code-context-control 2.70.0__tar.gz → 2.73.0__tar.gz

{code_context_control-2.70.0/code_context_control.egg-info → code_context_control-2.73.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.70.0
+Version: 2.73.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.70.0"
+__version__ = "2.73.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

code_context_control-2.73.0/cli/tools/_grants.py

@@ -0,0 +1,61 @@
+"""Override grants on the MCP content surface (override-requests.md P2a).
+
+The hooks have consulted grants since P1. The `c3_*` content tools have not:
+they called the evaluator and refused without ever asking whether the user
+had already approved this exact call. §13's coverage matrix recorded that as
+"not yet — P2a", which meant an approved request did nothing for any agent
+working through MCP — the grant was minted, and then no one looked at it.
+
+This module is the single place those tools ask. It is deliberately thin:
+all the policy ordering, TTL clamping, use accounting and audit lives in
+`services.override_grants.gate_access`, which is the same call the hooks
+make. Two implementations of "may I" is how the two surfaces drift apart.
+
+`session_id` lives here for the same reason. It was duplicated in edit.py,
+locks.py and override.py, each carrying a comment saying it must match the
+others exactly — and P2a makes that invariant load-bearing rather than
+merely tidy: a grant is minted under the session id `c3_override` computed
+and consumed under the one `c3_edit` computes. If those two ever disagree,
+every approval silently fails to apply.
+"""
+
+import os
+
+
+def session_id(svc) -> str:
+    """This agent's identity, for leases and for grants.
+
+    Falls back to the process id, never to "". Two agents that both resolved
+    to "" would count as ONE session and stop blocking each other — the exact
+    opposite of what a lock is for. Each Claude Code session runs its own
+    c3-mcp process, so the pid is a faithful stand-in.
+
+    It is also the right identity for c3_project: that proxy builds a runtime
+    for the TARGET project but runs inside the CALLER's process, so the pid
+    keeps the edit attributed to the agent that actually asked for it.
+    """
+    session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
+    return str(session.get("id", "") or "") or f"pid-{os.getpid()}"
+
+
+def allow(svc, denial, *, tool: str, op: str, path) -> str | None:
+    """The `[c3-override:granted]` line when a live grant permits this exact
+    call, or None to stay denied.
+
+    Consumes a use on success — so callers must invoke this only when they
+    are about to proceed, never speculatively. Ordering inside `gate_access`
+    is policy first, grants second, so a grant is void the instant the policy
+    or its layer is switched off (§12.8).
+
+    Fail-closed by construction: any error resolving the grant store leaves
+    the caller on its ordinary refusal path. A grant that cannot be read is
+    not a grant.
+    """
+    if denial is None:
+        return None
+    try:
+        from services import override_grants as og  # noqa: PLC0415 — lazy
+        return og.gate_access(svc.project_path, denial, tool=tool, op=op,
+                              path=str(path), session_id=session_id(svc))
+    except Exception:
+        return None

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/tools/compress.py

@@ -8,6 +8,7 @@ import sys
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from pathlib import Path
 
+from cli.tools import _grants
 from cli.tools._helpers import finalize_with_tokens, show_token_ratios
 from core import count_tokens
 from services import access_guard
@@ -118,7 +119,9 @@ def _compress_single(file_path: str, mode: str, svc, finalize, maybe_facts) -> s
     # Access Guard: read verdict up front — covers the map/dense_map paths
     # that never reach compressor.compress_file (docs/access-guard.md §3).
     _verdict = access_guard.verdict(file_path, "read", svc.project_path)
-    if _verdict.denial:
+    if _verdict.denial and not _grants.allow(svc, _verdict.denial,
+                                             tool="c3_compress", op="read",
+                                             path=file_path):
         return finalize("c3_compress", {"file_path": file_path, "mode": mode},
                         access_guard.refusal(_verdict.denial, file_path, "read"),
                         "access-denied")

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/tools/edit.py

@@ -22,25 +22,22 @@ import threading
 from contextlib import contextmanager
 from pathlib import Path
 
+from cli.tools import _grants
 from services import access_guard, agent_locks
 from services import credential_store as _cs
 from services.task_store import _FileLock
 
 
 def _session_id(svc) -> str:
-    """This agent's lease identity.
+    """This agent's lease identity — see `cli.tools._grants.session_id`.
 
-    Falls back to the process id, never to "". Two agents that both resolved
-    to "" would count as ONE session and stop blocking each other — the exact
-    opposite of what a lock is for. Each Claude Code session runs its own
-    c3-mcp process, so the pid is a faithful stand-in.
-
-    It is also the right identity for c3_project: that proxy builds a runtime
-    for the TARGET project but runs inside the CALLER's process, so the pid
-    keeps the edit attributed to the agent that actually asked for it.
+    Was defined here and copied into locks.py and override.py, each with a
+    comment saying it had to match. P2a makes that invariant load-bearing:
+    a grant is minted under the id c3_override computes and consumed under
+    the one c3_edit computes, so a divergence would make every approval
+    silently fail to apply. One definition, three callers.
     """
-    session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
-    return str(session.get("id", "") or "") or f"pid-{os.getpid()}"
+    return _grants.session_id(svc)
 
 # ── Same-file serialization ───────────────────────────────────────────────
 # In-process locks, keyed by resolved absolute path string.
@@ -325,7 +322,8 @@ def handle_edit(file_path: str, old_string: str, new_string: str,
     # (never replaces) any dedicated vault-file guard.
     op = "write" if path.exists() else "create"
     denial = access_guard.check(str(path), op, svc.project_path)
-    if denial:
+    if denial and not _grants.allow(svc, denial, tool="c3_edit", op=op,
+                                    path=str(path)):
         return finalize("c3_edit", {"file": file_path},
                         access_guard.refusal(denial, file_path, op),
                         "access-denied")

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/tools/filter.py

@@ -10,6 +10,7 @@ import json
 import re
 from pathlib import Path
 
+from cli.tools import _grants
 from cli.tools._helpers import finalize_with_tokens, show_token_ratios
 from core import count_tokens
 from services import access_guard
@@ -31,7 +32,9 @@ def handle_filter(file_path: str, text: str, pattern: str, max_lines: int,
     # Access Guard: read verdict (docs/access-guard.md §3), checked before
     # existence so probes can't distinguish missing from denied (R2).
     denial = access_guard.check(file_path, "read", svc.project_path)
-    if denial:
+    _granted = _grants.allow(svc, denial, tool="c3_filter", op="read",
+                             path=file_path) if denial else None
+    if denial and not _granted:
         return finalize("c3_filter", {"file": file_path},
                         access_guard.refusal(denial, file_path, "read"),
                         "access-denied")

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/tools/impact.py

@@ -9,6 +9,7 @@ import subprocess
 import sys
 from pathlib import Path
 
+from cli.tools import _grants
 from services import access_guard
 
 _SKIP_DIRS = frozenset({
@@ -115,7 +116,8 @@ def handle_impact(target: str, file_path: str, mode: str, svc, finalize) -> str:
     # Access Guard: refuse outright when the named source file is read-denied.
     if file_path:
         denial = access_guard.check(file_path, "read", str(project))
-        if denial:
+        if denial and not _grants.allow(svc, denial, tool="c3_impact",
+                                        op="read", path=file_path):
             return finalize("c3_impact", {"target": target, "mode": mode},
                             access_guard.refusal(denial, file_path, "read"),
                             "access-denied")

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/tools/locks.py

@@ -12,17 +12,14 @@ and letting go early instead of waiting out the TTL.
 force_release is deliberately absent: it is a human override that bumps the
 fencing counter, and it lives in `c3 locks force-release` / the Hub tab.
 """
-import os
-
+from cli.tools import _grants
 from services import agent_locks as al
 
 
 def _session_id(svc) -> str:
-    """Must match cli/tools/edit.py._session_id exactly — a lease taken by
-    c3_edit has to be recognised as ours by c3_locks, and vice versa. Never ""
-    (see the note there: two anonymous agents would stop blocking each other)."""
-    session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
-    return str(session.get("id", "") or "") or f"pid-{os.getpid()}"
+    """A lease taken by c3_edit has to be recognised as ours by c3_locks, and
+    vice versa — so both read the one definition in `_grants`."""
+    return _grants.session_id(svc)
 
 
 def _split(paths: str) -> list:

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/tools/override.py

@@ -12,9 +12,9 @@ Layers that can never be escalated (the credential vault, Tier-0 denies, the
 dispatcher fail-closed deny, catastrophic shell blocks) are refused at
 creation with `[c3-override:not-escalatable]` and never reach a human.
 """
-import os
 import time
 
+from cli.tools import _grants
 from services import access_guard as ag
 from services import override_policy as opol
 from services import override_requests as orq
@@ -28,9 +28,8 @@ _DEFAULT_TOOL = {"read": "Read", "write": "Edit"}
 
 
 def _session_id(svc) -> str:
-    """Must match cli/tools/edit.py._session_id — the grant is bound to it."""
-    session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
-    return str(session.get("id", "") or "") or f"pid-{os.getpid()}"
+    """The identity the grant is bound to — one definition, in `_grants`."""
+    return _grants.session_id(svc)
 
 
 def _fmt(row: dict) -> str:

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/tools/read.py

@@ -6,6 +6,7 @@ from concurrent.futures import ThreadPoolExecutor, as_completed
 from pathlib import Path
 from typing import Any
 
+from cli.tools import _grants
 from cli.tools._helpers import finalize_with_tokens, maybe_related_facts
 from core import count_tokens
 from services import access_guard
@@ -123,8 +124,14 @@ def handle_read(file_path: str, symbols: Any = None, lines: Any = None,
     # before existence so probes get the same refusal whether or not the
     # target exists (R2). Batch members hit this via the per-file dispatch,
     # so allowed members are served and denied ones carry the S1 line inline.
+    # A live grant (P2a) is consulted only on the DENIAL branch. The masked
+    # branch below is untouched on purpose: a mask is not a refusal to be
+    # lifted, it is a different view being served, and "approve once" has no
+    # meaning for it. Widening that is a separate decision, not a side effect.
     _verdict = access_guard.verdict(file_path, "read", svc.project_path)
-    if _verdict.denial:
+    if _verdict.denial and not _grants.allow(svc, _verdict.denial,
+                                             tool="c3_read", op="read",
+                                             path=file_path):
         resp = access_guard.refusal(_verdict.denial, file_path, "read")
         if finalize is None:
             return resp

{code_context_control-2.70.0 → code_context_control-2.73.0}/cli/tools/validate.py

@@ -8,6 +8,7 @@ import subprocess
 import sys
 from pathlib import Path
 
+from cli.tools import _grants
 from services import access_guard
 
 
@@ -169,7 +170,8 @@ async def _validate_one(file_path: str, svc) -> tuple:
     # Access Guard: read verdict (docs/access-guard.md §3) — the S1 refusal
     # becomes the batch line for this member; other members are still served.
     denial = access_guard.check(file_path, "read", svc.project_path)
-    if denial:
+    if denial and not _grants.allow(svc, denial, tool="c3_validate",
+                                    op="read", path=file_path):
         return ("SKIP", access_guard.refusal(denial, file_path, "read"))
     full = Path(svc.project_path) / file_path
     if not full.exists():
@@ -250,7 +252,8 @@ async def _validate_single(file_path: str, svc, finalize) -> str:
     """Original single-file validation path."""
     # Access Guard: read verdict, checked before existence (R2 probe parity).
     denial = access_guard.check(file_path, "read", svc.project_path)
-    if denial:
+    if denial and not _grants.allow(svc, denial, tool="c3_validate",
+                                    op="read", path=file_path):
         return finalize("c3_validate", {"file_path": file_path},
                         access_guard.refusal(denial, file_path, "read"),
                         "access-denied")

{code_context_control-2.70.0 → code_context_control-2.73.0/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.70.0
+Version: 2.73.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.70.0 → code_context_control-2.73.0}/code_context_control.egg-info/SOURCES.txt

@@ -69,6 +69,7 @@ cli/hub_ui/components/task_board.js
 cli/hub_ui/components/toasts.js
 cli/hub_ui/components/topbar.js
 cli/tools/__init__.py
+cli/tools/_grants.py
 cli/tools/_helpers.py
 cli/tools/agent.py
 cli/tools/artifacts.py
@@ -222,6 +223,7 @@ services/output_filter.py
 services/override_grants.py
 services/override_policy.py
 services/override_requests.py
+services/override_wake.py
 services/parser.py
 services/project_manager.py
 services/project_runtime.py
@@ -330,6 +332,7 @@ tests/test_memory_graph_api.py
 tests/test_memory_queue.py
 tests/test_memory_system.py
 tests/test_mobile_api.py
+tests/test_mobile_override_routes.py
 tests/test_mobile_security_api.py
 tests/test_no_stale_model_pins.py
 tests/test_notification_dedup.py
@@ -351,7 +354,9 @@ tests/test_oracle_subproject_awareness.py
 tests/test_oracle_ui_bundle.py
 tests/test_output_filter.py
 tests/test_override_grants.py
+tests/test_override_grants_mcp.py
 tests/test_override_requests.py
+tests/test_override_wake.py
 tests/test_permissions.py
 tests/test_pm_api.py
 tests/test_project_manager.py

{code_context_control-2.70.0 → code_context_control-2.73.0}/oracle/config.py

@@ -37,6 +37,15 @@ DEFAULTS = {
     # A global-scope access rule applies to EVERY project on this machine —
     # blast radius beyond the projects the token can even enumerate.
     "mobile_access_global_scope": False,
+    # ── Override Requests (docs/override-requests.md §3.2) ──
+    # The approval inbox. `override` serves the read routes (list / one /
+    # policy); `override_write` is what turns a phone tap into a real grant,
+    # so it is the switch that matters. Both default ON to match the access
+    # pair — the feature is already off by default one layer down, in the
+    # PROJECT policy (`override.enabled: false`, every layer false), which is
+    # what decides whether a request can exist at all.
+    "mobile_override_enabled": True,      # read: request list / one / policy
+    "mobile_override_write": True,        # decide / mute / policy edit
     # Second, tighter budget for security mutations, on top of the shared
     # api_rate_limit_per_min bucket. 0 = share the main bucket only.
     "mobile_security_rate_limit_per_min": 12,