code-context-control 2.66.0__tar.gz → 2.67.0__tar.gz

{code_context_control-2.66.0/code_context_control.egg-info → code_context_control-2.67.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.66.0
+Version: 2.67.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -186,7 +186,7 @@ Twelve tabs. The dashboard above shows token savings, indexed files, the live se
 
 ## The MCP tool suite
 
-C3 exposes **20 tools** as a native MCP server. Your IDE calls them directly:
+C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 
 | Tool | What it does |
 |---|---|
@@ -201,6 +201,7 @@ C3 exposes **20 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_memory` | Fact store with categories, recall, graph queries, `index`→`fetch` two-step |
 | `c3_session` | Snapshot, restore, log decisions, compact history |
 | `c3_impact` | Blast-radius analysis before editing shared symbols |
+| `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
 | `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter |
@@ -211,7 +212,7 @@ C3 exposes **20 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_jira` | Jira Cloud + Data Center — JQL, issues, transitions (v2.56.0) |
 | `c3_project` | Cross-project discovery & operations; guarded writes (v2.31.0) |
 
-Every tool is **read-only safe in plan mode** except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, `c3_delegate` with write delegation enabled, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task`.
+Every tool is **read-only safe in plan mode** except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, `c3_delegate` with write delegation enabled, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task` / `c3_locks`.
 
 On Windows `c3_shell` uses Git Bash when available. Git Bash bundles no `jq`; use `python -m json.tool` for portable JSON formatting.
 
@@ -242,12 +243,61 @@ c3 access mask activate                         # purge pre-mask artifacts, buil
 - **Masked means read-only, always.** Cropped rows have no inverse, so an edit in transformed coordinates would corrupt the one file you protected.
 - **Four deterministic presets, no LLM in the read path:** `redact_secrets`, `redact_columns` (salted one-way pseudonyms — joins survive, no reverse dictionary), `sample_rows`, `signatures_only`.
 - **Rule changes are human-only** (UI tab or CLI) and ledger-logged. Agents have no mutation surface.
+- **Built-ins can be switched off when you need to** (v2.65.0). `**/.env*`, `**/.c3/**`, `**/.claude/settings*.json` and `**/.git/**` yield to `c3 access builtin disable <glob>`, which makes you retype the glob first. It takes **two keys** — a config entry *and* a keyring attestation — so an agent that manages to write `config.json` still cannot grant itself write access to your settings. The credential vault stays absolute.
 - **Honest coverage.** This guards *cooperative* agents against mistakes and prompt injection. It is not a sandbox — a raw shell outside C3's tools still sees the real bytes.
 
 → [Access Guard](https://github.com/drknowhow/code-context-control/blob/main/docs/access-guard.md) · [Mask Guard](https://github.com/drknowhow/code-context-control/blob/main/docs/mask-guard.md)
 
 ---
 
+## Agent Locks — several agents, one repo (v2.65.0)
+
+Guards answer *may the agent touch this?* Locks answer *is someone already touching it?*
+
+Two agents editing one file used to be silent data loss. `c3_edit` serialized
+same-file edits with an in-process lock, but every session runs its own `c3-mcp`
+server — so two sessions could interleave read → replace → write and lose an edit
+with no error on either side. Create mode was worse: both agents "succeeded" and
+one file won.
+
+Now there are two mechanisms, because they solve different problems:
+
+- **Torn writes** — a cross-process file lock, held across create, single-edit and
+  batch alike. No daemon, no configuration, nothing to switch on.
+- **Overlapping work** — a *lease*. `c3_edit` takes one on the file it edits,
+  carrying the intent from your edit summary. A second agent gets told who holds
+  it and why:
+
+```text
+[c3-lock:held] services/router.py is held by claude-code:a3f19c2b.
+  intent: "refactor retry backoff"
+  lease expires in 6m12s.
+```
+
+```bash
+c3 locks list                              # who holds what, across the project
+c3 locks force-release services/router.py  # break a stuck lease (human-only, audited)
+```
+
+- **TTL is the real release mechanism.** Agents forget to release, so nothing
+  assumes they will — a crashed agent can never wedge a repo.
+- **Acquisition is all-or-nothing** over a sorted path list, so two agents grabbing
+  the same pair in opposite order cannot deadlock.
+- **`force-release` bumps a fencing counter**, so a holder that comes back is stale
+  by construction rather than by hope. It lives in the CLI and the Hub, never in
+  the agent-facing tool.
+- **The Hub's Locks tab badges a project it cannot read as `UNREADABLE`**, not as
+  zero leases — "all clear" is a different claim from "we don't know".
+- **Honest coverage, again.** Leases gate C3's own tool surfaces. A raw `c3_shell`
+  redirect, a non-Claude agent, or a human in an editor is *not* covered, and the
+  UI says so on screen.
+
+Set `locks.enabled: false` in `.c3/config.json` to opt out.
+
+→ [Agent Locks](https://github.com/drknowhow/code-context-control/blob/main/docs/agent-locks.md)
+
+---
+
 ## Integrations
 
 | | What you get | Guide |

{code_context_control-2.66.0 → code_context_control-2.67.0}/README.md

@@ -123,7 +123,7 @@ Twelve tabs. The dashboard above shows token savings, indexed files, the live se
 
 ## The MCP tool suite
 
-C3 exposes **20 tools** as a native MCP server. Your IDE calls them directly:
+C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 
 | Tool | What it does |
 |---|---|
@@ -138,6 +138,7 @@ C3 exposes **20 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_memory` | Fact store with categories, recall, graph queries, `index`→`fetch` two-step |
 | `c3_session` | Snapshot, restore, log decisions, compact history |
 | `c3_impact` | Blast-radius analysis before editing shared symbols |
+| `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
 | `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter |
@@ -148,7 +149,7 @@ C3 exposes **20 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_jira` | Jira Cloud + Data Center — JQL, issues, transitions (v2.56.0) |
 | `c3_project` | Cross-project discovery & operations; guarded writes (v2.31.0) |
 
-Every tool is **read-only safe in plan mode** except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, `c3_delegate` with write delegation enabled, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task`.
+Every tool is **read-only safe in plan mode** except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, `c3_delegate` with write delegation enabled, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task` / `c3_locks`.
 
 On Windows `c3_shell` uses Git Bash when available. Git Bash bundles no `jq`; use `python -m json.tool` for portable JSON formatting.
 
@@ -179,12 +180,61 @@ c3 access mask activate                         # purge pre-mask artifacts, buil
 - **Masked means read-only, always.** Cropped rows have no inverse, so an edit in transformed coordinates would corrupt the one file you protected.
 - **Four deterministic presets, no LLM in the read path:** `redact_secrets`, `redact_columns` (salted one-way pseudonyms — joins survive, no reverse dictionary), `sample_rows`, `signatures_only`.
 - **Rule changes are human-only** (UI tab or CLI) and ledger-logged. Agents have no mutation surface.
+- **Built-ins can be switched off when you need to** (v2.65.0). `**/.env*`, `**/.c3/**`, `**/.claude/settings*.json` and `**/.git/**` yield to `c3 access builtin disable <glob>`, which makes you retype the glob first. It takes **two keys** — a config entry *and* a keyring attestation — so an agent that manages to write `config.json` still cannot grant itself write access to your settings. The credential vault stays absolute.
 - **Honest coverage.** This guards *cooperative* agents against mistakes and prompt injection. It is not a sandbox — a raw shell outside C3's tools still sees the real bytes.
 
 → [Access Guard](https://github.com/drknowhow/code-context-control/blob/main/docs/access-guard.md) · [Mask Guard](https://github.com/drknowhow/code-context-control/blob/main/docs/mask-guard.md)
 
 ---
 
+## Agent Locks — several agents, one repo (v2.65.0)
+
+Guards answer *may the agent touch this?* Locks answer *is someone already touching it?*
+
+Two agents editing one file used to be silent data loss. `c3_edit` serialized
+same-file edits with an in-process lock, but every session runs its own `c3-mcp`
+server — so two sessions could interleave read → replace → write and lose an edit
+with no error on either side. Create mode was worse: both agents "succeeded" and
+one file won.
+
+Now there are two mechanisms, because they solve different problems:
+
+- **Torn writes** — a cross-process file lock, held across create, single-edit and
+  batch alike. No daemon, no configuration, nothing to switch on.
+- **Overlapping work** — a *lease*. `c3_edit` takes one on the file it edits,
+  carrying the intent from your edit summary. A second agent gets told who holds
+  it and why:
+
+```text
+[c3-lock:held] services/router.py is held by claude-code:a3f19c2b.
+  intent: "refactor retry backoff"
+  lease expires in 6m12s.
+```
+
+```bash
+c3 locks list                              # who holds what, across the project
+c3 locks force-release services/router.py  # break a stuck lease (human-only, audited)
+```
+
+- **TTL is the real release mechanism.** Agents forget to release, so nothing
+  assumes they will — a crashed agent can never wedge a repo.
+- **Acquisition is all-or-nothing** over a sorted path list, so two agents grabbing
+  the same pair in opposite order cannot deadlock.
+- **`force-release` bumps a fencing counter**, so a holder that comes back is stale
+  by construction rather than by hope. It lives in the CLI and the Hub, never in
+  the agent-facing tool.
+- **The Hub's Locks tab badges a project it cannot read as `UNREADABLE`**, not as
+  zero leases — "all clear" is a different claim from "we don't know".
+- **Honest coverage, again.** Leases gate C3's own tool surfaces. A raw `c3_shell`
+  redirect, a non-Claude agent, or a human in an editor is *not* covered, and the
+  UI says so on screen.
+
+Set `locks.enabled: false` in `.c3/config.json` to opt out.
+
+→ [Agent Locks](https://github.com/drknowhow/code-context-control/blob/main/docs/agent-locks.md)
+
+---
+
 ## Integrations
 
 | | What you get | Guide |

{code_context_control-2.66.0 → code_context_control-2.67.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.66.0"
+__version__ = "2.67.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

{code_context_control-2.66.0 → code_context_control-2.67.0}/cli/hub_server.py

@@ -435,9 +435,9 @@ def api_hub_config_set():
         cfg["projects_view"] = projects_view
     if "main_view" in data:
         main_view = str(data["main_view"]).strip().lower()
-        if main_view not in {"projects", "board", "creds", "locks"}:
+        if main_view not in {"projects", "board", "creds", "locks", "enforce"}:
             return jsonify({"error": "main_view must be 'projects', 'board', "
-                                     "'creds' or 'locks'"}), 400
+                                     "'creds', 'locks' or 'enforce'"}), 400
         cfg["main_view"] = main_view
     if "oracle_url" in data:
         cfg["oracle_url"] = str(data["oracle_url"]).strip()
@@ -1723,6 +1723,9 @@ def api_search_global():
 _CONFIG_READ_SECTIONS = ("hybrid", "agents", "delegate", "proxy", "mcp", "bitbucket", "meta",
                          "memory_llm")
 _CONFIG_WRITE_SECTIONS = ("hybrid", "agents", "delegate", "proxy", "mcp", "meta", "memory_llm")
+# "enforcement" is deliberately NOT writable here: the generic deep-merge would
+# bypass mode/ttl/blocked_tools validation and the set_by provenance rules.
+# POST /api/projects/enforcement is the only write path.
 # api_key: secrets never transit the hub or land in config.json — the Ollama
 # cloud key lives in the OS keyring (project Settings UI / OLLAMA_API_KEY env).
 _CONFIG_REFUSED_KEYS = ("version", "project_path", "permission_tier", "subprojects", "parent",
@@ -2166,6 +2169,7 @@ def api_hub_enforcement_overview():
                 row["set_by"] = policy.set_by
                 row["signal_ttl_s"] = policy.signal_ttl_s
                 row["warnings"] = list(policy.warnings)
+                row["blocked_tools"] = sorted(policy.blocked_tools)
 
                 cfg_path = Path(ppath) / ".c3" / "config.json"
                 try:
@@ -2188,12 +2192,28 @@ def api_hub_enforcement_overview():
             row["error"] = str(e)
         rows.append(row)
 
+    # The global (~/.c3) section, shown as its own card. A corrupt global
+    # config must not blank the tab — report the error inside the object.
+    try:
+        g = ep.resolve_global()
+        global_policy = {
+            "configured": g.scope == "global",
+            "mode": g.mode or None,
+            "set_by": g.set_by,
+            "signal_ttl_s": g.signal_ttl_s,
+            "blocked_tools": sorted(g.blocked_tools),
+            "warnings": list(g.warnings),
+        }
+    except Exception as e:
+        global_policy = {"configured": False, "mode": None, "error": str(e)}
+
     return jsonify({
         "projects": rows,
         "modes": [{"id": m, "help": ep.MODE_HELP[m]} for m in ep.MODES],
         "default_mode": ep.DEFAULT_MODE,
         "tier_map": ep.TIER_TO_MODE,
         "totals": totals,
+        "global_policy": global_policy,
         # Stated so the tab can never imply that turning discipline down also
         # turns the security boundaries down. Mirrors docs/enforcement.md.
         "coverage_note": (
@@ -2206,58 +2226,171 @@ def api_hub_enforcement_overview():
     })
 
 
+@app.route("/api/projects/enforcement", methods=["GET"])
+def api_projects_enforcement_get():
+    """One project's effective policy plus its denial evidence.
+
+    Hub-side mirror of the per-project GET /api/enforcement — feeds the drill
+    panel's Discipline tab. Optional ``?session=`` narrows the denial
+    aggregate to one session id (full id; the event search route does prefix
+    matching for the UI's 8-char short ids).
+    """
+    from services import access_telemetry as at
+    from services import enforcement_policy as ep
+
+    path = (request.args.get("path") or "").strip()
+    if not path:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+
+    policy = ep.resolve(resolved)
+    try:
+        cfg = json.loads((Path(resolved) / ".c3" / "config.json")
+                         .read_text(encoding="utf-8"))
+        tier = str(cfg.get("permission_tier") or "") if isinstance(cfg, dict) else ""
+    except Exception:
+        tier = ""
+    session = (request.args.get("session") or "").strip()
+    agg = at.aggregate(resolved, session_id=session)
+
+    return jsonify({
+        "mode": policy.mode,
+        "scope": policy.scope,
+        "set_by": policy.set_by,
+        "signal_ttl_s": policy.signal_ttl_s,
+        "blocked_tools": sorted(policy.blocked_tools),
+        "warnings": list(policy.warnings),
+        "tier": tier,
+        "tier_implies": ep.derive_from_tier(tier) if tier else "",
+        "default_mode": ep.DEFAULT_MODE,
+        "modes": [{"id": m, "help": ep.MODE_HELP[m]} for m in ep.MODES],
+        "denials": {
+            "total": agg["total"],
+            "by_layer": agg["by_layer"],
+            "rows": [{**r, "fix": at.suggest(r)} for r in agg["rows"][:12]],
+        },
+    })
+
+
 @app.route("/api/projects/enforcement", methods=["POST"])
 def api_projects_enforcement_set():
-    """Set one project's tool-discipline mode. Human-only, audited on target.
-
-    Always writes ``set_by='user'``: a change made deliberately in the Hub is
-    an explicit choice and must survive a later permission-tier change, the
-    same as `c3 enforce`.
+    """Set tool-discipline policy fields. Human-only, audited on target.
+
+    Body: ``{path?, scope?, mode?, signal_ttl_s?, blocked_tools?}``.
+    ``scope`` defaults to project (``path`` required); ``global`` writes
+    ``~/.c3`` and ignores ``path``. A body with ``mode`` goes through
+    ``set_mode`` — always ``set_by='user'``: a change made deliberately in
+    the Hub is an explicit choice and must survive a later permission-tier
+    change, the same as `c3 enforce`. A mode-less body goes through
+    ``set_fields``, which never touches ``mode``/``set_by``.
     """
     from services import enforcement_policy as ep
 
     data = request.get_json(force=True) or {}
     path = (data.get("path") or "").strip()
+    scope = (data.get("scope") or "project").strip().lower()
     mode = (data.get("mode") or "").strip().lower()
     ttl = data.get("signal_ttl_s")
-    if not path or not mode:
-        return jsonify({"error": "path and mode are required"}), 400
-    try:
-        resolved = _resolve_project_path(path)
-    except ValueError as e:
-        return jsonify({"error": str(e)}), 404
+    blocked = data.get("blocked_tools")
+    if scope not in ("project", "global"):
+        return jsonify({"error": "scope must be 'project' or 'global'"}), 400
+    if scope == "project":
+        if not path:
+            return jsonify({"error": "path is required for project scope"}), 400
+        try:
+            resolved = _resolve_project_path(path)
+        except ValueError as e:
+            return jsonify({"error": str(e)}), 404
+    else:
+        resolved = "."
 
     try:
-        result = ep.set_mode(mode, resolved, set_by=ep.SET_BY_USER,
-                             scope="project",
-                             signal_ttl_s=int(ttl) if ttl else None)
+        if mode:
+            result = ep.set_mode(mode, resolved, set_by=ep.SET_BY_USER,
+                                 scope=scope, signal_ttl_s=ttl,
+                                 blocked_tools=blocked)
+        elif ttl is not None or blocked is not None:
+            result = ep.set_fields(resolved, scope=scope,
+                                   signal_ttl_s=ttl, blocked_tools=blocked)
+        else:
+            return jsonify({"error": "nothing to set — pass mode, "
+                                     "signal_ttl_s or blocked_tools"}), 400
     except (ValueError, TypeError) as e:
         return jsonify({"error": str(e)}), 400
 
-    try:
-        from services.activity_log import ActivityLog
-        ActivityLog(resolved).log("access_action", {
-            "kind": "enforcement", "action": "set_mode",
-            "mode": result["mode"], "previous": result.get("previous", ""),
-            "scope": result["scope"], "via": "hub"})
-    except Exception:
-        pass
-    try:
-        from services.edit_ledger import EditLedger
-        EditLedger(resolved).log_edit(
-            file=f"enforcement://{result['scope']}",
-            change_type="enforcement_set_mode",
-            summary=(f"tool discipline {result.get('previous') or 'default'} "
-                     f"-> {result['mode']} via the Hub"),
-            tags=["enforcement", "access"],
-            detail={"kind": "enforcement", "mode": result["mode"],
-                    "previous": result.get("previous", ""),
-                    "scope": result["scope"], "via": "hub"})
-    except Exception:
-        pass
+    # Audit on the target project. Global scope has no target project to
+    # audit into — the ~/.c3/config.json write is itself the record.
+    if scope == "project":
+        action = "set_mode" if mode else "set_fields"
+        detail = {"kind": "enforcement", "action": action,
+                  "mode": result.get("mode", ""),
+                  "previous": result.get("previous", ""),
+                  "scope": result["scope"], "via": "hub"}
+        if "signal_ttl_s" in result:
+            detail["signal_ttl_s"] = result["signal_ttl_s"]
+        if "blocked_tools" in result:
+            detail["blocked_tools"] = result["blocked_tools"]
+        if mode:
+            summary = (f"tool discipline {result.get('previous') or 'default'} "
+                       f"-> {result['mode']} via the Hub")
+        else:
+            parts = []
+            if "signal_ttl_s" in result:
+                parts.append(f"signal_ttl_s={result['signal_ttl_s']}")
+            if "blocked_tools" in result:
+                parts.append("blocked_tools="
+                             + ",".join(result["blocked_tools"] or ["<none>"]))
+            summary = "tool discipline " + ", ".join(parts) + " via the Hub"
+        try:
+            from services.activity_log import ActivityLog
+            ActivityLog(resolved).log("access_action", dict(detail))
+        except Exception:
+            pass
+        try:
+            from services.edit_ledger import EditLedger
+            EditLedger(resolved).log_edit(
+                file=f"enforcement://{result['scope']}",
+                change_type=f"enforcement_{action}",
+                summary=summary,
+                tags=["enforcement", "access"],
+                detail=detail)
+        except Exception:
+            pass
     return jsonify(result)
 
 
+@app.route("/api/projects/enforcement/denials/search", methods=["GET"])
+def api_projects_enforcement_denials_search():
+    """Search one project's raw denial events. Read-only; newest first.
+
+    Params: ``path`` (required), ``q`` (AND'd case-insensitive substrings over
+    path/rule/tool), ``layer``, ``tool`` (exact), ``session`` (prefix — the UI
+    shows 8-char short ids), ``since`` (ISO-8601; events store
+    second-resolution UTC isoformat, so plain string comparison is correct),
+    ``limit`` (default 200, cap 500).
+    """
+    from services import access_telemetry as at
+
+    path = (request.args.get("path") or "").strip()
+    if not path:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    return jsonify(at.search_events(
+        resolved,
+        q=request.args.get("q") or "",
+        layer=request.args.get("layer") or "",
+        tool=request.args.get("tool") or "",
+        session=request.args.get("session") or "",
+        since=request.args.get("since") or "",
+        limit=request.args.get("limit") or 200))
+
+
 @app.route("/api/projects/enforcement/denials", methods=["DELETE"])
 def api_projects_enforcement_denials_clear():
     """Reset one project's denial counters (they are diagnostics, not audit)."""

{code_context_control-2.66.0 → code_context_control-2.67.0}/cli/hub_ui/components/drill_panel.js

@@ -14,6 +14,7 @@ const DRILL_PANEL_TABS = [
   ['health', 'Health'],
   ['budget', 'Budget'],
   ['creds', 'Credentials'],
+  ['discipline', 'Discipline'],
   ['config', 'Config'],
   ['mcp', 'MCP'],
 ];
@@ -134,6 +135,7 @@ function DrillPanel({ project, tab, setTab, onClose, onChanged, onOpenModal, pro
       case 'health': return <DrillHealth project={project} onChanged={onChanged} />;
       case 'budget': return <DrillBudget project={project} />;
       case 'creds': return <DrillCredentials project={project} />;
+      case 'discipline': return <DrillDiscipline project={project} />;
       case 'config': return <ConfigEditor project={project} />;
       case 'mcp': return <McpManager project={project} onChanged={onChanged} />;
       default: return <DrillOverview project={project} onChanged={onChanged} setTab={setTab} />;