code-context-control 2.57.1__tar.gz → 2.58.0__tar.gz

{code_context_control-2.57.1/code_context_control.egg-info → code_context_control-2.58.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.57.1
+Version: 2.58.0
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Copilot, Cursor, Antigravity). Retrieve less, read less, edit safer — version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP), and manage multi-project + sub-project hierarchies from a local hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -283,6 +283,7 @@ C3 exposes 18 tools as a native MCP server. Your IDE calls them directly:
 | `c3_edits` | Edit-ledger queries + version diffs + restore points + per-branch filter |
 | `c3_bitbucket` | Bitbucket Data Center integration — PRs, branches, builds, repo admin (v2.30.0) |
 | `c3_jira` | Jira integration — Cloud + Data Center: JQL search, issues, transitions, My Work board (v2.56.0) |
+| `c3_credentials` | Credential vault — named secrets (global + per-project), injection-first: agents use them by name, values never enter model context (v2.58.0) |
 | `c3_project` | Cross-project — discover & operate on other c3-installed projects; guarded writes (v2.31.0) |
 | `c3_task` | Durable per-project PM — tasks with dependencies & subtasks, milestones, decision notes, event history, health reports, and auto+manual time tracking (v2.53.0) |
 | `c3_artifacts` | Agent-config tracking — version history, diff & restore for CLAUDE.md, settings/hooks, MCP configs, skills (v2.46.0) |
@@ -291,7 +292,7 @@ On Windows, `c3_shell` uses Git Bash when available. Git Bash does not bundle
 optional utilities such as `jq`; use `python -m json.tool` for portable JSON
 formatting, or install `jq` separately when filter expressions are required.
 
-Every tool is **read-only safe in plan mode** (except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, and write actions on `c3_bitbucket` / `c3_jira` / `c3_project` / `c3_task`).
+Every tool is **read-only safe in plan mode** (except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task`).
 
 ### Bitbucket Data Center / Server (v2.30.0)
 
@@ -319,6 +320,44 @@ it has no active account C3 falls back to the global `~/.c3/config.json`. So a
 single `login --global` (or any login done from your home directory) is reusable
 across every C3 project — the PAT always lives in the OS keyring, never on disk.
 
+### Credential vault (v2.58.0)
+
+`c3_credentials` gives agents a protected, user-managed place for API keys,
+tokens, and `.env`-style values — **global** (`~/.c3`, every project) or
+**per-project** (`.c3`, shadows the global name). Values live in the **OS
+keyring** (large values in a Fernet-encrypted `.c3/secrets.enc` whose master
+key lives in the keyring) — never in config files, and *never in the model's
+context*: the agent addresses secrets by name and C3 decodes them only at the
+subprocess boundary.
+
+```bash
+# Store a secret for this project (value prompted, masked)
+c3 creds set OPENAI_KEY --desc "OpenAI billing key"
+
+# ...or globally for every C3 project
+c3 creds set NPM_TOKEN --global
+
+# Bulk-import an existing .env; list what the agent can see
+c3 creds import .env
+c3 creds list
+```
+
+The agent then runs commands *with* the secret but without ever seeing it:
+
+```
+c3_shell(cmd='npm publish', env_creds='NPM_TOKEN')       # injected as env var
+c3_shell(cmd='curl -H "Authorization: Bearer {{cred:OPENAI_KEY}}" …')  # expanded server-side
+```
+
+Echoed values are auto-redacted from output (`env` dumps come back as
+`[cred:NAME]`), every use is ledger-logged by name, and `reveal` — the only
+action that returns a value — is disabled per entry until you flip
+`agent_readable` in the **Credentials UI tab** or via
+`c3 creds set NAME --agent-readable`. A hostile repo config can't siphon your
+global secrets (realm-atomic resolution, tested), cross-project shells run
+with credentials disabled, and the vault is hard-excluded from the Oracle
+Discovery API.
+
 ### Jira — Cloud + Data Center (v2.56.0)
 
 `c3_jira` connects to Jira Cloud (REST v3, email + API token) or self-hosted

{code_context_control-2.57.1 → code_context_control-2.58.0}/README.md

@@ -220,6 +220,7 @@ C3 exposes 18 tools as a native MCP server. Your IDE calls them directly:
 | `c3_edits` | Edit-ledger queries + version diffs + restore points + per-branch filter |
 | `c3_bitbucket` | Bitbucket Data Center integration — PRs, branches, builds, repo admin (v2.30.0) |
 | `c3_jira` | Jira integration — Cloud + Data Center: JQL search, issues, transitions, My Work board (v2.56.0) |
+| `c3_credentials` | Credential vault — named secrets (global + per-project), injection-first: agents use them by name, values never enter model context (v2.58.0) |
 | `c3_project` | Cross-project — discover & operate on other c3-installed projects; guarded writes (v2.31.0) |
 | `c3_task` | Durable per-project PM — tasks with dependencies & subtasks, milestones, decision notes, event history, health reports, and auto+manual time tracking (v2.53.0) |
 | `c3_artifacts` | Agent-config tracking — version history, diff & restore for CLAUDE.md, settings/hooks, MCP configs, skills (v2.46.0) |
@@ -228,7 +229,7 @@ On Windows, `c3_shell` uses Git Bash when available. Git Bash does not bundle
 optional utilities such as `jq`; use `python -m json.tool` for portable JSON
 formatting, or install `jq` separately when filter expressions are required.
 
-Every tool is **read-only safe in plan mode** (except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, and write actions on `c3_bitbucket` / `c3_jira` / `c3_project` / `c3_task`).
+Every tool is **read-only safe in plan mode** (except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task`).
 
 ### Bitbucket Data Center / Server (v2.30.0)
 
@@ -256,6 +257,44 @@ it has no active account C3 falls back to the global `~/.c3/config.json`. So a
 single `login --global` (or any login done from your home directory) is reusable
 across every C3 project — the PAT always lives in the OS keyring, never on disk.
 
+### Credential vault (v2.58.0)
+
+`c3_credentials` gives agents a protected, user-managed place for API keys,
+tokens, and `.env`-style values — **global** (`~/.c3`, every project) or
+**per-project** (`.c3`, shadows the global name). Values live in the **OS
+keyring** (large values in a Fernet-encrypted `.c3/secrets.enc` whose master
+key lives in the keyring) — never in config files, and *never in the model's
+context*: the agent addresses secrets by name and C3 decodes them only at the
+subprocess boundary.
+
+```bash
+# Store a secret for this project (value prompted, masked)
+c3 creds set OPENAI_KEY --desc "OpenAI billing key"
+
+# ...or globally for every C3 project
+c3 creds set NPM_TOKEN --global
+
+# Bulk-import an existing .env; list what the agent can see
+c3 creds import .env
+c3 creds list
+```
+
+The agent then runs commands *with* the secret but without ever seeing it:
+
+```
+c3_shell(cmd='npm publish', env_creds='NPM_TOKEN')       # injected as env var
+c3_shell(cmd='curl -H "Authorization: Bearer {{cred:OPENAI_KEY}}" …')  # expanded server-side
+```
+
+Echoed values are auto-redacted from output (`env` dumps come back as
+`[cred:NAME]`), every use is ledger-logged by name, and `reveal` — the only
+action that returns a value — is disabled per entry until you flip
+`agent_readable` in the **Credentials UI tab** or via
+`c3 creds set NAME --agent-readable`. A hostile repo config can't siphon your
+global secrets (realm-atomic resolution, tested), cross-project shells run
+with credentials disabled, and the vault is hard-excluded from the Oracle
+Discovery API.
+
 ### Jira — Cloud + Data Center (v2.56.0)
 
 `c3_jira` connects to Jira Cloud (REST v3, email + API token) or self-hosted

{code_context_control-2.57.1 → code_context_control-2.58.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.57.1"
+__version__ = "2.58.0"
 
 
 def _command_deps() -> CommandDeps:
@@ -248,7 +248,7 @@ _C3_MCP_ALLOW = [
     "mcp__c3__c3_memory", "mcp__c3__c3_validate", "mcp__c3__c3_edit",
     "mcp__c3__c3_agent", "mcp__c3__c3_delegate", "mcp__c3__c3_edits",
     "mcp__c3__c3_impact", "mcp__c3__c3_shell", "mcp__c3__c3_bitbucket",
-    "mcp__c3__c3_jira",
+    "mcp__c3__c3_jira", "mcp__c3__c3_credentials",
     "mcp__c3__c3_project", "mcp__c3__c3_task", "mcp__c3__c3_artifacts",
 ]
 
@@ -5738,6 +5738,150 @@ def _bb_cmd_set_default(args, project_path: str) -> None:
     print(f"[OK] Default repo: {args.project}/{args.repo}")
 
 
+def cmd_creds(args):
+    """Credential vault management (global + per-project scopes)."""
+    sub = getattr(args, "creds_cmd", None)
+    if not sub:
+        print("Usage: c3 creds {set,get,list,rm,import} [args]")
+        return
+
+    project_path = getattr(args, "project_path", ".") or "."
+
+    if sub == "set":
+        _creds_cmd_set(args, project_path)
+    elif sub == "get":
+        _creds_cmd_get(args, project_path)
+    elif sub == "list":
+        _creds_cmd_list(args, project_path)
+    elif sub == "rm":
+        _creds_cmd_rm(args, project_path)
+    elif sub == "import":
+        _creds_cmd_import(args, project_path)
+    else:
+        print(f"Unknown creds subcommand: {sub}")
+
+
+def _creds_scope(args) -> str:
+    return "global" if getattr(args, "use_global", False) else "project"
+
+
+def _creds_entry_line(name: str, entry: dict) -> str:
+    flags = [f for f in ("inject", "agent_readable") if entry.get(f)]
+    parts = [
+        f"{name:<24} {entry.get('scope', '?'):<8} {entry.get('type', 'token'):<10}"
+        f" len={entry.get('value_len', '?')}",
+    ]
+    if entry.get("env_var"):
+        parts.append(f"env_var={entry['env_var']}")
+    if flags:
+        parts.append("[" + ",".join(flags) + "]")
+    if entry.get("description"):
+        parts.append(f"-- {entry['description']}")
+    return "  ".join(parts)
+
+
+def _creds_cmd_set(args, project_path: str) -> None:
+    import getpass
+
+    from services import credential_store as cred_store
+
+    value = getattr(args, "value", "") or ""
+    if getattr(args, "stdin", False):
+        value = sys.stdin.read().rstrip("\n")
+    if not value:
+        value = getpass.getpass(f"Value for {args.name}: ")
+    if not value:
+        print("Cancelled -- value required.")
+        return
+    scope = _creds_scope(args)
+    try:
+        entry = cred_store.set_credential(
+            args.name, value,
+            scope=scope, project_path=project_path,
+            description=getattr(args, "desc", "") or "",
+            ctype=getattr(args, "ctype", "token") or "token",
+            env_var=getattr(args, "env_var", "") or "",
+            agent_readable=bool(getattr(args, "agent_readable", False)),
+            inject=bool(getattr(args, "inject", False)),
+        )
+    except (cred_store.CredentialError, RuntimeError) as exc:
+        print(f"[error] {exc}")
+        return
+    print(f"[OK] Stored credential '{args.name}' "
+          f"(scope={scope}, storage={entry['storage']}, len={entry['value_len']})")
+    if entry["agent_readable"]:
+        print("[warn] agent_readable=true -- the agent can read this value "
+              "into its context and transcripts.")
+
+
+def _creds_cmd_get(args, project_path: str) -> None:
+    from services import credential_store as cred_store
+
+    entry = cred_store.get_entry(args.name, project_path=project_path)
+    if not entry:
+        print(f"[error] no credential named '{args.name}'")
+        return
+    print(_creds_entry_line(args.name, entry))
+    print(f"storage={entry.get('storage', 'keyring')}  "
+          f"created={entry.get('created', '?')}  updated={entry.get('updated', '?')}")
+    fp = cred_store.fingerprint(args.name, project_path=project_path)
+    print(f"fingerprint={fp or 'unresolvable'}")
+    if getattr(args, "show", False):
+        value = cred_store.get_value(args.name, project_path=project_path)
+        print(value if value is not None else "[error] value missing from store")
+
+
+def _creds_cmd_list(args, project_path: str) -> None:
+    from services import credential_store as cred_store
+
+    entries = cred_store.list_entries(project_path)
+    if not entries:
+        print("No credentials registered. Use `c3 creds set NAME` "
+              "(add --global for all projects).")
+        return
+    print(f"{len(entries)} credential(s) — project scope shadows global:")
+    for name, entry in entries.items():
+        print("  " + _creds_entry_line(name, entry))
+
+
+def _creds_cmd_rm(args, project_path: str) -> None:
+    from services import credential_store as cred_store
+
+    scope = _creds_scope(args)
+    entry = cred_store.get_entry(args.name, project_path=project_path)
+    if entry and entry["scope"] == "global" and scope == "project":
+        print(f"[error] '{args.name}' is a global credential -- "
+              "re-run with --global to delete it.")
+        return
+    if cred_store.delete_credential(args.name, scope=scope, project_path=project_path):
+        print(f"[OK] Removed credential '{args.name}' (scope={scope})")
+    else:
+        print(f"[error] no credential named '{args.name}' in {scope} scope")
+
+
+def _creds_cmd_import(args, project_path: str) -> None:
+    from services import credential_store as cred_store
+
+    env_path = Path(getattr(args, "env_file", ""))
+    if not env_path.exists():
+        print(f"[error] file not found: {env_path}")
+        return
+    try:
+        text = env_path.read_text(encoding="utf-8")
+        result = cred_store.import_env(
+            text, scope=_creds_scope(args), project_path=project_path,
+            overwrite=bool(getattr(args, "overwrite", False)),
+        )
+    except (cred_store.CredentialError, RuntimeError) as exc:
+        print(f"[error] {exc}")
+        return
+    print(f"[OK] Imported {len(result['created'])} credential(s): "
+          f"{', '.join(result['created']) or '-'}")
+    if result["skipped"]:
+        print(f"Skipped {len(result['skipped'])}: {', '.join(result['skipped'])} "
+              "(use --overwrite to replace)")
+
+
 def cmd_jira(args):
     """Jira Cloud / Data Center credential + workspace management."""
     sub = getattr(args, "jira_cmd", None)
@@ -7036,6 +7180,7 @@ def main():
         "hub": cmd_hub,
         "bitbucket": cmd_bitbucket,
         "jira": cmd_jira,
+        "creds": cmd_creds,
         "oracle": cmd_oracle,
         "upgrade": cmd_upgrade,
     }

{code_context_control-2.57.1 → code_context_control-2.58.0}/cli/commands/parser.py

@@ -401,6 +401,48 @@ def build_parser(version: str, parse_cli_ide_arg):
     jr_default.add_argument("--name", default="", help="Account name (defaults to the default account)")
     jr_default.add_argument("project_path", nargs="?", default=".")
 
+    # ── Credential vault (v2.58.0) ──────────────────────────────────────
+    p_creds = subparsers.add_parser(
+        "creds",
+        help="Credential vault — named secrets for agents (global + per-project)",
+    )
+    creds_subs = p_creds.add_subparsers(dest="creds_cmd")
+
+    cr_set = creds_subs.add_parser(
+        "set", help="Create or update a credential (value via hidden prompt)"
+    )
+    cr_set.add_argument("name", help="Entry name (env-var safe: [A-Za-z_][A-Za-z0-9_]*)")
+    cr_set.add_argument("--value", default="", help="Secret value (prompted via getpass if omitted — preferred)")
+    cr_set.add_argument("--stdin", action="store_true", help="Read the value from stdin (piped/multiline values)")
+    cr_set.add_argument("--type", dest="ctype", choices=["token", "env", "multiline"], default="token", help="Entry type")
+    cr_set.add_argument("--desc", default="", help="Human description shown in list/UI")
+    cr_set.add_argument("--env-var", default="", help="Env var name used at injection (default: entry name)")
+    cr_set.add_argument("--agent-readable", action="store_true", help="Allow the agent to reveal the decoded value into its context (default: injection-only)")
+    cr_set.add_argument("--inject", action="store_true", help="Auto-inject into every c3_shell run")
+    cr_set.add_argument("--global", dest="use_global", action="store_true", help="Store in the global scope (~/.c3) so every C3 project can use it")
+    # --path (not a trailing positional): a second positional after options
+    # breaks argparse on py<3.12 ("unrecognized arguments").
+    cr_set.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    cr_get = creds_subs.add_parser("get", help="Show entry metadata (masked; --show prints the value)")
+    cr_get.add_argument("name")
+    cr_get.add_argument("--show", action="store_true", help="Print the decoded value to the terminal")
+    cr_get.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    cr_list = creds_subs.add_parser("list", help="List credentials visible to this project")
+    cr_list.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    cr_rm = creds_subs.add_parser("rm", help="Delete a credential (value + registry entry)")
+    cr_rm.add_argument("name")
+    cr_rm.add_argument("--global", dest="use_global", action="store_true", help="Delete from the global scope")
+    cr_rm.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    cr_import = creds_subs.add_parser("import", help="Import KEY=VALUE lines from a .env file")
+    cr_import.add_argument("env_file", help="Path to the .env file")
+    cr_import.add_argument("--global", dest="use_global", action="store_true", help="Import into the global scope")
+    cr_import.add_argument("--overwrite", action="store_true", help="Replace entries already registered in the target scope")
+    cr_import.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
     # ── Oracle Discovery API (v2.32.0) ──────────────────────────────────
     p_oracle = subparsers.add_parser(
         "oracle",

{code_context_control-2.57.1 → code_context_control-2.58.0}/cli/hub_server.py

@@ -1773,6 +1773,36 @@ def api_projects_config_get():
                     "defaults": {k: _config_defaults(k) for k in _CONFIG_READ_SECTIONS}})
 
 
+@app.route("/api/projects/credentials", methods=["GET"])
+def api_projects_credentials():
+    """Read-only masked credential registry for a project (global entries +
+    project shadows). Values never transit the hub — the explicit field
+    allowlist below returns metadata only; management lives in the project UI
+    (`credentials` is deliberately absent from _CONFIG_WRITE_SECTIONS)."""
+    path = (request.args.get("path") or "").strip()
+    if not path:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    from services import credential_store as cred_store
+    entries = []
+    for name, entry in cred_store.list_entries(str(resolved)).items():
+        entries.append({
+            "name": name,
+            "scope": entry.get("scope", ""),
+            "type": entry.get("type", "token"),
+            "value_len": entry.get("value_len", 0),
+            "env_var": entry.get("env_var", ""),
+            "inject": bool(entry.get("inject")),
+            "agent_readable": bool(entry.get("agent_readable")),
+            "description": entry.get("description", ""),
+            "updated": entry.get("updated", ""),
+        })
+    return jsonify({"path": str(resolved), "entries": entries})
+
+
 @app.route("/api/projects/config", methods=["PUT"])
 def api_projects_config_put():
     """Whitelisted section write: deep-merge, atomic replace, audited on the target."""

{code_context_control-2.57.1 → code_context_control-2.58.0}/cli/hub_ui/components/drill_panel.js

@@ -13,6 +13,7 @@ const DRILL_PANEL_TABS = [
   ['sessions', 'Sessions'],
   ['health', 'Health'],
   ['budget', 'Budget'],
+  ['creds', 'Credentials'],
   ['config', 'Config'],
   ['mcp', 'MCP'],
 ];
@@ -132,6 +133,7 @@ function DrillPanel({ project, tab, setTab, onClose, onChanged, onOpenModal, pro
       case 'sessions': return <DrillSessions project={project} />;
       case 'health': return <DrillHealth project={project} onChanged={onChanged} />;
       case 'budget': return <DrillBudget project={project} />;
+      case 'creds': return <DrillCredentials project={project} />;
       case 'config': return <ConfigEditor project={project} />;
       case 'mcp': return <McpManager project={project} onChanged={onChanged} />;
       default: return <DrillOverview project={project} onChanged={onChanged} setTab={setTab} />;

{code_context_control-2.57.1 → code_context_control-2.58.0}/cli/hub_ui/components/drill_views.js

@@ -283,6 +283,56 @@ function DrillLedger({ project }) {
 }
 
 // ── Sessions ───────────────────────────────────────────────────
+// Read-only: the hub never transits credential values — this lists metadata
+// from GET /api/projects/credentials; management lives in the project UI.
+function DrillCredentials({ project }) {
+  const [data, setData] = useState(null);
+  const [err, setErr] = useState(null);
+
+  const load = async () => {
+    setErr(null);
+    try {
+      const d = await api.get('/api/projects/credentials?path=' + encodeURIComponent(project.path));
+      setData(d);
+    } catch (e) { setErr(e.message); }
+  };
+  useEffect(() => { setData(null); load(); }, [project.path]);
+
+  if (err) return <DrillMsg text={'Failed to load credentials: ' + err} color={T.error} />;
+  if (!data) return <DrillMsg text="Loading credentials…" />;
+
+  const entries = data.entries || [];
+  return (
+    <div className="fade-up">
+      <div style={{ fontSize: 11, color: T.textMuted, lineHeight: 1.5, marginBottom: 12 }}>
+        Read-only view — values never transit the hub. Manage entries (and the
+        agent_readable / inject flags) in this project's own UI Credentials tab
+        or via <span className="mono">c3 creds</span>.
+      </div>
+      {entries.length === 0 ? (
+        <DrillMsg text="No credentials registered for this project." />
+      ) : entries.map((entry) => (
+        <div key={entry.scope + '|' + entry.name} style={{
+          display: 'flex', alignItems: 'center', gap: 8, padding: '8px 0',
+          borderBottom: `1px solid ${T.border}`, fontSize: 12,
+        }}>
+          <I name="lock" size={12} color={T.textMuted} />
+          <span className="mono" style={{ fontWeight: 600, color: T.text }}>{entry.name}</span>
+          <Badge color={entry.scope === 'global' ? T.accent : T.ok}>{entry.scope}</Badge>
+          <Badge color={T.textMuted}>{entry.type}</Badge>
+          <span className="mono" style={{ color: T.textDim }}>len={entry.value_len}</span>
+          {!!entry.inject && <Badge color={T.warn}>inject</Badge>}
+          {!!entry.agent_readable && <Badge color={T.error}>agent_readable</Badge>}
+          <span style={{
+            flex: 1, color: T.textMuted, fontSize: 11, textAlign: 'right',
+            whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis',
+          }}>{entry.description}</span>
+        </div>
+      ))}
+    </div>
+  );
+}
+
 function DrillSessions({ project }) {
   const [data, setData] = useState(null);
   const [needsInit, setNeedsInit] = useState(false);

{code_context_control-2.57.1 → code_context_control-2.58.0}/cli/mcp_server.py

@@ -355,6 +355,22 @@ def _finalize_response(ctx: Context, tool_name: str, args: dict,
     snap_pct = 0
     svc = _svc(ctx)
 
+    # Credential hygiene: scrub any decoded vault value from every PERSISTED
+    # copy (session store, activity log, auto-memory). The response returned
+    # to the model is deliberately untouched — reveal is gated upstream by
+    # the per-entry agent_readable flag, and injected values only appear in
+    # output when a subprocess echoed them (already scrubbed in c3_shell;
+    # this is the belt-and-braces layer for every other tool).
+    persisted_response = response
+    try:
+        from services import credential_store as _creds
+        if _creds._ACTIVE_SECRETS:
+            args = _creds.redact_obj(args)
+            summary = _creds.redact_text(summary)
+            persisted_response = _creds.redact_text(response)
+    except Exception:
+        pass
+
     # Minimal critical section: only the module-global timing state needs
     # exclusive access. Disk I/O happens outside the lock so concurrent tool
     # calls don't serialize on append-only JSONL writes.
@@ -380,7 +396,7 @@ def _finalize_response(ctx: Context, tool_name: str, args: dict,
             tracker.ping("tool")  # throttled heartbeat; idle gaps close sessions
         except Exception:
             pass
-    svc.session_mgr.track_response(tool_name, response, response_tokens=response_tokens)
+    svc.session_mgr.track_response(tool_name, persisted_response, response_tokens=response_tokens)
 
     hybrid_cfg = svc.hybrid_config or {}
 
@@ -399,7 +415,7 @@ def _finalize_response(ctx: Context, tool_name: str, args: dict,
     # --- Outside lock: auto-memory extraction (may do file I/O / Ollama) ---
     if hasattr(svc, "auto_memory"):
         try:
-            svc.auto_memory.on_tool_complete(tool_name, args, summary, response)
+            svc.auto_memory.on_tool_complete(tool_name, args, summary, persisted_response)
         except Exception:
             pass
 
@@ -422,7 +438,7 @@ def _finalize_response(ctx: Context, tool_name: str, args: dict,
     return response
 
 
-# ─── TOOL REGISTRATIONS (18 tools) ────────────────────────────────
+# ─── TOOL REGISTRATIONS (19 tools) ────────────────────────────────
 # Each tool's first docstring line should state WHEN to reach for it —
 # that's what Claude reads when selecting between tools.
 
@@ -711,10 +727,14 @@ async def c3_impact(target: str, file_path: str = "", mode: str = "symbol",
 @mcp.tool()
 async def c3_shell(cmd: str, cwd: str = "", timeout: int = 60,
                    filter_output: bool = True, log: bool = True,
+                   env_creds: str = "",
                    ctx: Context = None) -> str:
     """EXECUTE shell command — structured returns, auto-filter, ledger-aware.
     Use for tests, git, build, scripts. Returns exit_code/stdout/stderr/duration_ms.
     Auto-filters stdout >30 lines; auto-logs git mutations to the edit ledger.
+    Credentials: env_creds='NAME1,NAME2' injects vault entries as env vars, and
+    {{cred:NAME}} inside cmd expands server-side — decoded values never enter
+    model context (see c3_credentials; echoed values are auto-redacted).
     Best-effort block of catastrophic commands (rm -rf of /, a top-level system dir, or
     $HOME/~; fork bombs; whole-drive wipes) — a guard, NOT a sandbox. Soft-warns on
     --force, --no-verify, reset --hard.
@@ -725,7 +745,8 @@ async def c3_shell(cmd: str, cwd: str = "", timeout: int = 60,
     def finalize(name, args, resp, summ, **kw):
         return _finalize_response(ctx, name, args, resp, summ, **kw)
 
-    return await handle_shell(cmd, cwd, timeout, filter_output, log, svc, finalize)
+    return await handle_shell(cmd, cwd, timeout, filter_output, log, svc, finalize,
+                              env_creds=env_creds)
 
 
 @mcp.tool()
@@ -822,6 +843,40 @@ async def c3_jira(
     )
 
 
+@mcp.tool()
+async def c3_credentials(
+    action: str,
+    name: str = "",
+    value: str = "",
+    scope: str = "",
+    description: str = "",
+    ctype: str = "",
+    env_var: str = "",
+    inject: bool = False,
+    agent_readable: bool = False,
+    ctx: Context = None,
+) -> str:
+    """CREDENTIAL VAULT — named secrets the user manages (global + per-project), injection-first.
+    actions: list, describe (name), check (name), reveal (name — only entries the
+    user marked agent_readable), set (name, value [scope=project|global] [ctype=token|env|multiline]
+    [description] [env_var] [inject]), delete (name [scope]).
+    To USE a credential, do NOT reveal it — pass env_creds='NAME1,NAME2' to c3_shell
+    (injected as env vars) or write {{cred:NAME}} inside the cmd (expanded server-side);
+    the decoded value never enters model context. Values live in the OS keyring /
+    an encrypted sidecar, never in config files. Mutations and reveals are ledger-logged."""
+    svc = _svc(ctx)
+
+    def finalize(fname, fargs, fresp, fsumm, **kw):
+        return _finalize_response(ctx, fname, fargs, fresp, fsumm, **kw)
+
+    from cli.tools.credentials import handle_credentials
+    return await asyncio.to_thread(
+        handle_credentials, action, svc, finalize,
+        name=name, value=value, scope=scope, description=description,
+        ctype=ctype, env_var=env_var, inject=inject, agent_readable=agent_readable,
+    )
+
+
 @mcp.tool()
 async def c3_project(
     action: str,