code-context-control 2.136.0__py3-none-any.whl → 2.139.0__py3-none-any.whl

cli/c3.py

@@ -91,7 +91,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.136.0"
+__version__ = "2.139.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -1583,6 +1583,19 @@ def cmd_delegate_eval(args):
 
     targets = [t.strip() for t in (args.targets or "").split(",") if t.strip()]
     case_ids = [c.strip() for c in (args.cases or "").split(",") if c.strip()]
+    if args.suite == "write":
+        # Write mode (docs/delegate-write.md): graded on the files left behind.
+        from services.bench import delegate_write_eval as dwe
+        if not targets:
+            raise RuntimeError("--suite write needs --targets (e.g. claude:small,claude:medium, or gold)")
+        try:
+            overrides = json.loads(args.config) if getattr(args, "config", None) else None
+            report = dwe.run_write_suite(targets, case_ids=case_ids or None, record=args.record,
+                                         delegate_overrides=overrides)
+        except ValueError as e:
+            raise RuntimeError(str(e))
+        print(json.dumps(report, indent=2) if args.json else dwe.render(report))
+        return
     overrides = json.loads(args.config) if getattr(args, "config", None) else None
     if overrides is not None and not isinstance(overrides, dict):
         raise RuntimeError("--config must be a JSON object")
@@ -5065,7 +5078,7 @@ back to native tools as the task progresses.
 - **Filter**: `c3_filter(text=...)` — for terminal output >10 lines
 - **Shell**: `c3_shell(cmd, timeout=60)` — structured shell exec (tests/git/build). Auto-filters output, logs git mutations to the ledger. Native Bash for interactive/TTY only
 - **Memory**: `c3_memory(action='recall')` — full recall. `index` + `fetch` for token-efficient two-step retrieval
-- **Delegate**: `c3_delegate(task, task_type, context|file_path)` — your own provider one tier down (default `backend='host'`, `tier='small'`; Claude Code: Haiku) for bounded answers: summarize a diff/log, explain a function, triage a traceback. `scout=true` lets it look files up itself. Multi-step work: the `c3-scout` (haiku) / `c3-worker` (sonnet) subagents
+- **Delegate**: `c3_delegate(task, task_type, context|file_path)` — your own provider one tier down (default `backend='host'`, `tier='small'`; Claude Code: Haiku) for bounded answers: summarize a diff/log, explain a function, triage a traceback. `scout=true` lets it look files up itself; `write_paths='a.py,b.py'` has Sonnet make a change you specified in only those files and return the diff. Multi-step work: the `c3-scout` (haiku) / `c3-worker` (sonnet) subagents
 - **Local CI** (v2.79.0+): `c3_ci(action='inspect|run|rerun|failures')` — run THIS repo's real `.github/workflows` here instead of pushing for feedback. `run` executes in `needs` order; `failures` gives {file,line,message}; `rerun` retries only what failed. Only `FULL_CI_PASS` means safe to push — `PARTIAL_PASS` means something did not run (other OS, unsupported action, or your selection).
 - **Bitbucket** (v2.30.0+, when `c3 bitbucket login` has run): `c3_bitbucket(action='list_prs|get_pr|merge_pr|...')` — self-hosted Bitbucket Data Center / Server. Token in OS keyring; mutating actions auto-log to the edit ledger.
 - **Cross-project** (v2.31.0+): `c3_project(action='list|scan|search|read|edit|...', project='<name|path>')` — discover and operate on OTHER c3-installed projects. Reads run freely; writes (edit/shell/memory) need `allow_write=true`.

cli/commands/parser.py

@@ -92,7 +92,8 @@ def build_parser(version: str, parse_cli_ide_arg):
     p_delegate_eval = subparsers.add_parser(
         "delegate-eval", help="Grade c3_delegate answers per backend/tier (docs/delegate-eval.md)")
     p_delegate_eval.add_argument("--suite", default="gold",
-                                 help="'gold' (bundled) or a .jsonl path")
+                                 help="'gold' (bundled), 'write' (write mode, docs/delegate-write.md) "
+                                      "or a .jsonl path")
     p_delegate_eval.add_argument("--targets", default="",
                                  help="Comma-separated backend[:tier] list, e.g. 'claude:small,claude:medium'")
     p_delegate_eval.add_argument("--cases", default="", help="Comma-separated case ids (default: all)")

cli/guide/tools.html

@@ -940,7 +940,7 @@ c3_status(view=<span class="str">'sessions'</span>)         <span class="com">#
                 <td class="param-name">tier</td>
                 <td class="param-type">string</td>
                 <td class="param-default">"small"</td>
-                <td class="param-desc"><code>small</code> · <code>medium</code> · <code>large</code> · <code>default</code>. Claude: Haiku / Sonnet / Opus. Codex and Grok: reasoning effort low / medium / high on the account's model. Gemini: flash-lite / flash / pro.</td>
+                <td class="param-desc"><code>small</code> · <code>medium</code> · <code>large</code> · <code>default</code>. Claude: Haiku (thinking capped at 1024 tokens) / Sonnet / Opus; a scout defaults to Sonnet, which finds things in far fewer turns. Codex and Grok: reasoning effort low / medium / high on the account's model. Gemini: flash-lite / flash / pro.</td>
               </tr>
               <tr>
                 <td class="param-name">model</td>
@@ -954,6 +954,12 @@ c3_status(view=<span class="str">'sessions'</span>)         <span class="com">#
                 <td class="param-default">false</td>
                 <td class="param-desc">Let the delegate Read/Grep/Glob the project itself, for lookups when you cannot name the files. Claude runs <code>--restricted</code> with Access Guard's read denies; Codex uses its read-only sandbox.</td>
               </tr>
+              <tr>
+                <td class="param-name">write_paths</td>
+                <td class="param-type">string</td>
+                <td class="param-default">""</td>
+                <td class="param-desc">Write mode (Claude only, defaults to Sonnet). Comma-separated project-relative globs the delegate may edit or create. You decide the change; it makes it with Read/Grep/Glob/Edit/Write, no commands. You get back the diff, and each change is in the edit ledger. Access Guard applies; confirm-held, locked, <code>.git/</code> and <code>.c3/</code> paths are refused. Review the diff and run the tests yourself.</td>
+              </tr>
             </tbody>
           </table>
 
@@ -965,7 +971,10 @@ c3_delegate(task=<span class="str">'Summarize this diff for a changelog in three
 c3_delegate(task=<span class="str">'What does resolve_host return inside a grok child?'</span>, file_path=<span class="str">'core/host.py'</span>, task_type=<span class="str">'explain'</span>, tier=<span class="str">'medium'</span>)
 
 <span class="com"># A lookup the delegate does itself</span>
-c3_delegate(task=<span class="str">'Which functions call charge_card, and where?'</span>, scout=<span class="kw">True</span>)</code></pre>
+c3_delegate(task=<span class="str">'Which functions call charge_card, and where?'</span>, scout=<span class="kw">True</span>)
+
+<span class="com"># A change you have decided, made by Sonnet inside a write set</span>
+c3_delegate(task=<span class="str">'Rename calc_total to order_total in its definition and every use; no alias'</span>, write_paths=<span class="str">'inv/orders.py, inv/report.py, tests/test_orders.py'</span>)</code></pre>
 
           <div class="callout callout-info">
             <span class="callout-icon">ℹ️</span>

cli/hook_access_guard.py

@@ -503,14 +503,77 @@ def run(payload: dict, project_path: Path | None = None,
     return None
 
 
+def _worker_refusal(rel: str, why: str) -> dict:
+    return _deny(f"[c3-delegate:refused] {rel}: {why}. Do not write it another way; "
+                 "leave it and say in your report what change it needed.")
+
+
+def worker_run(payload: dict, project_path: Path, state_dir: Path) -> dict | None:
+    """PreToolUse for a ``c3_delegate`` write-mode worker (see services/delegate_write).
+
+    Reads go through ``run`` exactly as for a scout. A write must pass, in
+    order: canonicalization inside the project, never ``.git/`` or ``.c3/``,
+    never the credential vault, Access Guard with NO grants and NO filed
+    requests (a confirm hold is a refusal here — a headless worker cannot
+    wait for a human, and the caller can make that edit itself), the caller's
+    write set, and another agent's lock. Then the pre-image is saved before
+    the write is allowed. Raises on a broken spec; main() turns that into a
+    deny.
+    """
+    from services import delegate_write as dw
+
+    tool = normalize_tool_name(payload.get("tool_name", ""))
+    if tool not in _WRITE_TOOLS:
+        return run(payload, project_path)
+    spec = dw.load_spec(state_dir)
+    fp = _target(payload.get("tool_input", {}) or {})
+    if not fp:
+        return _deny("[c3-delegate:refused] a write with no target path")
+    base = str(project_path)
+    canon, rel, denial = ag.canonicalize(fp, base)
+    if denial:
+        return _worker_refusal(fp, f"path refused ({denial.reason})")
+    if not rel:
+        return _worker_refusal(fp, "outside the project")
+    if dw.forbidden(rel):
+        return _worker_refusal(rel, "under .git/ or .c3/, never delegate-writable")
+    try:
+        from services import credential_store as _cs
+        vault = _cs.vault_guard_reason(fp)
+    except Exception as exc:  # fail closed: an unloadable vault check refuses
+        vault = f"vault check unavailable ({type(exc).__name__})"
+    if vault:
+        return _worker_refusal(rel, "credential vault file")
+    op = "write" if os.path.exists(fp) else "create"
+    denial = ag.check(fp, op, base)
+    if denial:
+        _record(denial, tool, op, fp, base, str(payload.get("session_id") or ""))
+        return _worker_refusal(rel, f"Access Guard {denial.kind} rule '{denial.rule}' "
+                                    f"({denial.scope})")
+    if not dw.in_write_set(rel, spec["write_paths"]):
+        return _worker_refusal(rel, "outside the write set the caller gave ("
+                                    + ", ".join(spec["write_paths"]) + ")")
+    try:
+        from services import agent_locks
+        holder = agent_locks.check(fp, base, str(spec.get("session_id") or ""))
+    except Exception:
+        holder = None
+    if holder:
+        return _worker_refusal(rel, f"locked by {holder.get('agent_id', 'another agent')}")
+    dw.snapshot(state_dir, fp, canon)
+    return None
+
+
 def main() -> None:
-    """Standalone PreToolUse entry for a ``c3_delegate`` scout run.
+    """Standalone PreToolUse entry for a ``c3_delegate`` scout or worker run.
 
     A scout is ``claude -p --restricted`` with Read/Grep/Glob and no C3 MCP
     server, so the dispatcher's discipline hook (hook_pretool_enforce) would
     refuse every native read. Only the access guard runs here. It prints a
     deny and nothing else: grants and search footers are for an agent that
     can act on them. Any failure denies (fail closed).
+
+    ``--worker-state DIR``: a write-mode worker; see ``worker_run``.
     """
     import argparse
     import json
@@ -520,6 +583,7 @@ def main() -> None:
     ensure_utf8_stdio()
     parser = argparse.ArgumentParser()
     parser.add_argument("--project", required=True)
+    parser.add_argument("--worker-state", default="")
     args = parser.parse_args()
     try:
         raw = sys.stdin.read()
@@ -527,9 +591,13 @@ def main() -> None:
         if not isinstance(payload, dict):
             raise ValueError("hook payload must be a JSON object")
         # access_guard canonicalizes the base itself (no direct resolve here).
-        out = run(payload, Path(args.project))
+        if args.worker_state:
+            out = worker_run(payload, Path(args.project), Path(args.worker_state))
+        else:
+            out = run(payload, Path(args.project))
     except Exception as exc:
-        out = _deny(f"[c3-access:error] scout guard failed ({type(exc).__name__}: {exc}); "
+        who = "worker" if args.worker_state else "scout"
+        out = _deny(f"[c3-access:error] {who} guard failed ({type(exc).__name__}: {exc}); "
                     "refusing the call")
     if isinstance(out, dict) and isinstance(out.get("hookSpecificOutput"), dict):
         print(json.dumps({"hookSpecificOutput": out["hookSpecificOutput"]}))

cli/mcp_server.py

@@ -806,11 +806,13 @@ async def c3_delegate(task: str, task_type: str = "ask", context: str = "",
                 file_path: str = "", backend: str = "host",
                 allow_write_delegation: bool = False,
                 tier: str = "", model: str = "", scout: bool = False,
+                write_paths: str = "",
                 ctx: Context = None) -> str:
     """OFFLOAD to another model — use when the subtask is local-model-sized or needs a different perspective.
     backend: host (default: your own provider, one tier down — Claude Code->claude, Codex->codex, Grok->grok, Antigravity->gemini) | claude|codex|gemini|grok|ollama|auto. task_type: auto, summarize, explain, review, ask, test, diagnose, ping (live auth check), available, codex_check, gemini_check, grok_check, codex_resume.
-    tier: small (default) | medium | large | default. claude: haiku/sonnet/opus; codex/grok: reasoning effort; gemini: flash-lite/flash/pro. model overrides the tier. Context + file_path are packed by C3 under Access Guard; a file over 8k tokens goes as its map, so for line-level questions on a big file paste the excerpt or use scout=true.
+    tier: small (default; scout=true defaults to medium) | medium | large | default. claude: haiku/sonnet/opus; codex/grok: reasoning effort; gemini: flash-lite/flash/pro. model overrides the tier. Context + file_path are packed by C3 under Access Guard; a file over 8k tokens goes as its map, so for line-level questions on a big file paste the excerpt or use scout=true.
     scout=true: the delegate may Read/Grep/Glob the project itself (claude: read-only, guard-denied paths refused; codex: its read-only sandbox) — for lookups when you cannot name the files.
+    write_paths: comma-separated project-relative globs the delegate may edit or create (write mode; claude only, tier defaults to medium). You decide the change: say what to change, where, and the intended behaviour. It cannot run commands. You get back the diff (each change is in the edit ledger): review it and run the tests yourself. Access Guard applies; confirm-held, locked, .git/ and .c3/ paths are refused.
     grok runs read-only in a temp dir unless delegate.grok_allow_write=true (then --yolo in the project, loading its trusted .grok MCP servers and hooks).
     allow_write_delegation: explicit user opt-in for write-capable backends (gemini/grok write mode/codex_resume) while Access Guard rules are active; codex is pinned read-only instead."""
     svc = _svc(ctx)
@@ -828,7 +830,8 @@ async def c3_delegate(task: str, task_type: str = "ask", context: str = "",
     try:
         return await asyncio.to_thread(handle_delegate, task, task_type, context,
                                        file_path, svc, finalize, backend,
-                                       allow_write_delegation, tier, model, scout)
+                                       allow_write_delegation, tier, model, scout,
+                                       write_paths)
     finally:
         svc._agent_progress_cb = None