code-context-control 2.145.2__py3-none-any.whl → 2.149.1__py3-none-any.whl

cli/c3.py

@@ -91,7 +91,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.145.2"
+__version__ = "2.149.1"
 
 # The PreToolUse matcher for native subagent calls (installer and hub migration).
 AGENT_MATCHER = "Agent|Task"
@@ -6685,10 +6685,10 @@ def _creds_cmd_list(args, project_path: str) -> None:
               "(add --global for all projects).")
         return
     print(f"{len(entries)} credential(s) — project scope shadows global:")
+    present = cred_store.presence_for(entries, project_path)
     missing = 0
     for name, entry in entries.items():
-        gone = not cred_store.is_resolvable(
-            name, project_path=project_path, scope=entry["scope"])
+        gone = not present[name]
         missing += gone
         print("  " + _creds_entry_line(name, entry, gone))
     if missing:

cli/hook_access_guard.py

@@ -447,6 +447,7 @@ def run(payload: dict, project_path: Path | None = None,
     tool_input = payload.get("tool_input", {}) or {}
     base = str(project_path if project_path is not None else Path.cwd())
     session_id = str(payload.get("session_id") or "")
+    ag.bind_session(session_id)
 
     if tool in _WRITE_TOOLS or tool in _READ_TOOLS:
         fp = _target(tool_input)

cli/hub_server.py

@@ -72,6 +72,10 @@ _HUB_CONFIG_DEFAULTS = {
     "projects_view": "list",
     "main_view": "projects",
     "oracle_url": "",
+    # Per-IDE launch command overrides, e.g. {"claude-code": "yep"} when the
+    # agent is started through a wrapper script instead of the stock binary.
+    # A project's own `ide_cmd` (projects.json) wins over this.
+    "ide_cmds": {},
     # Minutes of project silence, with no session heartbeat left, before a UI
     # server that an IDE session launched is stopped. 0 = never reap.
     "ui_reap_minutes": 30,
@@ -81,6 +85,48 @@ _HUB_CONFIG_DEFAULTS = {
 _MAIN_VIEWS = {"projects", "board", "ci", "creds", "tokens", "locks", "access",
                "enforce", "sessions"}
 
+# Stock command per IDE id, and whether it takes the project path as an
+# argument (GUI) instead of being run inside a terminal at that path.
+_IDE_DEFAULT_CMDS = {
+    "claude-code":  ("claude",      False),
+    "claude-app":   ("claude-app",  True),
+    "codex":        ("codex",       False),
+    "grok":         ("grok",        False),
+    "gemini":       ("gemini",      False),
+    "antigravity":  ("antigravity", False),
+    "vscode":       ("code",        True),
+    "cursor":       ("cursor",      True),
+}
+
+
+def _resolve_ide_cmd(ide: str, path: str, custom_cmd: str = "") -> tuple:
+    """Resolve the command to launch for `ide` in `path`.
+
+    Precedence: explicit custom_cmd (this launch) → the project's stored
+    `ide_cmd` → hub config `ide_cmds[ide]` → the stock command.
+    Returns (cmd, is_gui, error) — error is a message when nothing resolves.
+    """
+    default_cmd, is_gui = _IDE_DEFAULT_CMDS.get(ide, ("", False))
+    if ide != "custom" and not default_cmd:
+        return "", False, f"Unknown IDE: {ide}"
+    cmd = (custom_cmd or "").strip()
+    if not cmd:
+        try:
+            cmd = _pm().get_ide_cmd(path)
+        except Exception:
+            cmd = ""
+    if not cmd:
+        overrides = _read_hub_config().get("ide_cmds") or {}
+        if isinstance(overrides, dict):
+            cmd = str(overrides.get(ide) or "").strip()
+    if not cmd:
+        cmd = default_cmd
+    if not cmd:
+        return "", False, "custom_cmd is required for custom IDE"
+    # An overridden command replaces the binary, not the launch style: a
+    # wrapper for a terminal CLI is still a terminal CLI.
+    return cmd, is_gui, ""
+
 # How often the hub reaps orphaned UI servers and chases autostart projects.
 _UI_SWEEP_INTERVAL_S = 60
 
@@ -460,6 +506,15 @@ def api_hub_config_set():
         cfg["main_view"] = main_view
     if "oracle_url" in data:
         cfg["oracle_url"] = str(data["oracle_url"]).strip()
+    if "ide_cmds" in data:
+        raw = data["ide_cmds"]
+        if not isinstance(raw, dict):
+            return jsonify({"error": "ide_cmds must be an object"}), 400
+        # Empty string = "back to the stock command", so the key is dropped
+        # rather than stored blank.
+        cfg["ide_cmds"] = {
+            str(k): str(v).strip() for k, v in raw.items() if str(v or "").strip()
+        }
     if "sidebar_group" in data:
         cfg["sidebar_group"] = str(data["sidebar_group"]).strip()
     if "sidebar_collapsed" in data:
@@ -718,17 +773,11 @@ def api_projects_open():
 
 @app.route("/api/projects/launch-ide", methods=["POST"])
 def api_launch_ide():
-    """Launch an IDE or CLI tool in the project directory. Body: {path, ide, custom_cmd?}"""
-    _IDE_CMDS = {
-        "claude-code":  ("claude",      False),
-        "claude-app":   ("claude-app",  True),
-        "codex":        ("codex",       False),
-        "grok":         ("grok",        False),
-        "gemini":       ("gemini",      False),
-        "antigravity":  ("antigravity", False),
-        "vscode":       ("code",        True),
-        "cursor":       ("cursor",      True),
-    }
+    """Launch an IDE or CLI tool in the project directory. Body: {path, ide, custom_cmd?}
+
+    The command itself is resolved by _resolve_ide_cmd, so a project or the
+    hub can point `claude-code` at a wrapper such as `yep`.
+    """
     try:
         data = request.get_json(force=True) or {}
         path_str   = (data.get("path")       or "").strip()
@@ -744,14 +793,9 @@ def api_launch_ide():
         if not path.exists():
             return jsonify({"error": f"Path does not exist: {path_str}"}), 404
 
-        if ide == "custom":
-            if not custom_cmd:
-                return jsonify({"error": "custom_cmd is required for custom IDE"}), 400
-            cmd, is_gui = custom_cmd, False
-        elif ide in _IDE_CMDS:
-            cmd, is_gui = _IDE_CMDS[ide]
-        else:
-            return jsonify({"error": f"Unknown IDE: {ide}"}), 400
+        cmd, is_gui, err = _resolve_ide_cmd(ide, str(path), custom_cmd)
+        if err:
+            return jsonify({"error": err}), 400
 
         if is_gui:
             # GUI IDEs (VS Code, Cursor) accept a path argument directly
@@ -795,7 +839,7 @@ def api_launch_ide():
 
 @app.route("/api/projects/update", methods=["POST"])
 def api_projects_update():
-    """Update editable project fields (name, tags, notes). Body: {path, name?, tags?, notes?}"""
+    """Update editable project fields. Body: {path, name?, tags?, notes?, ide_cmd?}"""
     data = request.get_json(force=True) or {}
     path = (data.get("path") or "").strip()
     if not path:
@@ -812,6 +856,9 @@ def api_projects_update():
             fields["tags"] = [t.strip() for t in str(raw).split(",") if t.strip()]
     if "notes" in data:
         fields["notes"] = str(data["notes"])
+    if "ide_cmd" in data:
+        # Blank clears the override and falls back to the stock command.
+        fields["ide_cmd"] = str(data["ide_cmd"] or "").strip()
     try:
         ok = _pm().update_project(path, **fields)
         return jsonify({"updated": ok})
@@ -1804,7 +1851,7 @@ def api_projects_browse():
         return jsonify({"error": str(e)}), 400
     if not resolved.is_dir():
         return jsonify({"error": f"Not a directory: {resolved}"}), 404
-    registered = {os.path.normcase(p.get("path", "")) for p in _pm()._read_projects()}
+    registered = {os.path.normcase(p.get("path", "")) for p in _pm().list_registered()}
     dirs = []
     try:
         for child in sorted(resolved.iterdir(), key=lambda c: c.name.lower()):
@@ -1913,7 +1960,7 @@ def api_search_global():
                    if wanted else None)
 
     candidates, skipped = [], []
-    for p in _pm().list_projects():
+    for p in _pm().list_registered():
         ppath = p.get("path") or ""
         if wanted_norm is not None and os.path.normcase(ppath) not in wanted_norm:
             continue
@@ -2138,14 +2185,15 @@ def api_projects_credentials():
     usage = cred_store.read_usage_state(str(resolved))
     home = cred_store.global_base()
     global_names = set(cred_store.list_entries(str(home))) if home else set()
+    listed = cred_store.list_entries(str(resolved))
+    present = cred_store.presence_for(listed, str(resolved))
     entries = []
-    for name, entry in cred_store.list_entries(str(resolved)).items():
+    for name, entry in listed.items():
         entries.append(_cred_entry_public(
             name, entry, usage=usage,
             shadows_global=(entry.get("scope") == "project"
                             and name in global_names),
-            value_ok=cred_store.is_resolvable(
-                name, project_path=str(resolved), scope=entry["scope"])))
+            value_ok=present[name]))
     return jsonify({"path": str(resolved), "entries": entries})
 
 
@@ -2360,7 +2408,7 @@ def api_hub_credentials_audit():
     only_global = (request.args.get("scope") or "").strip().lower() == "global"
 
     events, errors = [], []
-    for p in ([] if only_global else _pm().list_projects()):
+    for p in ([] if only_global else _pm().list_registered()):
         ppath = str(p.get("path") or "")
         if not (Path(ppath) / ".c3").is_dir():
             continue
@@ -2417,9 +2465,12 @@ def api_hub_credentials_overview():
     from services import credential_store as cred_store
     home = cred_store.global_base()
     global_entries = cred_store.list_entries(str(home)) if home else {}
+    # realm -> {name: value decodes}, probed once per vault and shared with
+    # the backup banner, which asks the same question of the same entries.
+    present = {"global": cred_store.value_presence("global", str(home))} if home else {}
     shadowed_in = {name: [] for name in global_entries}
     projects_out = []
-    for p in _pm().list_projects():
+    for p in _pm().list_registered():
         ppath = str(p.get("path") or "")
         row = {"name": p.get("name") or "", "path": ppath,
                "initialized": True, "error": None, "entries": []}
@@ -2428,14 +2479,15 @@ def api_hub_credentials_overview():
                 row["initialized"] = False
             else:
                 usage = cred_store.read_usage_state(ppath)
+                ok = cred_store.value_presence("project", ppath)
+                present[cred_store.realm("project", ppath)] = ok
                 for name, entry in cred_store.list_entries(ppath).items():
                     if entry.get("scope") != "project":
                         continue
                     row["entries"].append(_cred_entry_public(
                         name, entry, usage=usage,
                         shadows_global=name in global_entries,
-                        value_ok=cred_store.is_resolvable(
-                            name, project_path=ppath, scope="project")))
+                        value_ok=ok.get(name, False)))
                     if name in shadowed_in:
                         shadowed_in[name].append(
                             {"name": row["name"], "path": ppath})
@@ -2446,21 +2498,21 @@ def api_hub_credentials_overview():
     global_out = [
         {**_cred_entry_public(
             name, entry, usage=global_usage,
-            value_ok=cred_store.is_resolvable(
-                name, project_path=str(home), scope="global")),
+            value_ok=present.get("global", {}).get(name, False)),
          "shadowed_in": shadowed_in.get(name, [])}
         for name, entry in global_entries.items()
     ]
     return jsonify({"global": {"entries": global_out}, "projects": projects_out,
                     "backup": _cred_backup_summary(
-                        [row["path"] for row in projects_out if row["initialized"]])})
+                        [row["path"] for row in projects_out if row["initialized"]],
+                        present)})
 
 
-def _cred_backup_summary(project_paths) -> dict:
+def _cred_backup_summary(project_paths, present) -> dict:
     """Backup state as counts for the Hub banner; a broken file reports its error."""
     from services import credential_backup
     try:
-        st = credential_backup.status(project_paths)
+        st = credential_backup.status(project_paths, presence=present)
     except credential_backup.BackupError as exc:
         return {"enabled": True, "error": str(exc), "restorable": 0, "lost": 0}
     return {"enabled": st["enabled"], "restorable": len(st["restorable"]),
@@ -2612,7 +2664,7 @@ def api_hub_tokens_overview():
     days = _hub_tokens_days(request.args.get("days"))
     rows, totals = [], {"tool_calls": 0, "tool_tokens": 0,
                         "session_tokens": 0, "saved": 0}
-    for p in _pm().list_projects():
+    for p in _pm().list_registered():
         ppath = str(p.get("path") or "")
         row = {"name": p.get("name") or "", "path": ppath, "initialized": True,
                "error": None, "tool_calls": 0, "tool_tokens": 0,
@@ -2662,7 +2714,7 @@ def api_hub_locks_overview():
     from services import agent_locks as al
 
     rows, total = [], 0
-    for p in _pm().list_projects():
+    for p in _pm().list_registered():
         ppath = str(p.get("path") or "")
         row = {"name": p.get("name") or "", "path": ppath, "initialized": True,
                "error": None, "enabled": True, "mode": "advisory",
@@ -2752,7 +2804,7 @@ def api_hub_enforcement_overview():
 
     rows = []
     totals = {"discipline": 0, "access": 0}
-    for p in _pm().list_projects():
+    for p in _pm().list_registered():
         ppath = str(p.get("path") or "")
         row = {"name": p.get("name") or "", "path": ppath, "initialized": True,
                "error": None, "mode": None, "scope": "", "set_by": "",
@@ -3428,7 +3480,7 @@ def api_hub_override_policy_overview():
     from services import override_policy as opol
 
     rows = []
-    for p in _pm().list_projects():
+    for p in _pm().list_registered():
         ppath = str(p.get("path") or "")
         row = {"name": p.get("name") or Path(ppath).name, "path": ppath,
                "initialized": True, "error": None, "policy": None,
@@ -3740,7 +3792,7 @@ def api_hub_access_overview():
     empty = {"deny": [], "read_only": [], "confirm": [], "mask": 0,
              "corrupt": False}
     rows = []
-    for p in _pm().list_projects():
+    for p in _pm().list_registered():
         ppath = str(p.get("path") or "")
         row = {"name": p.get("name") or Path(ppath).name, "path": ppath,
                "initialized": True, "error": None, "rules": dict(empty)}
@@ -3834,6 +3886,170 @@ def api_hub_access_rule_remove():
     return jsonify(result)
 
 
+# ── Builtin guard modes (v2.147.0) ─────────────────────────────────────────
+
+def _hub_human():
+    """The Desk client behind ``Authorization: Bearer``, else ``None``.
+
+    Loopback and the CSRF guard stop a browser, not a process on this
+    machine: an agent can POST here as easily as a person. A Desk client
+    token is minted only with ``bootstrap.key``, which Access Guard denies
+    to agents, and is stored as a hash, so presenting one is the proof a
+    loosening builtin change needs. A phone token does not count: builtin
+    guards are not loosened from a device that leaves the building.
+    """
+    from oracle.services import client_tokens
+    scheme, _, token = (request.headers.get("Authorization") or "").partition(" ")
+    if scheme.lower() != "bearer" or not token.strip():
+        return None
+    who = client_tokens.principal_for(token.strip())
+    return who if who and who.get("kind") == "desk" else None
+
+
+@app.route("/api/hub/access/builtin", methods=["GET"])
+def api_hub_access_builtin():
+    """Every Tier-1 builtin with its live global mode, and each project's own.
+
+    Modes are read through the keyring (config and attestation must agree),
+    so a mode listed here is one evaluation honours. ``projects`` holds only
+    projects that set a mode of their own, or could not be read.
+    ``strictness`` ranks each mode 0 (allow) to 3 (full deny), so a client
+    can tell loosening from tightening without knowing the tiers.
+    """
+    try:
+        global_modes = access_guard._scope_modes("global")
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+    home = access_guard._global_base()
+    guards = []
+    for glob in access_guard.DISABLEABLE_BUILTINS:
+        canon = access_guard._norm_builtin(glob)
+        guards.append({
+            "glob": canon,
+            "global": global_modes.get(canon, "default"),
+            "strictness": {m: access_guard.builtin_strictness(canon, m)
+                           for m in (*access_guard.BUILTIN_MODES, "default")},
+        })
+    projects = []
+    for p in _pm().list_registered():
+        ppath = str(p.get("path") or "")
+        row = {"name": p.get("name") or Path(ppath).name, "path": ppath,
+               "modes": {}, "error": None}
+        try:
+            base = Path(ppath).resolve()
+            if (base / ".c3").is_dir() and base != home:
+                row["modes"] = access_guard._scope_modes("project", ppath)
+        except Exception as e:
+            row["error"] = str(e)
+        if row["modes"] or row["error"]:
+            projects.append(row)
+    from services import builtin_leases
+    return jsonify({"guards": guards, "projects": projects,
+                    "leases": builtin_leases.active()})
+
+
+@app.route("/api/hub/access/builtin/mode", methods=["POST"])
+def api_hub_access_builtin_mode():
+    """Set a Tier-1 builtin's mode in the global realm or one project's.
+
+    Body: ``{scope, path?, glob, mode, confirm?}``. A mode at least as strict
+    as the live one needs nothing more. A looser one needs a Desk client
+    token (403 ``needs_human`` without it) and ``confirm`` equal to the glob
+    (400 ``needs_confirmation``). A project is judged against what its
+    agents see today, which is the global mode unless it set its own.
+    """
+    data = request.get_json(silent=True) or {}
+    scope, project, err = _hub_access_target(data)
+    if err:
+        return err
+    glob = str(data.get("glob") or "")
+    mode = str(data.get("mode") or "").strip()
+    canon = access_guard._norm_builtin(glob)
+    try:
+        new = access_guard.builtin_strictness(canon, mode)
+        live = (access_guard._scope_modes("global") if scope == "global"
+                else access_guard.effective_builtin_modes(project))
+        old = access_guard.builtin_strictness(canon, live.get(canon, "default"))
+    except ValueError as exc:
+        return jsonify({"error": str(exc)}), 400
+    if new < old:
+        if _hub_human() is None:
+            return jsonify({
+                "error": "loosening a built-in guard needs C3 Desk",
+                "needs_human": True,
+                "command": f'c3 access builtin mode "{canon}" {mode}'
+                           + (f' --project --path "{project}"'
+                              if scope == "project" else ""),
+            }), 403
+        if access_guard._norm_builtin(data.get("confirm")) != canon:
+            return jsonify({
+                "error": "loosening a built-in guard weakens protection",
+                "needs_confirmation": True, "confirm_with": canon,
+            }), 400
+    try:
+        result = access_guard.set_builtin_mode(canon, mode, scope,
+                                               project or ".")
+    except ValueError as exc:
+        return jsonify({"error": str(exc)}), 400
+    if result["changed"]:
+        _hub_access_audit(f"builtin_mode_{result['mode']}", result["glob"],
+                          "builtin", scope, project)
+    return jsonify({**result, "loosened": new < old})
+
+
+@app.route("/api/hub/access/builtin/lease", methods=["POST"])
+def api_hub_access_builtin_lease():
+    """Loosen a builtin for a while: every session, or one.
+
+    Body: ``{scope, path?, glob, mode, ttl_s, session_id?, confirm}``. A
+    lease only ever loosens, so it always needs a Desk client token and the
+    glob typed back, and a lease no looser than the live mode is a 400
+    rather than a row that would never apply. ``ttl_s`` is 60 s to 8 h.
+    """
+    from services import builtin_leases
+    data = request.get_json(silent=True) or {}
+    scope, project, err = _hub_access_target(data)
+    if err:
+        return err
+    who = _hub_human()
+    if who is None:
+        return jsonify({"error": "a temporary built-in change needs C3 Desk",
+                        "needs_human": True}), 403
+    canon = access_guard._norm_builtin(data.get("glob"))
+    mode = str(data.get("mode") or "").strip()
+    if access_guard._norm_builtin(data.get("confirm")) != canon or not canon:
+        return jsonify({"error": "a temporary change weakens protection",
+                        "needs_confirmation": True, "confirm_with": canon}), 400
+    try:
+        live = access_guard.effective_builtin_modes(project or ".") \
+            if scope == "project" else access_guard._scope_modes("global")
+        if access_guard.builtin_strictness(canon, mode) >= \
+                access_guard.builtin_strictness(canon, live.get(canon, "default")):
+            return jsonify({"error": f"{canon} is already {live.get(canon, 'default')}"
+                            f" — a {mode} lease would change nothing"}), 400
+        row = builtin_leases.mint(
+            canon, mode, scope=scope, project_path=project or ".",
+            session_id=str(data.get("session_id") or ""),
+            ttl_s=data.get("ttl_s"), created_by=who["client_id"])
+    except ValueError as exc:
+        return jsonify({"error": str(exc)}), 400
+    _hub_access_audit(f"builtin_lease_{mode}", canon, "builtin", scope, project)
+    return jsonify({"lease": row})
+
+
+@app.route("/api/hub/access/builtin/lease/revoke", methods=["POST"])
+def api_hub_access_builtin_lease_revoke():
+    """End a lease now. Tightening, so no token. Body: ``{id}``."""
+    from services import builtin_leases
+    lease_id = str((request.get_json(silent=True) or {}).get("id") or "")
+    gone = builtin_leases.revoke(lease_id) if lease_id else None
+    if gone is None:
+        return jsonify({"error": "unknown or already-expired lease"}), 404
+    _hub_access_audit("builtin_lease_revoke", gone["glob"], "builtin",
+                      gone["scope"], gone.get("project_path") or None)
+    return jsonify({"revoked": lease_id})
+
+
 # ── Project management: tasks / milestones / notes (v2.45.0) ──────────────
 # Direct TaskStore per request (reload-per-op store — no runtime build needed
 # for mutations); every write audited to the target project's activity log.
@@ -4268,7 +4484,7 @@ def api_pm_global():
     from services.task_store import TaskStore
 
     tasks, skipped, by_project = [], [], {}
-    entries = _pm()._read_projects()
+    entries = _pm().list_registered()
     for p in entries:
         ppath = p.get("path") or ""
         if not Path(ppath).is_dir():
@@ -4808,7 +5024,7 @@ def _session_project(raw: str):
     if not raw:
         return None
     want = os.path.normcase(os.path.normpath(raw))
-    for p in _pm().list_projects():
+    for p in _pm().list_registered():
         path = str(p.get("path") or "")
         if path and os.path.normcase(os.path.normpath(path)) == want:
             return {"name": str(p.get("name") or Path(path).name), "path": path}
@@ -4847,7 +5063,7 @@ def api_hub_sessions_overview():
         return row
 
     with ThreadPoolExecutor(max_workers=8) as pool:
-        rows = list(pool.map(one, _pm().list_projects()))
+        rows = list(pool.map(one, _pm().list_registered()))
     rows.sort(key=lambda r: r.get("last_active") or "", reverse=True)
     return jsonify({"projects": rows, "features": _SESSIONS_FEATURES})
 
@@ -4876,7 +5092,7 @@ def api_hub_sessions_list():
             res["errors"] = []
         else:
             projects = [{"name": str(p.get("name") or ""), "path": str(p.get("path") or "")}
-                        for p in _pm().list_projects()]
+                        for p in _pm().list_registered()]
             res = sc.list_many(projects, stale=stale, q=q, limit=limit, before=before)
         return jsonify(res)
     except Exception as e:

cli/hub_ui/app.js

@@ -50,7 +50,10 @@ function App() {
   }, []);
 
   useEffect(() => { loadConfig(); loadProjects(); }, []);
-  usePoll(loadProjects, 5000);
+  // Live status matters on the project list and in a drill-in. Elsewhere it
+  // only refreshes the sidebar and top-bar counts, which may lag 30 s, and
+  // each poll reads every project's activity log.
+  usePoll(loadProjects, mainView === 'projects' || drill ? 5000 : 30000);
 
   // Persisted preferences
   const toggleTheme = () => {