code-context-control 2.64.0__py3-none-any.whl → 2.65.0__py3-none-any.whl

cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.64.0"
+__version__ = "2.65.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -257,7 +257,8 @@ _C3_MCP_ALLOW = [
     "mcp__c3__c3_session", "mcp__c3__c3_status", "mcp__c3__c3_filter",
     "mcp__c3__c3_memory", "mcp__c3__c3_validate", "mcp__c3__c3_edit",
     "mcp__c3__c3_agent", "mcp__c3__c3_delegate", "mcp__c3__c3_edits",
-    "mcp__c3__c3_impact", "mcp__c3__c3_shell", "mcp__c3__c3_bitbucket",
+    "mcp__c3__c3_impact", "mcp__c3__c3_locks", "mcp__c3__c3_shell",
+    "mcp__c3__c3_bitbucket",
     "mcp__c3__c3_jira", "mcp__c3__c3_credentials",
     "mcp__c3__c3_project", "mcp__c3__c3_task", "mcp__c3__c3_artifacts",
 ]
@@ -5208,6 +5209,7 @@ def cmd_install_mcp(args):
             "mcp__c3__c3_edit",
             "mcp__c3__c3_edits",
             "mcp__c3__c3_impact",
+            "mcp__c3__c3_locks",
             "mcp__c3__c3_status",
             "mcp__c3__c3_delegate",
             "mcp__c3__c3_session",
@@ -5923,12 +5925,90 @@ def _creds_cmd_import(args, project_path: str) -> None:
               "(use --overwrite to replace)")
 
 
+def cmd_locks(args):
+    """Agent Locks — human surface. force-release lives here, never in c3_locks."""
+    from services import agent_locks as al
+
+    sub = getattr(args, "locks_cmd", None) or "list"
+    project_path = getattr(args, "project_path", ".") or "."
+    store = al.store_for(project_path)
+    cfg = al.config(project_path)
+
+    if sub == "list":
+        snap = store.snapshot()
+        print(f"{snap['count']} active lease(s) — mode={cfg['mode']}, "
+              f"enabled={cfg['enabled']}, fencing={snap['fencing']}")
+        if not snap["locks"]:
+            return
+        print(f"  {'file':<44} {'holder':<24} {'left':<8} intent")
+        for row in snap["locks"]:
+            left = int(max(0, row.get("expires_in_s", 0)))
+            print(f"  {row['relpath']:<44} {row['agent_id']:<24} "
+                  f"{left//60}m{left % 60:02d}s   {row.get('intent', '')}")
+        return
+
+    if sub == "release":
+        res = store.release(session_id=args.session)
+        print(f"Released {res['count']} lease(s)"
+              + (f": {', '.join(res['released'])}" if res["released"] else ""))
+        return
+
+    if sub == "force-release":
+        res = store.force_release(args.file, by="cli", note=args.note)
+        if not res.get("forced"):
+            print(f"[error] {res.get('error')}: {res.get('reason', '')}")
+            return
+        _locks_audit(args.file, res, project_path, args.note)
+        if res["was_locked"]:
+            print(f"[OK] Broke the lease on {res['relpath']} "
+                  f"(was held by {res['previous_owner']}).")
+            print("     The fencing token moved, so the old holder is stale "
+                  "even if it thinks it still holds it.")
+        else:
+            print(f"[=] {res['relpath']} was not locked; fencing bumped anyway.")
+        return
+
+    if sub == "sweep":
+        res = store.sweep()
+        print(f"Swept {res['count']} expired lease(s)"
+              + (f": {', '.join(res['expired'])}" if res["expired"] else ""))
+        return
+
+    print("Usage: c3 locks {list,release,force-release,sweep}")
+
+
+def _locks_audit(target: str, res: dict, project_path: str, note: str) -> None:
+    """Ledger + activity log for a human lease override. Failure-safe."""
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(project_path).log("lock_force_release", {
+            "kind": "locks", "relpath": res.get("relpath"),
+            "previous_owner": res.get("previous_owner"), "via": "cli",
+        })
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(project_path).log_edit(
+            file=f"lock://{res.get('relpath', target)}",
+            change_type="lock_force_release",
+            summary=f"force-released lease on {res.get('relpath', target)}"
+                    + (f" — {note}" if note else ""),
+            tags=["locks", "force_release"],
+            detail={"kind": "locks", "previous_owner": res.get("previous_owner"),
+                    "was_locked": res.get("was_locked"), "note": note},
+        )
+    except Exception:
+        pass
+
+
 def cmd_access(args):
     """Access Guard rule management — human-only mutation surface (spec §1)."""
     sub = getattr(args, "access_cmd", None)
     if not sub:
-        print("Usage: c3 access {list,add,remove,check,mask} [args]")
+        print("Usage: c3 access {list,add,remove,check,mask,builtin} [args]")
         print("       c3 access mask {add,rm,status,activate,preview} [args]")
+        print("       c3 access builtin {disable,enable} <glob>")
         return
 
     project_path = getattr(args, "project_path", ".") or "."
@@ -5943,6 +6023,8 @@ def cmd_access(args):
         _access_cmd_check(args, project_path)
     elif sub == "mask":
         _access_cmd_mask(args, project_path)
+    elif sub == "builtin":
+        _access_cmd_builtin(args, project_path)
     else:
         print(f"Unknown access subcommand: {sub}")
 
@@ -5998,6 +6080,21 @@ def _access_cmd_list(args, project_path: str) -> None:
             print("  [warn] access section invalid — scope fails closed "
                   "(deny-all); fix config.json 'access' by hand")
         if scope == "builtin":
+            off = sec.get("disabled") or []
+            if off:
+                print("  DISABLED by you (not enforced):")
+                for glob in off:
+                    print(f"    {'off':<10} {glob}")
+                print("    re-enable: c3 access builtin enable <glob>")
+            can = [g for g in (sec.get("disableable") or [])
+                   if access_guard._norm_builtin(g) not in set(off)]
+            if can:
+                print("  disableable (currently on): "
+                      + ", ".join(can))
+                print("    disable: c3 access builtin disable <glob>")
+            if sec.get("absolute"):
+                print("  absolute (credential vault, cannot be disabled): "
+                      + ", ".join(sec["absolute"]))
             print("  spelling rules (deny by how a path is written, no glob):")
             for name, why in access_guard.SYNTHETIC_RULES:
                 print(f"    {name:<18} {why}")
@@ -6010,6 +6107,58 @@ def _access_cmd_list(args, project_path: str) -> None:
     print(access_guard.COVERAGE_MATRIX)
 
 
+def _access_cmd_builtin(args, project_path: str) -> None:
+    """Switch a Tier-1 builtin off or back on. Human-only; always global scope.
+
+    Disabling asks for typed confirmation unless --yes: these guards are what
+    stop an agent rewriting its own hooks, settings or git history, and the
+    consequence deserves a beat of friction.
+    """
+    from services import access_guard
+
+    action = getattr(args, "builtin_cmd", None)
+    glob = getattr(args, "glob", None)
+    if action not in ("disable", "enable") or not glob:
+        print("Usage: c3 access builtin {disable,enable} <glob>")
+        print("       disableable: "
+              + ", ".join(access_guard.DISABLEABLE_BUILTINS))
+        return
+
+    disabling = action == "disable"
+    if disabling and not getattr(args, "yes", False):
+        print(f"About to STOP enforcing the builtin guard on: {glob}")
+        print("  While off, any agent with C3 tools can write those paths.")
+        if glob.endswith("settings*.json") or ".claude" in glob:
+            print("  This is the file that configures the agent itself — hooks,")
+            print("  permissions, model. An agent could rewrite its own rules.")
+        reply = input("Type the glob again to confirm: ").strip()
+        if reply != glob:
+            print("[abort] Not confirmed; nothing changed.")
+            return
+
+    try:
+        result = access_guard.set_builtin_disabled(glob, disabling)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+
+    _access_audit(f"builtin_{action}", result["glob"], "builtin", "global",
+                  project_path)
+    if not result["changed"]:
+        state = "already disabled" if disabling else "already enforced"
+        print(f"[=] {result['glob']} — {state}")
+        return
+    if disabling:
+        print(f"[OK] Builtin '{result['glob']}' DISABLED (global scope).")
+        print("     Re-enable with: c3 access builtin enable "
+              f"{result['glob']}")
+    else:
+        print(f"[OK] Builtin '{result['glob']}' re-enforced.")
+        if not result["attested"]:
+            print("     [warn] keyring attestation could not be cleared; the "
+                  "builtin is enforced anyway (config entry removed).")
+
+
 def _access_cmd_add(args, project_path: str) -> None:
     from services import access_guard
 
@@ -7583,6 +7732,7 @@ def main():
         "jira": cmd_jira,
         "creds": cmd_creds,
         "access": cmd_access,
+        "locks": cmd_locks,
         "oracle": cmd_oracle,
         "upgrade": cmd_upgrade,
     }

cli/commands/parser.py

@@ -447,6 +447,30 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_import.add_argument("--overwrite", action="store_true", help="Replace entries already registered in the target scope")
     cr_import.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    # ── Agent Locks (docs/agent-locks.md) ───────────────────────────────
+    # force-release is human-only: it bumps the fencing counter so a holder
+    # that comes back is stale by construction. Agents get c3_locks instead,
+    # which deliberately has no force action.
+    p_locks = subparsers.add_parser(
+        "locks", help="Agent leases — see who holds which file, release a stuck one")
+    locks_subs = p_locks.add_subparsers(dest="locks_cmd")
+
+    lk_list = locks_subs.add_parser("list", help="Show active leases")
+    lk_list.add_argument("--path", dest="project_path", default=".")
+
+    lk_rel = locks_subs.add_parser("release", help="Release leases held by a session")
+    lk_rel.add_argument("--session", required=True, help="session_id to release")
+    lk_rel.add_argument("--path", dest="project_path", default=".")
+
+    lk_force = locks_subs.add_parser(
+        "force-release", help="Break one lease regardless of holder (audited)")
+    lk_force.add_argument("file", help="Project-relative path to unlock")
+    lk_force.add_argument("--note", default="", help="Why — recorded in the ledger")
+    lk_force.add_argument("--path", dest="project_path", default=".")
+
+    lk_sweep = locks_subs.add_parser("sweep", help="Drop expired leases now")
+    lk_sweep.add_argument("--path", dest="project_path", default=".")
+
     # ── Access Guard (v2.62.0) ──────────────────────────────────────────
     # Human-only mutation surface (frozen spec docs/access-guard.md §1):
     # rule changes happen here or in the UI tab, never via an agent tool.
@@ -483,6 +507,24 @@ def build_parser(version: str, parse_cli_ide_arg):
                           help="Operation to evaluate (default: read)")
     ac_check.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    # ── Builtin opt-out (two-key) ───────────────────────────────────────
+    # Builtins are on by default. Switching one off needs a config entry AND
+    # a keyring attestation, so an agent that writes config.json alone still
+    # cannot loosen the guard. Global scope only — project scopes may only
+    # ever tighten. The credential-vault builtins are never disableable.
+    ac_builtin = access_subs.add_parser(
+        "builtin", help="Disable or re-enable a built-in guard (global, needs confirmation)")
+    builtin_subs = ac_builtin.add_subparsers(dest="builtin_cmd")
+    for _name, _help in (("disable", "Stop enforcing a built-in guard"),
+                         ("enable", "Re-enforce a built-in guard")):
+        _p = builtin_subs.add_parser(_name, help=_help)
+        _p.add_argument("glob", help="One of: **/.env*, **/.c3/**, **/.claude/settings*.json, **/.git/**")
+        _p.add_argument("--path", dest="project_path", default=".",
+                        help="Project directory used for the audit log (default: current)")
+        if _name == "disable":
+            _p.add_argument("--yes", action="store_true",
+                            help="Skip the typed confirmation (scripts/CI)")
+
     # ── Mask Guard (v2.63.0, docs/mask-guard.md) ────────────────────────
     # Masking exposes a path but transforms what the agent sees. Rules are
     # human-only, like the rest of Access Guard.

cli/hub_server.py

@@ -335,6 +335,7 @@ _HUB_JS_FILES = [
     "hub_ui/components/drill_panel.js",
     "hub_ui/components/drill_views.js",
     "hub_ui/components/hub_credentials.js",
+    "hub_ui/components/hub_locks.js",
     "hub_ui/components/drill_subprojects.js",
     "hub_ui/components/drill_health.js",
     "hub_ui/components/drill_tasks.js",
@@ -433,8 +434,9 @@ def api_hub_config_set():
         cfg["projects_view"] = projects_view
     if "main_view" in data:
         main_view = str(data["main_view"]).strip().lower()
-        if main_view not in {"projects", "board", "creds"}:
-            return jsonify({"error": "main_view must be 'projects', 'board' or 'creds'"}), 400
+        if main_view not in {"projects", "board", "creds", "locks"}:
+            return jsonify({"error": "main_view must be 'projects', 'board', "
+                                     "'creds' or 'locks'"}), 400
         cfg["main_view"] = main_view
     if "oracle_url" in data:
         cfg["oracle_url"] = str(data["oracle_url"]).strip()
@@ -2039,6 +2041,96 @@ def api_hub_credentials_overview():
     return jsonify({"global": {"entries": global_out}, "projects": projects_out})
 
 
+# ── Agent Locks (hub) ────────────────────────────────────────────────────────
+# Read + one human override. force-release is here and in `c3 locks`, never in
+# the c3_locks agent tool: it bumps the fencing counter so a holder that comes
+# back is stale by construction, which is a decision for a person.
+
+
+@app.route("/api/hub/locks/overview", methods=["GET"])
+def api_hub_locks_overview():
+    """Cross-project lease snapshot for the Locks tab.
+
+    Per-row isolation like /api/hub/credentials/overview: one unreadable
+    project must not blank the page. A project we cannot read reports
+    ``error``/``initialized`` rather than an empty lease list — "0 leases"
+    would claim the repo is clear when we simply do not know.
+    """
+    from services import agent_locks as al
+
+    rows, total = [], 0
+    for p in _pm().list_projects():
+        ppath = str(p.get("path") or "")
+        row = {"name": p.get("name") or "", "path": ppath, "initialized": True,
+               "error": None, "enabled": True, "mode": "advisory",
+               "locks": [], "count": 0, "fencing": 0}
+        try:
+            if not (Path(ppath) / ".c3").is_dir():
+                row["initialized"] = False
+            else:
+                cfg = al.config(ppath)
+                row["enabled"] = cfg["enabled"]
+                row["mode"] = cfg["mode"]
+                snap = al.store_for(ppath).snapshot()
+                row["locks"] = snap["locks"]
+                row["count"] = snap["count"]
+                row["fencing"] = snap["fencing"]
+                total += snap["count"]
+        except Exception as e:
+            row["error"] = str(e)
+        rows.append(row)
+    return jsonify({"projects": rows, "total": total,
+                    # Surfaced so the UI can state its own limits instead of
+                    # implying a lease covers everything (spec §9).
+                    "coverage_note": (
+                        "Leases gate C3 tool surfaces only. A raw shell "
+                        "redirect, a non-Claude agent, or a human in an editor "
+                        "is not covered.")})
+
+
+@app.route("/api/projects/locks/force-release", methods=["POST"])
+def api_projects_locks_force_release():
+    """Break one lease regardless of holder. Human-only, audited on the target."""
+    from services import agent_locks as al
+
+    data = request.get_json(force=True) or {}
+    path = (data.get("path") or "").strip()
+    relpath = (data.get("relpath") or "").strip()
+    note = (data.get("note") or "").strip()
+    if not path or not relpath:
+        return jsonify({"error": "path and relpath are required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+
+    res = al.store_for(resolved).force_release(relpath, by="hub", note=note)
+    if not res.get("forced"):
+        return jsonify({"error": res.get("error", "force-release failed"),
+                        "reason": res.get("reason", "")}), 400
+
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(resolved).log("lock_force_release", {
+            "kind": "locks", "relpath": res.get("relpath"),
+            "previous_owner": res.get("previous_owner"), "via": "hub"})
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(resolved).log_edit(
+            file=f"lock://{res.get('relpath', relpath)}",
+            change_type="lock_force_release",
+            summary=f"force-released lease on {res.get('relpath', relpath)}"
+                    + (f" — {note}" if note else ""),
+            tags=["locks", "force_release"],
+            detail={"kind": "locks", "previous_owner": res.get("previous_owner"),
+                    "was_locked": res.get("was_locked"), "note": note})
+    except Exception:
+        pass
+    return jsonify(res)
+
+
 @app.route("/api/projects/config", methods=["PUT"])
 def api_projects_config_put():
     """Whitelisted section write: deep-merge, atomic replace, audited on the target."""

cli/hub_ui/app.js

@@ -17,7 +17,7 @@ function App() {
   const [version, setVersion] = useState('');
   const [projects, setProjects] = useState([]);
   const [loaded, setLoaded] = useState(false);
-  const [mainView, setMainView] = useState('projects'); // projects | board | creds
+  const [mainView, setMainView] = useState('projects'); // projects | board | creds | locks
   const [filter, setFilter] = useState('all');          // all | active | idle | tag:<x>
   const [search, setSearch] = useState('');
   const [view, setView] = useState('list');             // list | grid
@@ -44,7 +44,7 @@ function App() {
       if (cfg.projects_view === 'grid') setView('grid');
       if (cfg.sidebar_collapsed != null) setSidebarCollapsed(!!cfg.sidebar_collapsed);
       if (cfg.sidebar_group) setFilter(cfg.sidebar_group);
-      if (cfg.main_view === 'board' || cfg.main_view === 'creds') setMainView(cfg.main_view);
+      if (['board', 'creds', 'locks'].includes(cfg.main_view)) setMainView(cfg.main_view);
     } catch { }
     try { const v = await api.get('/api/version'); setVersion(v.c3_version || ''); } catch { }
   }, []);
@@ -114,6 +114,8 @@ function App() {
             <TaskBoard projects={projects} onOpenDrill={openDrill} />
           ) : mainView === 'creds' ? (
             <HubCredentials projects={projects} onOpenDrill={openDrill} />
+          ) : mainView === 'locks' ? (
+            <HubLocks projects={projects} onOpenDrill={openDrill} />
           ) : (
             <React.Fragment>
               <SummaryBar projects={projects} search={search} setSearch={setSearch}

cli/hub_ui/components/hub_locks.js

@@ -0,0 +1,248 @@
+// ─── Agent Locks (cross-project) ──────────────────────────────────────────
+// Who holds which file, across every registered project, and the one human
+// override: force-release. That bumps the fencing counter so a holder which
+// comes back is stale by construction — a decision for a person, which is why
+// the agent-facing c3_locks tool deliberately has no force action.
+//
+// Honesty rules this view must keep (docs/agent-locks.md §4, §9):
+//   - never render "protected" for a repo we cannot actually protect;
+//   - a project we could not READ is not a project with zero leases;
+//   - the coverage caveat stays visible, because a lease gates C3 tool
+//     surfaces only — a raw shell redirect is not covered.
+
+function LockBadge({ row }) {
+  const pill = (label, fg, bg, title) => (
+    <span title={title} className="mono" style={{
+      fontSize: 10, padding: '2px 7px', borderRadius: 4,
+      color: fg, background: bg, whiteSpace: 'nowrap',
+    }}>{label}</span>
+  );
+  if (row.error) {
+    return pill('UNREADABLE', T.error, T.errorDim,
+      `Lock state could not be read: ${row.error}. This is not the same as "no leases".`);
+  }
+  if (!row.initialized) {
+    return pill('NO .c3', T.textDim, T.surfaceAlt,
+      'C3 is not initialized here, so nothing coordinates edits in this repo.');
+  }
+  if (!row.enabled) {
+    return pill('DISABLED', T.warn, T.warnDim,
+      'locks.enabled=false in .c3/config.json — leases are not taken or honoured here.');
+  }
+  return pill(String(row.mode || 'advisory').toUpperCase(), T.accent, T.accentDim,
+    'Advisory: enforced on C3 tool surfaces. A raw shell redirect or a '
+    + 'non-Claude agent is not covered.');
+}
+
+function LeaseRow({ row, lease, onForce }) {
+  // Draining bar: TTL is the real release mechanism, so how much is left is
+  // the most useful thing on the row.
+  const total = 900;
+  const left = Math.max(0, lease.expires_in_s || 0);
+  const pct = Math.max(2, Math.min(100, (left / total) * 100));
+  const mins = Math.floor(left / 60), secs = Math.floor(left % 60);
+  const low = left < 120;
+
+  return (
+    <div style={{
+      display: 'grid',
+      gridTemplateColumns: 'minmax(0,2fr) minmax(0,1.2fr) minmax(0,1.6fr) 96px 30px',
+      gap: 10, alignItems: 'center', padding: '7px 10px',
+      borderTop: `1px solid ${T.border}`, fontSize: 12,
+    }}>
+      <span className="mono" title={lease.relpath} style={{
+        overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', color: T.text,
+      }}>{lease.relpath}</span>
+
+      <span className="mono" title={`session ${lease.session_id || 'unknown'}`} style={{
+        overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap',
+        color: T.blue, fontSize: 11,
+      }}>{lease.agent_id || 'unknown'}</span>
+
+      <span title={lease.intent || 'no intent declared'} style={{
+        overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap',
+        color: lease.intent ? T.textMuted : T.textDim,
+        fontStyle: lease.intent ? 'normal' : 'italic',
+      }}>{lease.intent || 'no intent'}</span>
+
+      <div title={`lease expires in ${mins}m${String(secs).padStart(2, '0')}s`}>
+        <div className="mono" style={{
+          fontSize: 10, color: low ? T.warn : T.textMuted, marginBottom: 3,
+        }}>{mins}m{String(secs).padStart(2, '0')}s</div>
+        <div style={{ height: 3, background: T.surfaceAlt, borderRadius: 2 }}>
+          <div style={{
+            width: `${pct}%`, height: '100%', borderRadius: 2,
+            background: low ? T.warn : T.accent,
+          }} />
+        </div>
+      </div>
+
+      <div title="Force-release: breaks the lease and bumps the fencing token, so the current holder goes stale even if it thinks it still holds it."
+        onClick={() => onForce(row, lease)}
+        style={{
+          cursor: 'pointer', display: 'flex', justifyContent: 'center',
+          padding: 4, borderRadius: 4,
+        }}>
+        <I name="xCircle" size={13} color={T.error} />
+      </div>
+    </div>
+  );
+}
+
+function HubLocks({ projects, onOpenDrill }) {
+  const { useState, useCallback } = React;
+  const [data, setData] = useState(null);
+  const [err, setErr] = useState('');
+  const [confirm, setConfirm] = useState(null);
+
+  const load = useCallback(async () => {
+    try {
+      setData(await api.get('/api/hub/locks/overview'));
+      setErr('');
+    } catch (e) {
+      // Keep the last good snapshot rather than blanking to an empty page,
+      // which would read as "nothing is locked".
+      setErr(String(e && e.message ? e.message : e));
+    }
+  }, []);
+
+  React.useEffect(() => { load(); }, [load]);
+  usePoll(load, 5000);
+
+  const doForce = async (row, lease) => {
+    try {
+      await api.post('/api/projects/locks/force-release', {
+        path: row.path, relpath: lease.relpath, note: 'released from the Hub',
+      });
+    } catch (e) {
+      setErr(String(e && e.message ? e.message : e));
+    }
+    setConfirm(null);
+    load();
+  };
+
+  const rows = (data && data.projects) || [];
+  const withLeases = rows.filter(r => (r.count || 0) > 0);
+  const problems = rows.filter(r => r.error || (r.initialized && !r.enabled));
+
+  return (
+    <div style={{ display: 'flex', flexDirection: 'column', gap: 12 }}>
+      <div style={{ display: 'flex', alignItems: 'center', gap: 10 }}>
+        <I name="lock" size={15} color={T.accent} />
+        <span style={{ fontSize: 14, color: T.text }}>Agent Locks</span>
+        <span className="mono" style={{ fontSize: 11, color: T.textMuted }}>
+          {data ? `${data.total} active lease(s) across ${rows.length} project(s)` : 'loading…'}
+        </span>
+        <div style={{ flex: 1 }} />
+        <div onClick={load} title="Refresh"
+          style={{ cursor: 'pointer', padding: 4 }}>
+          <I name="refresh" size={13} color={T.textMuted} />
+        </div>
+      </div>
+
+      {/* Never let the page imply more protection than exists. */}
+      <div style={{
+        fontSize: 11, color: T.textMuted, background: T.surface,
+        border: `1px solid ${T.border}`, borderRadius: 6, padding: '8px 10px',
+        lineHeight: 1.5,
+      }}>
+        {(data && data.coverage_note)
+          || 'Leases gate C3 tool surfaces only.'}
+        {' '}A lease is cooperative coordination, not containment.
+      </div>
+
+      {err && (
+        <div style={{
+          fontSize: 11, color: T.error, background: T.errorDim,
+          border: `1px solid ${T.error}`, borderRadius: 6, padding: '8px 10px',
+        }}>
+          Could not refresh: {err} — showing the last snapshot, which may be stale.
+        </div>
+      )}
+
+      {data && withLeases.length === 0 && (
+        <div style={{
+          fontSize: 12, color: T.textMuted, padding: '18px 10px', textAlign: 'center',
+          border: `1px dashed ${T.border}`, borderRadius: 6,
+        }}>
+          No active leases. Agents take one automatically when they edit a file.
+        </div>
+      )}
+
+      {withLeases.map(row => (
+        <div key={row.path} style={{
+          background: T.surface, border: `1px solid ${T.border}`, borderRadius: 6,
+        }}>
+          <div style={{
+            display: 'flex', alignItems: 'center', gap: 8, padding: '8px 10px',
+          }}>
+            <I name="folder" size={13} color={T.textMuted} />
+            <span onClick={() => onOpenDrill && onOpenDrill(
+              projects.find(p => p.path === row.path) || { path: row.path, name: row.name })}
+              style={{ fontSize: 12, color: T.text, cursor: onOpenDrill ? 'pointer' : 'default' }}>
+              {row.name || row.path}
+            </span>
+            <LockBadge row={row} />
+            <span className="mono" style={{ fontSize: 11, color: T.textMuted }}>
+              {row.count} lease{row.count === 1 ? '' : 's'}
+            </span>
+            <div style={{ flex: 1 }} />
+            <span className="mono" title="Monotonic fencing counter — force-release bumps it."
+              style={{ fontSize: 10, color: T.textDim }}>fencing {row.fencing}</span>
+          </div>
+          <div style={{
+            display: 'grid',
+            gridTemplateColumns: 'minmax(0,2fr) minmax(0,1.2fr) minmax(0,1.6fr) 96px 30px',
+            gap: 10, padding: '0 10px 5px', fontSize: 10, color: T.textDim,
+          }}>
+            <span>FILE</span><span>HOLDER</span><span>INTENT</span>
+            <span>LEASE LEFT</span><span />
+          </div>
+          {row.locks.map(lease => (
+            <LeaseRow key={lease.relpath} row={row} lease={lease}
+              onForce={(r, l) => setConfirm({ row: r, lease: l })} />
+          ))}
+        </div>
+      ))}
+
+      {/* Projects that cannot coordinate are listed explicitly — silence here
+          would read as "all clear". */}
+      {problems.length > 0 && (
+        <div style={{
+          background: T.surface, border: `1px solid ${T.border}`,
+          borderRadius: 6, padding: '8px 10px',
+        }}>
+          <div style={{ fontSize: 11, color: T.textMuted, marginBottom: 6 }}>
+            Not coordinating
+          </div>
+          {problems.map(row => (
+            <div key={row.path} style={{
+              display: 'flex', alignItems: 'center', gap: 8, padding: '3px 0', fontSize: 11,
+            }}>
+              <I name="alertTriangle" size={12} color={row.error ? T.error : T.warn} />
+              <span className="mono" style={{ color: T.textMuted }}>{row.name || row.path}</span>
+              <LockBadge row={row} />
+              {row.error && <span style={{ color: T.textDim }}>{row.error}</span>}
+            </div>
+          ))}
+        </div>
+      )}
+
+      {confirm && (
+        <ConfirmDialog
+          title="Break this lease?"
+          danger
+          confirmLabel="Force-release"
+          message={
+            `${confirm.lease.relpath} is held by ${confirm.lease.agent_id}`
+            + (confirm.lease.intent ? ` ("${confirm.lease.intent}")` : '')
+            + '. Force-releasing bumps the fencing token, so that agent goes '
+            + 'stale even if it still believes it holds the file — it may be '
+            + 'mid-edit. Prefer waiting for the lease to expire.'
+          }
+          onConfirm={() => doForce(confirm.row, confirm.lease)}
+          onCancel={() => setConfirm(null)} />
+      )}
+    </div>
+  );
+}