code-context-control 2.140.0__tar.gz → 2.142.0__tar.gz

{code_context_control-2.140.0 → code_context_control-2.142.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.140.0
+Version: 2.142.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.140.0 → code_context_control-2.142.0}/cli/c3.py

@@ -91,7 +91,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.140.0"
+__version__ = "2.142.0"
 
 # The PreToolUse matcher for native subagent calls (installer and hub migration).
 AGENT_MATCHER = "Agent|Task"

{code_context_control-2.140.0 → code_context_control-2.142.0}/cli/hub_server.py

@@ -2982,6 +2982,65 @@ def api_projects_enforcement_set():
     return jsonify(result)
 
 
+@app.route("/api/projects/enforcement/clear", methods=["POST"])
+def api_projects_enforcement_clear():
+    """Drop a scope's `enforcement` section so it inherits again.
+
+    Body: ``{path?, scope?}`` — same scope rules as the set route. There is
+    no mode a surface can WRITE that means "use the global default" (resolve
+    stops at the first section it finds), so "inherit" is a removal, and it
+    gets its own verb rather than a magic mode string. Nothing to clear is a
+    200 with ``cleared: false``: the caller asked for the state it is in.
+    Audited on the target project like a set.
+    """
+    from services import enforcement_policy as ep
+
+    data = request.get_json(silent=True) or {}
+    path = (data.get("path") or "").strip()
+    scope = (data.get("scope") or "project").strip().lower()
+    if scope not in ("project", "global"):
+        return jsonify({"error": "scope must be 'project' or 'global'"}), 400
+    if scope == "project":
+        if not path:
+            return jsonify({"error": "path is required for project scope"}), 400
+        try:
+            resolved = _resolve_project_path(path)
+        except ValueError as e:
+            return jsonify({"error": str(e)}), 404
+    else:
+        resolved = "."
+
+    try:
+        result = ep.clear(resolved, scope=scope)
+    except (ValueError, TypeError) as e:
+        return jsonify({"error": str(e)}), 400
+
+    if scope == "project" and result.get("cleared"):
+        detail = {"kind": "enforcement", "action": "clear",
+                  "previous": result.get("previous", ""),
+                  "mode": result.get("mode", ""), "scope": result.get("scope", ""),
+                  "via": "hub"}
+        summary = (f"tool discipline {result.get('previous') or 'default'} -> "
+                   f"inherit ({result.get('mode')} from {result.get('scope')}) "
+                   "via the Hub")
+        try:
+            from services.activity_log import ActivityLog
+            ActivityLog(resolved).log("access_action", dict(detail))
+        except Exception:
+            pass
+        try:
+            from services.edit_ledger import EditLedger
+            EditLedger(resolved).log_edit(
+                file="enforcement://project",
+                change_type="enforcement_clear",
+                summary=summary,
+                tags=["enforcement", "access"],
+                detail=detail)
+        except Exception:
+            pass
+    return jsonify(result)
+
+
 @app.route("/api/projects/enforcement/denials/search", methods=["GET"])
 def api_projects_enforcement_denials_search():
     """Search one project's raw denial events. Read-only; newest first.
@@ -3260,6 +3319,43 @@ def api_hub_override_costs():
                     "project": project_path})
 
 
+#: Verbatim from the spec, and the one thing a toggle screen must not let the
+#: reader forget: policy is a floor, not a promise.
+_OVERRIDE_POLICY_NOTE = (
+    "Project and global policy merge by tightening only: a layer is "
+    "escalatable iff both scopes allow it, and the numeric limits take "
+    "the smaller value."
+)
+
+
+def _hub_policy_audit(project_path: str, action: str, detail_extra: dict) -> None:
+    """One activity row + ledger entry per override-POLICY edit on the target.
+
+    Key names and the widening list only — never values of ``wake`` (an argv
+    this machine runs). A policy edit changes what a single tap can allow, so
+    a surface that can make it for many projects at once must leave a trail
+    on every one. Failure-safe.
+    """
+    detail = {"kind": "override_policy", "action": action, "via": "hub"}
+    detail.update(detail_extra or {})
+    widened = detail.get("widened") or []
+    summary = (f"override policy {action} via the Hub"
+               + (f" (widened: {', '.join(widened)})" if widened else ""))
+    try:
+        from services.activity_log import ActivityLog as _AL
+        _AL(str(project_path)).log("access_action", dict(detail))
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(str(project_path)).log_edit(
+            file="override://policy",
+            change_type=f"override_policy_{action}",
+            summary=summary, tags=["override", "policy"], detail=dict(detail))
+    except Exception:
+        pass
+
+
 @app.route("/api/hub/overrides/policy", methods=["GET"])
 def api_hub_override_policy_get():
     """The effective `override` section for one project.
@@ -3289,13 +3385,7 @@ def api_hub_override_policy_get():
         "layers": list(opol.LAYER_KEYS),
         "typed_confirm_layers": sorted(opol.TYPED_CONFIRM_LAYERS),
         "hard_max_ttl_s": opol.HARD_MAX_TTL_S,
-        # Verbatim from the spec, and the one thing a toggle screen must not
-        # let the reader forget: policy is a floor, not a promise.
-        "coverage_note": (
-            "Project and global policy merge by tightening only: a layer is "
-            "escalatable iff both scopes allow it, and the numeric limits take "
-            "the smaller value."
-        ),
+        "coverage_note": _OVERRIDE_POLICY_NOTE,
     })
 
 
@@ -3334,11 +3424,107 @@ def api_hub_override_policy_set():
         return jsonify(exc.payload), exc.status
     except (OSError, ValueError) as exc:
         return jsonify({"error": f"{type(exc).__name__}: {exc}"}), 500
+    section = data.get("override") or {}
+    keys = [k for k in section if k != "layers"]
+    keys += [f"layers.{k}" for k in (section.get("layers") or {})]
+    _hub_policy_audit(project_path, "set",
+                      {"keys": sorted(keys), "widened": list(widens)})
     return jsonify({"path": project_path, "written": written,
                     "policy": opol.resolve(project_path).as_dict(),
                     "widened": widens})
 
 
+@app.route("/api/hub/overrides/policy/overview", methods=["GET"])
+def api_hub_override_policy_overview():
+    """Every registered project's effective override policy in one call.
+
+    The cross-project read a bulk editor needs (C3 Desk's Rules view), shaped
+    like the enforcement overview: per-row isolation, so one unreadable
+    project reports ``error`` instead of blanking the page, and a corrupt
+    section is reported as corrupt rather than as the disabled policy it
+    resolves to. ``project_keys`` names what the project pins itself, so a
+    screen can tell an inherited value from a chosen one. The global scope is
+    served READ-ONLY: ``write_section`` is project-scope by design.
+    """
+    from services import override_policy as opol
+
+    rows = []
+    for p in _pm().list_projects():
+        ppath = str(p.get("path") or "")
+        row = {"name": p.get("name") or Path(ppath).name, "path": ppath,
+               "initialized": True, "error": None, "policy": None,
+               "configured": False, "corrupt": False, "project_keys": []}
+        try:
+            if not (Path(ppath) / ".c3").is_dir():
+                row["initialized"] = False
+            else:
+                keys, present, corrupt = opol.scope_keys(ppath)
+                row["project_keys"] = keys
+                row["configured"] = present
+                row["corrupt"] = corrupt
+                row["policy"] = opol.resolve(ppath).as_dict()
+        except Exception as e:
+            row["error"] = str(e)
+        rows.append(row)
+
+    try:
+        keys, present, corrupt = opol.global_scope_keys()
+        global_policy = {"configured": present, "corrupt": corrupt,
+                         "keys": keys, "error": None,
+                         "policy": opol.resolve_global().as_dict()}
+    except Exception as e:
+        global_policy = {"configured": False, "corrupt": False, "keys": [],
+                         "error": str(e), "policy": None}
+
+    return jsonify({
+        "projects": rows,
+        "global_policy": global_policy,
+        "defaults": {k: v for k, v in opol.DEFAULTS.items()
+                     if k != opol.WAKE_KEY},
+        "layers": list(opol.LAYER_KEYS),
+        "typed_confirm_layers": sorted(opol.TYPED_CONFIRM_LAYERS),
+        "hard_max_ttl_s": opol.HARD_MAX_TTL_S,
+        "coverage_note": _OVERRIDE_POLICY_NOTE,
+        # What this Hub can do beyond the per-project GET/POST, so a client
+        # built against a newer C3 can hide what an older one cannot serve.
+        "features": ["clear"],
+    })
+
+
+@app.route("/api/hub/overrides/policy/clear", methods=["POST"])
+def api_hub_override_policy_clear():
+    """Drop one project's own `override` opinions so it inherits global.
+
+    Body: ``{path, confirm?}``. Clearing can LOOSEN (the project may have
+    been tighter than global), so it goes through the same widening check as
+    a set and needs ``confirm: "widen"`` when it does. ``wake`` survives the
+    clear. A corrupt project section is 409: it needs a human, not a reset.
+    """
+    from services import override_policy as opol
+    data = request.get_json(silent=True) or {}
+    raw = (data.get("path") or "").strip()
+    if not raw:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        project_path = str(_resolve_project_path(raw))
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    try:
+        kept, widens = opol.clear_section(
+            project_path, confirmed=(data.get("confirm") == "widen"))
+    except opol.PolicyEditError as exc:
+        return jsonify(exc.payload), exc.status
+    except (OSError, ValueError) as exc:
+        return jsonify({"error": f"{type(exc).__name__}: {exc}"}), 500
+    cleared = kept is not None
+    if cleared:
+        _hub_policy_audit(project_path, "clear",
+                          {"kept": sorted(kept), "widened": list(widens)})
+    return jsonify({"path": project_path, "cleared": cleared,
+                    "policy": opol.resolve(project_path).as_dict(),
+                    "widened": widens})
+
+
 @app.route("/api/hub/overrides/<request_id>", methods=["POST"])
 def api_hub_override_decide(request_id):
     """Approve (minting a grant) or deny one request. decided_by='desktop'.
@@ -3472,8 +3658,10 @@ def api_hub_access():
     """Effective Access Guard rules + override policy for one project.
 
     Read-only companion to the approvals list: the per-project mode matrix
-    the tab renders under the pending cards. Rule MUTATION stays on the
-    per-project server and the CLI — this route never writes.
+    the tab renders under the pending cards. This route never writes; rule
+    mutation from the Hub is ``/api/hub/access/rule`` (add) and
+    ``/api/hub/access/rule/remove`` (v2.142.0), besides the per-project
+    server and the CLI.
     """
     from services import access_guard
     from services import override_policy as opol
@@ -3493,6 +3681,180 @@ def api_hub_access():
                     "policy": policy})
 
 
+# ── Access Guard by file type, across projects (v2.142.0) ─────────────────
+# The desktop surface for path rules. The phone's /api/mobile/access/rule
+# cannot carry a bulk edit — 12 security calls a minute and no global scope,
+# both on purpose for a device that leaves the building — and the per-project
+# server only runs while its project's UI is open. So the Hub, loopback and
+# human-only, gains the same two verbs with the same asymmetry: adding a rule
+# tightens and is one call; removing a deny rule, or ANY global-scope rule,
+# needs the glob retyped. Every write is audited on the target (a global
+# write in ~/.c3, since it has no single target project).
+
+def _hub_access_audit(action: str, glob: str, kind: str, scope: str,
+                      project) -> None:
+    """Globs only — never file content. Failure-safe. Mirrors the phone's
+    ``_access_audit`` with ``via='hub'``."""
+    detail = {"kind": "access", "action": action, "glob": glob,
+              "rule_kind": kind, "scope": scope, "via": "hub"}
+    if project is not None:
+        try:
+            from services.activity_log import ActivityLog as _AL
+            _AL(str(project)).log("access_action", dict(detail))
+        except Exception:
+            pass
+        try:
+            from services.edit_ledger import EditLedger
+            EditLedger(str(project)).log_edit(
+                file=f"access://{glob}", change_type=f"access_{action}",
+                summary=f"{action} {kind} rule {glob} ({scope}) via the Hub",
+                tags=["access", action], detail=dict(detail))
+        except Exception:
+            pass
+    if scope == "global":
+        try:
+            from services import credential_store as cred_store
+            from services.activity_log import ActivityLog as _AL
+            home = cred_store.global_base()
+            if home is not None:
+                _AL(str(home)).log("access_action", dict(detail))
+        except Exception:
+            pass
+
+
+def _hub_access_target(data: dict):
+    """``(scope, project_path_or_None, error_response_or_None)``."""
+    scope = str(data.get("scope") or "project").strip().lower()
+    if scope not in ("project", "global"):
+        return scope, None, (jsonify(
+            {"error": "scope must be 'project' or 'global'"}), 400)
+    if scope == "global":
+        return scope, None, None
+    raw = str(data.get("path") or "").strip()
+    if not raw:
+        return scope, None, (jsonify(
+            {"error": "path is required for project scope"}), 400)
+    try:
+        resolved = _resolve_project_path(raw)
+    except ValueError as e:
+        return scope, None, (jsonify({"error": str(e)}), 404)
+    # set_rule would create .c3/config.json in any directory it is handed;
+    # a rule in a folder C3 does not manage protects nothing and says it does.
+    if not (Path(resolved) / ".c3").is_dir():
+        return scope, None, (jsonify(
+            {"error": "not initialized for C3", "needs_init": True}), 409)
+    return scope, str(resolved), None
+
+
+@app.route("/api/hub/access/overview", methods=["GET"])
+def api_hub_access_overview():
+    """Every registered project's own path rules, plus global and builtin.
+
+    Per-row isolation like the enforcement and policy overviews: a project we
+    could not read reports ``error`` rather than an empty rule list — "no
+    rules" is a claim about a repo, and we would be making it blind. A corrupt
+    scope is reported as corrupt: it evaluates deny-all until repaired by
+    hand, which is the opposite of what an empty list would suggest.
+    Builtin rules are read once, from the global realm; a project-scope
+    builtin mode (set with the CLI) is not reflected per row.
+    """
+    empty = {"deny": [], "read_only": [], "confirm": [], "mask": 0,
+             "corrupt": False}
+    rows = []
+    for p in _pm().list_projects():
+        ppath = str(p.get("path") or "")
+        row = {"name": p.get("name") or Path(ppath).name, "path": ppath,
+               "initialized": True, "error": None, "rules": dict(empty)}
+        try:
+            if not (Path(ppath) / ".c3").is_dir():
+                row["initialized"] = False
+            else:
+                row["rules"] = access_guard.scope_rules("project", ppath)
+        except Exception as e:
+            row["error"] = str(e)
+        rows.append(row)
+
+    try:
+        global_rules = {**access_guard.scope_rules("global"), "error": None}
+    except Exception as e:
+        global_rules = {**empty, "error": str(e)}
+    try:
+        home = access_guard._global_base()
+        b = access_guard.list_rules(str(home) if home else ".")["builtin"]
+        builtin = {"deny": list(b.get("deny") or []),
+                   "read_only": list(b.get("read_only") or []),
+                   "confirm": list(b.get("confirm") or []), "error": None}
+    except Exception as e:
+        builtin = {"deny": [], "read_only": [], "confirm": [], "error": str(e)}
+
+    return jsonify({
+        "projects": rows,
+        "global": global_rules,
+        "builtin": builtin,
+        # Strictest last. "allow" is the absence of a rule, not a kind.
+        "kinds": ["confirm", "read_only", "deny"],
+        "coverage_note": access_guard.COVERAGE_MATRIX,
+    })
+
+
+@app.route("/api/hub/access/rule", methods=["POST"])
+def api_hub_access_rule_add():
+    """Add one deny / read_only / confirm rule. Tightening — no confirmation.
+
+    Body: ``{path?, scope?, glob, kind}``. ``added: false`` when an equivalent
+    glob is already there (a 200, not an error: the caller asked for the
+    state it is in).
+    """
+    data = request.get_json(silent=True) or {}
+    scope, project, err = _hub_access_target(data)
+    if err:
+        return err
+    glob = str(data.get("glob") or "")
+    kind = str(data.get("kind") or "").strip()
+    try:
+        result = access_guard.set_rule(glob, kind, scope, project or ".")
+    except ValueError as exc:
+        return jsonify({"error": str(exc)}), 400
+    if result["added"]:
+        _hub_access_audit("add", result["glob"], kind, scope, project)
+    return jsonify({"rule": result})
+
+
+@app.route("/api/hub/access/rule/remove", methods=["POST"])
+def api_hub_access_rule_remove():
+    """Remove one rule. Loosening.
+
+    Body: ``{path?, scope?, glob, kind, confirm?}``. A ``deny`` rule, and any
+    rule in the GLOBAL scope (it governs every project on the machine), needs
+    ``confirm`` equal to the glob — the CLI's "type the glob again". A
+    read_only or confirm rule in one project does not: it downgrades writes
+    to writable-or-ask, not to fully visible. POST rather than DELETE so the
+    body survives every client.
+    """
+    data = request.get_json(silent=True) or {}
+    scope, project, err = _hub_access_target(data)
+    if err:
+        return err
+    glob = str(data.get("glob") or "")
+    kind = str(data.get("kind") or "").strip()
+    canon = access_guard._norm_glob(glob)
+    if kind == "deny" or scope == "global":
+        if access_guard._norm_glob(data.get("confirm")) != canon or not canon:
+            return jsonify({
+                "error": ("removing a deny rule weakens protection"
+                          if kind == "deny" else
+                          "removing a global rule weakens every project"),
+                "needs_confirmation": True, "confirm_with": canon,
+            }), 400
+    try:
+        result = access_guard.remove_rule(glob, kind, scope, project or ".")
+    except ValueError as exc:
+        return jsonify({"error": str(exc)}), 400
+    if result["removed"]:
+        _hub_access_audit("remove", result["glob"], kind, scope, project)
+    return jsonify(result)
+
+
 # ── Project management: tasks / milestones / notes (v2.45.0) ──────────────
 # Direct TaskStore per request (reload-per-op store — no runtime build needed
 # for mutations); every write audited to the target project's activity log.

{code_context_control-2.140.0 → code_context_control-2.142.0}/code_context_control.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.140.0
+Version: 2.142.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.140.0 → code_context_control-2.142.0}/code_context_control.egg-info/SOURCES.txt

@@ -409,6 +409,7 @@ tests/test_hook_session_end.py
 tests/test_hook_smoke.py
 tests/test_hook_state.py
 tests/test_hook_utf8_stdio.py
+tests/test_hub_access_routes.py
 tests/test_hub_credentials_route.py
 tests/test_hub_credentials_routes_write.py
 tests/test_hub_enforcement_routes.py
@@ -418,6 +419,7 @@ tests/test_hub_locks_routes.py
 tests/test_hub_oracle_service_routes.py
 tests/test_hub_override_policy_routes.py
 tests/test_hub_override_routes.py
+tests/test_hub_rules_routes.py
 tests/test_hub_server_smoke.py
 tests/test_hub_subproject_links.py
 tests/test_ide_workflow_adaptation.py

{code_context_control-2.140.0 → code_context_control-2.142.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-context-control"
-version = "2.140.0"
+version = "2.142.0"
 description = "Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub."
 readme = "README.md"
 requires-python = ">=3.10"

{code_context_control-2.140.0 → code_context_control-2.142.0}/services/access_guard.py

@@ -1439,6 +1439,28 @@ def list_rules(project_path: str = ".") -> dict:
     return out
 
 
+def scope_rules(scope: str, project_path: str = ".") -> dict:
+    """One scope's OWN list rules, for a cross-project screen.
+
+    ``{"deny": [...], "read_only": [...], "confirm": [...], "mask": <count>,
+    "corrupt": bool}``. Globs come back in the canonical storage form
+    (:func:`_norm_glob`), which is what :func:`set_rule` writes and what
+    :func:`remove_rule` compares against, so a caller can match a row to the
+    rule it would remove without re-deriving the spelling. A missing file is
+    an empty scope; an unreadable one is ``corrupt`` (it evaluates deny-all
+    until repaired by hand). Unlike :func:`list_rules` this touches no
+    keyring and computes no builtin modes, so it is cheap enough to run over
+    every registered project in one request.
+    """
+    cfg = _scope_config_path(scope, project_path)
+    section, corrupt = _raw_scope_section(cfg)
+    out = {k: [_norm_glob(g) for g in _str_list(section.get(k))]
+           for k in _LIST_KINDS}
+    out[_KIND_MASK] = len(_mask_list(section.get(_KIND_MASK)))
+    out["corrupt"] = corrupt
+    return out
+
+
 def _load_config_for_write(cfg: Path) -> tuple:
     """(config_dict, access_section) for read-modify-write of one scope.
 

{code_context_control-2.140.0 → code_context_control-2.142.0}/services/enforcement_policy.py

@@ -423,3 +423,41 @@ def set_fields(project_path: str = ".", *, scope: str = "project",
     _write_config(cfg, data)
     result["changed"] = changed
     return result
+
+
+def clear(project_path: str = ".", *, scope: str = "project") -> dict:
+    """Drop a scope's whole ``enforcement`` section so it inherits again.
+
+    ``resolve()`` stops at the first scope whose section exists, so there is
+    no value a surface can WRITE that means "use the global default" — only
+    removing the section does. Every field goes (mode, set_by, signal_ttl_s,
+    blocked_tools): a ttl left behind would be the mode-less partial section
+    ``set_fields`` refuses to create. Clearing the global scope falls back to
+    ``DEFAULT_MODE``.
+
+    Returns ``{"previous", "cleared", "mode", "scope", "path"}`` where
+    ``mode``/``scope`` are the EFFECTIVE policy afterwards (``scope`` is where
+    it now comes from: global | default). No section is a no-op with
+    ``cleared=False``, never an error — the surface asked for "inherit" and
+    that is already the state.
+    """
+    if scope not in ("project", "global"):
+        raise ValueError(f"unknown scope '{scope}' — expected project|global")
+    cfg = _config_path(scope, project_path)
+    if cfg is None:
+        raise ValueError("no home directory available for the global scope")
+
+    data = _load_config_data(cfg)
+    section = data.get(_SECTION)
+    previous = (str(section.get("mode") or "")
+                if isinstance(section, dict) else "")
+    cleared = _SECTION in data
+    if cleared:
+        del data[_SECTION]
+        _write_config(cfg, data)
+
+    after = resolve(project_path) if scope == "project" else resolve_global()
+    return {"previous": previous, "cleared": cleared,
+            "mode": after.mode or DEFAULT_MODE,
+            "scope": after.scope if after.mode else "default",
+            "path": str(cfg)}