code-context-control 2.61.2__tar.gz → 2.62.0__tar.gz

{code_context_control-2.61.2 → code_context_control-2.62.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.61.2
+Version: 2.62.0
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Copilot, Cursor, Antigravity). Retrieve less, read less, edit safer — version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP), and manage multi-project + sub-project hierarchies from a local hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -386,6 +386,45 @@ inbound-only, **no hub route ever returns a stored value** (there is no
 Full documentation: [`cli/guide/credentials.html`](cli/guide/credentials.html)
 — open it in the app at `/guide/credentials.html`.
 
+### Access Guard (v2.62.0)
+
+The Credential Vault protects *values*; **Access Guard** protects *files and
+folders*. Two glob lists in your config mark what an agent must never read
+(`deny`) or never write (`read_only`), and one shared evaluator enforces them
+at every C3 surface — the MCP tools (`c3_read`/`c3_edit`/`c3_search`/…, so
+any agent using C3 is covered), Claude Code's native tools via PreToolUse
+hooks (fail-closed: a broken guard denies writes instead of waving them
+through), and `c3_shell` via a best-effort command scan.
+
+```bash
+c3 access add "secrets/**" --kind deny        # never read, never write
+c3 access add "migrations/**" --kind read_only
+c3 access check secrets/key.txt               # probe: verdict + matched rule
+```
+
+- **Tighten-only.** No allow list exists; scopes (global `~/.c3` + project
+  `.c3`) merge as a union. A cloned repo's config can only add protection,
+  never grant itself access.
+- **`deny` means deny-create and deny-enumerate** too: alternate spellings
+  are canonicalized before matching, and denied paths never appear in search
+  results, maps, or the vector index.
+- **Refusals teach the agent to stop.** Every denial carries a stable
+  `[c3-access:*]` tag, the matched rule and scope, and explicit
+  do-not-retry guidance — no retry loops, no "file must not exist, let me
+  recreate it".
+- **All rule changes are human-only** (Access Guard UI tab or `c3 access`
+  CLI), ledger-logged; agents have no mutation surface.
+- **Built-ins always on:** `.env*` files, the credential vault's sidecars,
+  and write-denies on `.c3/`, `.claude/settings*.json`, `.git/`, and the
+  installed C3 package itself.
+- **Honest coverage:** this guards *cooperative* agents against mistakes and
+  prompt-injection. It is not a sandbox — raw shell or direct file access
+  outside C3's tools and hooks is not stopped. The guide states exactly
+  where each layer holds.
+
+Full documentation: [`cli/guide/access.html`](cli/guide/access.html)
+— open it in the app at `/guide/access.html`.
+
 ### Jira — Cloud + Data Center (v2.56.0)
 
 `c3_jira` connects to Jira Cloud (REST v3, email + API token) or self-hosted

{code_context_control-2.61.2 → code_context_control-2.62.0}/README.md

@@ -323,6 +323,45 @@ inbound-only, **no hub route ever returns a stored value** (there is no
 Full documentation: [`cli/guide/credentials.html`](cli/guide/credentials.html)
 — open it in the app at `/guide/credentials.html`.
 
+### Access Guard (v2.62.0)
+
+The Credential Vault protects *values*; **Access Guard** protects *files and
+folders*. Two glob lists in your config mark what an agent must never read
+(`deny`) or never write (`read_only`), and one shared evaluator enforces them
+at every C3 surface — the MCP tools (`c3_read`/`c3_edit`/`c3_search`/…, so
+any agent using C3 is covered), Claude Code's native tools via PreToolUse
+hooks (fail-closed: a broken guard denies writes instead of waving them
+through), and `c3_shell` via a best-effort command scan.
+
+```bash
+c3 access add "secrets/**" --kind deny        # never read, never write
+c3 access add "migrations/**" --kind read_only
+c3 access check secrets/key.txt               # probe: verdict + matched rule
+```
+
+- **Tighten-only.** No allow list exists; scopes (global `~/.c3` + project
+  `.c3`) merge as a union. A cloned repo's config can only add protection,
+  never grant itself access.
+- **`deny` means deny-create and deny-enumerate** too: alternate spellings
+  are canonicalized before matching, and denied paths never appear in search
+  results, maps, or the vector index.
+- **Refusals teach the agent to stop.** Every denial carries a stable
+  `[c3-access:*]` tag, the matched rule and scope, and explicit
+  do-not-retry guidance — no retry loops, no "file must not exist, let me
+  recreate it".
+- **All rule changes are human-only** (Access Guard UI tab or `c3 access`
+  CLI), ledger-logged; agents have no mutation surface.
+- **Built-ins always on:** `.env*` files, the credential vault's sidecars,
+  and write-denies on `.c3/`, `.claude/settings*.json`, `.git/`, and the
+  installed C3 package itself.
+- **Honest coverage:** this guards *cooperative* agents against mistakes and
+  prompt-injection. It is not a sandbox — raw shell or direct file access
+  outside C3's tools and hooks is not stopped. The guide states exactly
+  where each layer holds.
+
+Full documentation: [`cli/guide/access.html`](cli/guide/access.html)
+— open it in the app at `/guide/access.html`.
+
 ### Jira — Cloud + Data Center (v2.56.0)
 
 `c3_jira` connects to Jira Cloud (REST v3, email + API token) or self-hosted

{code_context_control-2.61.2 → code_context_control-2.62.0}/cli/_hook_utils.py

@@ -175,6 +175,17 @@ def load_enforcement_state(project_path: Path | None = None, session_id: str = "
     # session must not grant unlocks (signal files used to survive /clear).
     if session_id and state.get("session_id") and state["session_id"] != session_id:
         return _empty_state(session_id)
+    # Migrate unlock keys written before canonical_key (raw resolve() form):
+    # lookups are canonical now, so re-key at load — old and new forms merge.
+    migrated: dict = {}
+    for k, cats in state.get("unlocked_files", {}).items():
+        try:
+            key = canonical_key(k)
+        except OSError:
+            continue
+        merged = set(migrated.get(key, [])) | set(cats)
+        migrated[key] = sorted(merged)
+    state["unlocked_files"] = migrated
     return state
 
 
@@ -205,6 +216,16 @@ def record_c3_signal(
     save_enforcement_state(state, project_path)
 
 
+def canonical_key(path) -> str:
+    """Canonical unlock-map key: resolved, forward-slash, casefolded.
+
+    Must stay form-identical to services.access_guard.canonicalize()'s canon
+    string for existing paths (parity-tested) — the unlock map and the
+    access evaluator must never disagree about path identity on Windows.
+    """
+    return str(Path(path).resolve()).replace("\\", "/").casefold()
+
+
 def record_unlocked_files(
     paths,
     categories,
@@ -223,7 +244,7 @@ def record_unlocked_files(
         if not fp:
             continue
         try:
-            normalized = str(Path(fp).resolve())
+            normalized = canonical_key(fp)
         except OSError:
             continue
         cats = set(state["unlocked_files"].get(normalized, []))

{code_context_control-2.61.2 → code_context_control-2.62.0}/cli/c3.py

@@ -92,7 +92,17 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.61.2"
+__version__ = "2.62.0"
+
+
+def _compress_file_cli(compressor, path, mode="smart", **kw):
+    """compress_file for human-CLI paths: AccessDenied → error dict, not a
+    traceback. The refusal text names the rule so the operator can act."""
+    from services import access_guard as _ag
+    try:
+        return compressor.compress_file(path, mode, **kw)
+    except _ag.AccessDenied as exc:
+        return {"error": exc.message}
 
 
 def _command_deps() -> CommandDeps:
@@ -1338,7 +1348,7 @@ def _benchmark_extract_preview(full_path: Path, compressor: CodeCompressor, patt
     extracted = ""
 
     if ext in code_exts and not pattern:
-        result = compressor.compress_file(str(full_path), "smart")
+        result = _compress_file_cli(compressor, str(full_path), "smart")
         extracted = result.get("compressed", "") if "error" not in result else f"Error: {result['error']}"
 
     elif ext == ".jsonl" and not pattern:
@@ -1617,7 +1627,7 @@ def _benchmark_delegate_optional(project_path: Path, sample: list[tuple[Path, st
         "Focus on responsibilities, important functions/classes, and notable dependencies."
     )
 
-    compressed_result = compressor.compress_file(str(fpath), "smart")
+    compressed_result = _compress_file_cli(compressor, str(fpath), "smart")
     compressed_context = compressed_result.get("compressed", "") if isinstance(compressed_result, dict) else ""
     if not compressed_context:
         compressed_context = raw_content
@@ -3478,7 +3488,7 @@ def cmd_benchmark(args):
             raw_content = content
         comp_baseline_latencies.append((time.perf_counter() - t_read) * 1000)
         t0 = time.perf_counter()
-        result = compressor.compress_file(str(fpath), "smart")
+        result = _compress_file_cli(compressor, str(fpath), "smart")
         comp_c3_latencies.append((time.perf_counter() - t0) * 1000)
         raw_tokens = count_tokens(raw_content)
         comp_orig += raw_tokens
@@ -3544,7 +3554,7 @@ def cmd_benchmark(args):
                         tmp.write(raw_extracted)
                         tmp_path = tmp.name
                     try:
-                        comp_res = compressor.compress_file(tmp_path, mode="smart")
+                        comp_res = _compress_file_cli(compressor, tmp_path, mode="smart")
                         extracted_text += comp_res.get("compressed", raw_extracted)
                     finally:
                         if os.path.exists(tmp_path):
@@ -5203,6 +5213,9 @@ def cmd_install_mcp(args):
         ]
 
         # ── PreToolUse hooks (enforcement — blocks native tools without prior c3_*) ──
+        # Bash/run_shell_command joined in v2.62: the Access Guard sub-hook
+        # scans shell commands (best-effort); without these matchers PreToolUse
+        # simply never fires for shell — proven bypass, see docs/access-guard.md.
         _pre_matcher_names = [
             read_matcher,
             grep_matcher,
@@ -5210,6 +5223,8 @@ def cmd_install_mcp(args):
             edit_matcher,
             write_matcher,
             *extra_edit_matchers,
+            shell_matcher,
+            "run_shell_command",
         ]
         desired_pre_hooks = [
             {"matcher": m, "hooks": [{"type": "command", "command": hook_pretool_cmd}]}
@@ -5899,6 +5914,120 @@ def _creds_cmd_import(args, project_path: str) -> None:
               "(use --overwrite to replace)")
 
 
+def cmd_access(args):
+    """Access Guard rule management — human-only mutation surface (spec §1)."""
+    sub = getattr(args, "access_cmd", None)
+    if not sub:
+        print("Usage: c3 access {list,add,remove,check} [args]")
+        return
+
+    project_path = getattr(args, "project_path", ".") or "."
+
+    if sub == "list":
+        _access_cmd_list(args, project_path)
+    elif sub == "add":
+        _access_cmd_add(args, project_path)
+    elif sub == "remove":
+        _access_cmd_remove(args, project_path)
+    elif sub == "check":
+        _access_cmd_check(args, project_path)
+    else:
+        print(f"Unknown access subcommand: {sub}")
+
+
+def _access_scope(args) -> str:
+    return "global" if getattr(args, "use_global", False) else "project"
+
+
+def _access_audit(action: str, glob: str, kind: str, scope: str,
+                  project_path: str) -> None:
+    """Ledger + activity log for CLI rule mutations. Identifiers only; failure-safe."""
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(project_path).log("access_action", {
+            "kind": "access", "action": action, "glob": glob,
+            "rule_kind": kind, "scope": scope, "via": "cli",
+        })
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(project_path).log_edit(
+            file=f"access://{glob}", change_type=f"access_{action}",
+            summary=f"{action} {kind} rule '{glob}' ({scope}) via `c3 access`",
+            tags=["access", action],
+            detail={"kind": "access", "action": action, "glob": glob,
+                    "rule_kind": kind, "scope": scope},
+        )
+    except Exception:
+        pass
+
+
+def _access_cmd_list(args, project_path: str) -> None:
+    from services import access_guard
+
+    scopes = access_guard.list_rules(project_path)
+    notes = {"builtin": "built-in, always on",
+             "global": "~/.c3/config.json",
+             "project": ".c3/config.json"}
+    for scope in ("builtin", "global", "project"):
+        sec = scopes.get(scope) or {}
+        rules = [(k, g) for k in ("deny", "read_only") for g in sec.get(k, [])]
+        print(f"[{scope}] ({notes[scope]}) — {len(rules)} rule(s)")
+        for kind, glob in rules:
+            print(f"  {kind:<10} {glob}")
+        if sec.get("corrupt"):
+            print("  [warn] access section invalid — scope fails closed "
+                  "(deny-all); fix config.json 'access' by hand")
+    print()
+    print(access_guard.COVERAGE_MATRIX)
+
+
+def _access_cmd_add(args, project_path: str) -> None:
+    from services import access_guard
+
+    scope = _access_scope(args)
+    try:
+        result = access_guard.set_rule(args.glob, args.kind, scope, project_path)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+    if result["added"]:
+        _access_audit("add", result["glob"], args.kind, scope, project_path)
+        print(f"[OK] Added {args.kind} rule '{result['glob']}' (scope={scope})")
+    else:
+        print(f"[=] Rule already present: '{result['glob']}' "
+              f"({args.kind}, {scope})")
+
+
+def _access_cmd_remove(args, project_path: str) -> None:
+    from services import access_guard
+
+    scope = _access_scope(args)
+    try:
+        result = access_guard.remove_rule(args.glob, args.kind, scope, project_path)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+    if result["removed"]:
+        _access_audit("remove", result["glob"], args.kind, scope, project_path)
+        print(f"[OK] Removed {args.kind} rule '{result['glob']}' (scope={scope})")
+    else:
+        print(f"[error] no {args.kind} rule matching '{result['glob']}' "
+              f"in {scope} scope")
+
+
+def _access_cmd_check(args, project_path: str) -> None:
+    from services import access_guard
+
+    op = getattr(args, "op", "read") or "read"
+    denial = access_guard.check(args.target, op, project_path)
+    if denial is None:
+        print(f"[OK] {op} allowed: {args.target}")
+    else:
+        print(access_guard.refusal(denial, args.target, op))
+
+
 def cmd_jira(args):
     """Jira Cloud / Data Center credential + workspace management."""
     sub = getattr(args, "jira_cmd", None)
@@ -7199,6 +7328,7 @@ def main():
         "bitbucket": cmd_bitbucket,
         "jira": cmd_jira,
         "creds": cmd_creds,
+        "access": cmd_access,
         "oracle": cmd_oracle,
         "upgrade": cmd_upgrade,
     }

{code_context_control-2.61.2 → code_context_control-2.62.0}/cli/commands/parser.py

@@ -447,6 +447,42 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_import.add_argument("--overwrite", action="store_true", help="Replace entries already registered in the target scope")
     cr_import.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    # ── Access Guard (v2.62.0) ──────────────────────────────────────────
+    # Human-only mutation surface (frozen spec docs/access-guard.md §1):
+    # rule changes happen here or in the UI tab, never via an agent tool.
+    p_access = subparsers.add_parser(
+        "access",
+        help="Access Guard — path deny/read-only rules the agent must respect",
+    )
+    access_subs = p_access.add_subparsers(dest="access_cmd")
+
+    ac_list = access_subs.add_parser(
+        "list", help="Show rules per scope (builtin + global + project) and coverage"
+    )
+    ac_list.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    ac_add = access_subs.add_parser("add", help="Add a rule to the project (or --global) scope")
+    ac_add.add_argument("glob", help="POSIX glob (** crosses directories), e.g. 'secrets/**' or '*.pem'")
+    ac_add.add_argument("--kind", choices=["deny", "read_only"], required=True,
+                        help="deny = no read/write/enumerate; read_only = no write")
+    ac_add.add_argument("--global", dest="use_global", action="store_true",
+                        help="Store in the global scope (~/.c3) so every C3 project enforces it")
+    ac_add.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    ac_remove = access_subs.add_parser("remove", help="Remove a rule from the project (or --global) scope")
+    ac_remove.add_argument("glob", help="The stored glob to remove (case-insensitive match)")
+    ac_remove.add_argument("--kind", choices=["deny", "read_only"], required=True,
+                           help="Which rule list the glob lives in")
+    ac_remove.add_argument("--global", dest="use_global", action="store_true",
+                           help="Remove from the global scope (~/.c3)")
+    ac_remove.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    ac_check = access_subs.add_parser("check", help="Test a path: verdict + matched rule + refusal string")
+    ac_check.add_argument("target", help="Path to test (absolute or project-relative)")
+    ac_check.add_argument("--op", choices=["read", "write"], default="read",
+                          help="Operation to evaluate (default: read)")
+    ac_check.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
     # ── Oracle Discovery API (v2.32.0) ──────────────────────────────────
     p_oracle = subparsers.add_parser(
         "oracle",