code-context-control 2.142.0__tar.gz → 2.145.0__tar.gz

{code_context_control-2.142.0 → code_context_control-2.145.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.142.0
+Version: 2.145.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -44,6 +44,7 @@ Requires-Dist: rich>=13.0.0
 Requires-Dist: click>=8.0.0
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: keyring>=24.0
+Requires-Dist: cryptography>=41.0
 Provides-Extra: vector
 Requires-Dist: scikit-learn>=1.3.0; extra == "vector"
 Requires-Dist: numpy>=1.24.0; extra == "vector"
@@ -163,6 +164,8 @@ Every C3-initialized project registers itself here on `c3 init`. Filter by activ
 
 Three top-level views — **Projects**, **Tasks** (a cross-project kanban), and **Credentials** — plus a drill-in panel per project covering Overview, Sub-projects, Tasks, Artifacts, Memory, Ledger, Sessions, Health, Budget, Credentials, Config, and MCP.
 
+**Sessions** (v2.143.0) lists past Claude Code sessions across projects: the title, first and last prompt, the agent's note, and linked tasks and decisions. **Resume** opens a terminal running `claude --resume <id>`, or you can copy the command or open the claude.ai/code link. Agents mark dead ends stale with `c3_session(action='stale')`. → [Sessions](https://github.com/drknowhow/code-context-control/blob/main/docs/sessions.md)
+
 **Sub-projects** make one project a first-class child of another, with its own `.c3`. It can be a nested repo — the parent's index then excludes its subtree — or a project anywhere else on disk, linked by path. Hierarchies nest up to 8 levels, and `c3_search` / `c3_memory` fan out on demand (`scope='all'`, or one by name). → [Sub-projects guide](https://github.com/drknowhow/code-context-control/blob/main/docs/sub-projects.md)
 
 ### Per-project UI

{code_context_control-2.142.0 → code_context_control-2.145.0}/README.md

@@ -97,6 +97,8 @@ Every C3-initialized project registers itself here on `c3 init`. Filter by activ
 
 Three top-level views — **Projects**, **Tasks** (a cross-project kanban), and **Credentials** — plus a drill-in panel per project covering Overview, Sub-projects, Tasks, Artifacts, Memory, Ledger, Sessions, Health, Budget, Credentials, Config, and MCP.
 
+**Sessions** (v2.143.0) lists past Claude Code sessions across projects: the title, first and last prompt, the agent's note, and linked tasks and decisions. **Resume** opens a terminal running `claude --resume <id>`, or you can copy the command or open the claude.ai/code link. Agents mark dead ends stale with `c3_session(action='stale')`. → [Sessions](https://github.com/drknowhow/code-context-control/blob/main/docs/sessions.md)
+
 **Sub-projects** make one project a first-class child of another, with its own `.c3`. It can be a nested repo — the parent's index then excludes its subtree — or a project anywhere else on disk, linked by path. Hierarchies nest up to 8 levels, and `c3_search` / `c3_memory` fan out on demand (`scope='all'`, or one by name). → [Sub-projects guide](https://github.com/drknowhow/code-context-control/blob/main/docs/sub-projects.md)
 
 ### Per-project UI

{code_context_control-2.142.0 → code_context_control-2.145.0}/cli/c3.py

@@ -91,7 +91,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.142.0"
+__version__ = "2.145.0"
 
 # The PreToolUse matcher for native subagent calls (installer and hub migration).
 AGENT_MATCHER = "Agent|Task"
@@ -5081,6 +5081,7 @@ back to native tools as the task progresses.
 - **Filter**: `c3_filter(text=...)` — for terminal output >10 lines
 - **Shell**: `c3_shell(cmd, timeout=60)` — structured shell exec (tests/git/build). Auto-filters output, logs git mutations to the ledger. Native Bash for interactive/TTY only
 - **Memory**: `c3_memory(action='recall')` — full recall. `index` + `fetch` for token-efficient two-step retrieval
+- **Sessions** (v2.143.0+): `c3_session(action='note', data=<done>, reasoning=<next steps>)` before you stop; `c3_session(action='stale', target=<id>, reasoning=<why>)` when your work supersedes, finishes or abandons an earlier session (`action='list'` shows them). The Hub/Desk Sessions view resumes the rest
 - **Delegate**: `c3_delegate(task, task_type, context|file_path)` — your own provider one tier down (default `backend='host'`, `tier='small'`; Claude Code: Haiku) for bounded answers: summarize a diff/log, explain a function, triage a traceback. `scout=true` lets it look files up itself; `write_paths='a.py,b.py'` has Sonnet make a change you specified in only those files and return the diff. Multi-step work: the `c3-scout` (haiku) / `c3-worker` (sonnet) subagents; an `Agent` call with no `model` runs one tier below you (pass `model=` to choose)
 - **Local CI** (v2.79.0+): `c3_ci(action='inspect|run|rerun|failures')` — run THIS repo's real `.github/workflows` here instead of pushing for feedback. `run` executes in `needs` order; `failures` gives {file,line,message}; `rerun` retries only what failed. Only `FULL_CI_PASS` means safe to push — `PARTIAL_PASS` means something did not run (other OS, unsupported action, or your selection).
 - **Bitbucket** (v2.30.0+, when `c3 bitbucket login` has run): `c3_bitbucket(action='list_prs|get_pr|merge_pr|...')` — self-hosted Bitbucket Data Center / Server. Token in OS keyring; mutating actions auto-log to the edit ledger.
@@ -6370,7 +6371,7 @@ def cmd_creds(args):
     """Credential vault management (global + per-project scopes)."""
     sub = getattr(args, "creds_cmd", None)
     if not sub:
-        print("Usage: c3 creds {set,get,list,rm,import,usage,audit} [args]")
+        print("Usage: c3 creds {set,get,list,rm,import,usage,audit,backup} [args]")
         return
 
     project_path = getattr(args, "project_path", ".") or "."
@@ -6389,6 +6390,8 @@ def cmd_creds(args):
         _creds_cmd_usage(args, project_path)
     elif sub == "audit":
         _creds_cmd_audit(args, project_path)
+    elif sub == "backup":
+        _creds_cmd_backup(args, project_path)
     else:
         print(f"Unknown creds subcommand: {sub}")
 
@@ -6397,11 +6400,12 @@ def _creds_scope(args) -> str:
     return "global" if getattr(args, "use_global", False) else "project"
 
 
-def _creds_entry_line(name: str, entry: dict) -> str:
+def _creds_entry_line(name: str, entry: dict, missing: bool = False) -> str:
     flags = [f for f in ("inject", "agent_readable") if entry.get(f)]
+    size = "VALUE MISSING" if missing else f"len={entry.get('value_len', '?')}"
     parts = [
         f"{name:<24} {entry.get('scope', '?'):<8} {entry.get('type', 'token'):<10}"
-        f" len={entry.get('value_len', '?')}",
+        f" {size}",
     ]
     display = entry.get("display") or {}
     if display:
@@ -6464,13 +6468,15 @@ def _creds_cmd_set(args, project_path: str) -> None:
 
     from services import credential_store as cred_store
 
-    ctype = getattr(args, "ctype", "token") or "token"
+    ctype = getattr(args, "ctype", None)
+    prompt_type = ctype or cred_store.get_entry(
+        args.name, project_path=project_path).get("type", "token")
     value = getattr(args, "value", "") or ""
     if getattr(args, "stdin", False):
         value = sys.stdin.read().rstrip("\n")
     if not value:
-        if ctype in cred_store.STRUCTURED_TYPES:
-            value = _creds_prompt_structured(args.name, ctype)
+        if prompt_type in cred_store.STRUCTURED_TYPES:
+            value = _creds_prompt_structured(args.name, prompt_type)
             if value == "{}":
                 print("Cancelled -- no fields entered.")
                 return
@@ -6484,11 +6490,11 @@ def _creds_cmd_set(args, project_path: str) -> None:
         entry = cred_store.set_credential(
             args.name, value,
             scope=scope, project_path=project_path,
-            description=getattr(args, "desc", "") or "",
+            description=getattr(args, "desc", None),
             ctype=ctype,
-            env_var=getattr(args, "env_var", "") or "",
-            agent_readable=bool(getattr(args, "agent_readable", False)),
-            inject=bool(getattr(args, "inject", False)),
+            env_var=getattr(args, "env_var", None),
+            agent_readable=getattr(args, "agent_readable", None),
+            inject=getattr(args, "inject", None),
         )
     except (cred_store.CredentialError, RuntimeError) as exc:
         print(f"[error] {exc}")
@@ -6498,6 +6504,111 @@ def _creds_cmd_set(args, project_path: str) -> None:
     if entry["agent_readable"]:
         print("[warn] agent_readable=true -- the agent can read this value "
               "into its context and transcripts.")
+    _creds_print_backup_note(entry.get("backup", ""))
+
+
+def _creds_print_backup_note(backup: str) -> None:
+    if backup == "off":
+        print("[note] no vault backup: this value exists only in the OS keychain. "
+              "`c3 creds backup init` keeps a copy that survives a keychain wipe.")
+    elif backup.startswith("failed"):
+        print(f"[warn] the vault backup was not updated ({backup}); "
+              "run `c3 creds backup sync`.")
+
+
+def _creds_known_projects(project_path: str) -> list:
+    """The current project plus every project the hub knows about."""
+    from services.project_manager import ProjectManager
+    paths = [str(Path(project_path).resolve())]
+    paths += [str(p.get("path")) for p in ProjectManager().list_projects()
+              if p.get("path")]
+    return paths
+
+
+def _creds_read_passphrase(prompt: str, *, confirm: bool = False) -> str:
+    import getpass
+    first = getpass.getpass(prompt)
+    if confirm and getpass.getpass("Repeat it: ") != first:
+        print("[error] the passphrases did not match -- nothing changed.")
+        return ""
+    return first
+
+
+def _creds_cmd_backup(args, project_path: str) -> None:
+    from services import credential_backup as backup
+
+    action = args.backup_cmd
+    if action in ("init", "restore", "passphrase") and not sys.stdin.isatty():
+        print("[error] run this in your own terminal: the passphrase is read from "
+              "the keyboard, never from a pipe or an argument.")
+        return
+    try:
+        if action == "init":
+            print("Choose a passphrase for the vault backup. Without it the backup "
+                  "cannot be opened -- keep it in your password manager.")
+            passphrase = _creds_read_passphrase(
+                f"New passphrase (min {backup.MIN_PASSPHRASE} chars): ", confirm=True)
+            if not passphrase:
+                return
+            backup.init(passphrase)
+            done = backup.sync(_creds_known_projects(project_path))
+            print(f"[OK] Vault backup on: {backup.backup_path()} -- "
+                  f"{done['saved']} value(s) copied. Every value you set from now "
+                  "on is copied automatically.")
+            if done["missing"]:
+                print(f"  no value to copy (re-enter these): {', '.join(done['missing'])}")
+        elif action == "sync":
+            done = backup.sync(_creds_known_projects(project_path))
+            print(f"[OK] {done['saved']} value(s) copied to the vault backup.")
+            for label, names in (("no value to copy", done["missing"]),
+                                 ("failed", done["failed"])):
+                if names:
+                    print(f"  {label}: {', '.join(names)}")
+        elif action == "status":
+            st = backup.status(_creds_known_projects(project_path))
+            if st["enabled"]:
+                print(f"Vault backup: on ({st['path']}, created {st['created']}) -- "
+                      f"{st['backed_up']} value(s) held.")
+            else:
+                print("Vault backup: off -- values live only in the OS keychain. "
+                      "Turn it on with `c3 creds backup init`.")
+            for label, key in (("restorable (`c3 creds backup restore`)", "restorable"),
+                               ("lost, no copy (re-enter with `c3 creds set`)", "lost"),
+                               ("not backed up yet (`c3 creds backup sync`)", "not_backed_up")):
+                if st[key] and (st["enabled"] or key == "lost"):
+                    print(f"  {label}: {', '.join(st[key])}")
+        elif action == "restore":
+            passphrase = _creds_read_passphrase("Backup passphrase: ")
+            only = [n.strip() for n in (args.only or "").split(",") if n.strip()]
+            out = backup.restore(passphrase, only=only or None)
+            print(f"[OK] Restored {len(out['restored'])} value(s)"
+                  + (f": {', '.join(out['restored'])}" if out["restored"] else "."))
+            for label, key in (("still in the keychain, left alone", "present"),
+                               ("entry or project gone, skipped", "orphaned"),
+                               ("failed", "failed")):
+                if out[key]:
+                    print(f"  {label}: {', '.join(out[key])}")
+            if out["restored"]:
+                _creds_log_restore(out["restored"])
+        else:  # passphrase
+            old = _creds_read_passphrase("Current passphrase: ")
+            new = _creds_read_passphrase(
+                f"New passphrase (min {backup.MIN_PASSPHRASE} chars): ", confirm=True)
+            if old and new:
+                backup.change_passphrase(old, new)
+                print("[OK] Backup passphrase changed.")
+    except backup.BackupError as exc:
+        print(f"[error] {exc}")
+
+
+def _creds_log_restore(names: list) -> None:
+    """Names only, to the global activity log that `c3 creds audit` reads."""
+    from services import credential_store as cred_store
+    from services.activity_log import ActivityLog
+    home = cred_store.global_base()
+    if home is not None:
+        ActivityLog(str(home)).log("cred_action", {
+            "kind": "creds", "action": "restore", "names": names, "via": "cli"})
 
 
 def _creds_count_show(refs, project_path: str) -> None:
@@ -6574,8 +6685,17 @@ def _creds_cmd_list(args, project_path: str) -> None:
               "(add --global for all projects).")
         return
     print(f"{len(entries)} credential(s) — project scope shadows global:")
+    missing = 0
     for name, entry in entries.items():
-        print("  " + _creds_entry_line(name, entry))
+        gone = not cred_store.is_resolvable(
+            name, project_path=project_path, scope=entry["scope"])
+        missing += gone
+        print("  " + _creds_entry_line(name, entry, gone))
+    if missing:
+        print(f"\n{missing} entr{'y has' if missing == 1 else 'ies have'} no stored "
+              "value (the OS keychain no longer holds it). Re-enter with "
+              "`c3 creds set NAME` (add --global for global entries); the "
+              "entry keeps its env var, description and flags.")
 
 
 def _creds_cmd_rm(args, project_path: str) -> None:

{code_context_control-2.142.0 → code_context_control-2.145.0}/cli/commands/parser.py

@@ -520,16 +520,21 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_set.add_argument("name", help="Entry name (env-var safe: [A-Za-z_][A-Za-z0-9_]*)")
     cr_set.add_argument("--value", default="", help="Secret value (prompted via getpass if omitted — preferred). Structured types take a JSON object of fields")
     cr_set.add_argument("--stdin", action="store_true", help="Read the value from stdin (piped/multiline values)")
+    # Every metadata option defaults to None = keep what an existing entry
+    # has, so re-entering a value does not reset its settings.
     cr_set.add_argument("--type", dest="ctype",
                         choices=["token", "env", "multiline",
                                  "address", "identity", "card", "login"],
-                        default="token",
-                        help="Entry type; address/identity/card/login are structured "
+                        default=None,
+                        help="Entry type (default: keep the entry's type; token for a new one); "
+                             "address/identity/card/login are structured "
                              "(field payload, inject-only, never revealable to the agent)")
-    cr_set.add_argument("--desc", default="", help="Human description shown in list/UI")
-    cr_set.add_argument("--env-var", default="", help="Env var name used at injection (default: entry name)")
-    cr_set.add_argument("--agent-readable", action="store_true", help="Allow the agent to reveal the decoded value into its context (default: injection-only)")
-    cr_set.add_argument("--inject", action="store_true", help="Auto-inject into every c3_shell run")
+    cr_set.add_argument("--desc", default=None, help="Human description shown in list/UI (default: keep)")
+    cr_set.add_argument("--env-var", default=None, help="Env var name used at injection (default: keep; entry name for a new one)")
+    cr_set.add_argument("--agent-readable", action=argparse.BooleanOptionalAction, default=None,
+                        help="Allow the agent to reveal the decoded value into its context (default: keep; injection-only for a new one)")
+    cr_set.add_argument("--inject", action=argparse.BooleanOptionalAction, default=None,
+                        help="Auto-inject into every c3_shell run (default: keep; off for a new one)")
     cr_set.add_argument("--global", dest="use_global", action="store_true", help="Store in the global scope (~/.c3) so every C3 project can use it")
     # --path (not a trailing positional): a second positional after options
     # breaks argparse on py<3.12 ("unrecognized arguments").
@@ -578,6 +583,16 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_audit.add_argument("--json", dest="as_json", action="store_true", help="Emit raw JSON")
     cr_audit.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    cr_backup = creds_subs.add_parser(
+        "backup", help="Passphrase-locked copy of every value that survives an OS keychain wipe")
+    cr_backup.add_argument(
+        "backup_cmd", choices=["init", "status", "sync", "restore", "passphrase"],
+        help="init: turn it on (asks for a passphrase) · status · sync: copy every live "
+             "value now · restore: put lost values back (asks for the passphrase) · "
+             "passphrase: change it")
+    cr_backup.add_argument("--only", default="", help="restore: comma-separated names (default: all lost values)")
+    cr_backup.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
     # ── Agent Locks (docs/agent-locks.md) ───────────────────────────────
     # force-release is human-only: it bumps the fencing counter so a holder
     # that comes back is stale by construction. Agents get c3_locks instead,

{code_context_control-2.142.0 → code_context_control-2.145.0}/cli/hook_pretool_enforce.py

@@ -125,6 +125,7 @@ _WRITE_CLASS_ALWAYS = frozenset({"Edit", "Write", "MultiEdit"})
 # Mirrors services.credential_store.VAULT_PROTECTED_FILES (parity-tested);
 # duplicated because hooks must stay import-light.
 _VAULT_FILES = frozenset({"config.json", "secrets.enc", "cred_state.json",
+                          "vault_backup.json",
                           "cred_usage.jsonl", "cred_usage.jsonl.1"})
 
 # Redirect messages per native tool