code-context-control 2.61.0__tar.gz → 2.61.2__tar.gz

{code_context_control-2.61.0/code_context_control.egg-info → code_context_control-2.61.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.61.0
+Version: 2.61.2
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Copilot, Cursor, Antigravity). Retrieve less, read less, edit safer — version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP), and manage multi-project + sub-project hierarchies from a local hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.61.0 → code_context_control-2.61.2}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.61.0"
+__version__ = "2.61.2"
 
 
 def _command_deps() -> CommandDeps:

{code_context_control-2.61.0 → code_context_control-2.61.2}/cli/hook_pretool_enforce.py

@@ -78,6 +78,11 @@ _PREREQS = {
 _ADVISORY_TOOLS = {"Read", "Grep", "Glob", "FindFiles", "SearchText"}
 _BLOCKED_TOOLS = {"Edit", "Write", "MultiEdit"}
 
+# Vault files no native write may touch, regardless of unlock state.
+# Mirrors services.credential_store.VAULT_PROTECTED_FILES (parity-tested);
+# duplicated because hooks must stay import-light.
+_VAULT_FILES = frozenset({"config.json", "secrets.enc", "cred_state.json"})
+
 # Redirect messages per native tool
 _REDIRECTS = {
     "Read": (
@@ -283,6 +288,23 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     session_id = str(payload.get("session_id") or "")
     base = project_path if project_path is not None else Path.cwd()
 
+    # Vault write-guard: the credential registry/state may never be modified
+    # by the agent — even with a warm c3 signal or sticky unlock (v2.61.2).
+    if tool_name in _BLOCKED_TOOLS:
+        target = Path(str(tool_input.get("file_path") or ""))
+        if target.name.lower() in _VAULT_FILES and target.parent.name.lower() == ".c3":
+            return {
+                "hookSpecificOutput": {
+                    "hookEventName": "PreToolUse",
+                    "permissionDecision": "deny",
+                    "permissionDecisionReason": (
+                        f"[c3:vault-protected] {target.name} belongs to the "
+                        "credential vault and cannot be modified by the agent. "
+                        "Ask the user to use the Credentials UI or `c3 creds` CLI."
+                    ),
+                }
+            }
+
     # Session-scoped load: state written by a different session comes back
     # empty, so stale unlocks degrade to the advisory path below.
     state = load_enforcement_state(base, session_id=session_id)

{code_context_control-2.61.0 → code_context_control-2.61.2}/cli/hub_ui/components/project_card.js

@@ -377,24 +377,63 @@ function ProjectCard({ p, isChild, rollup, expanded, onToggleExpand, onChanged,
   // Launch the UI server, then open its tab once the port shows up in the
   // registry. launch_session cannot return the port (the detached child
   // picks it), so open a placeholder tab synchronously — still inside the
-  // click gesture, so popup blockers allow it — and navigate it when
-  // polling /api/projects finds the port.
+  // click gesture, so popup blockers allow it. The placeholder carries its
+  // own poll/redirect script (about:blank inherits this tab's origin, so
+  // its fetches are same-origin) and resolves even if this hub tab is
+  // closed, reloaded, or hung mid-launch — it must never depend on the
+  // opener surviving the launch window.
   const start = async (e) => {
     e.stopPropagation();
     if (starting) return;
     setStarting(true);
     const win = window.open('', '_blank');
+    // armed = the placeholder polls and navigates itself; when false
+    // (write failed / popup blocked) the hub-side poll navigates instead.
+    let armed = false;
     if (win) {
       try {
+        const escHtml = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;');
+        const jsStr = (s) => JSON.stringify(String(s)).replace(/</g, '\\u003c');
         win.document.write(
-          `<title>Starting ${p.name}…</title>` +
+          `<title>Starting ${escHtml(p.name)}…</title>` +
           '<body style="background:#0d1117;color:#8b949e;font-family:sans-serif;' +
-          'display:flex;align-items:center;justify-content:center;height:100vh">' +
-          `Starting ${p.name}…</body>`);
+          'display:flex;align-items:center;justify-content:center;height:100vh;margin:0">' +
+          '<div style="text-align:center;max-width:560px;padding:0 20px">' +
+          '<div id="spin" style="margin:0 auto 14px;width:22px;height:22px;' +
+          'border:2px solid #21262d;border-top-color:#58a6ff;border-radius:50%;' +
+          'animation:s .8s linear infinite"></div>' +
+          '<style>@keyframes s{to{transform:rotate(360deg)}}</style>' +
+          `<div id="msg" style="color:#c9d1d9">Starting ${escHtml(p.name)}…</div>` +
+          '<div id="sub" style="margin-top:6px;font-size:12px">waiting for the UI server to report a port</div>' +
+          '</div><script>' +
+          `var ORIGIN=${jsStr(location.origin)},TARGET=${jsStr((p.path || '').toLowerCase())},NAME=${jsStr(p.name)},tries=0,dead=0;` +
+          'function fail(why){dead=1;document.getElementById("spin").style.display="none";' +
+          'document.getElementById("msg").textContent=NAME+": "+why;' +
+          'document.getElementById("sub").textContent=' +
+          '"Check the project\'s .c3/ui.log — you can close this tab.";}' +
+          'window.__c3fail=fail;' +
+          'function poll(){if(dead)return;' +
+          'fetch(ORIGIN+"/api/projects").then(function(r){return r.json()})' +
+          '.then(function(rows){if(dead)return;' +
+          'var row=(Array.isArray(rows)?rows:[]).find(function(r){' +
+          'return (r.path||"").toLowerCase()===TARGET});' +
+          'if(row&&row.port){location.replace("http://127.0.0.1:"+row.port);return}' +
+          'if(++tries>=20){fail("UI server did not report a port after 30s");return}' +
+          'setTimeout(poll,1500)}).catch(function(){if(dead)return;' +
+          'if(++tries>=20){fail("hub unreachable");return}setTimeout(poll,1500)})}' +
+          'setTimeout(poll,1200);<\/script>');
+        win.document.close();
+        armed = true;
       } catch { }
     }
     const fail = (msg) => {
-      if (win) win.close();
+      if (win) {
+        // Surface the error inside the tab the user is looking at; close
+        // it only when the placeholder script isn't there to show it.
+        let shown = false;
+        try { if (armed && win.__c3fail) { win.__c3fail(msg); shown = true; } } catch { }
+        if (!shown) { try { win.close(); } catch { } }
+      }
       notify(msg, 'err');
       setStarting(false);
     };
@@ -403,19 +442,28 @@ function ProjectCard({ p, isChild, rollup, expanded, onToggleExpand, onChanged,
       if (!d.launched) { fail('Launch failed'); return; }
       notify(`Starting ${p.name}…`);
       setTimeout(onChanged, 1500);
+      // Bookkeeping poll: refresh the card and clear the busy state. Only
+      // navigates or closes the tab when the placeholder isn't armed.
       const poll = async (tries) => {
         let rows = [];
         try { rows = await api.get('/api/projects'); } catch { }
         const row = (Array.isArray(rows) ? rows : []).find(r =>
           (r.path || '').toLowerCase() === (p.path || '').toLowerCase());
         if (row && row.port) {
-          const url = 'http://127.0.0.1:' + row.port;
-          if (win) { win.location = url; } else { window.open(url, '_blank'); }
+          if (!armed) {
+            const url = 'http://127.0.0.1:' + row.port;
+            if (win) { win.location = url; } else { window.open(url, '_blank'); }
+          }
           onChanged();
           setStarting(false);
           return;
         }
-        if (tries >= 20) { fail(`${p.name}: UI server did not report a port — check .c3/ui.log`); return; }
+        if (tries >= 20) {
+          if (!armed && win) { try { win.close(); } catch { } }
+          notify(`${p.name}: UI server did not report a port — check .c3/ui.log`, 'err');
+          setStarting(false);
+          return;
+        }
         setTimeout(() => poll(tries + 1), 1500);
       };
       setTimeout(() => poll(0), 1200);

{code_context_control-2.61.0 → code_context_control-2.61.2}/cli/tools/credentials.py

@@ -130,6 +130,14 @@ def _act_reveal(name: str, svc, project_path: str) -> str:
             "or ask the user to enable agent_readable in the Credentials UI / "
             f"`c3 creds set {name} --agent-readable`."
         )
+    if not cs.verify_agent_readable(name, scope=entry["scope"], project_path=project_path):
+        return (
+            f"[creds:integrity] {name!r} is marked agent_readable in the registry, "
+            "but the flag's keyring attestation is missing or disagrees — the "
+            "registry may have been modified outside the credentials API. Ask the "
+            "user to re-confirm the flag (toggle it in the Credentials UI or "
+            "`c3 creds`); re-saving it restores the attestation."
+        )
     value = cs.get_value(name, project_path=project_path, scope=entry["scope"])
     if value is None:
         return (

{code_context_control-2.61.0 → code_context_control-2.61.2}/cli/tools/edit.py

@@ -13,6 +13,8 @@ import json
 import threading
 from pathlib import Path
 
+from services import credential_store as _cs
+
 # Per-file locks — keyed by resolved absolute path string.
 _file_locks: dict[str, threading.Lock] = {}
 _locks_lock = threading.Lock()
@@ -237,6 +239,12 @@ def handle_edit(file_path: str, old_string: str, new_string: str,
         path = Path(svc.project_path) / path
     path = path.resolve()
 
+    # Vault write-guard: the credential registry/state is never agent-writable
+    # (covers create, edit, and batch modes — and c3_project's edit proxy).
+    guard = _cs.vault_guard_reason(path)
+    if guard:
+        return finalize("c3_edit", {"file": file_path}, guard, "vault-protected")
+
     # Relative path for ledger + display (computed even for new files)
     try:
         rel = str(path.relative_to(Path(svc.project_path).resolve())).replace("\\", "/")

{code_context_control-2.61.0 → code_context_control-2.61.2/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.61.0
+Version: 2.61.2
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Copilot, Cursor, Antigravity). Retrieve less, read less, edit safer — version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP), and manage multi-project + sub-project hierarchies from a local hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.61.0 → code_context_control-2.61.2}/code_context_control.egg-info/SOURCES.txt

@@ -333,6 +333,7 @@ tests/test_token_telemetry.py
 tests/test_tool_registry.py
 tests/test_upgrade_and_version.py
 tests/test_validate.py
+tests/test_vault_write_guard.py
 tests/test_version_sync.py
 tests/test_web_security.py
 tests/test_windows_reliability.py

{code_context_control-2.61.0 → code_context_control-2.61.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-context-control"
-version = "2.61.0"
+version = "2.61.2"
 description = "Local code-intelligence layer for AI coding tools (Claude Code, Codex, Copilot, Cursor, Antigravity). Retrieve less, read less, edit safer — version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP), and manage multi-project + sub-project hierarchies from a local hub."
 readme = "README.md"
 requires-python = ">=3.10"

{code_context_control-2.61.0 → code_context_control-2.61.2}/services/credential_store.py

@@ -135,6 +135,56 @@ def _account(realm_s: str, name: str) -> str:
     return f"{realm_s}|{name}"
 
 
+def _flag_account(realm_s: str, name: str) -> str:
+    return f"{realm_s}|{name}::agent_readable"
+
+
+# Files the agent must never write through c3 tool surfaces: the vault
+# registry (config.json) and its sidecar state. Editing these outside the
+# credentials API is how a prompt-injected agent would grant itself reveal
+# access. Mirrored in cli/hook_pretool_enforce.py (parity-tested).
+VAULT_PROTECTED_FILES = frozenset({"config.json", "secrets.enc", "cred_state.json"})
+
+
+def vault_guard_reason(path) -> str:
+    """Non-empty refusal message when ``path`` is a vault file under .c3/."""
+    p = Path(path)
+    if p.name.lower() in VAULT_PROTECTED_FILES and p.parent.name.lower() == ".c3":
+        return (
+            f"[c3:vault-protected] {p.name} belongs to the credential vault "
+            "(registry/state) and cannot be modified by the agent. Changes go "
+            "through the Credentials UI or the `c3 creds` CLI — ask the user."
+        )
+    return ""
+
+
+def _write_flag_attestation(realm_s: str, name: str, readable: bool) -> None:
+    """Keyring copy of agent_readable — reveal trusts registry AND keyring.
+
+    A registry flag flipped by editing config.json directly (outside this
+    API) disagrees with the attestation, and reveal fails closed.
+    """
+    try:
+        _keyring_module().set_password(
+            KEYRING_SERVICE, _flag_account(realm_s, name), "1" if readable else "0")
+    except Exception:
+        pass  # keyring-less env: verify_agent_readable fails closed anyway
+
+
+def verify_agent_readable(name: str, *, scope: str, project_path: str = ".") -> bool:
+    """True only when the keyring attestation agrees the flag is enabled.
+
+    Fails closed: a missing attestation (pre-v2.61.2 entry, keyring failure,
+    or a registry edited outside this API) reads as not-readable.
+    """
+    try:
+        realm_s = realm(_norm_scope(scope, project_path), project_path)
+        return _keyring_module().get_password(
+            KEYRING_SERVICE, _flag_account(realm_s, name)) == "1"
+    except Exception:
+        return False
+
+
 def _scope_dir(scope: str, project_path: str) -> Optional[Path]:
     """Base directory holding .c3/ for the scope; None when global is unresolvable."""
     if scope == "global":
@@ -376,6 +426,7 @@ def set_credential(
     section["entries"][name] = entry
     config["credentials"] = section
     _save_config(base, config)
+    _write_flag_attestation(realm_s, name, bool(agent_readable))
     return dict(entry)
 
 
@@ -407,6 +458,9 @@ def update_metadata(name: str, *, scope: str, project_path: str = ".", **fields)
     entry["updated"] = _utcnow()
     config["credentials"] = section
     _save_config(base, config)
+    if "agent_readable" in fields:
+        _write_flag_attestation(
+            realm(scope, project_path), name, bool(fields["agent_readable"]))
     return dict(entry)
 
 
@@ -467,6 +521,10 @@ def delete_credential(name: str, *, scope: str, project_path: str = ".") -> bool
         removed_value = True
     except Exception:
         pass
+    try:
+        _keyring_module().delete_password(KEYRING_SERVICE, _flag_account(realm_s, name))
+    except Exception:
+        pass
     config = _load_config(base)
     section = _creds_section(config)
     removed_entry = name in section["entries"]

code_context_control-2.61.2/tests/test_vault_write_guard.py

@@ -0,0 +1,284 @@
+"""Vault write-guard hotfix (v2.61.2) — closes the agent_readable escalation.
+
+Attack: the agent edits .c3/config.json (c3_edit, native Write, or shell),
+flips a credential's agent_readable flag, then calls reveal. Three guards:
+  1. c3_edit refuses vault files (registry + sidecar state), all modes.
+  2. The PreToolUse hook denies native Edit/Write/MultiEdit on vault files
+     even when a warm c3 signal or sticky unlock would otherwise allow them.
+  3. reveal requires a keyring attestation of agent_readable written only by
+     the credentials API — a registry edited outside the API fails closed.
+"""
+from __future__ import annotations
+
+import base64
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO_ROOT))
+
+from cli import _hook_utils  # noqa: E402
+
+# hook_pretool_enforce imports plain `_hook_utils`; alias so both spellings
+# resolve to the same module instance (mirrors cli/hook_dispatch.py).
+sys.modules.setdefault("_hook_utils", _hook_utils)
+
+import cli.hook_pretool_enforce as hook  # noqa: E402
+from cli.tools.credentials import handle_credentials  # noqa: E402
+from cli.tools.edit import handle_edit  # noqa: E402
+from services import credential_store as cs  # noqa: E402
+
+
+class _StubKeyring:
+    def __init__(self):
+        self.store: dict[tuple[str, str], str] = {}
+
+    def set_password(self, service, account, password):
+        self.store[(service, account)] = password
+
+    def get_password(self, service, account):
+        return self.store.get((service, account))
+
+    def delete_password(self, service, account):
+        if (service, account) not in self.store:
+            raise KeyError("not found")
+        del self.store[(service, account)]
+
+
+class _StubFernet:
+    def __init__(self, key):
+        self._key = key
+
+    @staticmethod
+    def generate_key():
+        return base64.urlsafe_b64encode(b"0" * 32)
+
+    def encrypt(self, data):
+        return base64.urlsafe_b64encode(self._key + b"|" + data)
+
+    def decrypt(self, token):
+        raw = base64.urlsafe_b64decode(token)
+        key, _, data = raw.partition(b"|")
+        if key != self._key:
+            raise ValueError("bad key")
+        return data
+
+
+class _StubLedger:
+    def __init__(self):
+        self.edits: list[dict] = []
+
+    def log_edit(self, **kw):
+        self.edits.append(kw)
+
+
+class _StubActivity:
+    def __init__(self):
+        self.events: list[tuple] = []
+
+    def log(self, kind, data):
+        self.events.append((kind, data))
+
+
+class _Svc:
+    def __init__(self, project_path):
+        self.project_path = project_path
+        self.edit_ledger = _StubLedger()
+        self.activity_log = _StubActivity()
+
+
+def _finalize(tool, args, resp, summary, **kw):
+    return resp
+
+
+class TestParity(unittest.TestCase):
+    def test_hook_set_matches_store_set(self):
+        self.assertEqual(hook._VAULT_FILES, cs.VAULT_PROTECTED_FILES)
+
+
+class TestEditVaultGuard(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.proj = Path(self._tmp.name)
+        (self.proj / ".c3").mkdir()
+        (self.proj / ".c3" / "config.json").write_text("{}", encoding="utf-8")
+        self.svc = _Svc(str(self.proj))
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _edit(self, rel, old, new, edits=""):
+        return handle_edit(rel, old, new, summary="", tags="",
+                           replace_all=False, svc=self.svc,
+                           finalize=_finalize, edits=edits)
+
+    def test_edit_config_json_refused(self):
+        resp = self._edit(".c3/config.json", "{}", '{"x": 1}')
+        self.assertIn("[c3:vault-protected]", resp)
+        text = (self.proj / ".c3" / "config.json").read_text(encoding="utf-8")
+        self.assertEqual(text, "{}")
+
+    def test_create_mode_refused_for_missing_vault_file(self):
+        resp = self._edit(".c3/cred_state.json", "", '{"pwned": true}')
+        self.assertIn("[c3:vault-protected]", resp)
+        self.assertFalse((self.proj / ".c3" / "cred_state.json").exists())
+
+    def test_batch_mode_refused(self):
+        edits = json.dumps([{"old_string": "{}", "new_string": "{}"}])
+        resp = self._edit(".c3/config.json", "", "", edits=edits)
+        self.assertIn("[c3:vault-protected]", resp)
+
+    def test_secrets_enc_refused(self):
+        resp = self._edit(".c3/secrets.enc", "", "AAAA")
+        self.assertIn("[c3:vault-protected]", resp)
+
+    def test_absolute_path_refused(self):
+        resp = self._edit(str(self.proj / ".c3" / "config.json"), "{}", "{ }")
+        self.assertIn("[c3:vault-protected]", resp)
+
+    def test_case_insensitive_match(self):
+        resp = self._edit(".C3/Config.JSON", "{}", "{ }")
+        self.assertIn("[c3:vault-protected]", resp)
+
+    def test_normal_file_still_editable(self):
+        (self.proj / "a.txt").write_text("hello", encoding="utf-8")
+        resp = self._edit("a.txt", "hello", "world")
+        self.assertIn("✓", resp)
+        self.assertEqual((self.proj / "a.txt").read_text(encoding="utf-8"), "world")
+
+    def test_config_json_outside_c3_dir_not_guarded(self):
+        (self.proj / "config.json").write_text("{}", encoding="utf-8")
+        resp = self._edit("config.json", "{}", '{"ok": 1}')
+        self.assertIn("✓", resp)
+
+
+class TestHookVaultGuard(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.proj = Path(self._tmp.name)
+        (self.proj / ".c3").mkdir()
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _run(self, tool_name, file_path):
+        payload = {"tool_name": tool_name, "tool_input": {"file_path": file_path}}
+        return hook.run(payload, project_path=self.proj)
+
+    def _assert_vault_deny(self, out):
+        self.assertIsNotNone(out)
+        decision = out.get("hookSpecificOutput", {})
+        self.assertEqual(decision.get("permissionDecision"), "deny")
+        self.assertIn("[c3:vault-protected]",
+                      decision.get("permissionDecisionReason", ""))
+
+    def test_write_tools_denied_on_vault_files(self):
+        vault = str(self.proj / ".c3" / "config.json")
+        for tool in ("Edit", "Write", "MultiEdit"):
+            self._assert_vault_deny(self._run(tool, vault))
+
+    def test_denied_even_when_c3_prereq_satisfied(self):
+        # Force the unlock check to allow — the vault guard must fire first.
+        with mock.patch.object(hook, "_check_c3_used",
+                               return_value=(True, "signal")) as checked:
+            out = self._run("Write", str(self.proj / ".c3" / "config.json"))
+            self._assert_vault_deny(out)
+            checked.assert_not_called()
+
+    def test_read_of_vault_file_not_vault_denied(self):
+        out = self._run("Read", str(self.proj / ".c3" / "config.json"))
+        reason = (out or {}).get("hookSpecificOutput", {}).get(
+            "permissionDecisionReason", "")
+        self.assertNotIn("[c3:vault-protected]", reason)
+
+    def test_non_vault_write_gets_normal_enforcement(self):
+        out = self._run("Write", str(self.proj / "notes.txt"))
+        decision = (out or {}).get("hookSpecificOutput", {})
+        self.assertEqual(decision.get("permissionDecision"), "deny")
+        self.assertIn("[c3:enforce]", decision.get("permissionDecisionReason", ""))
+
+
+class TestRevealIntegrity(unittest.TestCase):
+    def setUp(self):
+        self._stub = _StubKeyring()
+        self._tmp_proj = tempfile.TemporaryDirectory()
+        self._tmp_home = tempfile.TemporaryDirectory()
+        self._patchers = [
+            mock.patch.object(cs, "_keyring_module", return_value=self._stub),
+            mock.patch.object(cs, "_crypto_module", return_value=_StubFernet),
+            mock.patch.object(cs, "_global_base", return_value=Path(self._tmp_home.name)),
+        ]
+        for p in self._patchers:
+            p.start()
+        cs._ACTIVE_SECRETS.clear()
+        self.svc = _Svc(self._tmp_proj.name)
+
+    def tearDown(self):
+        for p in self._patchers:
+            p.stop()
+        cs._ACTIVE_SECRETS.clear()
+        self._tmp_proj.cleanup()
+        self._tmp_home.cleanup()
+
+    def _creds(self, action, **kwargs):
+        return handle_credentials(action, self.svc, _finalize, **kwargs)
+
+    def _tamper_flag(self, name, value=True):
+        cfg_path = Path(self.svc.project_path) / ".c3" / "config.json"
+        config = json.loads(cfg_path.read_text(encoding="utf-8"))
+        config["credentials"]["entries"][name]["agent_readable"] = value
+        cfg_path.write_text(json.dumps(config), encoding="utf-8")
+
+    def test_tampered_registry_flag_fails_closed(self):
+        self._creds("set", name="API_KEY", value="s3cret")
+        self.assertIn("[creds:not-readable]", self._creds("reveal", name="API_KEY"))
+        self._tamper_flag("API_KEY")
+        resp = self._creds("reveal", name="API_KEY")
+        self.assertIn("[creds:integrity]", resp)
+        self.assertNotIn("s3cret", resp)
+
+    def test_creation_time_agent_readable_reveals(self):
+        self._creds("set", name="MINE", value="agent-made", agent_readable=True)
+        resp = self._creds("reveal", name="MINE")
+        self.assertIn("[creds:reveal]", resp)
+        self.assertIn("agent-made", resp)
+
+    def test_user_toggle_via_update_metadata_reveals(self):
+        self._creds("set", name="TOKEN", value="tok-1")
+        cs.update_metadata("TOKEN", scope="project",
+                           project_path=self.svc.project_path,
+                           agent_readable=True)
+        resp = self._creds("reveal", name="TOKEN")
+        self.assertIn("[creds:reveal]", resp)
+        self.assertIn("tok-1", resp)
+
+    def test_missing_attestation_fails_closed(self):
+        # Legacy entry: registry says readable but no keyring attestation.
+        self._creds("set", name="OLD", value="v", agent_readable=True)
+        flag_keys = [k for k in self._stub.store if k[1].endswith("::agent_readable")]
+        for k in flag_keys:
+            del self._stub.store[k]
+        self.assertIn("[creds:integrity]", self._creds("reveal", name="OLD"))
+
+    def test_delete_removes_attestation(self):
+        self._creds("set", name="GONE", value="v", agent_readable=True)
+        self.assertTrue(
+            any(k[1].endswith("::agent_readable") for k in self._stub.store))
+        self._creds("delete", name="GONE", scope="project")
+        self.assertFalse(
+            any(k[1].endswith("::agent_readable") for k in self._stub.store))
+
+    def test_verify_false_on_keyring_failure(self):
+        self._creds("set", name="KR", value="v", agent_readable=True)
+        with mock.patch.object(cs, "_keyring_module",
+                               side_effect=RuntimeError("keyring down")):
+            self.assertFalse(cs.verify_agent_readable(
+                "KR", scope="project", project_path=self.svc.project_path))
+
+
+if __name__ == "__main__":
+    unittest.main()