code-context-control 2.58.0__py3-none-any.whl → 2.60.0__py3-none-any.whl

cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.58.0"
+__version__ = "2.60.0"
 
 
 def _command_deps() -> CommandDeps:
@@ -1313,6 +1313,12 @@ def cmd_claudemd(args):
     return common_cmd_claudemd(args, _command_deps())
 
 
+def cmd_map(args):
+    """Live repo map (.c3/MAP.md) commands."""
+    from cli.commands.common import cmd_map as common_cmd_map
+    return common_cmd_map(args, _command_deps())
+
+
 def cmd_stats(args):
     """Show comprehensive stats."""
     return common_cmd_stats(args, _command_deps())
@@ -7162,6 +7168,7 @@ def main():
         "decode": cmd_decode,
         "session": cmd_session,
         "claudemd": cmd_claudemd,
+        "map": cmd_map,
         "stats": cmd_stats,
         "benchmark": cmd_benchmark,
         "session-benchmark": cmd_session_benchmark,

cli/commands/common.py

@@ -159,6 +159,57 @@ def cmd_session(args, deps: CommandDeps):
         print(context)
 
 
+def cmd_map(args, deps: CommandDeps):
+    """Live repo map (.c3/MAP.md): status | ensure | refresh."""
+    config = deps.load_config()
+    project_path = config.get("project_path", ".")
+
+    from services.repo_map import RepoMapService
+
+    sm = deps.SessionManager(project_path)
+    svc = RepoMapService(project_path, session_mgr=sm)
+
+    if args.map_cmd == "status":
+        result = svc.status()
+    elif args.map_cmd == "ensure":
+        result = svc.ensure()
+    else:
+        result = svc.refresh()
+
+    if getattr(args, "json", False):
+        print(json.dumps(result, indent=2))
+        return
+
+    if args.map_cmd == "status":
+        state = "STALE" if result["stale"] else ("FRESH" if result["exists"] else "MISSING")
+        deps.print_header(f"Repo Map — {state}")
+        print(f"  Path: {svc.map_path}")
+        if result.get("generated_at"):
+            print(f"  Generated: {result['generated_at']}")
+        if result.get("tokens"):
+            print(f"  Tokens: {result['tokens']}")
+        if result.get("reasons"):
+            print(f"  Stale reasons: {', '.join(result['reasons'])}")
+        if result.get("truncated"):
+            print("  [WARN] Map is truncated (file cap or token budget hit)")
+    else:
+        action = result.get("action", "?")
+        label = {
+            "regenerated": "Map regenerated",
+            "meta_only": "Content unchanged (meta refreshed)",
+            "fresh": "Already fresh — nothing to do",
+            "locked": "Another process is regenerating — skipped",
+            "disabled": "Repo map disabled (map.enabled=false in .c3/config.json)",
+        }.get(action, action)
+        deps.print_header(f"Repo Map — {label}")
+        if result.get("tokens"):
+            print(f"  Tokens: {result['tokens']}, duration: {result.get('duration_ms', '?')}ms")
+        if result.get("reasons"):
+            print(f"  Triggered by: {', '.join(result['reasons'])}")
+        if result.get("truncated"):
+            print("  [WARN] Map is truncated (file cap or token budget hit)")
+
+
 def cmd_claudemd(args, deps: CommandDeps):
     """Instructions file generation commands."""
     config = deps.load_config()

cli/commands/parser.py

@@ -61,6 +61,10 @@ def build_parser(version: str, parse_cli_ide_arg):
     p_claudemd.add_argument("claudemd_cmd", choices=["generate", "save", "check"])
     p_claudemd.add_argument("--nano", action="store_true", help="Generate nano mode (~250 tokens) instead of full compact mode")
 
+    p_map = subparsers.add_parser("map", help="Live repo map (.c3/MAP.md) management")
+    p_map.add_argument("map_cmd", choices=["status", "ensure", "refresh"])
+    p_map.add_argument("--json", action="store_true", help="Emit JSON result")
+
     subparsers.add_parser("stats", help="Show statistics")
 
     p_benchmark = subparsers.add_parser("benchmark", help="Run with/without-C3 workflow benchmark")

cli/guide/tools.html

@@ -125,6 +125,8 @@
       <div class="sidebar-label">SCM</div>
       <a href="#c3_task" class="sidebar-link"><span class="icon">✅</span> c3_task</a>
       <a href="#c3_bitbucket" class="sidebar-link"><span class="icon">🪣</span> c3_bitbucket</a>
+      <a href="#c3_credentials" class="sidebar-link"><span class="icon">🔐</span> c3_credentials</a>
+      <a href="#c3_jira" class="sidebar-link"><span class="icon">🎫</span> c3_jira</a>
     </div>
     <div class="sidebar-section">
       <div class="sidebar-label">Cross-project</div>
@@ -161,6 +163,8 @@
         <a href="#c3_task" class="toc-item">c3_task <span class="cat">PM</span></a>
         <a href="#c3_artifacts" class="toc-item">c3_artifacts <span class="cat">Config</span></a>
         <a href="#c3_bitbucket" class="toc-item">c3_bitbucket <span class="cat">SCM</span></a>
+        <a href="#c3_credentials" class="toc-item">c3_credentials <span class="cat">Secrets</span></a>
+        <a href="#c3_jira" class="toc-item">c3_jira <span class="cat">Issues</span></a>
         <a href="#c3_project"  class="toc-item">c3_project  <span class="cat">Multi-project</span></a>
       </div>
     </div>
@@ -1239,6 +1243,96 @@ c3_bitbucket(action=<span class="str">'merge_pr'</span>, pr_id=<span class="num"
           <p class="tool-desc"><strong>Audit trail:</strong> mutating actions (<code>merge_pr</code>, <code>create_branch</code>, <code>delete_branch</code>, webhook writes, etc.) are appended to the C3 edit ledger so the local audit log covers platform-side state changes too.</p>
         </div>
       </div>
+
+      <!-- c3_credentials -->
+      <div class="tool-card" id="c3_credentials">
+        <div class="tool-card-header">
+          <span class="tool-name">c3_credentials</span>
+          <div class="tag-row">
+            <span class="badge badge-purple">secrets</span>
+            <span class="badge">v2.58.0</span>
+          </div>
+          <span class="tool-tagline">Credential vault — the agent uses secrets by name, never by value</span>
+        </div>
+        <div class="tool-card-body">
+          <p class="tool-desc">A user-managed secret store, <strong>global</strong> (<code>~/.c3</code>, visible in every project) or <strong>per-project</strong> (<code>.c3</code>, shadows the same-named global). Values live in the OS keyring (service <code>c3-creds</code>; values over ~1KB in a Fernet-encrypted <code>.c3/secrets.enc</code> whose random master key is itself a keyring entry) — never in config files, and <em>never in the model's context</em>. <strong>Injection-first:</strong> the agent addresses secrets by name and C3 decodes them only at the subprocess boundary — <code>c3_shell(env_creds='A,B')</code> injects env vars, <code>{{cred:NAME}}</code> inside <code>cmd</code> expands server-side, and <code>inject</code>-flagged entries auto-inject into every shell run; echoed values are redacted back to <code>[cred:NAME]</code>. Resolution is <strong>realm-atomic</strong>: a project-registered name resolves in the project realm or not at all, so a hostile repo's committed config can never siphon your global values (tested).</p>
+
+          <h4>Actions</h4>
+          <table class="params-table">
+            <thead><tr><th>Action</th><th>Group</th><th>Description</th></tr></thead>
+            <tbody>
+              <tr><td class="param-name">list</td><td>Read</td><td class="param-desc">Merged registry (project shadows global) — names, scope, type, flags, usage. Never values</td></tr>
+              <tr><td class="param-name">describe</td><td>Read</td><td class="param-desc">Metadata + storage + live fingerprint (first 8 hex of SHA-256, computed on demand, never persisted)</td></tr>
+              <tr><td class="param-name">check</td><td>Read</td><td class="param-desc">Resolvability probe — does the stored value decode?</td></tr>
+              <tr><td class="param-name">set</td><td>Write</td><td class="param-desc">Create/replace an entry. <code>agent_readable</code> may be set at creation only — raising it on an existing entry is user-only</td></tr>
+              <tr><td class="param-name">delete</td><td>Write</td><td class="param-desc">Remove value + registry entry (owning scope inferred when omitted)</td></tr>
+              <tr><td class="param-name">reveal</td><td>Gated</td><td class="param-desc">The only value-returning action — refused unless the user enabled <code>agent_readable</code> on that entry</td></tr>
+            </tbody>
+          </table>
+
+          <h4>Examples</h4>
+          <pre><code><span class="com"># What can I use? (names and metadata only)</span>
+c3_credentials(action=<span class="str">'list'</span>)
+c3_credentials(action=<span class="str">'check'</span>, name=<span class="str">'NPM_TOKEN'</span>)
+
+<span class="com"># USE a secret without ever seeing it</span>
+c3_shell(cmd=<span class="str">'npm publish'</span>, env_creds=<span class="str">'NPM_TOKEN'</span>)
+c3_shell(cmd=<span class="str">'curl -H "Authorization: Bearer {{cred:API_KEY}}" https://api.example.com'</span>)</code></pre>
+
+          <p class="tool-desc"><strong>Surfaces:</strong> the <code>c3 creds</code> CLI (<code>set</code> / <code>get</code> / <code>list</code> / <code>rm</code> / <code>import .env</code>, <code>--global</code> for the shared scope), a per-project dashboard <strong>Credentials</strong> tab, and — since v2.59.0 — a top-level <strong>Credentials</strong> view in the Hub: a Global-vault manager plus a per-project browser with shadowing shown both ways ("shadows global" on project entries, "shadowed in N projects" on globals); the Hub's per-project drill panel manages too. No HTTP route ever returns a stored value (write-only wire contract, endpoint-sweep tested), every mutation is ledger-logged by name, the vault is hard-excluded from the Oracle Discovery API, and cross-project (<code>c3_project</code>) shells run with credentials disabled.</p>
+        </div>
+      </div>
+
+      <!-- c3_jira -->
+      <div class="tool-card" id="c3_jira">
+        <div class="tool-card-header">
+          <span class="tool-name">c3_jira</span>
+          <div class="tag-row">
+            <span class="badge badge-purple">issue tracking</span>
+            <span class="badge">v2.56.0</span>
+          </div>
+          <span class="tool-tagline">Jira Cloud + Data Center — search, create, transition, comment through one tool</span>
+        </div>
+        <div class="tool-card-body">
+          <p class="tool-desc">One tool for both Jira deployments: <strong>Cloud</strong> (REST v3, email + API token, ADF bodies handled transparently) and self-hosted <strong>Data Center / Server</strong> (REST v2, PAT Bearer, plain-text bodies) — normalized to a single DTO surface with an opaque pagination cursor. Transport is stdlib <code>urllib</code> (no new dependencies); reads get one bounded 429 retry honoring <code>Retry-After</code>, mutations are <em>never</em> auto-retried. Tokens live in the OS keyring keyed by <code>(base_url, username)</code>; the <code>jira</code> config section resolves project → home <strong>wholesale from a single file</strong>, so a repository's committed config can never field-override a home account's URL or TLS settings (credential-redirect hardening). HTTPS-only.</p>
+
+          <p class="tool-desc"><strong>Setup:</strong> <code>c3 jira login --url https://yoursite.atlassian.net</code> (Cloud inferred for <code>*.atlassian.net</code>; add <code>--deployment data_center</code> for self-hosted, <code>--ca-bundle</code> for enterprise certs, <code>--global</code> for a home config reusable across projects), then <code>c3 jira set-default --project PROJ</code>. Manage accounts with <code>c3 jira status / use / logout</code>.</p>
+
+          <h4>Actions</h4>
+          <table class="params-table">
+            <thead><tr><th>Action</th><th>Group</th><th>Description</th></tr></thead>
+            <tbody>
+              <tr><td class="param-name">status, whoami</td><td>Read</td><td class="param-desc">Active account, deployment, defaults, server probe / authenticated user</td></tr>
+              <tr><td class="param-name">search</td><td>Read</td><td class="param-desc">Raw JQL, paginated (helper-built JQL elsewhere is always quoted)</td></tr>
+              <tr><td class="param-name">my_issues</td><td>Read</td><td class="param-desc">Open issues assigned to the token's user (statusCategory-aware)</td></tr>
+              <tr><td class="param-name">get_issue, list_projects, list_transitions</td><td>Read</td><td class="param-desc">Issue detail with comments / project discovery / legal transitions for an issue</td></tr>
+              <tr><td class="param-name">get_create_metadata, search_users</td><td>Read</td><td class="param-desc">Required + allowed fields per project/type; user lookup for assignment</td></tr>
+              <tr><td class="param-name">create_issue</td><td>Write</td><td class="param-desc">Pre-validates against create metadata and returns machine-readable missing required fields instead of guessing defaults</td></tr>
+              <tr><td class="param-name">comment, transition, assign</td><td>Write</td><td class="param-desc">Comment on / move (accepts transition id <em>or</em> name) / assign an issue</td></tr>
+            </tbody>
+          </table>
+
+          <h4>Examples</h4>
+          <pre><code><span class="com"># Connection + account probe, then my open work</span>
+c3_jira(action=<span class="str">'status'</span>)
+c3_jira(action=<span class="str">'my_issues'</span>)
+
+<span class="com"># Raw JQL search</span>
+c3_jira(action=<span class="str">'search'</span>, jql=<span class="str">'project = PROJ AND status != Done ORDER BY updated DESC'</span>)
+
+<span class="com"># Create — required fields come from metadata, not guesses</span>
+c3_jira(action=<span class="str">'get_create_metadata'</span>, project=<span class="str">'PROJ'</span>, issue_type=<span class="str">'Task'</span>)
+c3_jira(action=<span class="str">'create_issue'</span>, project=<span class="str">'PROJ'</span>, issue_type=<span class="str">'Task'</span>,
+        summary=<span class="str">'Fix login flow'</span>, description=<span class="str">'Steps in thread'</span>)
+
+<span class="com"># Move it along — id or name both work</span>
+c3_jira(action=<span class="str">'list_transitions'</span>, issue=<span class="str">'PROJ-123'</span>)
+c3_jira(action=<span class="str">'transition'</span>, issue=<span class="str">'PROJ-123'</span>, transition=<span class="str">'In Progress'</span>)
+c3_jira(action=<span class="str">'comment'</span>, issue=<span class="str">'PROJ-123'</span>, body=<span class="str">'Deployed to staging'</span>)</code></pre>
+
+          <p class="tool-desc"><strong>Surfaces &amp; audit:</strong> the per-project dashboard gets a <strong>Jira tab</strong> (My Work board grouped by statusCategory, JQL search, an issue drawer with transition buttons + comments, and an Activity view) backed by <code>/api/jira/*</code> routes. Issue keys like <code>PROJ-123</code> are auto-linked from branch names and edit-ledger entries (acronym denylist, so UTF-8 / SHA-256 / CVE-2024 never match), and the issue drawer shows the local ledger activity for the open issue — that Activity view works with no account configured. Mutations (<code>create_issue</code>, <code>comment</code>, <code>transition</code>, <code>assign</code>) are edit-ledger-logged with identifiers only — bodies are never logged. Read actions are safe in plan mode.</p>
+        </div>
+      </div>
     </div>
 
     <!-- ═══════════════════════════════════════ CROSS-PROJECT ═════ -->

cli/guide/workflow.html

@@ -250,6 +250,7 @@
       <a href="#session-restart" class="sidebar-link"><span class="icon">🔄</span> Session Restart</a>
       <a href="#terse-skill" class="sidebar-link"><span class="icon">⚡</span> /terse Skill</a>
       <a href="#subprojects" class="sidebar-link"><span class="icon">🌳</span> Sub-projects</a>
+      <a href="#repo-map" class="sidebar-link"><span class="icon">🗺️</span> Live Repo Map</a>
       <a href="#native-fallback" class="sidebar-link"><span class="icon">⚠️</span> Native Fallback</a>
     </div>
   </aside>
@@ -984,6 +985,53 @@ c3_memory(action=<span class="str">'recall'</span>, query=<span class="str">'pay
 
     <hr class="divider">
 
+    <!-- Live repo map -->
+    <section class="section" id="repo-map">
+      <div class="section-title"><span class="icon">🗺️</span> Live Repo Map (v2.60.0)</div>
+
+      <p>Instruction docs (CLAUDE.md / AGENTS.md) no longer embed a frozen project tree. They carry a stable pointer to <code>.c3/MAP.md</code> — a machine-owned map C3 keeps fresh automatically. One map serves every consumer: Claude Code, Codex, Antigravity.</p>
+
+      <p>The map contains, in priority order: build/test commands, entry points, module one-liners, the depth-2 tree, and key files — under a token budget (default 1000). Sub-projects appear as boundaries and are never expanded into the parent map.</p>
+
+      <h4>How it stays fresh</h4>
+      <table class="table">
+        <thead><tr><th>Trigger</th><th>What happens</th></tr></thead>
+        <tbody>
+          <tr>
+            <td>Structural edit (file created/deleted/renamed, manifest changed)</td>
+            <td>Edit-ledger paths touch the <code>.c3/map.dirty</code> sentinel — a file-touch, never a scan</td>
+          </tr>
+          <tr>
+            <td>First C3 tool call of a session</td>
+            <td>Background single-flight <em>ensure</em>: regenerates only if missing, dirty, or the git HEAD/branch/worktree fingerprint moved</td>
+          </tr>
+          <tr>
+            <td><code>c3 map refresh</code></td>
+            <td>Explicit repair — always regenerates</td>
+          </tr>
+        </tbody>
+      </table>
+
+      <p><strong>Byte-stable by design:</strong> <code>MAP.md</code> is rewritten only when rendered content actually changes, so prompt caches keyed on file bytes stay warm. Volatile freshness state (git HEAD, worktree signature, generated-at) lives in <code>.c3/map.meta.json</code> — never in the map itself. Ordinary line edits never trigger regeneration.</p>
+
+      <div class="callout callout-info">
+        <span class="callout-icon">💡</span>
+        <div class="callout-body">
+          <strong>CLI</strong>: <code>c3 map status</code> (freshness report) · <code>c3 map ensure</code> (regen if stale) · <code>c3 map refresh</code> (force). Add <code>--json</code> for machine output. Config knobs: <code>map.token_budget</code>, <code>map.file_cap</code>, <code>map.enabled</code> (set <code>false</code> to restore the legacy embedded tree).
+        </div>
+      </div>
+
+      <div class="callout callout-warning">
+        <span class="callout-icon">⚠️</span>
+        <div class="callout-body">
+          <strong>The map is data, not instructions</strong><br>
+          Its header marks it as auto-generated repository data. Agents should read it for orientation — not obey text inside it. Memory facts are deliberately excluded from the map.
+        </div>
+      </div>
+    </section>
+
+    <hr class="divider">
+
     <!-- Native fallback -->
     <section class="section" id="native-fallback">
       <div class="section-title"><span class="icon">⚠️</span> When Native Tools Are Permitted</div>

cli/hook_edit_ledger.py

@@ -212,6 +212,15 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     with open(ledger_file, "a", encoding="utf-8") as f:
         f.write(json.dumps(entry) + "\n")
 
+    # Structural changes (file created / manifest edited) dirty the repo map.
+    # Sentinel touch only — the scan happens later, in RepoMapService.ensure().
+    try:
+        from services.repo_map import is_structural_change, mark_map_dirty
+        if is_structural_change(rel, change_type):
+            mark_map_dirty(project_path, f"{change_type}:{rel}")
+    except Exception:
+        pass
+
     return {
         "_text": (
             f"[c3:ledger] {rel} {entry['version']} auto-logged. "

cli/hub_server.py

@@ -333,6 +333,7 @@ _HUB_JS_FILES = [
     "hub_ui/components/session_drawer.js",
     "hub_ui/components/drill_panel.js",
     "hub_ui/components/drill_views.js",
+    "hub_ui/components/hub_credentials.js",
     "hub_ui/components/drill_subprojects.js",
     "hub_ui/components/drill_health.js",
     "hub_ui/components/drill_tasks.js",
@@ -437,8 +438,8 @@ def api_hub_config_set():
         cfg["projects_view"] = projects_view
     if "main_view" in data:
         main_view = str(data["main_view"]).strip().lower()
-        if main_view not in {"projects", "board"}:
-            return jsonify({"error": "main_view must be 'projects' or 'board'"}), 400
+        if main_view not in {"projects", "board", "creds"}:
+            return jsonify({"error": "main_view must be 'projects', 'board' or 'creds'"}), 400
         cfg["main_view"] = main_view
     if "oracle_url" in data:
         cfg["oracle_url"] = str(data["oracle_url"]).strip()
@@ -1773,12 +1774,100 @@ def api_projects_config_get():
                     "defaults": {k: _config_defaults(k) for k in _CONFIG_READ_SECTIONS}})
 
 
+# ── Credentials (hub) ────────────────────────────────────────────────────────
+# Write-only wire contract, hub edition: values go IN over POST and are never
+# returned by any hub route (no reveal exists here). `credentials` stays out of
+# _CONFIG_WRITE_SECTIONS — these dedicated routes are the only hub write path.
+
+_CRED_PUBLIC_FIELDS = ("scope", "type", "value_len", "env_var", "inject",
+                       "agent_readable", "description", "storage", "created",
+                       "updated")
+
+
+def _cred_entry_public(name, entry, *, usage=None, shadows_global=None):
+    """Explicit allowlist serializer — structurally cannot emit a value."""
+    rec = {"name": name}
+    for key in _CRED_PUBLIC_FIELDS:
+        rec[key] = entry.get(key, "")
+    rec["value_len"] = entry.get("value_len", 0)
+    rec["inject"] = bool(entry.get("inject"))
+    rec["agent_readable"] = bool(entry.get("agent_readable"))
+    if usage is not None:
+        rec["last_used"] = (usage.get(name) or {}).get("last_used", "")
+        rec["use_count"] = (usage.get(name) or {}).get("use_count", 0)
+    if shadows_global is not None:
+        rec["shadows_global"] = bool(shadows_global)
+    return rec
+
+
+def _resolve_cred_target(path: str, scope: str, *, mutation: bool):
+    """Resolve a credentials request target to (project, store_path, error).
+
+    scope='global' with no path targets the shared vault (~/.c3) directly;
+    project scope requires a registered path. Mutations on a path without a
+    .c3/ dir get 409 needs_init so the hub can't scatter .c3 dirs around."""
+    from services import credential_store as cred_store
+    if scope not in ("project", "global"):
+        return None, "", (jsonify({"error": "scope must be 'project' or 'global'"}), 400)
+    if not path:
+        if scope == "project":
+            return None, "", (jsonify({"error": "path is required for project scope"}), 400)
+        home = cred_store.global_base()
+        if home is None:
+            return None, "", (jsonify({"error": "global scope unresolvable (no home dir)"}), 500)
+        return None, str(home), None
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return None, "", (jsonify({"error": str(e)}), 404)
+    if mutation and not (resolved / ".c3").is_dir():
+        return None, "", (jsonify({"error": "not initialized", "needs_init": True}), 409)
+    return resolved, str(resolved), None
+
+
+def _hub_cred_audit(action: str, name: str, scope: str, project) -> None:
+    """Names only — never values. Failure-safe. Project mutations audit to the
+    target project's ActivityLog + EditLedger; global-scope mutations also land
+    in ~/.c3/activity_log.jsonl so the shared vault keeps its own trail."""
+    if project is not None:
+        try:
+            from services.activity_log import ActivityLog
+            ActivityLog(str(project)).log("cred_action", {
+                "kind": "creds", "action": action, "name": name,
+                "scope": scope, "via": "hub",
+            })
+        except Exception:
+            pass
+        try:
+            from services.edit_ledger import EditLedger
+            EditLedger(str(project)).log_edit(
+                file=f"cred://{name}", change_type=f"cred_{action}",
+                summary=f"{action} {name} ({scope}) via Hub",
+                tags=["creds", action],
+                detail={"kind": "creds", "action": action, "name": name,
+                        "scope": scope},
+            )
+        except Exception:
+            pass
+    if scope == "global" or project is None:
+        try:
+            from services import credential_store as cred_store
+            from services.activity_log import ActivityLog
+            home = cred_store.global_base()
+            if home is not None:
+                ActivityLog(str(home)).log("cred_action", {
+                    "kind": "creds", "action": action, "name": name,
+                    "scope": scope, "via": "hub",
+                })
+        except Exception:
+            pass
+
+
 @app.route("/api/projects/credentials", methods=["GET"])
 def api_projects_credentials():
-    """Read-only masked credential registry for a project (global entries +
-    project shadows). Values never transit the hub — the explicit field
-    allowlist below returns metadata only; management lives in the project UI
-    (`credentials` is deliberately absent from _CONFIG_WRITE_SECTIONS)."""
+    """Masked credential registry for a project (global entries + project
+    shadows). Values never transit the hub outbound — the allowlist serializer
+    returns metadata, usage and shadow info only."""
     path = (request.args.get("path") or "").strip()
     if not path:
         return jsonify({"error": "path is required"}), 400
@@ -1787,22 +1876,174 @@ def api_projects_credentials():
     except ValueError as e:
         return jsonify({"error": str(e)}), 404
     from services import credential_store as cred_store
+    usage = cred_store.read_usage_state(str(resolved))
+    home = cred_store.global_base()
+    global_names = set(cred_store.list_entries(str(home))) if home else set()
     entries = []
     for name, entry in cred_store.list_entries(str(resolved)).items():
-        entries.append({
-            "name": name,
-            "scope": entry.get("scope", ""),
-            "type": entry.get("type", "token"),
-            "value_len": entry.get("value_len", 0),
-            "env_var": entry.get("env_var", ""),
-            "inject": bool(entry.get("inject")),
-            "agent_readable": bool(entry.get("agent_readable")),
-            "description": entry.get("description", ""),
-            "updated": entry.get("updated", ""),
-        })
+        entries.append(_cred_entry_public(
+            name, entry, usage=usage,
+            shadows_global=(entry.get("scope") == "project"
+                            and name in global_names)))
     return jsonify({"path": str(resolved), "entries": entries})
 
 
+@app.route("/api/projects/credentials", methods=["POST"])
+def api_projects_credentials_set():
+    """Create/update an entry from the hub. `value` optional — metadata-only
+    update when absent, touching ONLY the keys present in the payload; a
+    submitted value is stored and never echoed back. scope='global' with no
+    `path` targets the shared vault directly."""
+    from services import credential_store as cred_store
+    data = request.get_json(force=True) or {}
+    name = str(data.get("name") or "").strip()
+    scope = str(data.get("scope") or "project").strip().lower()
+    project, store_path, err = _resolve_cred_target(
+        str(data.get("path") or "").strip(), scope, mutation=True)
+    if err:
+        return err
+    value = str(data.get("value") or "")
+    ctype = str(data.get("type") or data.get("ctype") or "token")
+    try:
+        if value:
+            entry = cred_store.set_credential(
+                name, value, scope=scope, project_path=store_path, ctype=ctype,
+                description=str(data.get("description") or ""),
+                env_var=str(data.get("env_var") or ""),
+                agent_readable=bool(data.get("agent_readable")),
+                inject=bool(data.get("inject")))
+        else:
+            # Metadata-only update: touch ONLY the keys present in the payload
+            # so a single-field toggle can't clobber the others.
+            fields = {}
+            for key in ("description", "env_var"):
+                if key in data:
+                    fields[key] = str(data[key] or "")
+            for key in ("agent_readable", "inject"):
+                if key in data:
+                    fields[key] = bool(data[key])
+            if "type" in data or "ctype" in data:
+                fields["type"] = ctype
+            entry = cred_store.update_metadata(
+                name, scope=scope, project_path=store_path, **fields)
+    except cred_store.CredentialError as exc:
+        return jsonify({"error": str(exc)}), 400
+    except RuntimeError as exc:
+        return jsonify({"error": str(exc)}), 500
+    _hub_cred_audit("set" if value else "update", name, scope, project)
+    return jsonify({"entry": _cred_entry_public(name, {**entry, "scope": scope})})
+
+
+@app.route("/api/projects/credentials/import", methods=["POST"])
+def api_projects_credentials_import():
+    """Import KEY=VALUE lines (.env paste). Values are stored, never echoed."""
+    from services import credential_store as cred_store
+    data = request.get_json(force=True) or {}
+    scope = str(data.get("scope") or "project").strip().lower()
+    project, store_path, err = _resolve_cred_target(
+        str(data.get("path") or "").strip(), scope, mutation=True)
+    if err:
+        return err
+    try:
+        result = cred_store.import_env(
+            str(data.get("text") or ""), scope=scope, project_path=store_path,
+            overwrite=bool(data.get("overwrite")))
+    except cred_store.CredentialError as exc:
+        return jsonify({"error": str(exc)}), 400
+    except RuntimeError as exc:
+        return jsonify({"error": str(exc)}), 500
+    for created in result["created"]:
+        _hub_cred_audit("set", created, scope, project)
+    return jsonify(result)
+
+
+@app.route("/api/projects/credentials/<name>", methods=["DELETE"])
+def api_projects_credentials_delete(name):
+    """Delete an entry (value + registry). Scope inferred from the owning
+    realm when omitted."""
+    from services import credential_store as cred_store
+    scope = str(request.args.get("scope") or "").strip().lower()
+    path = str(request.args.get("path") or "").strip()
+    project, store_path, err = _resolve_cred_target(
+        path, scope or ("project" if path else "global"), mutation=True)
+    if err:
+        return err
+    if not scope:
+        entry = cred_store.get_entry(name, project_path=store_path)
+        scope = (entry.get("scope") or "project") if entry else \
+            ("project" if path else "global")
+    try:
+        removed = cred_store.delete_credential(
+            name, scope=scope, project_path=store_path)
+    except cred_store.CredentialError as exc:
+        return jsonify({"error": str(exc)}), 400
+    if removed:
+        _hub_cred_audit("delete", name, scope, project)
+    return jsonify({"removed": bool(removed), "scope": scope})
+
+
+@app.route("/api/projects/credentials/<name>/check", methods=["POST"])
+def api_projects_credentials_check(name):
+    """Resolvability probe — returns a fingerprint, never the value."""
+    from services import credential_store as cred_store
+    data = request.get_json(silent=True) or {}
+    path = str(data.get("path") or "").strip()
+    project, store_path, err = _resolve_cred_target(
+        path, "project" if path else "global", mutation=False)
+    if err:
+        return err
+    entry = cred_store.get_entry(name, project_path=store_path)
+    if not entry:
+        return jsonify({"error": f"no credential named '{name}'"}), 404
+    return jsonify({
+        "name": name,
+        "scope": entry["scope"],
+        "storage": entry.get("storage", "keyring"),
+        "resolvable": cred_store.get_value(name, project_path=store_path) is not None,
+        "fingerprint": cred_store.fingerprint(name, project_path=store_path),
+    })
+
+
+@app.route("/api/hub/credentials/overview", methods=["GET"])
+def api_hub_credentials_overview():
+    """Cross-project credential inventory: the global vault plus each
+    registered project's project-scoped entries, with shadow info both ways.
+    Metadata only — the allowlist serializer structurally cannot emit a value."""
+    from services import credential_store as cred_store
+    home = cred_store.global_base()
+    global_entries = cred_store.list_entries(str(home)) if home else {}
+    shadowed_in = {name: [] for name in global_entries}
+    projects_out = []
+    for p in _pm().list_projects():
+        ppath = str(p.get("path") or "")
+        row = {"name": p.get("name") or "", "path": ppath,
+               "initialized": True, "error": None, "entries": []}
+        try:
+            if not (Path(ppath) / ".c3").is_dir():
+                row["initialized"] = False
+            else:
+                usage = cred_store.read_usage_state(ppath)
+                for name, entry in cred_store.list_entries(ppath).items():
+                    if entry.get("scope") != "project":
+                        continue
+                    row["entries"].append(_cred_entry_public(
+                        name, entry, usage=usage,
+                        shadows_global=name in global_entries))
+                    if name in shadowed_in:
+                        shadowed_in[name].append(
+                            {"name": row["name"], "path": ppath})
+        except Exception as e:  # per-row isolation, like /api/search/global
+            row["error"] = str(e)
+        projects_out.append(row)
+    global_usage = cred_store.read_usage_state(str(home)) if home else {}
+    global_out = [
+        {**_cred_entry_public(name, entry, usage=global_usage),
+         "shadowed_in": shadowed_in.get(name, [])}
+        for name, entry in global_entries.items()
+    ]
+    return jsonify({"global": {"entries": global_out}, "projects": projects_out})
+
+
 @app.route("/api/projects/config", methods=["PUT"])
 def api_projects_config_put():
     """Whitelisted section write: deep-merge, atomic replace, audited on the target."""

cli/hub_ui/app.js

@@ -17,7 +17,7 @@ function App() {
   const [version, setVersion] = useState('');
   const [projects, setProjects] = useState([]);
   const [loaded, setLoaded] = useState(false);
-  const [mainView, setMainView] = useState('projects'); // projects | board
+  const [mainView, setMainView] = useState('projects'); // projects | board | creds
   const [filter, setFilter] = useState('all');          // all | active | idle | tag:<x>
   const [search, setSearch] = useState('');
   const [view, setView] = useState('list');             // list | grid
@@ -44,7 +44,7 @@ function App() {
       if (cfg.projects_view === 'grid') setView('grid');
       if (cfg.sidebar_collapsed != null) setSidebarCollapsed(!!cfg.sidebar_collapsed);
       if (cfg.sidebar_group) setFilter(cfg.sidebar_group);
-      if (cfg.main_view === 'board') setMainView('board');
+      if (cfg.main_view === 'board' || cfg.main_view === 'creds') setMainView(cfg.main_view);
     } catch { }
     try { const v = await api.get('/api/version'); setVersion(v.c3_version || ''); } catch { }
   }, []);
@@ -112,6 +112,8 @@ function App() {
         }}>
           {mainView === 'board' ? (
             <TaskBoard projects={projects} onOpenDrill={openDrill} />
+          ) : mainView === 'creds' ? (
+            <HubCredentials projects={projects} onOpenDrill={openDrill} />
           ) : (
             <React.Fragment>
               <SummaryBar projects={projects} search={search} setSearch={setSearch}