code-context-control 2.143.0__tar.gz → 2.145.0__tar.gz

{code_context_control-2.143.0 → code_context_control-2.145.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.143.0
+Version: 2.145.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -44,6 +44,7 @@ Requires-Dist: rich>=13.0.0
 Requires-Dist: click>=8.0.0
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: keyring>=24.0
+Requires-Dist: cryptography>=41.0
 Provides-Extra: vector
 Requires-Dist: scikit-learn>=1.3.0; extra == "vector"
 Requires-Dist: numpy>=1.24.0; extra == "vector"

{code_context_control-2.143.0 → code_context_control-2.145.0}/cli/c3.py

@@ -91,7 +91,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.143.0"
+__version__ = "2.145.0"
 
 # The PreToolUse matcher for native subagent calls (installer and hub migration).
 AGENT_MATCHER = "Agent|Task"
@@ -6371,7 +6371,7 @@ def cmd_creds(args):
     """Credential vault management (global + per-project scopes)."""
     sub = getattr(args, "creds_cmd", None)
     if not sub:
-        print("Usage: c3 creds {set,get,list,rm,import,usage,audit} [args]")
+        print("Usage: c3 creds {set,get,list,rm,import,usage,audit,backup} [args]")
         return
 
     project_path = getattr(args, "project_path", ".") or "."
@@ -6390,6 +6390,8 @@ def cmd_creds(args):
         _creds_cmd_usage(args, project_path)
     elif sub == "audit":
         _creds_cmd_audit(args, project_path)
+    elif sub == "backup":
+        _creds_cmd_backup(args, project_path)
     else:
         print(f"Unknown creds subcommand: {sub}")
 
@@ -6398,11 +6400,12 @@ def _creds_scope(args) -> str:
     return "global" if getattr(args, "use_global", False) else "project"
 
 
-def _creds_entry_line(name: str, entry: dict) -> str:
+def _creds_entry_line(name: str, entry: dict, missing: bool = False) -> str:
     flags = [f for f in ("inject", "agent_readable") if entry.get(f)]
+    size = "VALUE MISSING" if missing else f"len={entry.get('value_len', '?')}"
     parts = [
         f"{name:<24} {entry.get('scope', '?'):<8} {entry.get('type', 'token'):<10}"
-        f" len={entry.get('value_len', '?')}",
+        f" {size}",
     ]
     display = entry.get("display") or {}
     if display:
@@ -6465,13 +6468,15 @@ def _creds_cmd_set(args, project_path: str) -> None:
 
     from services import credential_store as cred_store
 
-    ctype = getattr(args, "ctype", "token") or "token"
+    ctype = getattr(args, "ctype", None)
+    prompt_type = ctype or cred_store.get_entry(
+        args.name, project_path=project_path).get("type", "token")
     value = getattr(args, "value", "") or ""
     if getattr(args, "stdin", False):
         value = sys.stdin.read().rstrip("\n")
     if not value:
-        if ctype in cred_store.STRUCTURED_TYPES:
-            value = _creds_prompt_structured(args.name, ctype)
+        if prompt_type in cred_store.STRUCTURED_TYPES:
+            value = _creds_prompt_structured(args.name, prompt_type)
             if value == "{}":
                 print("Cancelled -- no fields entered.")
                 return
@@ -6485,11 +6490,11 @@ def _creds_cmd_set(args, project_path: str) -> None:
         entry = cred_store.set_credential(
             args.name, value,
             scope=scope, project_path=project_path,
-            description=getattr(args, "desc", "") or "",
+            description=getattr(args, "desc", None),
             ctype=ctype,
-            env_var=getattr(args, "env_var", "") or "",
-            agent_readable=bool(getattr(args, "agent_readable", False)),
-            inject=bool(getattr(args, "inject", False)),
+            env_var=getattr(args, "env_var", None),
+            agent_readable=getattr(args, "agent_readable", None),
+            inject=getattr(args, "inject", None),
         )
     except (cred_store.CredentialError, RuntimeError) as exc:
         print(f"[error] {exc}")
@@ -6499,6 +6504,111 @@ def _creds_cmd_set(args, project_path: str) -> None:
     if entry["agent_readable"]:
         print("[warn] agent_readable=true -- the agent can read this value "
               "into its context and transcripts.")
+    _creds_print_backup_note(entry.get("backup", ""))
+
+
+def _creds_print_backup_note(backup: str) -> None:
+    if backup == "off":
+        print("[note] no vault backup: this value exists only in the OS keychain. "
+              "`c3 creds backup init` keeps a copy that survives a keychain wipe.")
+    elif backup.startswith("failed"):
+        print(f"[warn] the vault backup was not updated ({backup}); "
+              "run `c3 creds backup sync`.")
+
+
+def _creds_known_projects(project_path: str) -> list:
+    """The current project plus every project the hub knows about."""
+    from services.project_manager import ProjectManager
+    paths = [str(Path(project_path).resolve())]
+    paths += [str(p.get("path")) for p in ProjectManager().list_projects()
+              if p.get("path")]
+    return paths
+
+
+def _creds_read_passphrase(prompt: str, *, confirm: bool = False) -> str:
+    import getpass
+    first = getpass.getpass(prompt)
+    if confirm and getpass.getpass("Repeat it: ") != first:
+        print("[error] the passphrases did not match -- nothing changed.")
+        return ""
+    return first
+
+
+def _creds_cmd_backup(args, project_path: str) -> None:
+    from services import credential_backup as backup
+
+    action = args.backup_cmd
+    if action in ("init", "restore", "passphrase") and not sys.stdin.isatty():
+        print("[error] run this in your own terminal: the passphrase is read from "
+              "the keyboard, never from a pipe or an argument.")
+        return
+    try:
+        if action == "init":
+            print("Choose a passphrase for the vault backup. Without it the backup "
+                  "cannot be opened -- keep it in your password manager.")
+            passphrase = _creds_read_passphrase(
+                f"New passphrase (min {backup.MIN_PASSPHRASE} chars): ", confirm=True)
+            if not passphrase:
+                return
+            backup.init(passphrase)
+            done = backup.sync(_creds_known_projects(project_path))
+            print(f"[OK] Vault backup on: {backup.backup_path()} -- "
+                  f"{done['saved']} value(s) copied. Every value you set from now "
+                  "on is copied automatically.")
+            if done["missing"]:
+                print(f"  no value to copy (re-enter these): {', '.join(done['missing'])}")
+        elif action == "sync":
+            done = backup.sync(_creds_known_projects(project_path))
+            print(f"[OK] {done['saved']} value(s) copied to the vault backup.")
+            for label, names in (("no value to copy", done["missing"]),
+                                 ("failed", done["failed"])):
+                if names:
+                    print(f"  {label}: {', '.join(names)}")
+        elif action == "status":
+            st = backup.status(_creds_known_projects(project_path))
+            if st["enabled"]:
+                print(f"Vault backup: on ({st['path']}, created {st['created']}) -- "
+                      f"{st['backed_up']} value(s) held.")
+            else:
+                print("Vault backup: off -- values live only in the OS keychain. "
+                      "Turn it on with `c3 creds backup init`.")
+            for label, key in (("restorable (`c3 creds backup restore`)", "restorable"),
+                               ("lost, no copy (re-enter with `c3 creds set`)", "lost"),
+                               ("not backed up yet (`c3 creds backup sync`)", "not_backed_up")):
+                if st[key] and (st["enabled"] or key == "lost"):
+                    print(f"  {label}: {', '.join(st[key])}")
+        elif action == "restore":
+            passphrase = _creds_read_passphrase("Backup passphrase: ")
+            only = [n.strip() for n in (args.only or "").split(",") if n.strip()]
+            out = backup.restore(passphrase, only=only or None)
+            print(f"[OK] Restored {len(out['restored'])} value(s)"
+                  + (f": {', '.join(out['restored'])}" if out["restored"] else "."))
+            for label, key in (("still in the keychain, left alone", "present"),
+                               ("entry or project gone, skipped", "orphaned"),
+                               ("failed", "failed")):
+                if out[key]:
+                    print(f"  {label}: {', '.join(out[key])}")
+            if out["restored"]:
+                _creds_log_restore(out["restored"])
+        else:  # passphrase
+            old = _creds_read_passphrase("Current passphrase: ")
+            new = _creds_read_passphrase(
+                f"New passphrase (min {backup.MIN_PASSPHRASE} chars): ", confirm=True)
+            if old and new:
+                backup.change_passphrase(old, new)
+                print("[OK] Backup passphrase changed.")
+    except backup.BackupError as exc:
+        print(f"[error] {exc}")
+
+
+def _creds_log_restore(names: list) -> None:
+    """Names only, to the global activity log that `c3 creds audit` reads."""
+    from services import credential_store as cred_store
+    from services.activity_log import ActivityLog
+    home = cred_store.global_base()
+    if home is not None:
+        ActivityLog(str(home)).log("cred_action", {
+            "kind": "creds", "action": "restore", "names": names, "via": "cli"})
 
 
 def _creds_count_show(refs, project_path: str) -> None:
@@ -6575,8 +6685,17 @@ def _creds_cmd_list(args, project_path: str) -> None:
               "(add --global for all projects).")
         return
     print(f"{len(entries)} credential(s) — project scope shadows global:")
+    missing = 0
     for name, entry in entries.items():
-        print("  " + _creds_entry_line(name, entry))
+        gone = not cred_store.is_resolvable(
+            name, project_path=project_path, scope=entry["scope"])
+        missing += gone
+        print("  " + _creds_entry_line(name, entry, gone))
+    if missing:
+        print(f"\n{missing} entr{'y has' if missing == 1 else 'ies have'} no stored "
+              "value (the OS keychain no longer holds it). Re-enter with "
+              "`c3 creds set NAME` (add --global for global entries); the "
+              "entry keeps its env var, description and flags.")
 
 
 def _creds_cmd_rm(args, project_path: str) -> None:

{code_context_control-2.143.0 → code_context_control-2.145.0}/cli/commands/parser.py

@@ -520,16 +520,21 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_set.add_argument("name", help="Entry name (env-var safe: [A-Za-z_][A-Za-z0-9_]*)")
     cr_set.add_argument("--value", default="", help="Secret value (prompted via getpass if omitted — preferred). Structured types take a JSON object of fields")
     cr_set.add_argument("--stdin", action="store_true", help="Read the value from stdin (piped/multiline values)")
+    # Every metadata option defaults to None = keep what an existing entry
+    # has, so re-entering a value does not reset its settings.
     cr_set.add_argument("--type", dest="ctype",
                         choices=["token", "env", "multiline",
                                  "address", "identity", "card", "login"],
-                        default="token",
-                        help="Entry type; address/identity/card/login are structured "
+                        default=None,
+                        help="Entry type (default: keep the entry's type; token for a new one); "
+                             "address/identity/card/login are structured "
                              "(field payload, inject-only, never revealable to the agent)")
-    cr_set.add_argument("--desc", default="", help="Human description shown in list/UI")
-    cr_set.add_argument("--env-var", default="", help="Env var name used at injection (default: entry name)")
-    cr_set.add_argument("--agent-readable", action="store_true", help="Allow the agent to reveal the decoded value into its context (default: injection-only)")
-    cr_set.add_argument("--inject", action="store_true", help="Auto-inject into every c3_shell run")
+    cr_set.add_argument("--desc", default=None, help="Human description shown in list/UI (default: keep)")
+    cr_set.add_argument("--env-var", default=None, help="Env var name used at injection (default: keep; entry name for a new one)")
+    cr_set.add_argument("--agent-readable", action=argparse.BooleanOptionalAction, default=None,
+                        help="Allow the agent to reveal the decoded value into its context (default: keep; injection-only for a new one)")
+    cr_set.add_argument("--inject", action=argparse.BooleanOptionalAction, default=None,
+                        help="Auto-inject into every c3_shell run (default: keep; off for a new one)")
     cr_set.add_argument("--global", dest="use_global", action="store_true", help="Store in the global scope (~/.c3) so every C3 project can use it")
     # --path (not a trailing positional): a second positional after options
     # breaks argparse on py<3.12 ("unrecognized arguments").
@@ -578,6 +583,16 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_audit.add_argument("--json", dest="as_json", action="store_true", help="Emit raw JSON")
     cr_audit.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    cr_backup = creds_subs.add_parser(
+        "backup", help="Passphrase-locked copy of every value that survives an OS keychain wipe")
+    cr_backup.add_argument(
+        "backup_cmd", choices=["init", "status", "sync", "restore", "passphrase"],
+        help="init: turn it on (asks for a passphrase) · status · sync: copy every live "
+             "value now · restore: put lost values back (asks for the passphrase) · "
+             "passphrase: change it")
+    cr_backup.add_argument("--only", default="", help="restore: comma-separated names (default: all lost values)")
+    cr_backup.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
     # ── Agent Locks (docs/agent-locks.md) ───────────────────────────────
     # force-release is human-only: it bumps the fencing counter so a holder
     # that comes back is stale by construction. Agents get c3_locks instead,

{code_context_control-2.143.0 → code_context_control-2.145.0}/cli/hook_pretool_enforce.py

@@ -125,6 +125,7 @@ _WRITE_CLASS_ALWAYS = frozenset({"Edit", "Write", "MultiEdit"})
 # Mirrors services.credential_store.VAULT_PROTECTED_FILES (parity-tested);
 # duplicated because hooks must stay import-light.
 _VAULT_FILES = frozenset({"config.json", "secrets.enc", "cred_state.json",
+                          "vault_backup.json",
                           "cred_usage.jsonl", "cred_usage.jsonl.1"})
 
 # Redirect messages per native tool

{code_context_control-2.143.0 → code_context_control-2.145.0}/cli/hub_server.py

@@ -2016,7 +2016,8 @@ def api_projects_config_get():
 # returned by any hub route (no reveal exists here). `credentials` stays out of
 # _CONFIG_WRITE_SECTIONS — these dedicated routes are the only hub write path.
 
-def _cred_entry_public(name, entry, *, usage=None, shadows_global=None):
+def _cred_entry_public(name, entry, *, usage=None, shadows_global=None,
+                       value_ok=None):
     """Explicit allowlist serializer — structurally cannot emit a value.
 
     Delegates to credential_store.public_entry so the hub, the per-project UI
@@ -2024,7 +2025,8 @@ def _cred_entry_public(name, entry, *, usage=None, shadows_global=None):
     is exactly the drift the write-only wire contract cannot survive."""
     from services import credential_store as cred_store
     return cred_store.public_entry(
-        name, entry, usage=usage, shadows_global=shadows_global)
+        name, entry, usage=usage, shadows_global=shadows_global,
+        value_ok=value_ok)
 
 
 def _resolve_cred_target(path: str, scope: str, *, mutation: bool):
@@ -2141,7 +2143,9 @@ def api_projects_credentials():
         entries.append(_cred_entry_public(
             name, entry, usage=usage,
             shadows_global=(entry.get("scope") == "project"
-                            and name in global_names)))
+                            and name in global_names),
+            value_ok=cred_store.is_resolvable(
+                name, project_path=str(resolved), scope=entry["scope"])))
     return jsonify({"path": str(resolved), "entries": entries})
 
 
@@ -2162,29 +2166,15 @@ def api_projects_credentials_set():
     value = data.get("value")
     # Structured kinds submit a field OBJECT; the store takes JSON text.
     value = json.dumps(value) if isinstance(value, dict) else str(value or "")
-    ctype = str(data.get("type") or data.get("ctype") or "token")
+    meta = cred_store.payload_meta(data)
     try:
         if value:
             entry = cred_store.set_credential(
-                name, value, scope=scope, project_path=store_path, ctype=ctype,
-                description=str(data.get("description") or ""),
-                env_var=str(data.get("env_var") or ""),
-                agent_readable=bool(data.get("agent_readable")),
-                inject=bool(data.get("inject")))
+                name, value, scope=scope, project_path=store_path,
+                ctype=meta.pop("type", None), **meta)
         else:
-            # Metadata-only update: touch ONLY the keys present in the payload
-            # so a single-field toggle can't clobber the others.
-            fields = {}
-            for key in ("description", "env_var"):
-                if key in data:
-                    fields[key] = str(data[key] or "")
-            for key in ("agent_readable", "inject"):
-                if key in data:
-                    fields[key] = bool(data[key])
-            if "type" in data or "ctype" in data:
-                fields["type"] = ctype
             entry = cred_store.update_metadata(
-                name, scope=scope, project_path=store_path, **fields)
+                name, scope=scope, project_path=store_path, **meta)
     except cred_store.CredentialError as exc:
         return jsonify({"error": str(exc)}), 400
     except RuntimeError as exc:
@@ -2443,7 +2433,9 @@ def api_hub_credentials_overview():
                         continue
                     row["entries"].append(_cred_entry_public(
                         name, entry, usage=usage,
-                        shadows_global=name in global_entries))
+                        shadows_global=name in global_entries,
+                        value_ok=cred_store.is_resolvable(
+                            name, project_path=ppath, scope="project")))
                     if name in shadowed_in:
                         shadowed_in[name].append(
                             {"name": row["name"], "path": ppath})
@@ -2452,11 +2444,27 @@ def api_hub_credentials_overview():
         projects_out.append(row)
     global_usage = cred_store.read_usage_state(str(home)) if home else {}
     global_out = [
-        {**_cred_entry_public(name, entry, usage=global_usage),
+        {**_cred_entry_public(
+            name, entry, usage=global_usage,
+            value_ok=cred_store.is_resolvable(
+                name, project_path=str(home), scope="global")),
          "shadowed_in": shadowed_in.get(name, [])}
         for name, entry in global_entries.items()
     ]
-    return jsonify({"global": {"entries": global_out}, "projects": projects_out})
+    return jsonify({"global": {"entries": global_out}, "projects": projects_out,
+                    "backup": _cred_backup_summary(
+                        [row["path"] for row in projects_out if row["initialized"]])})
+
+
+def _cred_backup_summary(project_paths) -> dict:
+    """Backup state as counts for the Hub banner; a broken file reports its error."""
+    from services import credential_backup
+    try:
+        st = credential_backup.status(project_paths)
+    except credential_backup.BackupError as exc:
+        return {"enabled": True, "error": str(exc), "restorable": 0, "lost": 0}
+    return {"enabled": st["enabled"], "restorable": len(st["restorable"]),
+            "lost": len(st["lost"]), "not_backed_up": len(st["not_backed_up"])}
 
 
 #: Bulk actions may only ever REDUCE what a credential is exposed to.

{code_context_control-2.143.0 → code_context_control-2.145.0}/cli/hub_ui/components/hub_credentials.js

@@ -1197,6 +1197,11 @@ function CredRow({ entry, striped, owner, onOpen, onMenu, check,
         <div style={{ display: 'flex', alignItems: 'center', flexWrap: 'wrap', gap: 7 }}>
           <span className="mono" style={{ fontWeight: 600, color: T.text, fontSize: 12.5 }}>{entry.name}</span>
           <Badge color={entry.scope === 'global' ? T.accent : T.blue}>{entry.scope}</Badge>
+          {!!entry.value_missing && (
+            <span title="Registered, but the OS keychain no longer holds its value — injecting it fails. Replace the secret to restore it.">
+              <Badge color={T.error}>value missing</Badge>
+            </span>
+          )}
           {!!entry.shadows_global && (
             <span title="This project's value wins over the global entry of the same name">
               <Badge color={T.warn}>overrides global</Badge>
@@ -2074,6 +2079,7 @@ function CredSearchResults({ groups, total, selected, setSelected, onOpen, onMen
                   minWidth: 150, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap',
                 }}>{def.projectName}</span>
                 <Badge color={e.scope === 'global' ? T.accent : T.blue}>{e.scope}</Badge>
+                {!!e.value_missing && <Badge color={T.error}>value missing</Badge>}
                 {!!e.shadows_global && <Badge color={T.warn}>overrides global</Badge>}
                 <span className="mono" style={{ fontSize: 11, color: T.textDim }}>
                   {e.type || 'token'} · ••••{e.value_len}
@@ -2287,6 +2293,18 @@ function HubCredentials({ projects, onOpenDrill }) {
   const totalProjEntries = ((ov || {}).projects || []).reduce((n, r) => n + (r.entries || []).length, 0);
   const globalCount = ((((ov || {}).global) || {}).entries || []).length;
 
+  // Restore and init read a passphrase from the keyboard, so they stay
+  // terminal commands; the Hub only says which one is needed.
+  const bk = (ov || {}).backup;
+  const backupNote = !bk ? null
+    : bk.restorable > 0 ? { tone: T.error, cmd: 'c3 creds backup restore',
+      text: `${bk.restorable} credential${bk.restorable === 1 ? '' : 's'} lost ${bk.restorable === 1 ? 'its value' : 'their values'} in the OS keychain and can be restored from the vault backup.` }
+    : bk.lost > 0 ? { tone: T.error, cmd: '',
+      text: `${bk.lost} credential${bk.lost === 1 ? ' has' : 's have'} no stored value and no backup copy — replace each secret marked "value missing".` }
+    : !bk.enabled ? { tone: T.warn, cmd: 'c3 creds backup init',
+      text: 'No vault backup: values live only in the OS keychain, which Windows can empty on a restart.' }
+    : null;
+
   return (
     <div className="fade-up" style={{ maxWidth: 1100 }}>
       <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 10 }}>
@@ -2308,6 +2326,20 @@ function HubCredentials({ projects, onOpenDrill }) {
         }}><I name="refresh" size={12} /> Refresh</button>
       </div>
 
+      {backupNote && (
+        <div style={{
+          display: 'flex', alignItems: 'center', gap: 10, flexWrap: 'wrap',
+          marginBottom: 10, padding: '8px 12px', fontSize: 12, color: T.text,
+          border: `1px solid ${T.border}`, borderLeft: `3px solid ${backupNote.tone}`,
+          borderRadius: 6, background: T.surfaceAlt,
+        }}>
+          <span>{backupNote.text}</span>
+          {backupNote.cmd && (
+            <span>In a terminal: <span className="mono" style={{ color: backupNote.tone }}>{backupNote.cmd}</span></span>
+          )}
+        </div>
+      )}
+
       {/* Cross-project search — always visible, above the sub-tabs */}
       <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 8, flexWrap: 'wrap' }}>
         <div style={{

{code_context_control-2.143.0 → code_context_control-2.145.0}/cli/server.py

@@ -2766,7 +2766,10 @@ def api_credentials_list():
     usage = cred_store.read_usage_state(pp)
     out = []
     for name, entry in cred_store.list_entries(pp).items():
-        out.append(cred_store.public_entry(name, entry, usage=usage))
+        out.append(cred_store.public_entry(
+            name, entry, usage=usage,
+            value_ok=cred_store.is_resolvable(
+                name, project_path=pp, scope=entry["scope"])))
     return jsonify({"entries": out})
 
 
@@ -2781,32 +2784,15 @@ def api_credentials_set():
     value = data.get("value")
     # Structured kinds submit a field OBJECT; the store takes JSON text.
     value = json.dumps(value) if isinstance(value, dict) else str(value or "")
-    ctype = str(data.get("type") or data.get("ctype") or "token")
-    meta = {
-        "description": str(data.get("description") or ""),
-        "env_var": str(data.get("env_var") or ""),
-        "agent_readable": bool(data.get("agent_readable")),
-        "inject": bool(data.get("inject")),
-    }
+    meta = cred_store.payload_meta(data)
     try:
         if value:
             entry = cred_store.set_credential(
                 name, value, scope=scope, project_path=str(PROJECT_PATH),
-                ctype=ctype, **meta)
+                ctype=meta.pop("type", None), **meta)
         else:
-            # Metadata-only update: touch ONLY the keys present in the payload
-            # so a single-field toggle can't clobber the others.
-            fields = {}
-            for key in ("description", "env_var"):
-                if key in data:
-                    fields[key] = str(data[key] or "")
-            for key in ("agent_readable", "inject"):
-                if key in data:
-                    fields[key] = bool(data[key])
-            if "type" in data or "ctype" in data:
-                fields["type"] = ctype
             entry = cred_store.update_metadata(
-                name, scope=scope, project_path=str(PROJECT_PATH), **fields)
+                name, scope=scope, project_path=str(PROJECT_PATH), **meta)
     except cred_store.CredentialError as exc:
         return jsonify({"error": str(exc)}), 400
     except RuntimeError as exc:

{code_context_control-2.143.0 → code_context_control-2.145.0}/cli/tools/credentials.py

@@ -64,7 +64,8 @@ def _log_access(svc, action: str, name: str, scope: str, response: str) -> None:
         pass
 
 
-def _format_entry_line(name: str, entry: dict, usage: dict) -> str:
+def _format_entry_line(name: str, entry: dict, usage: dict,
+                       missing: bool = False) -> str:
     flags = []
     if entry.get("inject"):
         flags.append("inject")
@@ -73,7 +74,7 @@ def _format_entry_line(name: str, entry: dict, usage: dict) -> str:
     last_used = (usage.get(name) or {}).get("last_used", "")
     parts = [
         f"{name} [{entry.get('scope', '?')}/{entry.get('type', 'token')}]",
-        f"len={entry.get('value_len', '?')}",
+        "VALUE MISSING" if missing else f"len={entry.get('value_len', '?')}",
     ]
     display = entry.get("display") or {}
     if display:
@@ -97,8 +98,22 @@ def _act_list(project_path: str) -> str:
             "The user manages them via the Credentials UI tab or `c3 creds set`."
         )
     usage = cs.read_usage_state(project_path)
+    missing = {n for n, e in entries.items() if not cs.is_resolvable(
+        n, project_path=project_path, scope=e["scope"])}
     lines = [f"[creds] {len(entries)} entries (project scope shadows global):"]
-    lines += [_format_entry_line(n, e, usage) for n, e in entries.items()]
+    lines += [_format_entry_line(n, e, usage, n in missing)
+              for n, e in entries.items()]
+    if missing:
+        from services import credential_backup
+        way_back = ("The user restores them in a terminal with `c3 creds backup "
+                    "restore` (it asks for the backup passphrase)"
+                    if credential_backup.is_enabled() else
+                    "No vault backup is configured; the user re-enters them "
+                    "(Credentials UI or `c3 creds set`)")
+        lines.append(
+            f"[creds:value-missing] {len(missing)} registered entries have no "
+            "stored value (the OS keychain no longer holds it); injecting them "
+            f"fails. {way_back}.")
     lines.append(_USAGE_FOOTER)
     return "\n".join(lines)
 
@@ -384,15 +399,17 @@ def handle_credentials(action: str, svc, finalize, **kwargs) -> str:
                         "(Credentials UI or `c3 creds set --agent-readable`)."
                     )
                 else:
+                    # Empty/false arguments mean "not given": the entry keeps
+                    # its current settings rather than resetting to defaults.
                     entry = cs.set_credential(
                         name, value,
                         scope=scope,
                         project_path=project_path,
-                        description=kwargs.get("description") or "",
-                        ctype=kwargs.get("ctype") or "token",
-                        env_var=kwargs.get("env_var") or "",
-                        agent_readable=want_readable,
-                        inject=bool(kwargs.get("inject")),
+                        description=kwargs.get("description") or None,
+                        ctype=kwargs.get("ctype") or None,
+                        env_var=kwargs.get("env_var") or None,
+                        agent_readable=True if want_readable else None,
+                        inject=True if kwargs.get("inject") else None,
                     )
                     resp = (
                         f"[creds:set] {name} (scope={scope}, "

{code_context_control-2.143.0 → code_context_control-2.145.0}/cli/ui/components/credentials.js

@@ -753,6 +753,7 @@ const CredentialsPanel = () => {
                   {entry.name}
                 </span>
                 <Badge color={entry.scope === "global" ? T.accent : T.blue}>{entry.scope}</Badge>
+                {!!entry.value_missing && <Badge color={T.error}>value missing</Badge>}
                 <Badge color={T.textMuted}>{entry.type || "token"}</Badge>
                 {CREDS_STRUCTURED[entry.type] ? (
                   <span className="mono" style={{ color: T.text }}>

{code_context_control-2.143.0 → code_context_control-2.145.0}/code_context_control.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.143.0
+Version: 2.145.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -44,6 +44,7 @@ Requires-Dist: rich>=13.0.0
 Requires-Dist: click>=8.0.0
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: keyring>=24.0
+Requires-Dist: cryptography>=41.0
 Provides-Extra: vector
 Requires-Dist: scikit-learn>=1.3.0; extra == "vector"
 Requires-Dist: numpy>=1.24.0; extra == "vector"

{code_context_control-2.143.0 → code_context_control-2.145.0}/code_context_control.egg-info/SOURCES.txt

@@ -226,6 +226,7 @@ services/context_snapshot.py
 services/conversation_store.py
 services/cred_audit.py
 services/cred_telemetry.py
+services/credential_backup.py
 services/credential_store.py
 services/delegate_agents.py
 services/delegate_hints.py
@@ -362,6 +363,7 @@ tests/test_confirm_guard_wiring.py
 tests/test_cooccurrence_bounds.py
 tests/test_cred_audit.py
 tests/test_cred_telemetry.py
+tests/test_credential_backup.py
 tests/test_credential_login_kind.py
 tests/test_credential_store.py
 tests/test_credential_ui_parity.py

{code_context_control-2.143.0 → code_context_control-2.145.0}/code_context_control.egg-info/requires.txt

@@ -18,6 +18,7 @@ rich>=13.0.0
 click>=8.0.0
 pyyaml>=6.0.0
 keyring>=24.0
+cryptography>=41.0
 
 [dev]
 pytest>=7.0.0

{code_context_control-2.143.0 → code_context_control-2.145.0}/oracle/services/mobile_api.py

@@ -1571,26 +1571,18 @@ def mobile_credentials_set():
                 "needs_confirmation": True, "confirm_with": name,
             }), 400
 
+    meta = cred_store.payload_meta(data)
     try:
         if value:
+            # ctype stays explicit here: "keep the existing type" would let a
+            # phone write field JSON into a structured entry.
+            meta.pop("type", None)
             entry = cred_store.set_credential(
-                name, value, scope=scope, project_path=store_path, ctype=ctype,
-                description=str(data.get("description") or ""),
-                env_var=str(data.get("env_var") or ""),
-                agent_readable=wants_readable,
-                inject=bool(data.get("inject")))
+                name, value, scope=scope, project_path=store_path,
+                ctype=ctype, **meta)
         else:
-            fields = {}
-            for key in ("description", "env_var"):
-                if key in data:
-                    fields[key] = str(data[key] or "")
-            for key in ("agent_readable", "inject"):
-                if key in data:
-                    fields[key] = bool(data[key])
-            if "type" in data or "ctype" in data:
-                fields["type"] = ctype
             entry = cred_store.update_metadata(
-                name, scope=scope, project_path=store_path, **fields)
+                name, scope=scope, project_path=store_path, **meta)
     except cred_store.CredentialError as exc:
         return jsonify({"error": str(exc)}), 400
     except (ValueError, RuntimeError) as exc: