code-context-control 2.143.0__tar.gz → 2.145.1__tar.gz

{code_context_control-2.143.0 → code_context_control-2.145.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.143.0
+Version: 2.145.1
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -44,6 +44,7 @@ Requires-Dist: rich>=13.0.0
 Requires-Dist: click>=8.0.0
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: keyring>=24.0
+Requires-Dist: cryptography>=41.0
 Provides-Extra: vector
 Requires-Dist: scikit-learn>=1.3.0; extra == "vector"
 Requires-Dist: numpy>=1.24.0; extra == "vector"

{code_context_control-2.143.0 → code_context_control-2.145.1}/cli/c3.py

@@ -91,7 +91,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.143.0"
+__version__ = "2.145.1"
 
 # The PreToolUse matcher for native subagent calls (installer and hub migration).
 AGENT_MATCHER = "Agent|Task"
@@ -5063,7 +5063,7 @@ _GLOBAL_CLAUDE_MD_CONTENT = """\
 # C3 - Global Enforcement (applies to all projects with C3 installed)
 
 ## Tool Discipline
-When C3 MCP tools are available (c3_search, c3_read, c3_compress, c3_edit, c3_validate, etc.),
+When C3 MCP tools are available (c3_search, c3_read, c3_edit, c3_validate, etc.),
 you MUST use them instead of native tools (Read, Grep, Glob, Edit, Write).
 
 Native tools are blocked by PreToolUse hooks in C3 projects. Do NOT attempt them without
@@ -6371,7 +6371,7 @@ def cmd_creds(args):
     """Credential vault management (global + per-project scopes)."""
     sub = getattr(args, "creds_cmd", None)
     if not sub:
-        print("Usage: c3 creds {set,get,list,rm,import,usage,audit} [args]")
+        print("Usage: c3 creds {set,get,list,rm,import,usage,audit,backup} [args]")
         return
 
     project_path = getattr(args, "project_path", ".") or "."
@@ -6390,6 +6390,8 @@ def cmd_creds(args):
         _creds_cmd_usage(args, project_path)
     elif sub == "audit":
         _creds_cmd_audit(args, project_path)
+    elif sub == "backup":
+        _creds_cmd_backup(args, project_path)
     else:
         print(f"Unknown creds subcommand: {sub}")
 
@@ -6398,11 +6400,12 @@ def _creds_scope(args) -> str:
     return "global" if getattr(args, "use_global", False) else "project"
 
 
-def _creds_entry_line(name: str, entry: dict) -> str:
+def _creds_entry_line(name: str, entry: dict, missing: bool = False) -> str:
     flags = [f for f in ("inject", "agent_readable") if entry.get(f)]
+    size = "VALUE MISSING" if missing else f"len={entry.get('value_len', '?')}"
     parts = [
         f"{name:<24} {entry.get('scope', '?'):<8} {entry.get('type', 'token'):<10}"
-        f" len={entry.get('value_len', '?')}",
+        f" {size}",
     ]
     display = entry.get("display") or {}
     if display:
@@ -6465,13 +6468,15 @@ def _creds_cmd_set(args, project_path: str) -> None:
 
     from services import credential_store as cred_store
 
-    ctype = getattr(args, "ctype", "token") or "token"
+    ctype = getattr(args, "ctype", None)
+    prompt_type = ctype or cred_store.get_entry(
+        args.name, project_path=project_path).get("type", "token")
     value = getattr(args, "value", "") or ""
     if getattr(args, "stdin", False):
         value = sys.stdin.read().rstrip("\n")
     if not value:
-        if ctype in cred_store.STRUCTURED_TYPES:
-            value = _creds_prompt_structured(args.name, ctype)
+        if prompt_type in cred_store.STRUCTURED_TYPES:
+            value = _creds_prompt_structured(args.name, prompt_type)
             if value == "{}":
                 print("Cancelled -- no fields entered.")
                 return
@@ -6485,11 +6490,11 @@ def _creds_cmd_set(args, project_path: str) -> None:
         entry = cred_store.set_credential(
             args.name, value,
             scope=scope, project_path=project_path,
-            description=getattr(args, "desc", "") or "",
+            description=getattr(args, "desc", None),
             ctype=ctype,
-            env_var=getattr(args, "env_var", "") or "",
-            agent_readable=bool(getattr(args, "agent_readable", False)),
-            inject=bool(getattr(args, "inject", False)),
+            env_var=getattr(args, "env_var", None),
+            agent_readable=getattr(args, "agent_readable", None),
+            inject=getattr(args, "inject", None),
         )
     except (cred_store.CredentialError, RuntimeError) as exc:
         print(f"[error] {exc}")
@@ -6499,6 +6504,111 @@ def _creds_cmd_set(args, project_path: str) -> None:
     if entry["agent_readable"]:
         print("[warn] agent_readable=true -- the agent can read this value "
               "into its context and transcripts.")
+    _creds_print_backup_note(entry.get("backup", ""))
+
+
+def _creds_print_backup_note(backup: str) -> None:
+    if backup == "off":
+        print("[note] no vault backup: this value exists only in the OS keychain. "
+              "`c3 creds backup init` keeps a copy that survives a keychain wipe.")
+    elif backup.startswith("failed"):
+        print(f"[warn] the vault backup was not updated ({backup}); "
+              "run `c3 creds backup sync`.")
+
+
+def _creds_known_projects(project_path: str) -> list:
+    """The current project plus every project the hub knows about."""
+    from services.project_manager import ProjectManager
+    paths = [str(Path(project_path).resolve())]
+    paths += [str(p.get("path")) for p in ProjectManager().list_projects()
+              if p.get("path")]
+    return paths
+
+
+def _creds_read_passphrase(prompt: str, *, confirm: bool = False) -> str:
+    import getpass
+    first = getpass.getpass(prompt)
+    if confirm and getpass.getpass("Repeat it: ") != first:
+        print("[error] the passphrases did not match -- nothing changed.")
+        return ""
+    return first
+
+
+def _creds_cmd_backup(args, project_path: str) -> None:
+    from services import credential_backup as backup
+
+    action = args.backup_cmd
+    if action in ("init", "restore", "passphrase") and not sys.stdin.isatty():
+        print("[error] run this in your own terminal: the passphrase is read from "
+              "the keyboard, never from a pipe or an argument.")
+        return
+    try:
+        if action == "init":
+            print("Choose a passphrase for the vault backup. Without it the backup "
+                  "cannot be opened -- keep it in your password manager.")
+            passphrase = _creds_read_passphrase(
+                f"New passphrase (min {backup.MIN_PASSPHRASE} chars): ", confirm=True)
+            if not passphrase:
+                return
+            backup.init(passphrase)
+            done = backup.sync(_creds_known_projects(project_path))
+            print(f"[OK] Vault backup on: {backup.backup_path()} -- "
+                  f"{done['saved']} value(s) copied. Every value you set from now "
+                  "on is copied automatically.")
+            if done["missing"]:
+                print(f"  no value to copy (re-enter these): {', '.join(done['missing'])}")
+        elif action == "sync":
+            done = backup.sync(_creds_known_projects(project_path))
+            print(f"[OK] {done['saved']} value(s) copied to the vault backup.")
+            for label, names in (("no value to copy", done["missing"]),
+                                 ("failed", done["failed"])):
+                if names:
+                    print(f"  {label}: {', '.join(names)}")
+        elif action == "status":
+            st = backup.status(_creds_known_projects(project_path))
+            if st["enabled"]:
+                print(f"Vault backup: on ({st['path']}, created {st['created']}) -- "
+                      f"{st['backed_up']} value(s) held.")
+            else:
+                print("Vault backup: off -- values live only in the OS keychain. "
+                      "Turn it on with `c3 creds backup init`.")
+            for label, key in (("restorable (`c3 creds backup restore`)", "restorable"),
+                               ("lost, no copy (re-enter with `c3 creds set`)", "lost"),
+                               ("not backed up yet (`c3 creds backup sync`)", "not_backed_up")):
+                if st[key] and (st["enabled"] or key == "lost"):
+                    print(f"  {label}: {', '.join(st[key])}")
+        elif action == "restore":
+            passphrase = _creds_read_passphrase("Backup passphrase: ")
+            only = [n.strip() for n in (args.only or "").split(",") if n.strip()]
+            out = backup.restore(passphrase, only=only or None)
+            print(f"[OK] Restored {len(out['restored'])} value(s)"
+                  + (f": {', '.join(out['restored'])}" if out["restored"] else "."))
+            for label, key in (("still in the keychain, left alone", "present"),
+                               ("entry or project gone, skipped", "orphaned"),
+                               ("failed", "failed")):
+                if out[key]:
+                    print(f"  {label}: {', '.join(out[key])}")
+            if out["restored"]:
+                _creds_log_restore(out["restored"])
+        else:  # passphrase
+            old = _creds_read_passphrase("Current passphrase: ")
+            new = _creds_read_passphrase(
+                f"New passphrase (min {backup.MIN_PASSPHRASE} chars): ", confirm=True)
+            if old and new:
+                backup.change_passphrase(old, new)
+                print("[OK] Backup passphrase changed.")
+    except backup.BackupError as exc:
+        print(f"[error] {exc}")
+
+
+def _creds_log_restore(names: list) -> None:
+    """Names only, to the global activity log that `c3 creds audit` reads."""
+    from services import credential_store as cred_store
+    from services.activity_log import ActivityLog
+    home = cred_store.global_base()
+    if home is not None:
+        ActivityLog(str(home)).log("cred_action", {
+            "kind": "creds", "action": "restore", "names": names, "via": "cli"})
 
 
 def _creds_count_show(refs, project_path: str) -> None:
@@ -6575,8 +6685,17 @@ def _creds_cmd_list(args, project_path: str) -> None:
               "(add --global for all projects).")
         return
     print(f"{len(entries)} credential(s) — project scope shadows global:")
+    missing = 0
     for name, entry in entries.items():
-        print("  " + _creds_entry_line(name, entry))
+        gone = not cred_store.is_resolvable(
+            name, project_path=project_path, scope=entry["scope"])
+        missing += gone
+        print("  " + _creds_entry_line(name, entry, gone))
+    if missing:
+        print(f"\n{missing} entr{'y has' if missing == 1 else 'ies have'} no stored "
+              "value (the OS keychain no longer holds it). Re-enter with "
+              "`c3 creds set NAME` (add --global for global entries); the "
+              "entry keeps its env var, description and flags.")
 
 
 def _creds_cmd_rm(args, project_path: str) -> None:

{code_context_control-2.143.0 → code_context_control-2.145.1}/cli/commands/parser.py

@@ -520,16 +520,21 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_set.add_argument("name", help="Entry name (env-var safe: [A-Za-z_][A-Za-z0-9_]*)")
     cr_set.add_argument("--value", default="", help="Secret value (prompted via getpass if omitted — preferred). Structured types take a JSON object of fields")
     cr_set.add_argument("--stdin", action="store_true", help="Read the value from stdin (piped/multiline values)")
+    # Every metadata option defaults to None = keep what an existing entry
+    # has, so re-entering a value does not reset its settings.
     cr_set.add_argument("--type", dest="ctype",
                         choices=["token", "env", "multiline",
                                  "address", "identity", "card", "login"],
-                        default="token",
-                        help="Entry type; address/identity/card/login are structured "
+                        default=None,
+                        help="Entry type (default: keep the entry's type; token for a new one); "
+                             "address/identity/card/login are structured "
                              "(field payload, inject-only, never revealable to the agent)")
-    cr_set.add_argument("--desc", default="", help="Human description shown in list/UI")
-    cr_set.add_argument("--env-var", default="", help="Env var name used at injection (default: entry name)")
-    cr_set.add_argument("--agent-readable", action="store_true", help="Allow the agent to reveal the decoded value into its context (default: injection-only)")
-    cr_set.add_argument("--inject", action="store_true", help="Auto-inject into every c3_shell run")
+    cr_set.add_argument("--desc", default=None, help="Human description shown in list/UI (default: keep)")
+    cr_set.add_argument("--env-var", default=None, help="Env var name used at injection (default: keep; entry name for a new one)")
+    cr_set.add_argument("--agent-readable", action=argparse.BooleanOptionalAction, default=None,
+                        help="Allow the agent to reveal the decoded value into its context (default: keep; injection-only for a new one)")
+    cr_set.add_argument("--inject", action=argparse.BooleanOptionalAction, default=None,
+                        help="Auto-inject into every c3_shell run (default: keep; off for a new one)")
     cr_set.add_argument("--global", dest="use_global", action="store_true", help="Store in the global scope (~/.c3) so every C3 project can use it")
     # --path (not a trailing positional): a second positional after options
     # breaks argparse on py<3.12 ("unrecognized arguments").
@@ -578,6 +583,16 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_audit.add_argument("--json", dest="as_json", action="store_true", help="Emit raw JSON")
     cr_audit.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    cr_backup = creds_subs.add_parser(
+        "backup", help="Passphrase-locked copy of every value that survives an OS keychain wipe")
+    cr_backup.add_argument(
+        "backup_cmd", choices=["init", "status", "sync", "restore", "passphrase"],
+        help="init: turn it on (asks for a passphrase) · status · sync: copy every live "
+             "value now · restore: put lost values back (asks for the passphrase) · "
+             "passphrase: change it")
+    cr_backup.add_argument("--only", default="", help="restore: comma-separated names (default: all lost values)")
+    cr_backup.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
     # ── Agent Locks (docs/agent-locks.md) ───────────────────────────────
     # force-release is human-only: it bumps the fencing counter so a holder
     # that comes back is stale by construction. Agents get c3_locks instead,