code-context-control 2.58.0__py3-none-any.whl → 2.59.0__py3-none-any.whl

cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.58.0"
+__version__ = "2.59.0"
 
 
 def _command_deps() -> CommandDeps:

cli/guide/tools.html

@@ -125,6 +125,7 @@
       <div class="sidebar-label">SCM</div>
       <a href="#c3_task" class="sidebar-link"><span class="icon">✅</span> c3_task</a>
       <a href="#c3_bitbucket" class="sidebar-link"><span class="icon">🪣</span> c3_bitbucket</a>
+      <a href="#c3_credentials" class="sidebar-link"><span class="icon">🔐</span> c3_credentials</a>
     </div>
     <div class="sidebar-section">
       <div class="sidebar-label">Cross-project</div>
@@ -161,6 +162,7 @@
         <a href="#c3_task" class="toc-item">c3_task <span class="cat">PM</span></a>
         <a href="#c3_artifacts" class="toc-item">c3_artifacts <span class="cat">Config</span></a>
         <a href="#c3_bitbucket" class="toc-item">c3_bitbucket <span class="cat">SCM</span></a>
+        <a href="#c3_credentials" class="toc-item">c3_credentials <span class="cat">Secrets</span></a>
         <a href="#c3_project"  class="toc-item">c3_project  <span class="cat">Multi-project</span></a>
       </div>
     </div>
@@ -1239,6 +1241,45 @@ c3_bitbucket(action=<span class="str">'merge_pr'</span>, pr_id=<span class="num"
           <p class="tool-desc"><strong>Audit trail:</strong> mutating actions (<code>merge_pr</code>, <code>create_branch</code>, <code>delete_branch</code>, webhook writes, etc.) are appended to the C3 edit ledger so the local audit log covers platform-side state changes too.</p>
         </div>
       </div>
+
+      <!-- c3_credentials -->
+      <div class="tool-card" id="c3_credentials">
+        <div class="tool-card-header">
+          <span class="tool-name">c3_credentials</span>
+          <div class="tag-row">
+            <span class="badge badge-purple">secrets</span>
+            <span class="badge">v2.58.0</span>
+          </div>
+          <span class="tool-tagline">Credential vault — the agent uses secrets by name, never by value</span>
+        </div>
+        <div class="tool-card-body">
+          <p class="tool-desc">A user-managed secret store, <strong>global</strong> (<code>~/.c3</code>, visible in every project) or <strong>per-project</strong> (<code>.c3</code>, shadows the same-named global). Values live in the OS keyring (service <code>c3-creds</code>; values over ~1KB in a Fernet-encrypted <code>.c3/secrets.enc</code> whose random master key is itself a keyring entry) — never in config files, and <em>never in the model's context</em>. <strong>Injection-first:</strong> the agent addresses secrets by name and C3 decodes them only at the subprocess boundary — <code>c3_shell(env_creds='A,B')</code> injects env vars, <code>{{cred:NAME}}</code> inside <code>cmd</code> expands server-side, and <code>inject</code>-flagged entries auto-inject into every shell run; echoed values are redacted back to <code>[cred:NAME]</code>. Resolution is <strong>realm-atomic</strong>: a project-registered name resolves in the project realm or not at all, so a hostile repo's committed config can never siphon your global values (tested).</p>
+
+          <h4>Actions</h4>
+          <table class="params-table">
+            <thead><tr><th>Action</th><th>Group</th><th>Description</th></tr></thead>
+            <tbody>
+              <tr><td class="param-name">list</td><td>Read</td><td class="param-desc">Merged registry (project shadows global) — names, scope, type, flags, usage. Never values</td></tr>
+              <tr><td class="param-name">describe</td><td>Read</td><td class="param-desc">Metadata + storage + live fingerprint (first 8 hex of SHA-256, computed on demand, never persisted)</td></tr>
+              <tr><td class="param-name">check</td><td>Read</td><td class="param-desc">Resolvability probe — does the stored value decode?</td></tr>
+              <tr><td class="param-name">set</td><td>Write</td><td class="param-desc">Create/replace an entry. <code>agent_readable</code> may be set at creation only — raising it on an existing entry is user-only</td></tr>
+              <tr><td class="param-name">delete</td><td>Write</td><td class="param-desc">Remove value + registry entry (owning scope inferred when omitted)</td></tr>
+              <tr><td class="param-name">reveal</td><td>Gated</td><td class="param-desc">The only value-returning action — refused unless the user enabled <code>agent_readable</code> on that entry</td></tr>
+            </tbody>
+          </table>
+
+          <h4>Examples</h4>
+          <pre><code><span class="com"># What can I use? (names and metadata only)</span>
+c3_credentials(action=<span class="str">'list'</span>)
+c3_credentials(action=<span class="str">'check'</span>, name=<span class="str">'NPM_TOKEN'</span>)
+
+<span class="com"># USE a secret without ever seeing it</span>
+c3_shell(cmd=<span class="str">'npm publish'</span>, env_creds=<span class="str">'NPM_TOKEN'</span>)
+c3_shell(cmd=<span class="str">'curl -H "Authorization: Bearer {{cred:API_KEY}}" https://api.example.com'</span>)</code></pre>
+
+          <p class="tool-desc"><strong>Surfaces:</strong> the <code>c3 creds</code> CLI (<code>set</code> / <code>get</code> / <code>list</code> / <code>rm</code> / <code>import .env</code>, <code>--global</code> for the shared scope), a per-project dashboard <strong>Credentials</strong> tab, and — since v2.59.0 — a top-level <strong>Credentials</strong> view in the Hub: a Global-vault manager plus a per-project browser with shadowing shown both ways ("shadows global" on project entries, "shadowed in N projects" on globals); the Hub's per-project drill panel manages too. No HTTP route ever returns a stored value (write-only wire contract, endpoint-sweep tested), every mutation is ledger-logged by name, the vault is hard-excluded from the Oracle Discovery API, and cross-project (<code>c3_project</code>) shells run with credentials disabled.</p>
+        </div>
+      </div>
     </div>
 
     <!-- ═══════════════════════════════════════ CROSS-PROJECT ═════ -->

cli/hub_server.py

@@ -333,6 +333,7 @@ _HUB_JS_FILES = [
     "hub_ui/components/session_drawer.js",
     "hub_ui/components/drill_panel.js",
     "hub_ui/components/drill_views.js",
+    "hub_ui/components/hub_credentials.js",
     "hub_ui/components/drill_subprojects.js",
     "hub_ui/components/drill_health.js",
     "hub_ui/components/drill_tasks.js",
@@ -437,8 +438,8 @@ def api_hub_config_set():
         cfg["projects_view"] = projects_view
     if "main_view" in data:
         main_view = str(data["main_view"]).strip().lower()
-        if main_view not in {"projects", "board"}:
-            return jsonify({"error": "main_view must be 'projects' or 'board'"}), 400
+        if main_view not in {"projects", "board", "creds"}:
+            return jsonify({"error": "main_view must be 'projects', 'board' or 'creds'"}), 400
         cfg["main_view"] = main_view
     if "oracle_url" in data:
         cfg["oracle_url"] = str(data["oracle_url"]).strip()
@@ -1773,12 +1774,100 @@ def api_projects_config_get():
                     "defaults": {k: _config_defaults(k) for k in _CONFIG_READ_SECTIONS}})
 
 
+# ── Credentials (hub) ────────────────────────────────────────────────────────
+# Write-only wire contract, hub edition: values go IN over POST and are never
+# returned by any hub route (no reveal exists here). `credentials` stays out of
+# _CONFIG_WRITE_SECTIONS — these dedicated routes are the only hub write path.
+
+_CRED_PUBLIC_FIELDS = ("scope", "type", "value_len", "env_var", "inject",
+                       "agent_readable", "description", "storage", "created",
+                       "updated")
+
+
+def _cred_entry_public(name, entry, *, usage=None, shadows_global=None):
+    """Explicit allowlist serializer — structurally cannot emit a value."""
+    rec = {"name": name}
+    for key in _CRED_PUBLIC_FIELDS:
+        rec[key] = entry.get(key, "")
+    rec["value_len"] = entry.get("value_len", 0)
+    rec["inject"] = bool(entry.get("inject"))
+    rec["agent_readable"] = bool(entry.get("agent_readable"))
+    if usage is not None:
+        rec["last_used"] = (usage.get(name) or {}).get("last_used", "")
+        rec["use_count"] = (usage.get(name) or {}).get("use_count", 0)
+    if shadows_global is not None:
+        rec["shadows_global"] = bool(shadows_global)
+    return rec
+
+
+def _resolve_cred_target(path: str, scope: str, *, mutation: bool):
+    """Resolve a credentials request target to (project, store_path, error).
+
+    scope='global' with no path targets the shared vault (~/.c3) directly;
+    project scope requires a registered path. Mutations on a path without a
+    .c3/ dir get 409 needs_init so the hub can't scatter .c3 dirs around."""
+    from services import credential_store as cred_store
+    if scope not in ("project", "global"):
+        return None, "", (jsonify({"error": "scope must be 'project' or 'global'"}), 400)
+    if not path:
+        if scope == "project":
+            return None, "", (jsonify({"error": "path is required for project scope"}), 400)
+        home = cred_store.global_base()
+        if home is None:
+            return None, "", (jsonify({"error": "global scope unresolvable (no home dir)"}), 500)
+        return None, str(home), None
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return None, "", (jsonify({"error": str(e)}), 404)
+    if mutation and not (resolved / ".c3").is_dir():
+        return None, "", (jsonify({"error": "not initialized", "needs_init": True}), 409)
+    return resolved, str(resolved), None
+
+
+def _hub_cred_audit(action: str, name: str, scope: str, project) -> None:
+    """Names only — never values. Failure-safe. Project mutations audit to the
+    target project's ActivityLog + EditLedger; global-scope mutations also land
+    in ~/.c3/activity_log.jsonl so the shared vault keeps its own trail."""
+    if project is not None:
+        try:
+            from services.activity_log import ActivityLog
+            ActivityLog(str(project)).log("cred_action", {
+                "kind": "creds", "action": action, "name": name,
+                "scope": scope, "via": "hub",
+            })
+        except Exception:
+            pass
+        try:
+            from services.edit_ledger import EditLedger
+            EditLedger(str(project)).log_edit(
+                file=f"cred://{name}", change_type=f"cred_{action}",
+                summary=f"{action} {name} ({scope}) via Hub",
+                tags=["creds", action],
+                detail={"kind": "creds", "action": action, "name": name,
+                        "scope": scope},
+            )
+        except Exception:
+            pass
+    if scope == "global" or project is None:
+        try:
+            from services import credential_store as cred_store
+            from services.activity_log import ActivityLog
+            home = cred_store.global_base()
+            if home is not None:
+                ActivityLog(str(home)).log("cred_action", {
+                    "kind": "creds", "action": action, "name": name,
+                    "scope": scope, "via": "hub",
+                })
+        except Exception:
+            pass
+
+
 @app.route("/api/projects/credentials", methods=["GET"])
 def api_projects_credentials():
-    """Read-only masked credential registry for a project (global entries +
-    project shadows). Values never transit the hub — the explicit field
-    allowlist below returns metadata only; management lives in the project UI
-    (`credentials` is deliberately absent from _CONFIG_WRITE_SECTIONS)."""
+    """Masked credential registry for a project (global entries + project
+    shadows). Values never transit the hub outbound — the allowlist serializer
+    returns metadata, usage and shadow info only."""
     path = (request.args.get("path") or "").strip()
     if not path:
         return jsonify({"error": "path is required"}), 400
@@ -1787,22 +1876,174 @@ def api_projects_credentials():
     except ValueError as e:
         return jsonify({"error": str(e)}), 404
     from services import credential_store as cred_store
+    usage = cred_store.read_usage_state(str(resolved))
+    home = cred_store.global_base()
+    global_names = set(cred_store.list_entries(str(home))) if home else set()
     entries = []
     for name, entry in cred_store.list_entries(str(resolved)).items():
-        entries.append({
-            "name": name,
-            "scope": entry.get("scope", ""),
-            "type": entry.get("type", "token"),
-            "value_len": entry.get("value_len", 0),
-            "env_var": entry.get("env_var", ""),
-            "inject": bool(entry.get("inject")),
-            "agent_readable": bool(entry.get("agent_readable")),
-            "description": entry.get("description", ""),
-            "updated": entry.get("updated", ""),
-        })
+        entries.append(_cred_entry_public(
+            name, entry, usage=usage,
+            shadows_global=(entry.get("scope") == "project"
+                            and name in global_names)))
     return jsonify({"path": str(resolved), "entries": entries})
 
 
+@app.route("/api/projects/credentials", methods=["POST"])
+def api_projects_credentials_set():
+    """Create/update an entry from the hub. `value` optional — metadata-only
+    update when absent, touching ONLY the keys present in the payload; a
+    submitted value is stored and never echoed back. scope='global' with no
+    `path` targets the shared vault directly."""
+    from services import credential_store as cred_store
+    data = request.get_json(force=True) or {}
+    name = str(data.get("name") or "").strip()
+    scope = str(data.get("scope") or "project").strip().lower()
+    project, store_path, err = _resolve_cred_target(
+        str(data.get("path") or "").strip(), scope, mutation=True)
+    if err:
+        return err
+    value = str(data.get("value") or "")
+    ctype = str(data.get("type") or data.get("ctype") or "token")
+    try:
+        if value:
+            entry = cred_store.set_credential(
+                name, value, scope=scope, project_path=store_path, ctype=ctype,
+                description=str(data.get("description") or ""),
+                env_var=str(data.get("env_var") or ""),
+                agent_readable=bool(data.get("agent_readable")),
+                inject=bool(data.get("inject")))
+        else:
+            # Metadata-only update: touch ONLY the keys present in the payload
+            # so a single-field toggle can't clobber the others.
+            fields = {}
+            for key in ("description", "env_var"):
+                if key in data:
+                    fields[key] = str(data[key] or "")
+            for key in ("agent_readable", "inject"):
+                if key in data:
+                    fields[key] = bool(data[key])
+            if "type" in data or "ctype" in data:
+                fields["type"] = ctype
+            entry = cred_store.update_metadata(
+                name, scope=scope, project_path=store_path, **fields)
+    except cred_store.CredentialError as exc:
+        return jsonify({"error": str(exc)}), 400
+    except RuntimeError as exc:
+        return jsonify({"error": str(exc)}), 500
+    _hub_cred_audit("set" if value else "update", name, scope, project)
+    return jsonify({"entry": _cred_entry_public(name, {**entry, "scope": scope})})
+
+
+@app.route("/api/projects/credentials/import", methods=["POST"])
+def api_projects_credentials_import():
+    """Import KEY=VALUE lines (.env paste). Values are stored, never echoed."""
+    from services import credential_store as cred_store
+    data = request.get_json(force=True) or {}
+    scope = str(data.get("scope") or "project").strip().lower()
+    project, store_path, err = _resolve_cred_target(
+        str(data.get("path") or "").strip(), scope, mutation=True)
+    if err:
+        return err
+    try:
+        result = cred_store.import_env(
+            str(data.get("text") or ""), scope=scope, project_path=store_path,
+            overwrite=bool(data.get("overwrite")))
+    except cred_store.CredentialError as exc:
+        return jsonify({"error": str(exc)}), 400
+    except RuntimeError as exc:
+        return jsonify({"error": str(exc)}), 500
+    for created in result["created"]:
+        _hub_cred_audit("set", created, scope, project)
+    return jsonify(result)
+
+
+@app.route("/api/projects/credentials/<name>", methods=["DELETE"])
+def api_projects_credentials_delete(name):
+    """Delete an entry (value + registry). Scope inferred from the owning
+    realm when omitted."""
+    from services import credential_store as cred_store
+    scope = str(request.args.get("scope") or "").strip().lower()
+    path = str(request.args.get("path") or "").strip()
+    project, store_path, err = _resolve_cred_target(
+        path, scope or ("project" if path else "global"), mutation=True)
+    if err:
+        return err
+    if not scope:
+        entry = cred_store.get_entry(name, project_path=store_path)
+        scope = (entry.get("scope") or "project") if entry else \
+            ("project" if path else "global")
+    try:
+        removed = cred_store.delete_credential(
+            name, scope=scope, project_path=store_path)
+    except cred_store.CredentialError as exc:
+        return jsonify({"error": str(exc)}), 400
+    if removed:
+        _hub_cred_audit("delete", name, scope, project)
+    return jsonify({"removed": bool(removed), "scope": scope})
+
+
+@app.route("/api/projects/credentials/<name>/check", methods=["POST"])
+def api_projects_credentials_check(name):
+    """Resolvability probe — returns a fingerprint, never the value."""
+    from services import credential_store as cred_store
+    data = request.get_json(silent=True) or {}
+    path = str(data.get("path") or "").strip()
+    project, store_path, err = _resolve_cred_target(
+        path, "project" if path else "global", mutation=False)
+    if err:
+        return err
+    entry = cred_store.get_entry(name, project_path=store_path)
+    if not entry:
+        return jsonify({"error": f"no credential named '{name}'"}), 404
+    return jsonify({
+        "name": name,
+        "scope": entry["scope"],
+        "storage": entry.get("storage", "keyring"),
+        "resolvable": cred_store.get_value(name, project_path=store_path) is not None,
+        "fingerprint": cred_store.fingerprint(name, project_path=store_path),
+    })
+
+
+@app.route("/api/hub/credentials/overview", methods=["GET"])
+def api_hub_credentials_overview():
+    """Cross-project credential inventory: the global vault plus each
+    registered project's project-scoped entries, with shadow info both ways.
+    Metadata only — the allowlist serializer structurally cannot emit a value."""
+    from services import credential_store as cred_store
+    home = cred_store.global_base()
+    global_entries = cred_store.list_entries(str(home)) if home else {}
+    shadowed_in = {name: [] for name in global_entries}
+    projects_out = []
+    for p in _pm().list_projects():
+        ppath = str(p.get("path") or "")
+        row = {"name": p.get("name") or "", "path": ppath,
+               "initialized": True, "error": None, "entries": []}
+        try:
+            if not (Path(ppath) / ".c3").is_dir():
+                row["initialized"] = False
+            else:
+                usage = cred_store.read_usage_state(ppath)
+                for name, entry in cred_store.list_entries(ppath).items():
+                    if entry.get("scope") != "project":
+                        continue
+                    row["entries"].append(_cred_entry_public(
+                        name, entry, usage=usage,
+                        shadows_global=name in global_entries))
+                    if name in shadowed_in:
+                        shadowed_in[name].append(
+                            {"name": row["name"], "path": ppath})
+        except Exception as e:  # per-row isolation, like /api/search/global
+            row["error"] = str(e)
+        projects_out.append(row)
+    global_usage = cred_store.read_usage_state(str(home)) if home else {}
+    global_out = [
+        {**_cred_entry_public(name, entry, usage=global_usage),
+         "shadowed_in": shadowed_in.get(name, [])}
+        for name, entry in global_entries.items()
+    ]
+    return jsonify({"global": {"entries": global_out}, "projects": projects_out})
+
+
 @app.route("/api/projects/config", methods=["PUT"])
 def api_projects_config_put():
     """Whitelisted section write: deep-merge, atomic replace, audited on the target."""

cli/hub_ui/app.js

@@ -17,7 +17,7 @@ function App() {
   const [version, setVersion] = useState('');
   const [projects, setProjects] = useState([]);
   const [loaded, setLoaded] = useState(false);
-  const [mainView, setMainView] = useState('projects'); // projects | board
+  const [mainView, setMainView] = useState('projects'); // projects | board | creds
   const [filter, setFilter] = useState('all');          // all | active | idle | tag:<x>
   const [search, setSearch] = useState('');
   const [view, setView] = useState('list');             // list | grid
@@ -44,7 +44,7 @@ function App() {
       if (cfg.projects_view === 'grid') setView('grid');
       if (cfg.sidebar_collapsed != null) setSidebarCollapsed(!!cfg.sidebar_collapsed);
       if (cfg.sidebar_group) setFilter(cfg.sidebar_group);
-      if (cfg.main_view === 'board') setMainView('board');
+      if (cfg.main_view === 'board' || cfg.main_view === 'creds') setMainView(cfg.main_view);
     } catch { }
     try { const v = await api.get('/api/version'); setVersion(v.c3_version || ''); } catch { }
   }, []);
@@ -112,6 +112,8 @@ function App() {
         }}>
           {mainView === 'board' ? (
             <TaskBoard projects={projects} onOpenDrill={openDrill} />
+          ) : mainView === 'creds' ? (
+            <HubCredentials projects={projects} onOpenDrill={openDrill} />
           ) : (
             <React.Fragment>
               <SummaryBar projects={projects} search={search} setSearch={setSearch}

cli/hub_ui/components/drill_views.js

@@ -282,55 +282,11 @@ function DrillLedger({ project }) {
   );
 }
 
-// ── Sessions ───────────────────────────────────────────────────
-// Read-only: the hub never transits credential values — this lists metadata
-// from GET /api/projects/credentials; management lives in the project UI.
+// ── Credentials ────────────────────────────────────────────────
+// Full management via the shared CredsManager (hub_credentials.js).
+// Write-only wire: values are submitted inbound-only and never returned.
 function DrillCredentials({ project }) {
-  const [data, setData] = useState(null);
-  const [err, setErr] = useState(null);
-
-  const load = async () => {
-    setErr(null);
-    try {
-      const d = await api.get('/api/projects/credentials?path=' + encodeURIComponent(project.path));
-      setData(d);
-    } catch (e) { setErr(e.message); }
-  };
-  useEffect(() => { setData(null); load(); }, [project.path]);
-
-  if (err) return <DrillMsg text={'Failed to load credentials: ' + err} color={T.error} />;
-  if (!data) return <DrillMsg text="Loading credentials…" />;
-
-  const entries = data.entries || [];
-  return (
-    <div className="fade-up">
-      <div style={{ fontSize: 11, color: T.textMuted, lineHeight: 1.5, marginBottom: 12 }}>
-        Read-only view — values never transit the hub. Manage entries (and the
-        agent_readable / inject flags) in this project's own UI Credentials tab
-        or via <span className="mono">c3 creds</span>.
-      </div>
-      {entries.length === 0 ? (
-        <DrillMsg text="No credentials registered for this project." />
-      ) : entries.map((entry) => (
-        <div key={entry.scope + '|' + entry.name} style={{
-          display: 'flex', alignItems: 'center', gap: 8, padding: '8px 0',
-          borderBottom: `1px solid ${T.border}`, fontSize: 12,
-        }}>
-          <I name="lock" size={12} color={T.textMuted} />
-          <span className="mono" style={{ fontWeight: 600, color: T.text }}>{entry.name}</span>
-          <Badge color={entry.scope === 'global' ? T.accent : T.ok}>{entry.scope}</Badge>
-          <Badge color={T.textMuted}>{entry.type}</Badge>
-          <span className="mono" style={{ color: T.textDim }}>len={entry.value_len}</span>
-          {!!entry.inject && <Badge color={T.warn}>inject</Badge>}
-          {!!entry.agent_readable && <Badge color={T.error}>agent_readable</Badge>}
-          <span style={{
-            flex: 1, color: T.textMuted, fontSize: 11, textAlign: 'right',
-            whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis',
-          }}>{entry.description}</span>
-        </div>
-      ))}
-    </div>
-  );
+  return <CredsManager path={project.path} projectName={project.name} />;
 }
 
 function DrillSessions({ project }) {

cli/hub_ui/components/hub_credentials.js

@@ -0,0 +1,516 @@
+// ─── Hub credentials: global vault + cross-project manager ─────
+// CredsManager is the shared manager (also used by the drill Credentials tab);
+// HubCredentials is the top-level mainView='creds' page.
+// Write-only wire: values are submitted inbound-only and never returned by
+// any hub route — rows show length + fingerprint, never the secret itself.
+
+const HUB_CREDS_EMPTY_FORM = {
+  name: '', value: '', scope: 'project', type: 'token',
+  description: '', env_var: '', agent_readable: false, inject: false,
+};
+
+// path=null → the global vault (~/.c3): scope locked to 'global'.
+// path=string → that project's merged view (global entries + project shadows).
+function CredsManager({ path, projectName, onChanged }) {
+  const isGlobal = !path;
+  const [entries, setEntries] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [form, setForm] = useState(null);        // null = closed; {…} = create/edit
+  const [editing, setEditing] = useState(false);
+  const [checks, setChecks] = useState({});      // name -> {resolvable, fingerprint}
+  const [importOpen, setImportOpen] = useState(false);
+  const [importText, setImportText] = useState('');
+  const [importScope, setImportScope] = useState(isGlobal ? 'global' : 'project');
+
+  const withPath = (obj) => (path ? Object.assign({ path }, obj) : obj);
+  const pathQuery = path ? '&path=' + encodeURIComponent(path) : '';
+
+  const load = useCallback(async () => {
+    try {
+      if (path) {
+        const data = await api.get('/api/projects/credentials?path=' + encodeURIComponent(path));
+        setEntries((data && data.entries) || []);
+      } else {
+        const data = await api.get('/api/hub/credentials/overview');
+        setEntries((((data || {}).global) || {}).entries || []);
+      }
+      setError('');
+    } catch (e) { setError(String(e)); }
+    setLoading(false);
+  }, [path]);
+
+  useEffect(() => { setLoading(true); setChecks({}); load(); }, [load]);
+
+  const done = (msg) => { notify(msg); load(); if (onChanged) onChanged(); };
+
+  const saveForm = async () => {
+    if (!form || !form.name.trim()) return;
+    setBusy(true);
+    try {
+      const payload = withPath({
+        name: form.name.trim(), scope: isGlobal ? 'global' : form.scope,
+        type: form.type, description: form.description, env_var: form.env_var,
+        agent_readable: !!form.agent_readable, inject: !!form.inject,
+      });
+      if (form.value) payload.value = form.value; // blank on edit = keep stored value
+      const resp = await api.post('/api/projects/credentials', payload);
+      if (resp && resp.error) { setError(resp.error); }
+      else {
+        setForm(null);
+        done(`Saved '${payload.name}' (${payload.scope})`);
+      }
+    } catch (e) { setError(String(e)); }
+    setBusy(false);
+  };
+
+  const removeEntry = async (entry) => {
+    if (!window.confirm(`Delete credential '${entry.name}' (${entry.scope})? The stored value is destroyed.`)) return;
+    setBusy(true);
+    try {
+      await api.del(`/api/projects/credentials/${encodeURIComponent(entry.name)}?scope=${entry.scope}${pathQuery}`);
+      done(`Deleted '${entry.name}'`);
+    } catch (e) { setError(String(e)); }
+    setBusy(false);
+  };
+
+  const checkEntry = async (entry) => {
+    try {
+      const data = await api.post(
+        `/api/projects/credentials/${encodeURIComponent(entry.name)}/check`, withPath({}));
+      setChecks(prev => Object.assign({}, prev, { [entry.name]: data }));
+    } catch (e) { setError(String(e)); }
+  };
+
+  const toggleFlag = async (entry, field) => {
+    if (field === 'agent_readable' && !entry.agent_readable) {
+      if (!window.confirm(
+        `Enable agent_readable for '${entry.name}'?\n\nThe agent will be able to read this value into its context ` +
+        'and conversation transcripts. Keep it off to allow injection-only use.'
+      )) return;
+    }
+    try {
+      const resp = await api.post('/api/projects/credentials', withPath({
+        name: entry.name, scope: entry.scope, [field]: !entry[field],
+      }));
+      if (resp && resp.error) setError(resp.error); else { load(); if (onChanged) onChanged(); }
+    } catch (e) { setError(String(e)); }
+  };
+
+  const runImport = async () => {
+    if (!importText.trim()) return;
+    setBusy(true);
+    try {
+      const resp = await api.post('/api/projects/credentials/import',
+        withPath({ text: importText, scope: isGlobal ? 'global' : importScope }));
+      if (resp && resp.error) setError(resp.error);
+      else {
+        setImportText(''); setImportOpen(false);
+        done(`Imported ${(resp.created || []).length}, skipped ${(resp.skipped || []).length}`);
+      }
+    } catch (e) { setError(String(e)); }
+    setBusy(false);
+  };
+
+  const inputStyle = drillFieldStyle({ width: '100%', boxSizing: 'border-box' });
+  const labelStyle = { fontSize: 11, color: T.textMuted, marginBottom: 4, display: 'block' };
+
+  const openCreate = () => {
+    setForm(Object.assign({}, HUB_CREDS_EMPTY_FORM, isGlobal ? { scope: 'global' } : {}));
+    setEditing(false);
+  };
+  const openEdit = (entry) => {
+    setForm({
+      name: entry.name, value: '', scope: entry.scope, type: entry.type || 'token',
+      description: entry.description || '', env_var: entry.env_var || '',
+      agent_readable: !!entry.agent_readable, inject: !!entry.inject,
+    });
+    setEditing(true);
+  };
+
+  const fmtWhen = (iso) => iso ? String(iso).replace('T', ' ').replace(/\+.*$/, '') : '—';
+
+  return (
+    <div className="fade-up">
+      {/* Toolbar */}
+      <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 6 }}>
+        <span style={{ fontSize: 12, color: T.textMuted }}>
+          {isGlobal ? 'Shared vault — entries visible in every C3 project.'
+            : `Merged view for ${projectName || 'this project'} — project entries shadow same-named globals.`}
+        </span>
+        <div style={{ flex: 1 }} />
+        <button className="btn" onClick={() => setImportOpen(!importOpen)} style={{
+          background: T.surfaceAlt, color: T.text, border: `1px solid ${T.border}`,
+          padding: '5px 11px', borderRadius: 6, fontSize: 12, cursor: 'pointer',
+        }}>Import .env</button>
+        <button className="btn" onClick={openCreate} style={{
+          background: T.accent, color: '#fff', border: 'none',
+          padding: '5px 11px', borderRadius: 6, fontSize: 12, cursor: 'pointer',
+        }}>+ Add credential</button>
+      </div>
+
+      {error && (
+        <div style={{
+          padding: '8px 12px', borderRadius: 6, marginBottom: 10, fontSize: 12,
+          background: `${T.error}22`, color: T.error, border: `1px solid ${T.error}55`,
+        }}>{error}</div>
+      )}
+
+      {/* .env import */}
+      {importOpen && (
+        <div style={{
+          border: `1px solid ${T.border}`, borderRadius: 8, padding: 12,
+          marginBottom: 12, background: T.surface,
+        }}>
+          <span style={labelStyle}>Paste KEY=VALUE lines (comments and `export` prefixes are tolerated)</span>
+          <textarea rows={5} value={importText} onChange={e => setImportText(e.target.value)}
+            style={Object.assign({}, inputStyle, { fontFamily: 'monospace', resize: 'vertical' })}
+            autoComplete="off" spellCheck={false} />
+          <div style={{ display: 'flex', gap: 10, marginTop: 8, alignItems: 'center' }}>
+            {!isGlobal && (
+              <select value={importScope} onChange={e => setImportScope(e.target.value)}
+                style={Object.assign({}, inputStyle, { width: 150 })}>
+                <option value="project">project scope</option>
+                <option value="global">global scope</option>
+              </select>
+            )}
+            <button className="btn" disabled={busy} onClick={runImport} style={{
+              background: T.accent, color: '#fff', border: 'none',
+              padding: '5px 13px', borderRadius: 6, fontSize: 12, cursor: 'pointer',
+            }}>Import</button>
+          </div>
+        </div>
+      )}
+
+      {/* Create / edit form */}
+      {form && (
+        <div style={{
+          border: `1px solid ${T.accent}55`, borderRadius: 8, padding: 12,
+          marginBottom: 12, background: T.surface,
+        }}>
+          <div style={{ fontSize: 13, fontWeight: 600, color: T.text, marginBottom: 10 }}>
+            {editing ? `Edit '${form.name}'` : (isGlobal ? 'New global credential' : 'New credential')}
+          </div>
+          <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 10 }}>
+            <div>
+              <span style={labelStyle}>Name (env-var safe)</span>
+              <input value={form.name} disabled={editing}
+                onChange={e => setForm(Object.assign({}, form, { name: e.target.value }))}
+                style={inputStyle} autoComplete="off" spellCheck={false} />
+            </div>
+            <div>
+              <span style={labelStyle}>Scope</span>
+              {isGlobal ? (
+                <div style={Object.assign({}, inputStyle, { color: T.textMuted })}>global (all C3 projects)</div>
+              ) : (
+                <select value={form.scope} disabled={editing}
+                  onChange={e => setForm(Object.assign({}, form, { scope: e.target.value }))}
+                  style={inputStyle}>
+                  <option value="project">project (this project only)</option>
+                  <option value="global">global (all C3 projects)</option>
+                </select>
+              )}
+            </div>
+            <div style={{ gridColumn: '1 / -1' }}>
+              <span style={labelStyle}>
+                Value{editing ? ' (leave blank to keep the stored value)' : ''}
+              </span>
+              {form.type === 'multiline' ? (
+                <textarea rows={4} value={form.value}
+                  onChange={e => setForm(Object.assign({}, form, { value: e.target.value }))}
+                  style={Object.assign({}, inputStyle, { fontFamily: 'monospace', resize: 'vertical' })}
+                  autoComplete="new-password" spellCheck={false} />
+              ) : (
+                <input type="password" value={form.value}
+                  onChange={e => setForm(Object.assign({}, form, { value: e.target.value }))}
+                  style={inputStyle} autoComplete="new-password" />
+              )}
+            </div>
+            <div>
+              <span style={labelStyle}>Type</span>
+              <select value={form.type}
+                onChange={e => setForm(Object.assign({}, form, { type: e.target.value }))}
+                style={inputStyle}>
+                <option value="token">token — single secret</option>
+                <option value="env">env — env-style value</option>
+                <option value="multiline">multiline — .env blob / PEM</option>
+              </select>
+            </div>
+            <div>
+              <span style={labelStyle}>Env var at injection (default: name)</span>
+              <input value={form.env_var}
+                onChange={e => setForm(Object.assign({}, form, { env_var: e.target.value }))}
+                style={inputStyle} autoComplete="off" spellCheck={false} />
+            </div>
+            <div style={{ gridColumn: '1 / -1' }}>
+              <span style={labelStyle}>Description</span>
+              <input value={form.description}
+                onChange={e => setForm(Object.assign({}, form, { description: e.target.value }))}
+                style={inputStyle} autoComplete="off" />
+            </div>
+          </div>
+          <div style={{ display: 'flex', gap: 18, marginTop: 10, fontSize: 12, color: T.text }}>
+            <label style={{ display: 'flex', alignItems: 'center', gap: 6, cursor: 'pointer' }}>
+              <input type="checkbox" checked={!!form.inject}
+                onChange={e => setForm(Object.assign({}, form, { inject: e.target.checked }))} />
+              auto-inject into every c3_shell run
+            </label>
+            <label style={{ display: 'flex', alignItems: 'center', gap: 6, cursor: 'pointer' }}>
+              <input type="checkbox" checked={!!form.agent_readable}
+                onChange={e => setForm(Object.assign({}, form, { agent_readable: e.target.checked }))} />
+              agent_readable
+            </label>
+          </div>
+          {form.agent_readable && (
+            <div style={{
+              marginTop: 8, padding: '6px 10px', borderRadius: 6, fontSize: 11,
+              background: `${T.warn}22`, color: T.warn, border: `1px solid ${T.warn}55`,
+            }}>
+              ⚠ The agent will be able to reveal this value into its context and
+              conversation transcripts. Leave off for injection-only use.
+            </div>
+          )}
+          <div style={{ display: 'flex', gap: 10, marginTop: 12 }}>
+            <button className="btn" disabled={busy || !form.name.trim() || (!editing && !form.value)}
+              onClick={saveForm} style={{
+                background: T.accent, color: '#fff', border: 'none',
+                padding: '5px 15px', borderRadius: 6, fontSize: 12, cursor: 'pointer',
+                opacity: (busy || !form.name.trim() || (!editing && !form.value)) ? 0.5 : 1,
+              }}>Save</button>
+            <button className="btn" onClick={() => setForm(null)} style={{
+              background: T.surfaceAlt, color: T.text, border: `1px solid ${T.border}`,
+              padding: '5px 15px', borderRadius: 6, fontSize: 12, cursor: 'pointer',
+            }}>Cancel</button>
+          </div>
+        </div>
+      )}
+
+      {/* Entry list */}
+      {loading ? (
+        <div style={{ color: T.textMuted, fontSize: 13 }}>Loading…</div>
+      ) : entries.length === 0 ? (
+        <div style={{
+          border: `1px dashed ${T.border}`, borderRadius: 8, padding: 26,
+          textAlign: 'center', color: T.textMuted, fontSize: 13,
+        }}>
+          {isGlobal
+            ? <span>No global credentials yet. Add one here or run{' '}
+              <span className="mono">c3 creds set NAME --global</span>.</span>
+            : <span>No credentials registered for this project.</span>}
+        </div>
+      ) : (
+        <div style={{ border: `1px solid ${T.border}`, borderRadius: 8, overflow: 'hidden' }}>
+          {entries.map((entry, i) => {
+            const chk = checks[entry.name];
+            const shadowedIn = entry.shadowed_in || [];
+            return (
+              <div key={`${entry.scope}|${entry.name}`} style={{
+                display: 'flex', alignItems: 'center', flexWrap: 'wrap', gap: 8,
+                padding: '8px 12px', borderTop: i === 0 ? 'none' : `1px solid ${T.border}`,
+                background: i % 2 ? T.surfaceAlt : T.surface, fontSize: 12,
+              }}>
+                <I name="lock" size={13} color={T.textMuted} />
+                <span className="mono" style={{ fontWeight: 600, color: T.text, minWidth: 120 }}>
+                  {entry.name}
+                </span>
+                <Badge color={entry.scope === 'global' ? T.accent : T.ok}>{entry.scope}</Badge>
+                {!!entry.shadows_global && (
+                  <span title="This project's value wins over the global entry of the same name">
+                    <Badge color={T.warn}>shadows global</Badge>
+                  </span>
+                )}
+                {shadowedIn.length > 0 && (
+                  <span title={'Shadowed by a project-scoped entry in: '
+                    + shadowedIn.map(s => s.name || s.path).join(', ')}>
+                    <Badge color={T.warn}>shadowed in {shadowedIn.length}</Badge>
+                  </span>
+                )}
+                <Badge color={T.textMuted}>{entry.type || 'token'}</Badge>
+                <span className="mono" style={{ color: T.textMuted }}>
+                  •••• len={entry.value_len}
+                </span>
+                {entry.env_var && (
+                  <span className="mono" style={{ color: T.textMuted }}>→ ${entry.env_var}</span>
+                )}
+                {!!entry.inject && <Badge color={T.warn}>inject</Badge>}
+                {!!entry.agent_readable && <Badge color={T.error}>agent_readable</Badge>}
+                {chk && (
+                  <span className="mono" style={{
+                    color: chk.resolvable ? T.ok : T.error, fontSize: 11,
+                  }}>
+                    {chk.resolvable ? `✓ ${chk.fingerprint}` : '✗ unresolvable'}
+                  </span>
+                )}
+                <div style={{ flex: 1 }} />
+                <span style={{ color: T.textMuted, fontSize: 11 }}>
+                  used {entry.use_count || 0}× · {fmtWhen(entry.last_used)}
+                </span>
+                <span title="Verify the value resolves" onClick={() => checkEntry(entry)}
+                  style={{ cursor: 'pointer', color: T.textMuted }}>
+                  <I name="refresh" size={13} />
+                </span>
+                <span title={entry.inject ? 'Disable auto-inject' : 'Auto-inject into every c3_shell run'}
+                  onClick={() => toggleFlag(entry, 'inject')}
+                  style={{ cursor: 'pointer', color: entry.inject ? T.warn : T.textMuted }}>
+                  <I name="zap" size={13} />
+                </span>
+                <span title={entry.agent_readable
+                  ? 'Revoke agent reveal access'
+                  : 'Allow the agent to reveal this value (into its context!)'}
+                  onClick={() => toggleFlag(entry, 'agent_readable')}
+                  style={{ cursor: 'pointer', color: entry.agent_readable ? T.error : T.textMuted }}>
+                  <I name="eye" size={13} />
+                </span>
+                <span title="Edit metadata / replace value" onClick={() => openEdit(entry)}
+                  style={{ cursor: 'pointer', color: T.textMuted }}>
+                  <I name="edit" size={13} />
+                </span>
+                <span title="Delete" onClick={() => removeEntry(entry)}
+                  style={{ cursor: 'pointer', color: T.error }}>
+                  <I name="trash" size={13} />
+                </span>
+              </div>
+            );
+          })}
+        </div>
+      )}
+    </div>
+  );
+}
+
+// Top-level mainView='creds' page: Global vault | Projects sub-tabs.
+function HubCredentials({ projects, onOpenDrill }) {
+  const [sub, setSub] = useState('global');
+  const [ov, setOv] = useState(null);
+  const [ovErr, setOvErr] = useState(null);
+  const [expanded, setExpanded] = useState({}); // path -> bool
+
+  const loadOverview = async () => {
+    setOvErr(null);
+    try { setOv(await api.get('/api/hub/credentials/overview')); }
+    catch (e) { setOvErr(e.message); }
+  };
+  useEffect(() => { if (sub === 'projects' && !ov) loadOverview(); }, [sub, ov]);
+
+  const norm = (s) => String(s || '').replace(/\\/g, '/').toLowerCase();
+  const findProject = (row) => (projects || []).find(p => norm(p.path) === norm(row.path));
+
+  const subBtn = (id, label) => (
+    <button key={id} onClick={() => setSub(id)} style={{
+      display: 'inline-flex', alignItems: 'center', gap: 6, height: 28,
+      padding: '0 12px', border: 'none', cursor: 'pointer', fontSize: 12,
+      background: sub === id ? T.accentDim : 'transparent',
+      color: sub === id ? T.accent : T.textMuted,
+      fontWeight: sub === id ? 700 : 400,
+    }}>{label}</button>
+  );
+
+  return (
+    <div className="fade-up" style={{ maxWidth: 1100 }}>
+      <div style={{ display: 'flex', alignItems: 'center', gap: 10, marginBottom: 4 }}>
+        <I name="lock" size={18} color={T.accent} />
+        <span style={{ fontSize: 15, fontWeight: 600, color: T.text }}>Credentials</span>
+        <div style={{
+          display: 'inline-flex', marginLeft: 10, border: `1px solid ${T.border}`,
+          borderRadius: 6, overflow: 'hidden',
+        }}>
+          {subBtn('global', 'Global vault')}
+          {subBtn('projects', 'Projects')}
+        </div>
+        <div style={{ flex: 1 }} />
+        {sub === 'projects' && (
+          <button className="btn" onClick={loadOverview} title="Refresh" style={{
+            background: T.surfaceAlt, color: T.text, border: `1px solid ${T.border}`,
+            padding: '5px 11px', borderRadius: 6, fontSize: 12, cursor: 'pointer',
+          }}>Refresh</button>
+        )}
+      </div>
+      <div style={{ fontSize: 11, color: T.textMuted, marginBottom: 14, lineHeight: 1.5 }}>
+        Values live in the OS keyring (large values in an encrypted sidecar), are
+        submitted inbound-only and are <b>never</b> returned by any hub route. Agents
+        use them by name via <span className="mono">c3_shell env_creds</span> or{' '}
+        <span className="mono">{'{{cred:NAME}}'}</span> — decoded only at the subprocess
+        boundary. <b>Global</b> entries are visible in every C3 project;{' '}
+        <b>project</b> entries shadow same-named globals in their project.
+      </div>
+
+      {sub === 'global' ? (
+        <CredsManager path={null} onChanged={() => setOv(null)} />
+      ) : ovErr ? (
+        <div style={{
+          padding: '8px 12px', borderRadius: 6, fontSize: 12,
+          background: `${T.error}22`, color: T.error, border: `1px solid ${T.error}55`,
+        }}>Failed to load overview: {ovErr}</div>
+      ) : !ov ? (
+        <div style={{ color: T.textMuted, fontSize: 13 }}>Loading…</div>
+      ) : (ov.projects || []).length === 0 ? (
+        <div style={{
+          border: `1px dashed ${T.border}`, borderRadius: 8, padding: 26,
+          textAlign: 'center', color: T.textMuted, fontSize: 13,
+        }}>No projects registered in the hub.</div>
+      ) : (
+        <div style={{ display: 'flex', flexDirection: 'column', gap: 8 }}>
+          {(ov.projects || []).map(row => {
+            const open = !!expanded[row.path];
+            const proj = findProject(row);
+            const muted = !row.initialized || row.error;
+            return (
+              <div key={row.path} style={{
+                border: `1px solid ${T.border}`, borderRadius: 8,
+                background: T.surface, overflow: 'hidden',
+              }}>
+                <div onClick={() => !muted && setExpanded(prev =>
+                  Object.assign({}, prev, { [row.path]: !open }))}
+                  style={{
+                    display: 'flex', alignItems: 'center', gap: 10, padding: '9px 14px',
+                    cursor: muted ? 'default' : 'pointer', opacity: muted ? 0.55 : 1,
+                    fontSize: 12,
+                  }}>
+                  <span style={{ color: T.textMuted, fontSize: 10, width: 10 }}>
+                    {muted ? '' : (open ? '▾' : '▸')}
+                  </span>
+                  <span style={{ fontWeight: 600, color: T.text }}>{row.name || row.path}</span>
+                  <span className="mono" style={{
+                    color: T.textDim, fontSize: 11, overflow: 'hidden',
+                    textOverflow: 'ellipsis', whiteSpace: 'nowrap', maxWidth: 340,
+                  }}>{row.path}</span>
+                  <div style={{ flex: 1 }} />
+                  {row.error ? (
+                    <Badge color={T.error}>error</Badge>
+                  ) : !row.initialized ? (
+                    <Badge color={T.textMuted}>not initialized</Badge>
+                  ) : (
+                    <React.Fragment>
+                      <span style={{ color: T.textMuted, fontSize: 11 }}>
+                        {row.entries.length} project {row.entries.length === 1 ? 'entry' : 'entries'}
+                        {row.entries.filter(e => e.shadows_global).length > 0 &&
+                          ` · ${row.entries.filter(e => e.shadows_global).length} shadowing global`}
+                      </span>
+                      {proj && onOpenDrill && (
+                        <button className="btn" onClick={(e) => { e.stopPropagation(); onOpenDrill(proj, 'creds'); }}
+                          style={{
+                            background: T.surfaceAlt, color: T.text, border: `1px solid ${T.border}`,
+                            padding: '3px 9px', borderRadius: 6, fontSize: 11, cursor: 'pointer',
+                          }}>Open drill</button>
+                      )}
+                    </React.Fragment>
+                  )}
+                </div>
+                {row.error && (
+                  <div style={{ padding: '0 14px 9px 34px', fontSize: 11, color: T.error }}>{row.error}</div>
+                )}
+                {open && !muted && (
+                  <div style={{ padding: '4px 14px 14px', borderTop: `1px solid ${T.border}` }}>
+                    <CredsManager path={row.path} projectName={row.name}
+                      onChanged={loadOverview} />
+                  </div>
+                )}
+              </div>
+            );
+          })}
+        </div>
+      )}
+    </div>
+  );
+}

cli/hub_ui/components/topbar.js

@@ -38,7 +38,7 @@ function TopBar({ version, activeCount, darkMode, hubConfig, mainView, setMainVi
           display: 'inline-flex', marginLeft: 10, border: `1px solid ${T.border}`,
           borderRadius: 6, overflow: 'hidden',
         }}>
-          {[['projects', 'Projects', 'layers'], ['board', 'Tasks', 'check']].map(([id, label, icon]) => (
+          {[['projects', 'Projects', 'layers'], ['board', 'Tasks', 'check'], ['creds', 'Credentials', 'lock']].map(([id, label, icon]) => (
             <button key={id} onClick={() => setMainView(id)} style={{
               display: 'inline-flex', alignItems: 'center', gap: 6, height: 28,
               padding: '0 12px', border: 'none', cursor: 'pointer', fontSize: 12,

{code_context_control-2.58.0.dist-info → code_context_control-2.59.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.58.0
+Version: 2.59.0
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Copilot, Cursor, Antigravity). Retrieve less, read less, edit safer — version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP), and manage multi-project + sub-project hierarchies from a local hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -358,6 +358,14 @@ global secrets (realm-atomic resolution, tested), cross-project shells run
 with credentials disabled, and the vault is hard-excluded from the Oracle
 Discovery API.
 
+Since **v2.59.0** the Hub has a top-level **Credentials** view: manage the
+global vault (`~/.c3`) and every registered project's entries from one place —
+create / edit / delete / `.env` import / flag toggles, with shadowing shown
+both ways ("shadows global" on project entries, "shadowed in N projects" on
+globals). The write-only wire contract extends to the hub: values are
+submitted inbound-only and **no hub route ever returns a stored value** (there
+is no `reveal` on the hub at all).
+
 ### Jira — Cloud + Data Center (v2.56.0)
 
 `c3_jira` connects to Jira Cloud (REST v3, email + API token) or self-hosted

{code_context_control-2.58.0.dist-info → code_context_control-2.59.0.dist-info}/RECORD

@@ -1,6 +1,6 @@
 cli/__init__.py,sha256=ec66drCZGNMRU4V6ov0zVhYZph1us12Vn8OvG_LJyRY,22
 cli/_hook_utils.py,sha256=tJ4ZmXD5Y-JjFWb0uoR7ycYklYFUMnnjF2G7BO-wyBI,12600
-cli/c3.py,sha256=XAMKweN2-rRUWsH0opfVQ-1xgP-oDR5tG6a4ZMq6xU4,322126
+cli/c3.py,sha256=aa7hBkW_gt95oqoy4xQhChHtOdL7cmamdrL_cCrMgX0,322126
 cli/docs.html,sha256=bNymSz7LatnWHjxSXL92QSUtGvB3jBzNHbOV-bRpAOo,142507
 cli/edits.html,sha256=UjAhoCmBmQ89cklGvJqzC6eyNP2tc8H6T-e01DVkLvE,43418
 cli/hook_artifact.py,sha256=Se1CNBfoBFyvJQlRmYdNtdRXIkQp9zaF0O6ndRMo7ts,2198
@@ -18,7 +18,7 @@ cli/hook_read.py,sha256=ZWZldgqGSNz78COhlgETQ7yxdOW5vWIIHUet9gZKhxk,8176
 cli/hook_session_stats.py,sha256=hZiX0r1SLOstu1PXvygWae0cIqHCcC3mb0SbFL6nCic,2083
 cli/hook_terse_advisor.py,sha256=W_zaTfX2akgX-ifuUTsLu2H1atM8XmWt6jpPoeU7Pm0,6252
 cli/hub.html,sha256=Hl-XPZGT1mMiKrbX9c5OsEw6mXEumwIB3vp1WlWaplM,183966
-cli/hub_server.py,sha256=iJrrabNgnMqicclPcmDy0amEaDCATOqwzSBABmA31nk,113645
+cli/hub_server.py,sha256=jfBcqiQlcmwPMmMdNHbaN52l7Qzq-mMkDiy_JI6-Vs0,124815
 cli/hub_ui.html,sha256=nnGqWhWGCLfNisGUnoAlQFcBr6wPNsq-AEOR7uFtVkE,2942
 cli/mcp_proxy.py,sha256=92htuT-p0j-cDTbyqlIJpGoQ85_Aw7UuB8L_Toi_u20,17511
 cli/mcp_server.py,sha256=mt9ED7TKWttX5yV6fyiRSPAkx0_RcelyTENr67sgCcg,45144
@@ -35,9 +35,9 @@ cli/guide/getting-started.html,sha256=5iS-_iAP1PboU9pFbMsfh8C9Du9usqOfIyawOc-X4H
 cli/guide/index.html,sha256=mUDUBX590TTappvrKT7_eXi0P8G-3YvHjGk9pCcwWzQ,21350
 cli/guide/oracle.html,sha256=3HSyPB25mH83IwUeKjetykSOK0jwcui7OJkFoJLLWjg,22214
 cli/guide/shared.css,sha256=Mmm7W6aYxrkDq2RPOcyXiQFYGR-yB3auwX1uIWi6C74,15967
-cli/guide/tools.html,sha256=J_3ogwzUMm9KcHSzR-8BQMGuhEKKM-nNQd2m_Zx6GJw,75047
+cli/guide/tools.html,sha256=F1Qd38Q4UnSVMcfxJDtDQEfVrHmhK2aqSqKtNNx-jGs,79614
 cli/guide/workflow.html,sha256=gFUHUAVES4EG5nB3GARqQz_f62qvHCNfNsX4pvSgcPs,59044
-cli/hub_ui/app.js,sha256=XGmxjMrZS3qaxHLiaCggL2Wdm3qunsVq0NZlwft_Leo,6211
+cli/hub_ui/app.js,sha256=5W54CwLr60HL-HmKXT2GK8xFzLedZyMqWDYGDY9VtP0,6368
 cli/hub_ui/state.js,sha256=nlZtBU6WNJCMLiHRuj6AX5vkwWDvrcVjnK0oSaQALqI,6081
 cli/hub_ui/components/add_project.js,sha256=j5m0mX0gePcEYQW_0vodJkw5v8Vn2lQqPAI0miIGdv4,3182
 cli/hub_ui/components/config_editor.js,sha256=xew4RoxFt3j3r0UTkVc3-7y2Z1cOjx3dgRZMKSsCFhg,18211
@@ -46,8 +46,9 @@ cli/hub_ui/components/drill_health.js,sha256=Jpe-53gbN0WiV8Ao58WATk6UwT_yer85lvc
 cli/hub_ui/components/drill_panel.js,sha256=y7m52_3c6fs_RuZGyx3_gWcLWSVsNuCKlfkGv8HHXlI,8495
 cli/hub_ui/components/drill_subprojects.js,sha256=wdPNTIMrrLLQI5Qxi3xk-rZFMDO8pFT_HnbfzI4RCOI,23452
 cli/hub_ui/components/drill_tasks.js,sha256=1iG8Kx9vCoCIHFDXCVtGiw_HwYff3SuScM90tj0cFRQ,14245
-cli/hub_ui/components/drill_views.js,sha256=szfN_WbTiwrM0Sbs8jSTLIyKv9iq6iJjxXmWhHE5XwE,17417
+cli/hub_ui/components/drill_views.js,sha256=XtWP6CohPfmw0ZQoUANx4l77pz0_K6FS1XwgxsZNXYU,15397
 cli/hub_ui/components/global_search.js,sha256=GPfq1EsZa73vXBNCVn4VhT3a7gYkaUblbcXOFCe7PJQ,11395
+cli/hub_ui/components/hub_credentials.js,sha256=807HpYffR_uqkRExxLjfX8ziox_3jwoCq1bc1tC4LkY,24798
 cli/hub_ui/components/mcp_manager.js,sha256=KxA0LlpyNFDgtGxajoqwViJ0pJ0lsa1PqdCMNyyfhCo,17368
 cli/hub_ui/components/modals.js,sha256=3maxEVYIg4McqM-RiOQyr0wz0U08_plGifxVHw2CShQ,52437
 cli/hub_ui/components/project_card.js,sha256=PBHtRmh-bocIDkd_qlJmMoxQqQYTcDFFGmjmeSI560E,27219
@@ -58,7 +59,7 @@ cli/hub_ui/components/sidebar.js,sha256=RH0OlqCINFNCIXgns-wgge5gG8vkn5wyfRT87qdm
 cli/hub_ui/components/summary_bar.js,sha256=JnMq01Oum8DwwUOhFnX5mr8K7I-ERdPlbaBOR8QT72o,2993
 cli/hub_ui/components/task_board.js,sha256=QiWKmj1NkhkloGlfzZj_tWd7Sgz3xSxwVLp8I5OfIiM,15952
 cli/hub_ui/components/toasts.js,sha256=caj_x3npcM_wMv9E_xEde88jyfXI-jt8RrDQW_yXz5k,3376
-cli/hub_ui/components/topbar.js,sha256=NB4h8W-M5FexGZsBCvFfl7EBgCKI253soo1ZcmoppxA,4345
+cli/hub_ui/components/topbar.js,sha256=vgQpNB77iJRjd5KTX3BJwvqN0pwd46tiVpKFaMUFoIU,4379
 cli/tools/__init__.py,sha256=HO6eVKzDm1KPqsKTHY6lfIsnFnv3C7Bd9o3Q_V88idg,127
 cli/tools/_helpers.py,sha256=Yo_ol8bFT2R5ayjT54pXLVZhW_PgpBVoM8I7pDoomCI,7823
 cli/tools/agent.py,sha256=fdt5kmw9O-AEKlYaij-PPmCJ4sI7bmdej56V4NGWaqI,48145
@@ -100,7 +101,7 @@ cli/ui/components/sessions.js,sha256=FIKtil76B8tCkAmcFV7hlj6GQ_DCJK2jCzvEmdK7NBE
 cli/ui/components/settings.js,sha256=ATbAjBlVIwCNpxq7s191b49a_INQV38iwmySqtJLYwY,79066
 cli/ui/components/sidebar.js,sha256=K2ym2kUgpbyG-EBA_wBIIiqQY8qTatsiBZwzseMWuIQ,9939
 cli/ui/components/tasks.js,sha256=vyKQ3uwoppMwvdEaHlhWXW4oWcAisx4NveqzMhsYqHo,38438
-code_context_control-2.58.0.dist-info/licenses/LICENSE,sha256=l8Kh5QCNWNvR6kIt8L0BUZvc2LAFiHv2c-FnsGnUZf4,11301
+code_context_control-2.59.0.dist-info/licenses/LICENSE,sha256=l8Kh5QCNWNvR6kIt8L0BUZvc2LAFiHv2c-FnsGnUZf4,11301
 core/__init__.py,sha256=TSDCEcM4V7gcZVM3w2ykJaqEUch4Dkon-rivV17T73s,2501
 core/config.py,sha256=YmkcZwedz_lfDM0ZuI_f4xpe98ixPLcSQFcTCHgRiRg,19206
 core/ide.py,sha256=V6VVMVsFdmmcsMyxikjQp7z9xa42CWiHKS-ya-MAcG4,6172
@@ -161,7 +162,7 @@ services/claude_md.py,sha256=Mh5qiWGNCcA1rKpl1lPC3PtcCaNxMMFMjhpacohOIcs,44001
 services/compressor.py,sha256=AK31TqHFpkOD_Lqbp9aEOkOx7zENUwpsQHQ9B2imEHo,33081
 services/context_snapshot.py,sha256=2f_bxY3xX4ZC653ncYno8YSeSTFSavwBjrorytHA0Ns,16879
 services/conversation_store.py,sha256=-E2H6f9pMSOHiBjsq7tFUjrFAwWYExf7LJkibi5MRMA,35650
-services/credential_store.py,sha256=MzrViF6TbxiFTol-WbE4EMGBSQ1I5eJ0FFaA9F1XSRQ,23135
+services/credential_store.py,sha256=4LAolC_fBjFgW-Lg8yMpoRwFh0dwi-raP1UMw5z3YbA,23270
 services/doc_index.py,sha256=ZEQD1kyGCAMm9AY4Kpi1zDWJTul-cAcAdi_4Md43Hpw,19205
 services/e2e_benchmark.py,sha256=4pDXkOFjq5b2ZwDvMK0CWdUXQli5OE4cOh_OJs7W36c,132970
 services/e2e_evaluator.py,sha256=FsB4vMzcFUcmicfIwRtA8JZ_XeMpuk2_-86F2iVNEDc,17783
@@ -237,8 +238,8 @@ tui/screens/search_view.py,sha256=MMHjVdlk3HZSuDBSvq8IGrqv_Mh5Us6YqXQ80bcWSMk,19
 tui/screens/session_view.py,sha256=eZ1eDwHTvPOck1wCCviixtOaCxIkBT_95ytNNNriGNA,5991
 tui/screens/stats.py,sha256=p81PjzdaIv7hllb8f45-rlVe4lJZwSdIMqu7e86_u5s,6223
 tui/screens/ui_view.py,sha256=1QJCgLh2YfgWIpvzRG1KOGXYEaOYX6ojN61Azjf2oX0,2125
-code_context_control-2.58.0.dist-info/METADATA,sha256=m1ZYcCxbV_MAEuNd4TFidqWWD5mpqfIjlNMMBfqSwBs,29637
-code_context_control-2.58.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
-code_context_control-2.58.0.dist-info/entry_points.txt,sha256=7kX_WUsDCF2hbXzvbNyscyaBb9AeA-DJY5v_5hN0DlU,93
-code_context_control-2.58.0.dist-info/top_level.txt,sha256=wRt41zBybVF3qAiNXHz9BURbkKvUvfhmWWtKMhaw6eE,29
-code_context_control-2.58.0.dist-info/RECORD,,
+code_context_control-2.59.0.dist-info/METADATA,sha256=--W3obwi4LV8oMlP8tLSGAarOEPTsuPDA8Qe0nG3qJ0,30130
+code_context_control-2.59.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+code_context_control-2.59.0.dist-info/entry_points.txt,sha256=7kX_WUsDCF2hbXzvbNyscyaBb9AeA-DJY5v_5hN0DlU,93
+code_context_control-2.59.0.dist-info/top_level.txt,sha256=wRt41zBybVF3qAiNXHz9BURbkKvUvfhmWWtKMhaw6eE,29
+code_context_control-2.59.0.dist-info/RECORD,,

services/credential_store.py

@@ -98,6 +98,11 @@ def _global_base() -> Optional[Path]:
         return None
 
 
+def global_base() -> Optional[Path]:
+    """Public accessor for the global-scope base directory (home)."""
+    return _global_base()
+
+
 def _project_is_home(project_path: str) -> bool:
     home = _global_base()
     if home is None: