 +298,8 @@ tui/screens/search_view.py,sha256=MMHjVdlk3HZSuDBSvq8IGrqv_Mh5Us6YqXQ80bcWSMk,19
 tui/screens/session_view.py,sha256=eZ1eDwHTvPOck1wCCviixtOaCxIkBT_95ytNNNriGNA,5991
 tui/screens/stats.py,sha256=p81PjzdaIv7hllb8f45-rlVe4lJZwSdIMqu7e86_u5s,6223
 tui/screens/ui_view.py,sha256=1QJCgLh2YfgWIpvzRG1KOGXYEaOYX6ojN61Azjf2oX0,2125
-code_context_control-2.118.0.dist-info/METADATA,sha256=OjEEfgapyEY9G8cY-ghz5wvFy7cspM9AoyjVb-8srZ4,26700
-code_context_control-2.118.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-code_context_control-2.118.0.dist-info/entry_points.txt,sha256=7kX_WUsDCF2hbXzvbNyscyaBb9AeA-DJY5v_5hN0DlU,93
-code_context_control-2.118.0.dist-info/top_level.txt,sha256=wRt41zBybVF3qAiNXHz9BURbkKvUvfhmWWtKMhaw6eE,29
-code_context_control-2.118.0.dist-info/RECORD,,
+code_context_control-2.118.2.dist-info/METADATA,sha256=J372pWy3pynKt7IYUKIgzgrPcrIASfS2gSo-dFn-enU,26700
+code_context_control-2.118.2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+code_context_control-2.118.2.dist-info/entry_points.txt,sha256=7kX_WUsDCF2hbXzvbNyscyaBb9AeA-DJY5v_5hN0DlU,93
+code_context_control-2.118.2.dist-info/top_level.txt,sha256=wRt41zBybVF3qAiNXHz9BURbkKvUvfhmWWtKMhaw6eE,29
+code_context_control-2.118.2.dist-info/RECORD,,

oracle/services/mobile_api.py

@@ -56,6 +56,7 @@ from oracle.config import ORACLE_DIR, load_config
 from oracle.services import api_auth, discovery_audit
 from oracle.services.api_auth import extract_bearer
 from oracle.services.tool_registry import _c3_version
+from services.atomic_json import write_json_atomic
 
 # 2: /info reports EFFECTIVE capabilities (filtered by the config switches)
 # rather than a static list, so a client can gate its UI instead of probing.
@@ -2090,10 +2091,11 @@ def _write_override_section(project: Path, section: dict) -> dict:
         else:
             block[key] = value
     cfg["override"] = block
-    tmp = cfg_file.with_name(f"{cfg_file.name}.tmp")
-    tmp.write_text(json.dumps(cfg, indent=2, ensure_ascii=False),
-                   encoding="utf-8")
-    tmp.replace(cfg_file)
+    # Shared with the CLI and the hub, and served from a threaded API, so the
+    # publish goes through the one race-safe writer rather than a temp name
+    # every writer of this file would pick. See services.atomic_json.
+    write_json_atomic(cfg_file, cfg, ensure_ascii=False,
+                      trailing_newline=False)
     return block
 
 

services/access_guard.py

@@ -20,6 +20,8 @@ import re
 from dataclasses import dataclass
 from pathlib import Path
 
+from services.atomic_json import write_json_atomic
+
 # ── Rule model ──────────────────────────────────────────────────────────────
 
 _KIND_DENY = "deny"
@@ -1473,11 +1475,17 @@ def _load_config_for_write(cfg: Path) -> tuple:
 
 
 def _write_scope_config(cfg: Path, data: dict) -> None:
-    """Atomic same-directory replace; privileged internal write."""
-    cfg.parent.mkdir(parents=True, exist_ok=True)
-    tmp = cfg.with_name(cfg.name + ".tmp")
-    tmp.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
-    os.replace(tmp, cfg)
+    """Atomic same-directory replace; privileged internal write.
+
+    The CLI, the hub and the mobile API all reach this for the same scope
+    file, so the publish is via ``services.atomic_json`` — a shared
+    ``config.json.tmp`` is a name they would collide on. The fsync matters
+    more here than anywhere else in the codebase: a truncated ``config.json``
+    comes back from ``load_all`` in its ``corrupt`` list, every path then
+    fails closed with ``<corrupt-config>``, and the session can no longer run
+    the command that would fix it.
+    """
+    write_json_atomic(cfg, data)
 
 
 def seed_default_global_rules() -> dict:

services/agent_locks.py

@@ -41,6 +41,7 @@ import time
 import uuid
 from pathlib import Path
 
+from services.atomic_json import write_json_atomic
 from services.task_store import _FileLock
 
 SCHEMA_VERSION = 1
@@ -219,10 +220,15 @@ class LockStore:
         return doc
 
     def _save(self, doc: dict) -> None:
-        self.data_dir.mkdir(parents=True, exist_ok=True)
-        tmp = self.state_file.with_name(self.state_file.name + ".tmp")
-        tmp.write_text(json.dumps(doc, indent=2) + "\n", encoding="utf-8")
-        os.replace(tmp, self.state_file)
+        # The `_FileLock` guard serialises the read-modify-write, but only
+        # among callers that take it — and it is advisory, held per process.
+        # The publish itself has to be safe on its own: a shared
+        # `locks.json.tmp` is one name every writer on the box picks, and two
+        # of them landing together either publishes a half-written lease file
+        # or raises WinError 5 (see services.atomic_json). Losing this write
+        # means losing live leases, which is exactly what `_load` refuses to
+        # do when it quarantines a corrupt file instead of resetting it.
+        write_json_atomic(self.state_file, doc)
 
     def _guard(self):
         return _FileLock(self.lock_file)

services/atomic_json.py

@@ -0,0 +1,118 @@
+"""One durable same-directory replace for the small JSON stores C3 writes.
+
+Why this module exists
+----------------------
+C3 keeps a handful of tiny JSON files that more than one writer touches: the
+agent lock store, the per-scope ``config.json`` written by the CLI, the hub
+and the mobile API, and the shell job store. Every one of them had grown the
+same three-line publish step by copy — ``<name>.tmp`` then a single
+``os.replace`` — and on Windows that shape is a live bug rather than a style
+nit:
+
+1. **A shared temp name races on the TEMP, not on the target.**
+   ``os.replace`` is atomic on the destination; nothing at all protects
+   ``<name>.tmp``. Two writers of one path both create it, so one publishes
+   a file the other is still writing, or the replace raises
+   ``PermissionError: [WinError 5] Access is denied`` because the loser still
+   holds a handle to it. Observed for real in the shell job store, where it
+   crashed a supervisor and reported "failed before running" for a command
+   that was fine (fixed there in 2.118.1, PR #157). The other copies had the
+   identical shape and no demonstrated failure only because they are written
+   far less often — the lock store especially is a coin that had not landed
+   on its edge yet.
+2. **A pid alone is not a unique suffix.** Threads share a pid, and the hub,
+   the Oracle and the lock store are all written from threaded servers. Six
+   threads are enough to drive a ``.tmp<pid>`` implementation into both
+   ``PermissionError`` and ``FileNotFoundError`` within a second, so the
+   suffix carries per-WRITE randomness as well.
+3. **One attempt turns a transient sharing violation into a lost write.** An
+   AV scanner or the Search indexer holding the target open for a few
+   milliseconds is ordinary on Windows and clears on its own; a single
+   ``os.replace`` turns it into an exception at the call site.
+
+``cli/_hook_utils._atomic_write_json`` deliberately does NOT import this. A
+PreToolUse hook is a separate, short-lived, single-threaded process that
+imports nothing from ``services`` on purpose, so pid-only is genuinely
+enough there. That one duplication stays.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import secrets
+import time
+from pathlib import Path
+
+# Four attempts across ~0.14s of backoff. Sized for a scanner or indexer
+# holding a handle, not for a lock a peer holds for seconds — a failure that
+# survives this is real and is re-raised.
+REPLACE_ATTEMPTS = 4
+REPLACE_BACKOFF_S = 0.02
+
+
+def atomic_tmp_path(path: Path) -> Path:
+    """``<name>.tmp<pid>-<random>`` beside ``path`` — unique per write."""
+    return path.with_name(f"{path.name}.tmp{os.getpid()}-{secrets.token_hex(4)}")
+
+
+def write_text_atomic(path, text: str, *, encoding: str = "utf-8",
+                      fsync: bool = True) -> None:
+    """Publish ``text`` at ``path``: unique temp, then a retried ``os.replace``.
+
+    ``fsync`` flushes the temp's bytes before the replace, so a crash or power
+    loss between the two cannot publish a zero-length or half-written file.
+    Durable state wants that: a truncated ``config.json`` makes the Access
+    Guard read ``<corrupt-config>`` and fail closed on every subsequent call,
+    which wedges the whole session. Callers whose file is ephemeral spill
+    state pass ``fsync=False`` rather than pay a disk flush per update.
+
+    Newline translation matches ``Path.write_text`` (the default), so this is
+    a drop-in for the ``write_text`` + ``os.replace`` pairs it replaces and
+    does not churn line endings in files already on disk.
+    """
+    path = Path(path)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = atomic_tmp_path(path)
+    try:
+        with open(tmp, "w", encoding=encoding) as fh:
+            fh.write(text)
+            if fsync:
+                fh.flush()
+                os.fsync(fh.fileno())
+        last_exc: OSError | None = None
+        for attempt in range(REPLACE_ATTEMPTS):
+            try:
+                os.replace(tmp, path)
+                return
+            except PermissionError as exc:
+                last_exc = exc
+                if attempt < REPLACE_ATTEMPTS - 1:
+                    time.sleep(REPLACE_BACKOFF_S * (2 ** attempt))
+        if last_exc is not None:
+            raise last_exc
+    finally:
+        # A successful replace already consumed tmp, so this only fires on the
+        # failure paths — otherwise abandoned temps accumulate next to the
+        # file, and for `.c3/` that means they get indexed and committed.
+        try:
+            if tmp.exists():
+                tmp.unlink()
+        except OSError:
+            pass
+
+
+def write_json_atomic(path, data, *, indent: int = 2,
+                      ensure_ascii: bool = True,
+                      trailing_newline: bool = True,
+                      fsync: bool = True) -> None:
+    """``write_text_atomic`` over ``json.dumps``.
+
+    The serialisation knobs exist so each caller keeps the exact bytes it
+    wrote before this module: the point of the change is the publish step,
+    not a reformat of five JSON files that other tools and diffs already read.
+    """
+    text = json.dumps(data, indent=indent, ensure_ascii=ensure_ascii)
+    if trailing_newline:
+        text += "\n"
+    write_text_atomic(path, text, fsync=fsync)

services/shell_output.py

@@ -75,6 +75,8 @@ from dataclasses import dataclass, field
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
+from services.atomic_json import write_json_atomic
+
 __all__ = [
     "STORE_ROOT", "RETENTION_DAYS", "RETENTION_BYTES", "HEAD_BYTES", "TAIL_BYTES",
     "TEXT_MAX_BYTES", "DEFAULT_READ_BYTES", "LINE_CLIP_CHARS",
@@ -961,9 +963,21 @@ def _load_meta(path: Path) -> OutputMeta | None:
 
 
 def _write_json_atomic(path: Path, data: dict) -> None:
-    tmp = path.with_name(path.name + ".tmp")
-    tmp.write_text(json.dumps(data, ensure_ascii=False, indent=1), encoding="utf-8")
-    os.replace(tmp, path)
+    """Publish a job record durably — see ``services.atomic_json``.
+
+    This was the first copy of the unique-temp + retried-``os.replace`` shape
+    (2.118.1, PR #157, after a shared ``<name>.tmp`` crashed supervisors on
+    Windows CI with WinError 5 and reported "failed before running" for
+    commands that were fine). The implementation now lives in one place so the
+    lock store and the three ``config.json`` writers share it instead of
+    carrying four more copies of a bug.
+
+    ``fsync=False`` is the one thing kept local: a job record is ephemeral
+    spill state that a crash invalidates anyway, so a disk flush per status
+    update buys nothing. The durable stores take the default.
+    """
+    write_json_atomic(path, data, indent=1, ensure_ascii=False,
+                      trailing_newline=False, fsync=False)
 
 
 def _move(src: Path, dst: Path) -> None: