code-context-control 2.61.2__tar.gz → 2.63.0__tar.gz

{code_context_control-2.61.2 → code_context_control-2.63.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.61.2
+Version: 2.63.0
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Copilot, Cursor, Antigravity). Retrieve less, read less, edit safer — version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP), and manage multi-project + sub-project hierarchies from a local hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -386,6 +386,45 @@ inbound-only, **no hub route ever returns a stored value** (there is no
 Full documentation: [`cli/guide/credentials.html`](cli/guide/credentials.html)
 — open it in the app at `/guide/credentials.html`.
 
+### Access Guard (v2.62.0)
+
+The Credential Vault protects *values*; **Access Guard** protects *files and
+folders*. Two glob lists in your config mark what an agent must never read
+(`deny`) or never write (`read_only`), and one shared evaluator enforces them
+at every C3 surface — the MCP tools (`c3_read`/`c3_edit`/`c3_search`/…, so
+any agent using C3 is covered), Claude Code's native tools via PreToolUse
+hooks (fail-closed: a broken guard denies writes instead of waving them
+through), and `c3_shell` via a best-effort command scan.
+
+```bash
+c3 access add "secrets/**" --kind deny        # never read, never write
+c3 access add "migrations/**" --kind read_only
+c3 access check secrets/key.txt               # probe: verdict + matched rule
+```
+
+- **Tighten-only.** No allow list exists; scopes (global `~/.c3` + project
+  `.c3`) merge as a union. A cloned repo's config can only add protection,
+  never grant itself access.
+- **`deny` means deny-create and deny-enumerate** too: alternate spellings
+  are canonicalized before matching, and denied paths never appear in search
+  results, maps, or the vector index.
+- **Refusals teach the agent to stop.** Every denial carries a stable
+  `[c3-access:*]` tag, the matched rule and scope, and explicit
+  do-not-retry guidance — no retry loops, no "file must not exist, let me
+  recreate it".
+- **All rule changes are human-only** (Access Guard UI tab or `c3 access`
+  CLI), ledger-logged; agents have no mutation surface.
+- **Built-ins always on:** `.env*` files, the credential vault's sidecars,
+  and write-denies on `.c3/`, `.claude/settings*.json`, `.git/`, and the
+  installed C3 package itself.
+- **Honest coverage:** this guards *cooperative* agents against mistakes and
+  prompt-injection. It is not a sandbox — raw shell or direct file access
+  outside C3's tools and hooks is not stopped. The guide states exactly
+  where each layer holds.
+
+Full documentation: [`cli/guide/access.html`](cli/guide/access.html)
+— open it in the app at `/guide/access.html`.
+
 ### Jira — Cloud + Data Center (v2.56.0)
 
 `c3_jira` connects to Jira Cloud (REST v3, email + API token) or self-hosted

{code_context_control-2.61.2 → code_context_control-2.63.0}/README.md

@@ -323,6 +323,45 @@ inbound-only, **no hub route ever returns a stored value** (there is no
 Full documentation: [`cli/guide/credentials.html`](cli/guide/credentials.html)
 — open it in the app at `/guide/credentials.html`.
 
+### Access Guard (v2.62.0)
+
+The Credential Vault protects *values*; **Access Guard** protects *files and
+folders*. Two glob lists in your config mark what an agent must never read
+(`deny`) or never write (`read_only`), and one shared evaluator enforces them
+at every C3 surface — the MCP tools (`c3_read`/`c3_edit`/`c3_search`/…, so
+any agent using C3 is covered), Claude Code's native tools via PreToolUse
+hooks (fail-closed: a broken guard denies writes instead of waving them
+through), and `c3_shell` via a best-effort command scan.
+
+```bash
+c3 access add "secrets/**" --kind deny        # never read, never write
+c3 access add "migrations/**" --kind read_only
+c3 access check secrets/key.txt               # probe: verdict + matched rule
+```
+
+- **Tighten-only.** No allow list exists; scopes (global `~/.c3` + project
+  `.c3`) merge as a union. A cloned repo's config can only add protection,
+  never grant itself access.
+- **`deny` means deny-create and deny-enumerate** too: alternate spellings
+  are canonicalized before matching, and denied paths never appear in search
+  results, maps, or the vector index.
+- **Refusals teach the agent to stop.** Every denial carries a stable
+  `[c3-access:*]` tag, the matched rule and scope, and explicit
+  do-not-retry guidance — no retry loops, no "file must not exist, let me
+  recreate it".
+- **All rule changes are human-only** (Access Guard UI tab or `c3 access`
+  CLI), ledger-logged; agents have no mutation surface.
+- **Built-ins always on:** `.env*` files, the credential vault's sidecars,
+  and write-denies on `.c3/`, `.claude/settings*.json`, `.git/`, and the
+  installed C3 package itself.
+- **Honest coverage:** this guards *cooperative* agents against mistakes and
+  prompt-injection. It is not a sandbox — raw shell or direct file access
+  outside C3's tools and hooks is not stopped. The guide states exactly
+  where each layer holds.
+
+Full documentation: [`cli/guide/access.html`](cli/guide/access.html)
+— open it in the app at `/guide/access.html`.
+
 ### Jira — Cloud + Data Center (v2.56.0)
 
 `c3_jira` connects to Jira Cloud (REST v3, email + API token) or self-hosted

{code_context_control-2.61.2 → code_context_control-2.63.0}/cli/_hook_utils.py

@@ -175,6 +175,17 @@ def load_enforcement_state(project_path: Path | None = None, session_id: str = "
     # session must not grant unlocks (signal files used to survive /clear).
     if session_id and state.get("session_id") and state["session_id"] != session_id:
         return _empty_state(session_id)
+    # Migrate unlock keys written before canonical_key (raw resolve() form):
+    # lookups are canonical now, so re-key at load — old and new forms merge.
+    migrated: dict = {}
+    for k, cats in state.get("unlocked_files", {}).items():
+        try:
+            key = canonical_key(k)
+        except OSError:
+            continue
+        merged = set(migrated.get(key, [])) | set(cats)
+        migrated[key] = sorted(merged)
+    state["unlocked_files"] = migrated
     return state
 
 
@@ -205,6 +216,16 @@ def record_c3_signal(
     save_enforcement_state(state, project_path)
 
 
+def canonical_key(path) -> str:
+    """Canonical unlock-map key: resolved, forward-slash, casefolded.
+
+    Must stay form-identical to services.access_guard.canonicalize()'s canon
+    string for existing paths (parity-tested) — the unlock map and the
+    access evaluator must never disagree about path identity on Windows.
+    """
+    return str(Path(path).resolve()).replace("\\", "/").casefold()
+
+
 def record_unlocked_files(
     paths,
     categories,
@@ -223,7 +244,7 @@ def record_unlocked_files(
         if not fp:
             continue
         try:
-            normalized = str(Path(fp).resolve())
+            normalized = canonical_key(fp)
         except OSError:
             continue
         cats = set(state["unlocked_files"].get(normalized, []))

{code_context_control-2.61.2 → code_context_control-2.63.0}/cli/c3.py

@@ -92,7 +92,17 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.61.2"
+__version__ = "2.63.0"
+
+
+def _compress_file_cli(compressor, path, mode="smart", **kw):
+    """compress_file for human-CLI paths: AccessDenied → error dict, not a
+    traceback. The refusal text names the rule so the operator can act."""
+    from services import access_guard as _ag
+    try:
+        return compressor.compress_file(path, mode, **kw)
+    except _ag.AccessDenied as exc:
+        return {"error": exc.message}
 
 
 def _command_deps() -> CommandDeps:
@@ -1338,7 +1348,7 @@ def _benchmark_extract_preview(full_path: Path, compressor: CodeCompressor, patt
     extracted = ""
 
     if ext in code_exts and not pattern:
-        result = compressor.compress_file(str(full_path), "smart")
+        result = _compress_file_cli(compressor, str(full_path), "smart")
         extracted = result.get("compressed", "") if "error" not in result else f"Error: {result['error']}"
 
     elif ext == ".jsonl" and not pattern:
@@ -1617,7 +1627,7 @@ def _benchmark_delegate_optional(project_path: Path, sample: list[tuple[Path, st
         "Focus on responsibilities, important functions/classes, and notable dependencies."
     )
 
-    compressed_result = compressor.compress_file(str(fpath), "smart")
+    compressed_result = _compress_file_cli(compressor, str(fpath), "smart")
     compressed_context = compressed_result.get("compressed", "") if isinstance(compressed_result, dict) else ""
     if not compressed_context:
         compressed_context = raw_content
@@ -3478,7 +3488,7 @@ def cmd_benchmark(args):
             raw_content = content
         comp_baseline_latencies.append((time.perf_counter() - t_read) * 1000)
         t0 = time.perf_counter()
-        result = compressor.compress_file(str(fpath), "smart")
+        result = _compress_file_cli(compressor, str(fpath), "smart")
         comp_c3_latencies.append((time.perf_counter() - t0) * 1000)
         raw_tokens = count_tokens(raw_content)
         comp_orig += raw_tokens
@@ -3544,7 +3554,7 @@ def cmd_benchmark(args):
                         tmp.write(raw_extracted)
                         tmp_path = tmp.name
                     try:
-                        comp_res = compressor.compress_file(tmp_path, mode="smart")
+                        comp_res = _compress_file_cli(compressor, tmp_path, mode="smart")
                         extracted_text += comp_res.get("compressed", raw_extracted)
                     finally:
                         if os.path.exists(tmp_path):
@@ -4660,6 +4670,7 @@ back to native tools as the task progresses.
 - **Delegate**: `c3_delegate(task, backend='ollama|codex|gemini|claude|auto')` — offload to other models
 - **Bitbucket** (v2.30.0+, when `c3 bitbucket login` has run): `c3_bitbucket(action='list_prs|get_pr|merge_pr|...')` — self-hosted Bitbucket Data Center / Server. Token in OS keyring; mutating actions auto-log to the edit ledger.
 - **Cross-project** (v2.31.0+): `c3_project(action='list|scan|search|read|edit|...', project='<name|path>')` — discover and operate on OTHER c3-installed projects. Reads run freely; writes (edit/shell/memory) need `allow_write=true`.
+- **Masked paths** (v2.63.0+): content prefixed `[c3-mask:transformed]` is a policy-transformed VIEW, not the file. Values may be synthetic, rows withheld, bodies stripped — don't copy literals out of it or infer completeness from it. Masked paths are read-only and refuse shell/git/validate/impact/filter/delegate (`[c3-mask:unsupported]`). That's policy, not a transient error — report the block instead of routing around it.
 
 ## Self-Check
 If you haven't called a c3_* tool in several turns during active development, re-engage
@@ -5203,6 +5214,9 @@ def cmd_install_mcp(args):
         ]
 
         # ── PreToolUse hooks (enforcement — blocks native tools without prior c3_*) ──
+        # Bash/run_shell_command joined in v2.62: the Access Guard sub-hook
+        # scans shell commands (best-effort); without these matchers PreToolUse
+        # simply never fires for shell — proven bypass, see docs/access-guard.md.
         _pre_matcher_names = [
             read_matcher,
             grep_matcher,
@@ -5210,6 +5224,8 @@ def cmd_install_mcp(args):
             edit_matcher,
             write_matcher,
             *extra_edit_matchers,
+            shell_matcher,
+            "run_shell_command",
         ]
         desired_pre_hooks = [
             {"matcher": m, "hooks": [{"type": "command", "command": hook_pretool_cmd}]}
@@ -5899,6 +5915,297 @@ def _creds_cmd_import(args, project_path: str) -> None:
               "(use --overwrite to replace)")
 
 
+def cmd_access(args):
+    """Access Guard rule management — human-only mutation surface (spec §1)."""
+    sub = getattr(args, "access_cmd", None)
+    if not sub:
+        print("Usage: c3 access {list,add,remove,check,mask} [args]")
+        print("       c3 access mask {add,rm,status,activate,preview} [args]")
+        return
+
+    project_path = getattr(args, "project_path", ".") or "."
+
+    if sub == "list":
+        _access_cmd_list(args, project_path)
+    elif sub == "add":
+        _access_cmd_add(args, project_path)
+    elif sub == "remove":
+        _access_cmd_remove(args, project_path)
+    elif sub == "check":
+        _access_cmd_check(args, project_path)
+    elif sub == "mask":
+        _access_cmd_mask(args, project_path)
+    else:
+        print(f"Unknown access subcommand: {sub}")
+
+
+def _access_scope(args) -> str:
+    return "global" if getattr(args, "use_global", False) else "project"
+
+
+def _access_audit(action: str, glob: str, kind: str, scope: str,
+                  project_path: str) -> None:
+    """Ledger + activity log for CLI rule mutations. Identifiers only; failure-safe."""
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(project_path).log("access_action", {
+            "kind": "access", "action": action, "glob": glob,
+            "rule_kind": kind, "scope": scope, "via": "cli",
+        })
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(project_path).log_edit(
+            file=f"access://{glob}", change_type=f"access_{action}",
+            summary=f"{action} {kind} rule '{glob}' ({scope}) via `c3 access`",
+            tags=["access", action],
+            detail={"kind": "access", "action": action, "glob": glob,
+                    "rule_kind": kind, "scope": scope},
+        )
+    except Exception:
+        pass
+
+
+def _access_cmd_list(args, project_path: str) -> None:
+    from services import access_guard
+
+    scopes = access_guard.list_rules(project_path)
+    notes = {"builtin": "built-in, always on",
+             "global": "~/.c3/config.json",
+             "project": ".c3/config.json"}
+    for scope in ("builtin", "global", "project"):
+        sec = scopes.get(scope) or {}
+        rules = [(k, g) for k in ("deny", "read_only") for g in sec.get(k, [])]
+        masks = sec.get("mask") or []
+        print(f"[{scope}] ({notes[scope]}) — {len(rules) + len(masks)} rule(s)")
+        for kind, glob in rules:
+            print(f"  {kind:<10} {glob}")
+        for entry in masks:
+            params = entry.get("params") or {}
+            detail = ", ".join(f"{k}={v}" for k, v in sorted(params.items()))
+            print(f"  {'mask':<10} {entry.get('glob')}  -> "
+                  f"{entry.get('preset')}" + (f"({detail})" if detail else ""))
+        if sec.get("corrupt"):
+            print("  [warn] access section invalid — scope fails closed "
+                  "(deny-all); fix config.json 'access' by hand")
+    print()
+    from services import mask_activation
+    summary = mask_activation.summary_line(project_path)
+    if summary:
+        print(summary)
+        print()
+    print(access_guard.COVERAGE_MATRIX)
+
+
+def _access_cmd_add(args, project_path: str) -> None:
+    from services import access_guard
+
+    scope = _access_scope(args)
+    try:
+        result = access_guard.set_rule(args.glob, args.kind, scope, project_path)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+    if result["added"]:
+        _access_audit("add", result["glob"], args.kind, scope, project_path)
+        print(f"[OK] Added {args.kind} rule '{result['glob']}' (scope={scope})")
+    else:
+        print(f"[=] Rule already present: '{result['glob']}' "
+              f"({args.kind}, {scope})")
+
+
+def _access_cmd_remove(args, project_path: str) -> None:
+    from services import access_guard
+
+    scope = _access_scope(args)
+    try:
+        result = access_guard.remove_rule(args.glob, args.kind, scope, project_path)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+    if result["removed"]:
+        _access_audit("remove", result["glob"], args.kind, scope, project_path)
+        print(f"[OK] Removed {args.kind} rule '{result['glob']}' (scope={scope})")
+    else:
+        print(f"[error] no {args.kind} rule matching '{result['glob']}' "
+              f"in {scope} scope")
+
+
+def _access_cmd_check(args, project_path: str) -> None:
+    from services import access_guard
+
+    op = getattr(args, "op", "read") or "read"
+    v = access_guard.verdict(args.target, op, project_path)
+    if v.masked:
+        rule = v.mask_rule
+        print(f"[MASKED] {op} served as a transformed view: {args.target}")
+        print(f"  rule '{rule.glob}' ({rule.scope} scope) -> {rule.preset}")
+        print("  Preview what the agent sees: "
+              f"c3 access mask preview {args.target}")
+    elif v.denial is None:
+        print(f"[OK] {op} allowed: {args.target}")
+    else:
+        print(access_guard.refusal(v.denial, args.target, op))
+
+
+# ── mask subcommands ────────────────────────────────────────────────────────
+
+def _parse_mask_params(raw: str, preset: str) -> dict:
+    """`count=20,strategy=first` / `columns=email,name` -> typed params."""
+    from services import access_guard
+
+    schema = (access_guard.MASK_PRESETS.get(preset) or {}).get("params", {})
+    params: dict = {}
+    for chunk in (raw or "").split(","):
+        chunk = chunk.strip()
+        if not chunk:
+            continue
+        if "=" not in chunk:
+            # bare value continues the previous list param (columns=a,b,c)
+            last = next((k for k in reversed(list(params))
+                         if schema.get(k) is list), None)
+            if last:
+                params[last].append(chunk)
+                continue
+            raise ValueError(f"cannot parse param '{chunk}' — use key=value")
+        key, value = (part.strip() for part in chunk.split("=", 1))
+        expected = schema.get(key)
+        if expected is int:
+            params[key] = int(value)
+        elif expected is list:
+            params[key] = [value]
+        else:
+            params[key] = value
+    return params
+
+
+def _access_cmd_mask_add(args, project_path: str) -> None:
+    from services import access_guard, mask_activation
+
+    scope = _access_scope(args)
+    try:
+        params = _parse_mask_params(getattr(args, "params", "") or "",
+                                    args.preset)
+        result = access_guard.set_mask_rule(args.glob, args.preset, params,
+                                            scope, project_path)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+    _access_audit("mask-add", result["glob"], args.preset, scope, project_path)
+    verb = "Replaced" if result["replaced"] else "Added"
+    print(f"[OK] {verb} mask rule '{result['glob']}' -> {args.preset} "
+          f"(scope={scope})")
+    print()
+    print(mask_activation.summary_line(project_path))
+    print("Run `c3 access mask activate` to purge pre-mask derived artifacts.")
+
+
+def _access_cmd_mask_remove(args, project_path: str) -> None:
+    from services import access_guard
+
+    scope = _access_scope(args)
+    try:
+        result = access_guard.remove_mask_rule(args.glob, scope, project_path)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+    if result["removed"]:
+        _access_audit("mask-remove", result["glob"], "mask", scope,
+                      project_path)
+        print(f"[OK] Removed mask rule '{result['glob']}' (scope={scope})")
+    else:
+        print(f"[error] no mask rule matching '{result['glob']}' "
+              f"in {scope} scope")
+
+
+def _access_cmd_mask_status(args, project_path: str) -> None:
+    from services import mask_activation
+
+    st = mask_activation.status(project_path)
+    print(f"rules      : {st['rule_count']}")
+    print(f"status     : {st['status']}")
+    print(f"stale      : {st['stale']}")
+    if st["corrupt_scopes"]:
+        print(f"corrupt    : {', '.join(st['corrupt_scopes'])}")
+    report = st.get("last_report") or {}
+    if report:
+        print(f"last run   : {report.get('views_built', 0)} view(s) built, "
+              f"{len(report.get('failures') or [])} failure(s)")
+        for failure in (report.get("failures") or [])[:10]:
+            print(f"  [fail] {failure['path']}: {failure['detail']}")
+    print()
+    print(mask_activation.summary_line(project_path) or "no mask rules")
+
+
+def _access_cmd_mask_activate(args, project_path: str) -> None:
+    from services import mask_activation
+
+    print("Activating mask rules (purge -> build -> validate)...")
+    report = mask_activation.activate(
+        project_path, rebuild_index=bool(getattr(args, "reindex", False)))
+    print(f"  files matched      : {report['files']}")
+    print(f"  views built        : {report['views_built']}")
+    print(f"  cache entries wiped: {report['cache_entries_removed']}")
+    print(f"  index dropped      : {report['index_dropped']}")
+    print(f"  file memory dropped: {report['file_memory_dropped']}")
+    facts = report.get("facts") or {}
+    print(f"  facts purged       : {facts.get('purged', 0)} "
+          f"(+{facts.get('unknown_purged', 0)} unknown-provenance)")
+    for failure in report.get("failures") or []:
+        print(f"  [fail] {failure['path']}: {failure['detail']}")
+    _access_audit("mask-activate", f"{report['files']} file(s)", "mask",
+                  "project", project_path)
+    print()
+    print(mask_activation.summary_line(project_path))
+
+
+def _access_cmd_mask_preview(args, project_path: str) -> None:
+    """Show exactly what the agent will see. Human surface only."""
+    from pathlib import Path as _Path
+
+    from services import access_guard, mask_mirror
+
+    target = _Path(args.target)
+    if not target.is_absolute():
+        target = _Path(project_path) / args.target
+    v = access_guard.verdict(str(target), "read", project_path)
+    if v.denial:
+        print(access_guard.refusal(v.denial, str(target), "read"))
+        return
+    if not v.masked:
+        print(f"[=] Not masked: {args.target} — the agent sees the real file.")
+        return
+    try:
+        view = mask_mirror.render_for_path(target, project_path)
+    except mask_mirror.MaskUnavailable as exc:
+        print(f"[error] {exc.message}")
+        return
+    print(f"rule    : '{v.mask_rule.glob}' ({v.mask_rule.scope} scope)")
+    print(f"preset  : {v.mask_rule.preset}  {v.mask_rule.params_dict or ''}")
+    print(f"stats   : {view.stats}")
+    print("-" * 70)
+    print(view.with_header(args.target))
+
+
+def _access_cmd_mask(args, project_path: str) -> None:
+    sub = getattr(args, "mask_cmd", None) or "status"
+    handlers = {
+        "add": _access_cmd_mask_add,
+        "rm": _access_cmd_mask_remove,
+        "remove": _access_cmd_mask_remove,
+        "status": _access_cmd_mask_status,
+        "activate": _access_cmd_mask_activate,
+        "preview": _access_cmd_mask_preview,
+    }
+    handler = handlers.get(sub)
+    if handler is None:
+        print(f"[error] unknown mask subcommand '{sub}' — expected one of: "
+              f"{', '.join(sorted(handlers))}")
+        return
+    handler(args, project_path)
+
+
 def cmd_jira(args):
     """Jira Cloud / Data Center credential + workspace management."""
     sub = getattr(args, "jira_cmd", None)
@@ -7199,6 +7506,7 @@ def main():
         "bitbucket": cmd_bitbucket,
         "jira": cmd_jira,
         "creds": cmd_creds,
+        "access": cmd_access,
         "oracle": cmd_oracle,
         "upgrade": cmd_upgrade,
     }

{code_context_control-2.61.2 → code_context_control-2.63.0}/cli/commands/parser.py

@@ -447,6 +447,84 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_import.add_argument("--overwrite", action="store_true", help="Replace entries already registered in the target scope")
     cr_import.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    # ── Access Guard (v2.62.0) ──────────────────────────────────────────
+    # Human-only mutation surface (frozen spec docs/access-guard.md §1):
+    # rule changes happen here or in the UI tab, never via an agent tool.
+    p_access = subparsers.add_parser(
+        "access",
+        help="Access Guard — path deny/read-only rules the agent must respect",
+    )
+    access_subs = p_access.add_subparsers(dest="access_cmd")
+
+    ac_list = access_subs.add_parser(
+        "list", help="Show rules per scope (builtin + global + project) and coverage"
+    )
+    ac_list.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    ac_add = access_subs.add_parser("add", help="Add a rule to the project (or --global) scope")
+    ac_add.add_argument("glob", help="POSIX glob (** crosses directories), e.g. 'secrets/**' or '*.pem'")
+    ac_add.add_argument("--kind", choices=["deny", "read_only"], required=True,
+                        help="deny = no read/write/enumerate; read_only = no write")
+    ac_add.add_argument("--global", dest="use_global", action="store_true",
+                        help="Store in the global scope (~/.c3) so every C3 project enforces it")
+    ac_add.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    ac_remove = access_subs.add_parser("remove", help="Remove a rule from the project (or --global) scope")
+    ac_remove.add_argument("glob", help="The stored glob to remove (case-insensitive match)")
+    ac_remove.add_argument("--kind", choices=["deny", "read_only"], required=True,
+                           help="Which rule list the glob lives in")
+    ac_remove.add_argument("--global", dest="use_global", action="store_true",
+                           help="Remove from the global scope (~/.c3)")
+    ac_remove.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    ac_check = access_subs.add_parser("check", help="Test a path: verdict + matched rule + refusal string")
+    ac_check.add_argument("target", help="Path to test (absolute or project-relative)")
+    ac_check.add_argument("--op", choices=["read", "write"], default="read",
+                          help="Operation to evaluate (default: read)")
+    ac_check.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    # ── Mask Guard (v2.63.0, docs/mask-guard.md) ────────────────────────
+    # Masking exposes a path but transforms what the agent sees. Rules are
+    # human-only, like the rest of Access Guard.
+    ac_mask = access_subs.add_parser(
+        "mask", help="Mask Guard — expose a path but transform what the agent sees")
+    mask_subs = ac_mask.add_subparsers(dest="mask_cmd")
+
+    am_add = mask_subs.add_parser("add", help="Add or replace a mask rule")
+    am_add.add_argument("glob", help="POSIX glob, e.g. 'data/**' or '*.csv'")
+    am_add.add_argument("--preset", required=True,
+                        choices=["redact_secrets", "redact_columns",
+                                 "sample_rows", "signatures_only"],
+                        help="Deterministic transform applied to matching files")
+    am_add.add_argument("--params", default="",
+                        help="Preset params, e.g. 'count=20,strategy=first' "
+                             "or 'columns=email,name'")
+    am_add.add_argument("--global", dest="use_global", action="store_true",
+                        help="Store in the global scope (~/.c3)")
+    am_add.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    am_rm = mask_subs.add_parser("rm", help="Remove a mask rule")
+    am_rm.add_argument("glob", help="The stored glob to remove")
+    am_rm.add_argument("--global", dest="use_global", action="store_true",
+                       help="Remove from the global scope (~/.c3)")
+    am_rm.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    am_status = mask_subs.add_parser(
+        "status", help="Activation state — whether masking is actually in effect")
+    am_status.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    am_act = mask_subs.add_parser(
+        "activate",
+        help="Purge pre-mask derived artifacts, then build + validate views")
+    am_act.add_argument("--reindex", action="store_true",
+                        help="Also rebuild the code index in the same pass")
+    am_act.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
+    am_prev = mask_subs.add_parser(
+        "preview", help="Show exactly what the agent sees for one path")
+    am_prev.add_argument("target", help="Path to preview (absolute or project-relative)")
+    am_prev.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
     # ── Oracle Discovery API (v2.32.0) ──────────────────────────────────
     p_oracle = subparsers.add_parser(
         "oracle",