code-context-control 2.63.2__tar.gz → 2.65.0__tar.gz

{code_context_control-2.63.2 → code_context_control-2.65.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.63.2
+Version: 2.65.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.63.2 → code_context_control-2.65.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.63.2"
+__version__ = "2.65.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -257,7 +257,8 @@ _C3_MCP_ALLOW = [
     "mcp__c3__c3_session", "mcp__c3__c3_status", "mcp__c3__c3_filter",
     "mcp__c3__c3_memory", "mcp__c3__c3_validate", "mcp__c3__c3_edit",
     "mcp__c3__c3_agent", "mcp__c3__c3_delegate", "mcp__c3__c3_edits",
-    "mcp__c3__c3_impact", "mcp__c3__c3_shell", "mcp__c3__c3_bitbucket",
+    "mcp__c3__c3_impact", "mcp__c3__c3_locks", "mcp__c3__c3_shell",
+    "mcp__c3__c3_bitbucket",
     "mcp__c3__c3_jira", "mcp__c3__c3_credentials",
     "mcp__c3__c3_project", "mcp__c3__c3_task", "mcp__c3__c3_artifacts",
 ]
@@ -4046,14 +4047,22 @@ def cmd_pipe(args):
 
 
 from services.claude_md import C3_COMPACT_WORKFLOW as _SHARED_C3_COMPACT_WORKFLOW
+from services.claude_md import VSCODE_SESSION_INIT as _VSCODE_SESSION_INIT
+from services.claude_md import adapt_workflow_for_ide as _adapt_workflow_for_ide
 
 _C3_COMPACT_WORKFLOW = _SHARED_C3_COMPACT_WORKFLOW
 
 _CLAUDE_MD_CONTENT = _C3_COMPACT_WORKFLOW
 
-_COPILOT_INSTRUCTIONS_CONTENT = _C3_COMPACT_WORKFLOW
+# Copilot and Codex run without PreToolUse hooks and without /clear, so both
+# docs get the hookless restatement of the mandate (see PROFILES in core/ide.py).
+_C3_HOOKLESS_WORKFLOW = _adapt_workflow_for_ide(
+    _C3_COMPACT_WORKFLOW, supports_hooks=False, supports_clear=False
+)
+
+_COPILOT_INSTRUCTIONS_CONTENT = _VSCODE_SESSION_INIT + "\n\n" + _C3_HOOKLESS_WORKFLOW
 
-_AGENTS_MD_CONTENT = _C3_COMPACT_WORKFLOW + """
+_AGENTS_MD_CONTENT = _C3_HOOKLESS_WORKFLOW + """
 
 ## IDE Configuration (Codex)
 This project uses project-scoped MCP servers. Ensure your `.codex/config.toml` includes:
@@ -5200,6 +5209,7 @@ def cmd_install_mcp(args):
             "mcp__c3__c3_edit",
             "mcp__c3__c3_edits",
             "mcp__c3__c3_impact",
+            "mcp__c3__c3_locks",
             "mcp__c3__c3_status",
             "mcp__c3__c3_delegate",
             "mcp__c3__c3_session",
@@ -5915,12 +5925,90 @@ def _creds_cmd_import(args, project_path: str) -> None:
               "(use --overwrite to replace)")
 
 
+def cmd_locks(args):
+    """Agent Locks — human surface. force-release lives here, never in c3_locks."""
+    from services import agent_locks as al
+
+    sub = getattr(args, "locks_cmd", None) or "list"
+    project_path = getattr(args, "project_path", ".") or "."
+    store = al.store_for(project_path)
+    cfg = al.config(project_path)
+
+    if sub == "list":
+        snap = store.snapshot()
+        print(f"{snap['count']} active lease(s) — mode={cfg['mode']}, "
+              f"enabled={cfg['enabled']}, fencing={snap['fencing']}")
+        if not snap["locks"]:
+            return
+        print(f"  {'file':<44} {'holder':<24} {'left':<8} intent")
+        for row in snap["locks"]:
+            left = int(max(0, row.get("expires_in_s", 0)))
+            print(f"  {row['relpath']:<44} {row['agent_id']:<24} "
+                  f"{left//60}m{left % 60:02d}s   {row.get('intent', '')}")
+        return
+
+    if sub == "release":
+        res = store.release(session_id=args.session)
+        print(f"Released {res['count']} lease(s)"
+              + (f": {', '.join(res['released'])}" if res["released"] else ""))
+        return
+
+    if sub == "force-release":
+        res = store.force_release(args.file, by="cli", note=args.note)
+        if not res.get("forced"):
+            print(f"[error] {res.get('error')}: {res.get('reason', '')}")
+            return
+        _locks_audit(args.file, res, project_path, args.note)
+        if res["was_locked"]:
+            print(f"[OK] Broke the lease on {res['relpath']} "
+                  f"(was held by {res['previous_owner']}).")
+            print("     The fencing token moved, so the old holder is stale "
+                  "even if it thinks it still holds it.")
+        else:
+            print(f"[=] {res['relpath']} was not locked; fencing bumped anyway.")
+        return
+
+    if sub == "sweep":
+        res = store.sweep()
+        print(f"Swept {res['count']} expired lease(s)"
+              + (f": {', '.join(res['expired'])}" if res["expired"] else ""))
+        return
+
+    print("Usage: c3 locks {list,release,force-release,sweep}")
+
+
+def _locks_audit(target: str, res: dict, project_path: str, note: str) -> None:
+    """Ledger + activity log for a human lease override. Failure-safe."""
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(project_path).log("lock_force_release", {
+            "kind": "locks", "relpath": res.get("relpath"),
+            "previous_owner": res.get("previous_owner"), "via": "cli",
+        })
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(project_path).log_edit(
+            file=f"lock://{res.get('relpath', target)}",
+            change_type="lock_force_release",
+            summary=f"force-released lease on {res.get('relpath', target)}"
+                    + (f" — {note}" if note else ""),
+            tags=["locks", "force_release"],
+            detail={"kind": "locks", "previous_owner": res.get("previous_owner"),
+                    "was_locked": res.get("was_locked"), "note": note},
+        )
+    except Exception:
+        pass
+
+
 def cmd_access(args):
     """Access Guard rule management — human-only mutation surface (spec §1)."""
     sub = getattr(args, "access_cmd", None)
     if not sub:
-        print("Usage: c3 access {list,add,remove,check,mask} [args]")
+        print("Usage: c3 access {list,add,remove,check,mask,builtin} [args]")
         print("       c3 access mask {add,rm,status,activate,preview} [args]")
+        print("       c3 access builtin {disable,enable} <glob>")
         return
 
     project_path = getattr(args, "project_path", ".") or "."
@@ -5935,6 +6023,8 @@ def cmd_access(args):
         _access_cmd_check(args, project_path)
     elif sub == "mask":
         _access_cmd_mask(args, project_path)
+    elif sub == "builtin":
+        _access_cmd_builtin(args, project_path)
     else:
         print(f"Unknown access subcommand: {sub}")
 
@@ -5989,6 +6079,25 @@ def _access_cmd_list(args, project_path: str) -> None:
         if sec.get("corrupt"):
             print("  [warn] access section invalid — scope fails closed "
                   "(deny-all); fix config.json 'access' by hand")
+        if scope == "builtin":
+            off = sec.get("disabled") or []
+            if off:
+                print("  DISABLED by you (not enforced):")
+                for glob in off:
+                    print(f"    {'off':<10} {glob}")
+                print("    re-enable: c3 access builtin enable <glob>")
+            can = [g for g in (sec.get("disableable") or [])
+                   if access_guard._norm_builtin(g) not in set(off)]
+            if can:
+                print("  disableable (currently on): "
+                      + ", ".join(can))
+                print("    disable: c3 access builtin disable <glob>")
+            if sec.get("absolute"):
+                print("  absolute (credential vault, cannot be disabled): "
+                      + ", ".join(sec["absolute"]))
+            print("  spelling rules (deny by how a path is written, no glob):")
+            for name, why in access_guard.SYNTHETIC_RULES:
+                print(f"    {name:<18} {why}")
     print()
     from services import mask_activation
     summary = mask_activation.summary_line(project_path)
@@ -5998,6 +6107,58 @@ def _access_cmd_list(args, project_path: str) -> None:
     print(access_guard.COVERAGE_MATRIX)
 
 
+def _access_cmd_builtin(args, project_path: str) -> None:
+    """Switch a Tier-1 builtin off or back on. Human-only; always global scope.
+
+    Disabling asks for typed confirmation unless --yes: these guards are what
+    stop an agent rewriting its own hooks, settings or git history, and the
+    consequence deserves a beat of friction.
+    """
+    from services import access_guard
+
+    action = getattr(args, "builtin_cmd", None)
+    glob = getattr(args, "glob", None)
+    if action not in ("disable", "enable") or not glob:
+        print("Usage: c3 access builtin {disable,enable} <glob>")
+        print("       disableable: "
+              + ", ".join(access_guard.DISABLEABLE_BUILTINS))
+        return
+
+    disabling = action == "disable"
+    if disabling and not getattr(args, "yes", False):
+        print(f"About to STOP enforcing the builtin guard on: {glob}")
+        print("  While off, any agent with C3 tools can write those paths.")
+        if glob.endswith("settings*.json") or ".claude" in glob:
+            print("  This is the file that configures the agent itself — hooks,")
+            print("  permissions, model. An agent could rewrite its own rules.")
+        reply = input("Type the glob again to confirm: ").strip()
+        if reply != glob:
+            print("[abort] Not confirmed; nothing changed.")
+            return
+
+    try:
+        result = access_guard.set_builtin_disabled(glob, disabling)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+
+    _access_audit(f"builtin_{action}", result["glob"], "builtin", "global",
+                  project_path)
+    if not result["changed"]:
+        state = "already disabled" if disabling else "already enforced"
+        print(f"[=] {result['glob']} — {state}")
+        return
+    if disabling:
+        print(f"[OK] Builtin '{result['glob']}' DISABLED (global scope).")
+        print("     Re-enable with: c3 access builtin enable "
+              f"{result['glob']}")
+    else:
+        print(f"[OK] Builtin '{result['glob']}' re-enforced.")
+        if not result["attested"]:
+            print("     [warn] keyring attestation could not be cleared; the "
+                  "builtin is enforced anyway (config entry removed).")
+
+
 def _access_cmd_add(args, project_path: str) -> None:
     from services import access_guard
 
@@ -6404,6 +6565,66 @@ def _jira_cmd_set_default(args, project_path: str) -> None:
     print(f"[OK] Default Jira project: {args.project}")
 
 
+def _oracle_open(args):
+    """Mint a single-use sign-in URL for a running Oracle dashboard (#31).
+
+    Plain ``GET /`` no longer issues the session cookie, so a dashboard opened
+    by hand is read-only until a bootstrap code is redeemed. Reading the
+    owner-only key file is what proves we are the same OS user as the server.
+    """
+    import json as _json
+    import urllib.error
+    import urllib.request
+    import webbrowser
+
+    from oracle.config import ORACLE_DIR, load_config
+    from oracle.services import local_session
+
+    cfg = load_config()
+    host = cfg.get("bind_host", "127.0.0.1")
+    disp_host = "127.0.0.1" if host in ("0.0.0.0", "") else host
+    port = getattr(args, "port", None) or cfg.get("port", 3331)
+    base = f"http://{disp_host}:{port}"
+
+    key = local_session.read_bootstrap_key(ORACLE_DIR)
+    if not key:
+        print(f"[oracle:open] no bootstrap key at "
+              f"{ORACLE_DIR / local_session.BOOTSTRAP_KEY_FILENAME}")
+        print("  The key is written when the server starts. Is Oracle running?")
+        print("  Start it with: c3 oracle serve")
+        return
+
+    req = urllib.request.Request(
+        f"{base}/api/session/bootstrap",
+        data=_json.dumps({"key": key}).encode("utf-8"),
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            payload = _json.loads(resp.read().decode("utf-8"))
+    except urllib.error.HTTPError as e:
+        detail = e.read().decode("utf-8", "replace")[:200]
+        print(f"[oracle:open] server refused the request ({e.code}): {detail}")
+        if e.code == 401:
+            print("  The key on disk is stale — restart the server to rewrite it.")
+        return
+    except OSError as e:
+        print(f"[oracle:open] could not reach {base}: {e}")
+        print("  Start it with: c3 oracle serve")
+        return
+
+    url = payload.get("url", "")
+    if not url:
+        print("[oracle:open] server returned no URL")
+        return
+    ttl = payload.get("expires_in", local_session.CODE_TTL_SECONDS)
+    print(f"[oracle:open] single-use sign-in link (valid {ttl}s, one use):")
+    print(f"  {url}")
+    if not getattr(args, "no_browser", False):
+        webbrowser.open(url)
+
+
 def cmd_oracle(args):
     """Oracle dashboard server + Discovery API key management."""
     sub = getattr(args, "oracle_cmd", None)
@@ -6414,8 +6635,12 @@ def cmd_oracle(args):
         run_oracle(port=getattr(args, "port", None),
                    open_browser=not getattr(args, "no_browser", False))
         return
+    if sub == "open":
+        _oracle_open(args)
+        return
     if sub != "api":
-        print("Usage: c3 oracle {serve,api} — serve: launch the dashboard; "
+        print("Usage: c3 oracle {serve,open,api} — serve: launch the dashboard; "
+              "open: sign in to a running dashboard; "
               "api {info,key,rotate,clear}: manage the Discovery key")
         return
 
@@ -7507,6 +7732,7 @@ def main():
         "jira": cmd_jira,
         "creds": cmd_creds,
         "access": cmd_access,
+        "locks": cmd_locks,
         "oracle": cmd_oracle,
         "upgrade": cmd_upgrade,
     }

{code_context_control-2.63.2 → code_context_control-2.65.0}/cli/commands/parser.py

@@ -447,6 +447,30 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_import.add_argument("--overwrite", action="store_true", help="Replace entries already registered in the target scope")
     cr_import.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    # ── Agent Locks (docs/agent-locks.md) ───────────────────────────────
+    # force-release is human-only: it bumps the fencing counter so a holder
+    # that comes back is stale by construction. Agents get c3_locks instead,
+    # which deliberately has no force action.
+    p_locks = subparsers.add_parser(
+        "locks", help="Agent leases — see who holds which file, release a stuck one")
+    locks_subs = p_locks.add_subparsers(dest="locks_cmd")
+
+    lk_list = locks_subs.add_parser("list", help="Show active leases")
+    lk_list.add_argument("--path", dest="project_path", default=".")
+
+    lk_rel = locks_subs.add_parser("release", help="Release leases held by a session")
+    lk_rel.add_argument("--session", required=True, help="session_id to release")
+    lk_rel.add_argument("--path", dest="project_path", default=".")
+
+    lk_force = locks_subs.add_parser(
+        "force-release", help="Break one lease regardless of holder (audited)")
+    lk_force.add_argument("file", help="Project-relative path to unlock")
+    lk_force.add_argument("--note", default="", help="Why — recorded in the ledger")
+    lk_force.add_argument("--path", dest="project_path", default=".")
+
+    lk_sweep = locks_subs.add_parser("sweep", help="Drop expired leases now")
+    lk_sweep.add_argument("--path", dest="project_path", default=".")
+
     # ── Access Guard (v2.62.0) ──────────────────────────────────────────
     # Human-only mutation surface (frozen spec docs/access-guard.md §1):
     # rule changes happen here or in the UI tab, never via an agent tool.
@@ -483,6 +507,24 @@ def build_parser(version: str, parse_cli_ide_arg):
                           help="Operation to evaluate (default: read)")
     ac_check.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    # ── Builtin opt-out (two-key) ───────────────────────────────────────
+    # Builtins are on by default. Switching one off needs a config entry AND
+    # a keyring attestation, so an agent that writes config.json alone still
+    # cannot loosen the guard. Global scope only — project scopes may only
+    # ever tighten. The credential-vault builtins are never disableable.
+    ac_builtin = access_subs.add_parser(
+        "builtin", help="Disable or re-enable a built-in guard (global, needs confirmation)")
+    builtin_subs = ac_builtin.add_subparsers(dest="builtin_cmd")
+    for _name, _help in (("disable", "Stop enforcing a built-in guard"),
+                         ("enable", "Re-enforce a built-in guard")):
+        _p = builtin_subs.add_parser(_name, help=_help)
+        _p.add_argument("glob", help="One of: **/.env*, **/.c3/**, **/.claude/settings*.json, **/.git/**")
+        _p.add_argument("--path", dest="project_path", default=".",
+                        help="Project directory used for the audit log (default: current)")
+        if _name == "disable":
+            _p.add_argument("--yes", action="store_true",
+                            help="Skip the typed confirmation (scripts/CI)")
+
     # ── Mask Guard (v2.63.0, docs/mask-guard.md) ────────────────────────
     # Masking exposes a path but transforms what the agent sees. Rules are
     # human-only, like the rest of Access Guard.
@@ -540,6 +582,14 @@ def build_parser(version: str, parse_cli_ide_arg):
                           help="Server port (default: config 'port', 3331)")
     or_serve.add_argument("--no-browser", action="store_true",
                           help="Don't open the browser")
+    or_open = or_subs.add_parser(
+        "open",
+        help="Sign in to a running dashboard via a single-use URL",
+    )
+    or_open.add_argument("--port", type=int, default=None,
+                         help="Server port (default: config 'port', 3331)")
+    or_open.add_argument("--no-browser", action="store_true",
+                         help="Print the URL without opening a browser")
     or_api = or_subs.add_parser(
         "api",
         help="Show connection info / manage the Discovery API key",

{code_context_control-2.63.2 → code_context_control-2.65.0}/cli/hook_access_guard.py

@@ -31,6 +31,23 @@ _SHELL_TOOLS = {"Bash"}  # normalize_tool_name folds run_shell_command in
 _TOKEN_SPLIT = re.compile(r"\s+")
 _MAX_TOKENS = 200
 
+# A colon in a shell token overwhelmingly means "URL scheme" or "IPv6", not
+# "NTFS alternate data stream". The ADS check stays strict for real path
+# arguments (_WRITE_TOOLS/_READ_TOOLS); here it only produced false denies on
+# commit messages, curl, and gh (#50).
+_SCHEME_RE = re.compile(r"^[a-z][a-z0-9+.\-]*://", re.IGNORECASE)
+# IPv6 literal or CIDR: >=2 colons, hex groups only, optional [] and /prefix.
+# 'C:/x/f.txt:stream' has one colon and non-hex parts, so it never matches.
+_IPV6_RE = re.compile(
+    r"^\[?[0-9a-f]{0,4}(?::[0-9a-f]{0,4}){2,}\]?(?:/\d{1,3})?$",
+    re.IGNORECASE,
+)
+
+
+def _is_network_token(tok: str) -> bool:
+    """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling."""
+    return bool(_SCHEME_RE.match(tok) or _IPV6_RE.match(tok))
+
 
 def _deny(reason: str) -> dict:
     return {
@@ -57,6 +74,10 @@ def _scan_shell(cmd: str, base: str):
     Confident = the token resolves to an EXISTING path that a ``deny`` rule
     covers (existence-gating keeps regex/pattern arguments like '\\.env'
     from false-denying), or the evaluator flags the spelling itself.
+
+    URLs and IPv6 literals are skipped outright: they trip the ADS spelling
+    check, which is exempt from existence-gating, so a token naming nothing
+    on disk would otherwise hard-deny (#50).
     """
     for raw in _TOKEN_SPLIT.split(cmd)[:_MAX_TOKENS]:
         tok = raw.strip("\"'`;,()")
@@ -64,6 +85,8 @@ def _scan_shell(cmd: str, base: str):
             continue
         if "/" not in tok and "\\" not in tok and not tok.startswith("."):
             continue
+        if _is_network_token(tok):
+            continue
         if re.match(r"^/[a-z]/", tok):  # MSYS /c/foo → C:/foo
             tok = f"{tok[1]}:{tok[2:]}"
         denial = ag.check(tok, "read", base)

{code_context_control-2.63.2 → code_context_control-2.65.0}/cli/hub_server.py

@@ -335,6 +335,7 @@ _HUB_JS_FILES = [
     "hub_ui/components/drill_panel.js",
     "hub_ui/components/drill_views.js",
     "hub_ui/components/hub_credentials.js",
+    "hub_ui/components/hub_locks.js",
     "hub_ui/components/drill_subprojects.js",
     "hub_ui/components/drill_health.js",
     "hub_ui/components/drill_tasks.js",
@@ -379,12 +380,6 @@ def index():
     return Response(_hub_html_cache, mimetype="text/html")
 
 
-@app.route("/legacy")
-def index_legacy():
-    """Frozen pre-2.44 hub UI — escape hatch for one release, then removed."""
-    return send_from_directory(str(Path(__file__).parent), "hub.html")
-
-
 @app.route("/guide/")
 @app.route("/guide/<path:filename>")
 def serve_guide(filename="index.html"):
@@ -439,8 +434,9 @@ def api_hub_config_set():
         cfg["projects_view"] = projects_view
     if "main_view" in data:
         main_view = str(data["main_view"]).strip().lower()
-        if main_view not in {"projects", "board", "creds"}:
-            return jsonify({"error": "main_view must be 'projects', 'board' or 'creds'"}), 400
+        if main_view not in {"projects", "board", "creds", "locks"}:
+            return jsonify({"error": "main_view must be 'projects', 'board', "
+                                     "'creds' or 'locks'"}), 400
         cfg["main_view"] = main_view
     if "oracle_url" in data:
         cfg["oracle_url"] = str(data["oracle_url"]).strip()
@@ -2045,6 +2041,96 @@ def api_hub_credentials_overview():
     return jsonify({"global": {"entries": global_out}, "projects": projects_out})
 
 
+# ── Agent Locks (hub) ────────────────────────────────────────────────────────
+# Read + one human override. force-release is here and in `c3 locks`, never in
+# the c3_locks agent tool: it bumps the fencing counter so a holder that comes
+# back is stale by construction, which is a decision for a person.
+
+
+@app.route("/api/hub/locks/overview", methods=["GET"])
+def api_hub_locks_overview():
+    """Cross-project lease snapshot for the Locks tab.
+
+    Per-row isolation like /api/hub/credentials/overview: one unreadable
+    project must not blank the page. A project we cannot read reports
+    ``error``/``initialized`` rather than an empty lease list — "0 leases"
+    would claim the repo is clear when we simply do not know.
+    """
+    from services import agent_locks as al
+
+    rows, total = [], 0
+    for p in _pm().list_projects():
+        ppath = str(p.get("path") or "")
+        row = {"name": p.get("name") or "", "path": ppath, "initialized": True,
+               "error": None, "enabled": True, "mode": "advisory",
+               "locks": [], "count": 0, "fencing": 0}
+        try:
+            if not (Path(ppath) / ".c3").is_dir():
+                row["initialized"] = False
+            else:
+                cfg = al.config(ppath)
+                row["enabled"] = cfg["enabled"]
+                row["mode"] = cfg["mode"]
+                snap = al.store_for(ppath).snapshot()
+                row["locks"] = snap["locks"]
+                row["count"] = snap["count"]
+                row["fencing"] = snap["fencing"]
+                total += snap["count"]
+        except Exception as e:
+            row["error"] = str(e)
+        rows.append(row)
+    return jsonify({"projects": rows, "total": total,
+                    # Surfaced so the UI can state its own limits instead of
+                    # implying a lease covers everything (spec §9).
+                    "coverage_note": (
+                        "Leases gate C3 tool surfaces only. A raw shell "
+                        "redirect, a non-Claude agent, or a human in an editor "
+                        "is not covered.")})
+
+
+@app.route("/api/projects/locks/force-release", methods=["POST"])
+def api_projects_locks_force_release():
+    """Break one lease regardless of holder. Human-only, audited on the target."""
+    from services import agent_locks as al
+
+    data = request.get_json(force=True) or {}
+    path = (data.get("path") or "").strip()
+    relpath = (data.get("relpath") or "").strip()
+    note = (data.get("note") or "").strip()
+    if not path or not relpath:
+        return jsonify({"error": "path and relpath are required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+
+    res = al.store_for(resolved).force_release(relpath, by="hub", note=note)
+    if not res.get("forced"):
+        return jsonify({"error": res.get("error", "force-release failed"),
+                        "reason": res.get("reason", "")}), 400
+
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(resolved).log("lock_force_release", {
+            "kind": "locks", "relpath": res.get("relpath"),
+            "previous_owner": res.get("previous_owner"), "via": "hub"})
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(resolved).log_edit(
+            file=f"lock://{res.get('relpath', relpath)}",
+            change_type="lock_force_release",
+            summary=f"force-released lease on {res.get('relpath', relpath)}"
+                    + (f" — {note}" if note else ""),
+            tags=["locks", "force_release"],
+            detail={"kind": "locks", "previous_owner": res.get("previous_owner"),
+                    "was_locked": res.get("was_locked"), "note": note})
+    except Exception:
+        pass
+    return jsonify(res)
+
+
 @app.route("/api/projects/config", methods=["PUT"])
 def api_projects_config_put():
     """Whitelisted section write: deep-merge, atomic replace, audited on the target."""

{code_context_control-2.63.2 → code_context_control-2.65.0}/cli/hub_ui/app.js

@@ -17,7 +17,7 @@ function App() {
   const [version, setVersion] = useState('');
   const [projects, setProjects] = useState([]);
   const [loaded, setLoaded] = useState(false);
-  const [mainView, setMainView] = useState('projects'); // projects | board | creds
+  const [mainView, setMainView] = useState('projects'); // projects | board | creds | locks
   const [filter, setFilter] = useState('all');          // all | active | idle | tag:<x>
   const [search, setSearch] = useState('');
   const [view, setView] = useState('list');             // list | grid
@@ -44,7 +44,7 @@ function App() {
       if (cfg.projects_view === 'grid') setView('grid');
       if (cfg.sidebar_collapsed != null) setSidebarCollapsed(!!cfg.sidebar_collapsed);
       if (cfg.sidebar_group) setFilter(cfg.sidebar_group);
-      if (cfg.main_view === 'board' || cfg.main_view === 'creds') setMainView(cfg.main_view);
+      if (['board', 'creds', 'locks'].includes(cfg.main_view)) setMainView(cfg.main_view);
     } catch { }
     try { const v = await api.get('/api/version'); setVersion(v.c3_version || ''); } catch { }
   }, []);
@@ -114,6 +114,8 @@ function App() {
             <TaskBoard projects={projects} onOpenDrill={openDrill} />
           ) : mainView === 'creds' ? (
             <HubCredentials projects={projects} onOpenDrill={openDrill} />
+          ) : mainView === 'locks' ? (
+            <HubLocks projects={projects} onOpenDrill={openDrill} />
           ) : (
             <React.Fragment>
               <SummaryBar projects={projects} search={search} setSearch={setSearch}