code-context-control 2.140.0__tar.gz → 2.141.0__tar.gz

{code_context_control-2.140.0 → code_context_control-2.141.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.140.0
+Version: 2.141.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.140.0 → code_context_control-2.141.0}/cli/c3.py

@@ -91,7 +91,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.140.0"
+__version__ = "2.141.0"
 
 # The PreToolUse matcher for native subagent calls (installer and hub migration).
 AGENT_MATCHER = "Agent|Task"

{code_context_control-2.140.0 → code_context_control-2.141.0}/cli/hub_server.py

@@ -2982,6 +2982,65 @@ def api_projects_enforcement_set():
     return jsonify(result)
 
 
+@app.route("/api/projects/enforcement/clear", methods=["POST"])
+def api_projects_enforcement_clear():
+    """Drop a scope's `enforcement` section so it inherits again.
+
+    Body: ``{path?, scope?}`` — same scope rules as the set route. There is
+    no mode a surface can WRITE that means "use the global default" (resolve
+    stops at the first section it finds), so "inherit" is a removal, and it
+    gets its own verb rather than a magic mode string. Nothing to clear is a
+    200 with ``cleared: false``: the caller asked for the state it is in.
+    Audited on the target project like a set.
+    """
+    from services import enforcement_policy as ep
+
+    data = request.get_json(silent=True) or {}
+    path = (data.get("path") or "").strip()
+    scope = (data.get("scope") or "project").strip().lower()
+    if scope not in ("project", "global"):
+        return jsonify({"error": "scope must be 'project' or 'global'"}), 400
+    if scope == "project":
+        if not path:
+            return jsonify({"error": "path is required for project scope"}), 400
+        try:
+            resolved = _resolve_project_path(path)
+        except ValueError as e:
+            return jsonify({"error": str(e)}), 404
+    else:
+        resolved = "."
+
+    try:
+        result = ep.clear(resolved, scope=scope)
+    except (ValueError, TypeError) as e:
+        return jsonify({"error": str(e)}), 400
+
+    if scope == "project" and result.get("cleared"):
+        detail = {"kind": "enforcement", "action": "clear",
+                  "previous": result.get("previous", ""),
+                  "mode": result.get("mode", ""), "scope": result.get("scope", ""),
+                  "via": "hub"}
+        summary = (f"tool discipline {result.get('previous') or 'default'} -> "
+                   f"inherit ({result.get('mode')} from {result.get('scope')}) "
+                   "via the Hub")
+        try:
+            from services.activity_log import ActivityLog
+            ActivityLog(resolved).log("access_action", dict(detail))
+        except Exception:
+            pass
+        try:
+            from services.edit_ledger import EditLedger
+            EditLedger(resolved).log_edit(
+                file="enforcement://project",
+                change_type="enforcement_clear",
+                summary=summary,
+                tags=["enforcement", "access"],
+                detail=detail)
+        except Exception:
+            pass
+    return jsonify(result)
+
+
 @app.route("/api/projects/enforcement/denials/search", methods=["GET"])
 def api_projects_enforcement_denials_search():
     """Search one project's raw denial events. Read-only; newest first.
@@ -3260,6 +3319,43 @@ def api_hub_override_costs():
                     "project": project_path})
 
 
+#: Verbatim from the spec, and the one thing a toggle screen must not let the
+#: reader forget: policy is a floor, not a promise.
+_OVERRIDE_POLICY_NOTE = (
+    "Project and global policy merge by tightening only: a layer is "
+    "escalatable iff both scopes allow it, and the numeric limits take "
+    "the smaller value."
+)
+
+
+def _hub_policy_audit(project_path: str, action: str, detail_extra: dict) -> None:
+    """One activity row + ledger entry per override-POLICY edit on the target.
+
+    Key names and the widening list only — never values of ``wake`` (an argv
+    this machine runs). A policy edit changes what a single tap can allow, so
+    a surface that can make it for many projects at once must leave a trail
+    on every one. Failure-safe.
+    """
+    detail = {"kind": "override_policy", "action": action, "via": "hub"}
+    detail.update(detail_extra or {})
+    widened = detail.get("widened") or []
+    summary = (f"override policy {action} via the Hub"
+               + (f" (widened: {', '.join(widened)})" if widened else ""))
+    try:
+        from services.activity_log import ActivityLog as _AL
+        _AL(str(project_path)).log("access_action", dict(detail))
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(str(project_path)).log_edit(
+            file="override://policy",
+            change_type=f"override_policy_{action}",
+            summary=summary, tags=["override", "policy"], detail=dict(detail))
+    except Exception:
+        pass
+
+
 @app.route("/api/hub/overrides/policy", methods=["GET"])
 def api_hub_override_policy_get():
     """The effective `override` section for one project.
@@ -3289,13 +3385,7 @@ def api_hub_override_policy_get():
         "layers": list(opol.LAYER_KEYS),
         "typed_confirm_layers": sorted(opol.TYPED_CONFIRM_LAYERS),
         "hard_max_ttl_s": opol.HARD_MAX_TTL_S,
-        # Verbatim from the spec, and the one thing a toggle screen must not
-        # let the reader forget: policy is a floor, not a promise.
-        "coverage_note": (
-            "Project and global policy merge by tightening only: a layer is "
-            "escalatable iff both scopes allow it, and the numeric limits take "
-            "the smaller value."
-        ),
+        "coverage_note": _OVERRIDE_POLICY_NOTE,
     })
 
 
@@ -3334,11 +3424,107 @@ def api_hub_override_policy_set():
         return jsonify(exc.payload), exc.status
     except (OSError, ValueError) as exc:
         return jsonify({"error": f"{type(exc).__name__}: {exc}"}), 500
+    section = data.get("override") or {}
+    keys = [k for k in section if k != "layers"]
+    keys += [f"layers.{k}" for k in (section.get("layers") or {})]
+    _hub_policy_audit(project_path, "set",
+                      {"keys": sorted(keys), "widened": list(widens)})
     return jsonify({"path": project_path, "written": written,
                     "policy": opol.resolve(project_path).as_dict(),
                     "widened": widens})
 
 
+@app.route("/api/hub/overrides/policy/overview", methods=["GET"])
+def api_hub_override_policy_overview():
+    """Every registered project's effective override policy in one call.
+
+    The cross-project read a bulk editor needs (C3 Desk's Rules view), shaped
+    like the enforcement overview: per-row isolation, so one unreadable
+    project reports ``error`` instead of blanking the page, and a corrupt
+    section is reported as corrupt rather than as the disabled policy it
+    resolves to. ``project_keys`` names what the project pins itself, so a
+    screen can tell an inherited value from a chosen one. The global scope is
+    served READ-ONLY: ``write_section`` is project-scope by design.
+    """
+    from services import override_policy as opol
+
+    rows = []
+    for p in _pm().list_projects():
+        ppath = str(p.get("path") or "")
+        row = {"name": p.get("name") or Path(ppath).name, "path": ppath,
+               "initialized": True, "error": None, "policy": None,
+               "configured": False, "corrupt": False, "project_keys": []}
+        try:
+            if not (Path(ppath) / ".c3").is_dir():
+                row["initialized"] = False
+            else:
+                keys, present, corrupt = opol.scope_keys(ppath)
+                row["project_keys"] = keys
+                row["configured"] = present
+                row["corrupt"] = corrupt
+                row["policy"] = opol.resolve(ppath).as_dict()
+        except Exception as e:
+            row["error"] = str(e)
+        rows.append(row)
+
+    try:
+        keys, present, corrupt = opol.global_scope_keys()
+        global_policy = {"configured": present, "corrupt": corrupt,
+                         "keys": keys, "error": None,
+                         "policy": opol.resolve_global().as_dict()}
+    except Exception as e:
+        global_policy = {"configured": False, "corrupt": False, "keys": [],
+                         "error": str(e), "policy": None}
+
+    return jsonify({
+        "projects": rows,
+        "global_policy": global_policy,
+        "defaults": {k: v for k, v in opol.DEFAULTS.items()
+                     if k != opol.WAKE_KEY},
+        "layers": list(opol.LAYER_KEYS),
+        "typed_confirm_layers": sorted(opol.TYPED_CONFIRM_LAYERS),
+        "hard_max_ttl_s": opol.HARD_MAX_TTL_S,
+        "coverage_note": _OVERRIDE_POLICY_NOTE,
+        # What this Hub can do beyond the per-project GET/POST, so a client
+        # built against a newer C3 can hide what an older one cannot serve.
+        "features": ["clear"],
+    })
+
+
+@app.route("/api/hub/overrides/policy/clear", methods=["POST"])
+def api_hub_override_policy_clear():
+    """Drop one project's own `override` opinions so it inherits global.
+
+    Body: ``{path, confirm?}``. Clearing can LOOSEN (the project may have
+    been tighter than global), so it goes through the same widening check as
+    a set and needs ``confirm: "widen"`` when it does. ``wake`` survives the
+    clear. A corrupt project section is 409: it needs a human, not a reset.
+    """
+    from services import override_policy as opol
+    data = request.get_json(silent=True) or {}
+    raw = (data.get("path") or "").strip()
+    if not raw:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        project_path = str(_resolve_project_path(raw))
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    try:
+        kept, widens = opol.clear_section(
+            project_path, confirmed=(data.get("confirm") == "widen"))
+    except opol.PolicyEditError as exc:
+        return jsonify(exc.payload), exc.status
+    except (OSError, ValueError) as exc:
+        return jsonify({"error": f"{type(exc).__name__}: {exc}"}), 500
+    cleared = kept is not None
+    if cleared:
+        _hub_policy_audit(project_path, "clear",
+                          {"kept": sorted(kept), "widened": list(widens)})
+    return jsonify({"path": project_path, "cleared": cleared,
+                    "policy": opol.resolve(project_path).as_dict(),
+                    "widened": widens})
+
+
 @app.route("/api/hub/overrides/<request_id>", methods=["POST"])
 def api_hub_override_decide(request_id):
     """Approve (minting a grant) or deny one request. decided_by='desktop'.

{code_context_control-2.140.0 → code_context_control-2.141.0}/code_context_control.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.140.0
+Version: 2.141.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.140.0 → code_context_control-2.141.0}/code_context_control.egg-info/SOURCES.txt

@@ -418,6 +418,7 @@ tests/test_hub_locks_routes.py
 tests/test_hub_oracle_service_routes.py
 tests/test_hub_override_policy_routes.py
 tests/test_hub_override_routes.py
+tests/test_hub_rules_routes.py
 tests/test_hub_server_smoke.py
 tests/test_hub_subproject_links.py
 tests/test_ide_workflow_adaptation.py

{code_context_control-2.140.0 → code_context_control-2.141.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-context-control"
-version = "2.140.0"
+version = "2.141.0"
 description = "Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub."
 readme = "README.md"
 requires-python = ">=3.10"

{code_context_control-2.140.0 → code_context_control-2.141.0}/services/enforcement_policy.py

@@ -423,3 +423,41 @@ def set_fields(project_path: str = ".", *, scope: str = "project",
     _write_config(cfg, data)
     result["changed"] = changed
     return result
+
+
+def clear(project_path: str = ".", *, scope: str = "project") -> dict:
+    """Drop a scope's whole ``enforcement`` section so it inherits again.
+
+    ``resolve()`` stops at the first scope whose section exists, so there is
+    no value a surface can WRITE that means "use the global default" — only
+    removing the section does. Every field goes (mode, set_by, signal_ttl_s,
+    blocked_tools): a ttl left behind would be the mode-less partial section
+    ``set_fields`` refuses to create. Clearing the global scope falls back to
+    ``DEFAULT_MODE``.
+
+    Returns ``{"previous", "cleared", "mode", "scope", "path"}`` where
+    ``mode``/``scope`` are the EFFECTIVE policy afterwards (``scope`` is where
+    it now comes from: global | default). No section is a no-op with
+    ``cleared=False``, never an error — the surface asked for "inherit" and
+    that is already the state.
+    """
+    if scope not in ("project", "global"):
+        raise ValueError(f"unknown scope '{scope}' — expected project|global")
+    cfg = _config_path(scope, project_path)
+    if cfg is None:
+        raise ValueError("no home directory available for the global scope")
+
+    data = _load_config_data(cfg)
+    section = data.get(_SECTION)
+    previous = (str(section.get("mode") or "")
+                if isinstance(section, dict) else "")
+    cleared = _SECTION in data
+    if cleared:
+        del data[_SECTION]
+        _write_config(cfg, data)
+
+    after = resolve(project_path) if scope == "project" else resolve_global()
+    return {"previous": previous, "cleared": cleared,
+            "mode": after.mode or DEFAULT_MODE,
+            "scope": after.scope if after.mode else "default",
+            "path": str(cfg)}

{code_context_control-2.140.0 → code_context_control-2.141.0}/services/override_policy.py

@@ -434,6 +434,10 @@ def _global_base() -> Path | None:
         return None
 
 
+#: Sentinel for :func:`_resolve` — "read the project scope from disk".
+_READ = object()
+
+
 def resolve(project_path: str = ".") -> OverridePolicy:
     """Effective policy for *project_path*: defaults ← global ← project.
 
@@ -442,6 +446,17 @@ def resolve(project_path: str = ".") -> OverridePolicy:
     disables the feature outright — there is no partial-trust reading of a
     config we could not parse.
     """
+    return _resolve(project_path)
+
+
+def _resolve(project_path, project_section=_READ) -> OverridePolicy:
+    """:func:`resolve`, optionally with the project's section SUBSTITUTED.
+
+    ``project_section`` other than ``_READ`` stands in for what the project's
+    config holds (``None`` = no section), so a caller can ask "what would the
+    effective policy be after this edit" without writing anything first. That
+    is what lets a clear be widening-checked before it lands.
+    """
     try:
         proj = Path(project_path).resolve()
     except Exception:
@@ -453,7 +468,10 @@ def resolve(project_path: str = ".") -> OverridePolicy:
     for scope, base in (("global", gbase), ("project", proj)):
         if base is None or (scope == "global" and gbase == proj):
             continue
-        section, bad = _read_scope(base)
+        if scope == "project" and project_section is not _READ:
+            section, bad = project_section, False
+        else:
+            section, bad = _read_scope(base)
         if bad:
             corrupt.append(scope)
             warnings.append(
@@ -466,7 +484,55 @@ def resolve(project_path: str = ".") -> OverridePolicy:
     if corrupt:
         return OverridePolicy(warnings=tuple(warnings),
                               corrupt_scopes=tuple(corrupt))
+    return _merge(sections, warnings)
+
 
+def resolve_global() -> OverridePolicy:
+    """The global (``~``) scope over the defaults, with no project opinion.
+
+    What a project that sets nothing inherits — the baseline a cross-project
+    screen shows beside each row. A corrupt global section disables the
+    feature here exactly as it does for every project.
+    """
+    gbase = _global_base()
+    if gbase is None:
+        return _merge([], [])
+    section, bad = _read_scope(gbase)
+    if bad:
+        return OverridePolicy(
+            warnings=("[c3-override] the 'global' scope's `override` section "
+                      "is invalid or unparseable — overrides are DISABLED "
+                      f"(fix {gbase / '.c3' / 'config.json'} by hand)",),
+            corrupt_scopes=("global",))
+    return _merge([section] if section is not None else [], [])
+
+
+def scope_keys(base) -> tuple[list, bool, bool]:
+    """``(keys, present, corrupt)`` for one scope's own ``override`` section.
+
+    ``keys`` names what that scope expresses an opinion on — layers as
+    ``layers.<key>`` — so a screen can say which values a project pins and
+    which it inherits. ``present`` is whether a section exists at all.
+    """
+    if base is None:
+        return [], False, False
+    section, bad = _read_scope(Path(base))
+    if bad:
+        return [], True, True
+    if section is None:
+        return [], False, False
+    keys = [k for k in section if k != "layers"]
+    keys += [f"layers.{k}" for k in (section.get("layers") or {})]
+    return sorted(keys), True, False
+
+
+def global_scope_keys() -> tuple[list, bool, bool]:
+    """:func:`scope_keys` for the global (``~``) scope."""
+    return scope_keys(_global_base())
+
+
+def _merge(sections: list, warnings: list) -> OverridePolicy:
+    """Fold validated sections (global first, project last) over DEFAULTS."""
     values = dict(DEFAULTS)
     values["layers"] = dict(DEFAULTS["layers"])
 
@@ -677,6 +743,66 @@ def apply_section(project_path, section: dict, *, confirmed: bool = False,
     return write_section(project_path, section), widens
 
 
+def clear_section(project_path, *, confirmed: bool = False) -> tuple[dict, list]:
+    """Drop the project's own `override` opinions so it inherits global again.
+
+    Returns ``(remaining_block, widens)``; ``remaining_block`` is ``{}`` when
+    nothing is left, and ``None`` when there was no section to clear.
+
+    ``wake`` survives: it is not a permission, no remote surface may write it,
+    and "inherit the policy" is not a request to stop telling the agent about
+    decisions. Everything else goes.
+
+    Clearing is NOT automatically a tightening. Merge is tightening-only, so a
+    project section can only ever hold the policy at or below global — which
+    means removing it can loosen. The widening check runs against the policy
+    as it would resolve afterwards, and demands ``confirmed`` exactly as
+    :func:`apply_section` does.
+
+    A corrupt project section is refused rather than cleared: it currently
+    disables overrides outright, so clearing it is a silent widening of
+    whatever global allows, and the file needs a human looking at it anyway.
+    """
+    proj = Path(project_path)
+    section, bad = _read_scope(proj)
+    if bad:
+        msg = ("the project's `override` section is invalid or unparseable "
+               "(overrides are disabled for it) — fix "
+               f"{proj / '.c3' / 'config.json'} by hand rather than clearing it")
+        raise PolicyEditError(msg, status=409,
+                              payload={"error": msg, "corrupt": True})
+    if section is None:
+        return None, []
+
+    kept = {WAKE_KEY: section[WAKE_KEY]} if WAKE_KEY in section else None
+    current = resolve(str(project_path))
+    after = _resolve(str(project_path), kept)
+    widens = widenings(current, after.as_dict())
+    if widens and not confirmed:
+        msg = "clearing this widens what an approval can allow: " + ", ".join(widens)
+        raise PolicyEditError(
+            msg,
+            payload={"error": msg, "widens": widens,
+                     "needs_confirmation": True, "confirm_with": "widen"},
+            widens=widens)
+
+    from services.atomic_json import write_json_atomic  # noqa: PLC0415
+
+    cfg_file = proj / ".c3" / "config.json"
+    try:
+        cfg = json.loads(cfg_file.read_text(encoding="utf-8")) or {}
+    except ValueError as exc:
+        raise ValueError(f"project config is not valid JSON: {exc}") from exc
+    if not isinstance(cfg, dict):
+        raise ValueError("project config is not a JSON object")
+    if kept is None:
+        cfg.pop("override", None)
+    else:
+        cfg["override"] = kept
+    write_json_atomic(cfg_file, cfg, ensure_ascii=False, trailing_newline=False)
+    return dict(kept or {}), widens
+
+
 def offer_line(layer_key: str, path, tool: str, op: str) -> str:
     """The single line appended to a refusal when a layer IS escalatable.