code-context-control 2.60.0__tar.gz → 2.61.0__tar.gz

{code_context_control-2.60.0 → code_context_control-2.61.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.60.0
+Version: 2.61.0
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Copilot, Cursor, Antigravity). Retrieve less, read less, edit safer — version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP), and manage multi-project + sub-project hierarchies from a local hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -361,12 +361,30 @@ with credentials disabled, and the vault is hard-excluded from the Oracle
 Discovery API.
 
 Since **v2.59.0** the Hub has a top-level **Credentials** view: manage the
-global vault (`~/.c3`) and every registered project's entries from one place —
-create / edit / delete / `.env` import / flag toggles, with shadowing shown
-both ways ("shadows global" on project entries, "shadowed in N projects" on
-globals). The write-only wire contract extends to the hub: values are
-submitted inbound-only and **no hub route ever returns a stored value** (there
-is no `reveal` on the hub at all).
+global vault (`~/.c3`) and every registered project's entries from one place,
+with overriding shown both ways ("overrides global" on project entries,
+"overridden ×N" on globals). **v2.61.0** makes it navigable at scale:
+
+- **Cross-project search** — <kbd>/</kbd> or <kbd>Ctrl/⌘-K</kbd>. Free words
+  match name / description / env var / project; `project:` `scope:` `type:`
+  `storage:` `name:` `env:` `inject:` `agent:` `shadow:` qualifiers narrow
+  further. Results are **grouped by credential name**, so "where is
+  `STRIPE_KEY` defined and which one wins?" is one glance instead of forty
+  accordions. `agent:true` and `inject:true` are one-key exposure audits.
+- **Per-credential settings drawer** — metadata, the two exposure switches
+  with their blast radius written out, an on-demand resolution check +
+  fingerprint, write-only value replacement, usage and override
+  relationships, and a separated danger zone.
+- **Right-click context menu** on any row (also `⋯` and <kbd>Shift</kbd>+<kbd>F10</kbd>),
+  with typed confirmations replacing `window.confirm`: deleting or granting
+  agent-read access requires typing the credential's name.
+
+The write-only wire contract extends to the hub: values are submitted
+inbound-only, **no hub route ever returns a stored value** (there is no
+`reveal` on the hub at all), and search indexes metadata only.
+
+Full documentation: [`cli/guide/credentials.html`](cli/guide/credentials.html)
+— open it in the app at `/guide/credentials.html`.
 
 ### Jira — Cloud + Data Center (v2.56.0)
 

{code_context_control-2.60.0 → code_context_control-2.61.0}/README.md

@@ -298,12 +298,30 @@ with credentials disabled, and the vault is hard-excluded from the Oracle
 Discovery API.
 
 Since **v2.59.0** the Hub has a top-level **Credentials** view: manage the
-global vault (`~/.c3`) and every registered project's entries from one place —
-create / edit / delete / `.env` import / flag toggles, with shadowing shown
-both ways ("shadows global" on project entries, "shadowed in N projects" on
-globals). The write-only wire contract extends to the hub: values are
-submitted inbound-only and **no hub route ever returns a stored value** (there
-is no `reveal` on the hub at all).
+global vault (`~/.c3`) and every registered project's entries from one place,
+with overriding shown both ways ("overrides global" on project entries,
+"overridden ×N" on globals). **v2.61.0** makes it navigable at scale:
+
+- **Cross-project search** — <kbd>/</kbd> or <kbd>Ctrl/⌘-K</kbd>. Free words
+  match name / description / env var / project; `project:` `scope:` `type:`
+  `storage:` `name:` `env:` `inject:` `agent:` `shadow:` qualifiers narrow
+  further. Results are **grouped by credential name**, so "where is
+  `STRIPE_KEY` defined and which one wins?" is one glance instead of forty
+  accordions. `agent:true` and `inject:true` are one-key exposure audits.
+- **Per-credential settings drawer** — metadata, the two exposure switches
+  with their blast radius written out, an on-demand resolution check +
+  fingerprint, write-only value replacement, usage and override
+  relationships, and a separated danger zone.
+- **Right-click context menu** on any row (also `⋯` and <kbd>Shift</kbd>+<kbd>F10</kbd>),
+  with typed confirmations replacing `window.confirm`: deleting or granting
+  agent-read access requires typing the credential's name.
+
+The write-only wire contract extends to the hub: values are submitted
+inbound-only, **no hub route ever returns a stored value** (there is no
+`reveal` on the hub at all), and search indexes metadata only.
+
+Full documentation: [`cli/guide/credentials.html`](cli/guide/credentials.html)
+— open it in the app at `/guide/credentials.html`.
 
 ### Jira — Cloud + Data Center (v2.56.0)
 

{code_context_control-2.60.0 → code_context_control-2.61.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.60.0"
+__version__ = "2.61.0"
 
 
 def _command_deps() -> CommandDeps:
@@ -5128,22 +5128,33 @@ def cmd_install_mcp(args):
         settings = _safe_read_json(settings_path, str(settings_path))
 
         # Build hook commands using the Python executable that runs c3.
-        # On Windows, Claude Code executes hooks via /usr/bin/bash (Git Bash), which cannot
-        # parse Windows absolute paths containing parentheses (e.g. "(C3)"). Prefix with
-        # cmd.exe so it handles path resolution instead of bash.
         #
-        # Use "cmd.exe" WITH the extension, not bare "cmd": Git Bash does not resolve bare
-        # "cmd" on PATH, so the old "cmd /c …" prefix silently failed to launch any hook
-        # (verified: under bash, "cmd.exe /c '<py>' '<hook>'" runs and writes the signal
-        # file; "cmd /c …" returns "cmd: command not found"). The single-quoted paths are
-        # correct — bash strips them and re-quotes for cmd.exe, preserving spaces/parens.
-        _hook_prefix = "cmd.exe /c " if sys.platform == "win32" else ""
+        # Windows: do NOT wrap in cmd.exe. Claude Code runs hooks through Git Bash,
+        # whose MSYS argument conversion rewrites a standalone "/c" into "C:/" before
+        # cmd.exe ever sees it — so cmd.exe starts INTERACTIVELY, prints its banner,
+        # and reads the hook's stdin JSON payload as console commands. The hook never
+        # runs, and any ">" token in the payload becomes a shell redirect that silently
+        # creates junk files in the repo root.
+        #
+        # Verified 2026-07-26 under Git Bash on Windows 11:
+        #   python -c "import sys;print(sys.argv)" /c foo   ->  ['-c', 'C:/', 'foo']
+        #   cmd.exe /c '<py>' -c "print('x')"               ->  banner, no execution
+        #   '<py>' '<hook>' posttool                        ->  runs, stdin intact
+        # Both "cmd /c" (bash cannot resolve bare "cmd") and "cmd.exe /c" are broken;
+        # the wrapper was never needed. A double-quoted forward-slash path is parsed
+        # correctly by bash AND cmd, including paths containing spaces or parentheses
+        # (e.g. "Claude Code Companion (C3)"), which is why the wrapper was added.
+        def _hook_arg(raw: str) -> str:
+            if sys.platform == "win32":
+                return '"' + str(raw).replace("\\", "/") + '"'
+            return shlex.quote(str(raw))
+
         # v2.42: single dispatcher script per hook event instead of N separate
         # per-hook commands. One interpreter spawn per event; the dispatcher
         # (cli/hook_dispatch.py) runs all applicable sub-hooks in-process.
         _dispatch_base = (
-            f"{_hook_prefix}{shlex.quote(sys.executable)} "
-            f"{shlex.quote(str(cli_dir / 'hook_dispatch.py'))}"
+            f"{_hook_arg(sys.executable)} "
+            f"{_hook_arg(str(cli_dir / 'hook_dispatch.py'))}"
         )
         hook_pretool_cmd  = f"{_dispatch_base} pretool"
         hook_posttool_cmd = f"{_dispatch_base} posttool"

{code_context_control-2.60.0 → code_context_control-2.61.0}/cli/guide/bitbucket.html

@@ -77,6 +77,7 @@
       <a href="getting-started.html">Get Started</a>
       <a href="workflow.html">Workflow</a>
       <a href="tools.html">Tools</a>
+      <a href="credentials.html">Credentials</a>
       <a href="bitbucket.html" class="active">Bitbucket</a>
       <a href="oracle.html">Oracle</a>
       <a href="https://github.com/sponsors/drknowhow" target="_blank" rel="noopener" style="color:#EA4AAA">&#9829; Sponsor</a>