code-context-control 2.73.0__tar.gz → 2.75.0__tar.gz

{code_context_control-2.73.0/code_context_control.egg-info → code_context_control-2.75.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.73.0
+Version: 2.75.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -204,7 +204,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
-| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter |
+| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter, `verify` (did a failed `c3_edit` still land?) |
 | `c3_task` | Per-project PM — tasks, dependencies, milestones, time tracking (v2.53.0) |
 | `c3_artifacts` | Agent-config version history, diff & restore (v2.46.0) |
 | `c3_credentials` | Named-secret vault; values never enter model context (v2.58.0) |

{code_context_control-2.73.0 → code_context_control-2.75.0}/README.md

@@ -141,7 +141,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
-| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter |
+| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter, `verify` (did a failed `c3_edit` still land?) |
 | `c3_task` | Per-project PM — tasks, dependencies, milestones, time tracking (v2.53.0) |
 | `c3_artifacts` | Agent-config version history, diff & restore (v2.46.0) |
 | `c3_credentials` | Named-secret vault; values never enter model context (v2.58.0) |

{code_context_control-2.73.0 → code_context_control-2.75.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.73.0"
+__version__ = "2.75.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

{code_context_control-2.73.0 → code_context_control-2.75.0}/cli/hook_access_guard.py

@@ -48,12 +48,49 @@ _IPV6_RE = re.compile(
     re.IGNORECASE,
 )
 
+# Characters that make a token a compound expression rather than a path
+# argument: what Windows forbids in a filename outright (< > " | ? *) plus the
+# bracketing and quoting that marks structure ({} [] () ' ` &).
+#
+# NOT in this set, deliberately: ':' is the thing under test; '$' and '=' are
+# legal in a real path AND in a real ADS spelling — './notes.txt:$DATA' is the
+# canonical default-stream syntax, and dropping it here silently deleted an
+# existing negative control the first time this was written. Every genuinely
+# dangerous shell use of '$' arrives with '(' or '{' anyway, which are covered.
+#
+# This is the general form of the fix #50 attempted with _is_network_token, and
+# the reason that one was not enough: it whitelisted two *shapes* — a token
+# STARTING with a scheme, or a bare IPv6 — so a URL that was not the whole token
+# still tripped, and syntax carrying no URL at all was never covered:
+#
+#     echo "see [#1](https://example.com/a/b)"   -> token '[#1](https://…' , scheme not at position 0
+#     echo '{a:.x,b:("/"+.y)}'                   -> a jq filter, no URL anywhere
+#     python -c "… ['src/a.py','src/b.py'] …"    -> a list literal
+#
+# All three contain '/', so the token gate admitted them; all three canonicalize
+# to something with a residual colon, and <ads> is exempt from existence-gating,
+# so each became a hard deny on text that names no file at all.
+_SYNTAX_CHARS = frozenset("{}[]()<>\"'`|&*?")
+
 
 def _is_network_token(tok: str) -> bool:
     """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling."""
     return bool(_SCHEME_RE.match(tok) or _IPV6_RE.match(tok))
 
 
+def _looks_like_a_path(tok: str) -> bool:
+    """False for tokens that are shell syntax rather than a path argument.
+
+    Deliberately asymmetric, because the two errors are not equal. Skipping a
+    token that WAS a path costs a missed advisory flag in a best-effort scanner
+    — the real gates (the Read/Write/Edit path check above, and every c3 tool)
+    still refuse it. Flagging a token that was NOT a path costs a hard,
+    unappealable deny on a command that touches nothing, which is what #50 was.
+    So this errs toward skipping.
+    """
+    return not (_SYNTAX_CHARS & set(tok))
+
+
 def _deny(reason: str) -> dict:
     return {
         "hookSpecificOutput": {
@@ -113,9 +150,10 @@ def _scan_shell(cmd: str, base: str):
     covers (existence-gating keeps regex/pattern arguments like '\\.env'
     from false-denying), or the evaluator flags the spelling itself.
 
-    URLs and IPv6 literals are skipped outright: they trip the ADS spelling
-    check, which is exempt from existence-gating, so a token naming nothing
-    on disk would otherwise hard-deny (#50).
+    Tokens that are shell syntax rather than path arguments are skipped
+    outright, as are URLs and IPv6 literals: all of them trip the ADS spelling
+    check, which is exempt from existence-gating, so a token naming nothing on
+    disk would otherwise hard-deny (#50).
     """
     for raw in _TOKEN_SPLIT.split(cmd)[:_MAX_TOKENS]:
         tok = raw.strip("\"'`;,()")
@@ -123,7 +161,11 @@ def _scan_shell(cmd: str, base: str):
             continue
         if "/" not in tok and "\\" not in tok and not tok.startswith("."):
             continue
-        if _is_network_token(tok):
+        # Order matters only for readability: a URL is also syntax-free, so
+        # either check alone would skip 'https://x'. Both are kept because they
+        # answer different questions — "is this a network literal" and "is this
+        # a path at all" — and the second is the one that generalizes.
+        if not _looks_like_a_path(tok) or _is_network_token(tok):
             continue
         if re.match(r"^/[a-z]/", tok):  # MSYS /c/foo → C:/foo
             tok = f"{tok[1]}:{tok[2:]}"

{code_context_control-2.73.0 → code_context_control-2.75.0}/cli/mcp_server.py

@@ -708,7 +708,9 @@ async def c3_edit(file_path: str, old_string: str = "", new_string: str = "",
     """EDIT — read+patch+write+log in one step. Primary code-change tool; always prefer over native Edit.
     old_string: text to replace. new_string: replacement. summary: ledger description.
     edits: JSON list of {old_string, new_string, summary?} for multi-hunk batch on one file.
-    Parallel across files. Create new file: non-existent file_path + old_string='' + new_string=<content>."""
+    Parallel across files. Create new file: non-existent file_path + old_string='' + new_string=<content>.
+    If this call ERRORS OR TIMES OUT, do not retry blind — a failed c3_edit may still have
+    written the file. Re-send the same args to c3_edits(action='verify') for a verdict."""
     path_err = validate_file_path(file_path)
     if path_err:
         return f"[c3_edit:error] {path_err}"
@@ -725,10 +727,15 @@ async def c3_edit(file_path: str, old_string: str = "", new_string: str = "",
 async def c3_edits(action: str, file: str = "", change_type: str = "modified",
              summary: str = "", lines_changed: str = "", tags: str = "",
              limit: int = 50, since: str = "", edit_id: str = "",
-             tag: str = "", branch: str = "", ctx: Context = None) -> str:
+             tag: str = "", branch: str = "", old_string: str = "",
+             new_string: str = "", edits: str = "", ctx: Context = None) -> str:
     """EDIT HISTORY — inspect the ledger. Different from c3_edit (which writes); this one reads.
-    actions: log (append entry), history (recent edits), versions (per-file), stats, tag (mark edit_id).
-    branch: filter history to edits stamped with a given git branch."""
+    actions: log (append entry), history (recent edits), versions (per-file), stats, tag (mark edit_id),
+    verify (did an edit land?).
+    branch: filter history to edits stamped with a given git branch.
+    verify: pass the SAME file/old_string/new_string (or edits) you gave the c3_edit that errored or
+    timed out. Answers APPLIED (do not retry) / NOT_APPLIED (safe to retry) / INCONCLUSIVE (read the
+    file) — a failed c3_edit may still have written, so retrying blind can apply an edit twice."""
     svc = _svc(ctx)
 
     def finalize(name, args, resp, summ, **kw):
@@ -737,7 +744,8 @@ async def c3_edits(action: str, file: str = "", change_type: str = "modified",
     from cli.tools.edits import handle_edits
     return await asyncio.to_thread(handle_edits, action, file, change_type, summary,
                                    lines_changed, tags, limit, since, edit_id, tag,
-                                   svc, finalize, branch)
+                                   svc, finalize, branch, old_string, new_string,
+                                   edits)
 
 
 @mcp.tool()

code_context_control-2.75.0/cli/tools/edit_verify.py

@@ -0,0 +1,267 @@
+"""`c3_edits(action='verify')` — did that edit land?
+
+Written for #74. A `c3_edit` call can fail *after* doing its work: one call in a
+logged session hung until the harness aborted it at the 1800s MCP idle timeout,
+and the write had fully landed; another dropped the MCP connection and had
+written nothing. Both reached the caller as an error, and nothing distinguished
+them.
+
+That ambiguity is the defect, separately from whatever causes the stall. The
+retry that is safe after the second incident is a double-apply after the first,
+and the case where that actually corrupts a file is not exotic — any edit whose
+``new_string`` contains its ``old_string`` (appending a line, wrapping a call)
+matches again on a retry and applies twice. `c3_edit`'s own not-found error is
+what saves the ordinary case, which is luck rather than a property.
+
+**The file is the primary evidence; the ledger corroborates.** In that order,
+because they answer different questions: the file says whether the intended text
+is there now, the ledger says whether *this* edit is what put it there. Neither
+alone is enough —
+
+- text present, no ledger entry → it may have been there all along;
+- ledger entry, text absent → something wrote and something else overwrote it.
+
+So there are three verdicts, and the third one is the honest half:
+
+- ``NOT_APPLIED`` — ``new_string`` is absent from the file. Definitive: had the
+  edit landed, its own replacement text would be there. Safe to retry.
+- ``APPLIED`` — ``new_string`` is present *and* a ledger entry for this file
+  records this exact old/new pair. Definitive: do not retry.
+- ``INCONCLUSIVE`` — everything else, with the specific check that failed named
+  in the output. Never collapsed into either of the above; a verifier that
+  guesses is worth less than one that says it cannot tell, because the caller
+  can always fall back to reading the file.
+
+Batch (`edits=`) verification reports per patch, since `c3_edit`'s batch mode
+writes the file once after applying every hunk in memory — so "half written" is
+not a state it can leave behind, but "patch 2 missed while 1 and 3 applied" very
+much is, and that is what the caller needs itemized.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from cli.tools import _grants
+from services import access_guard
+
+VERDICT_APPLIED = "APPLIED"
+VERDICT_NOT_APPLIED = "NOT_APPLIED"
+VERDICT_INCONCLUSIVE = "INCONCLUSIVE"
+
+#: How far back to look for a corroborating ledger entry. Generous on purpose:
+#: the failure this exists for is a call that hung for half an hour, so a window
+#: measured in a handful of entries would miss the case it was built for.
+_DEFAULT_LOOKBACK = 200
+
+#: The ledger caps stored old/new strings (``_DETAIL_CAP`` in cli/tools/edit.py).
+#: A long ``new_string`` is therefore recorded truncated, and comparing it whole
+#: would report INCONCLUSIVE for every large edit — which is to say, for exactly
+#: the edits most likely to have timed out. Compare on the stored prefix.
+_DETAIL_CAP = 2000
+
+
+def _rel(file_path: str, project_path: str) -> str:
+    """The ledger's spelling of ``file_path``.
+
+    The caller should be able to paste the same ``file_path`` they gave
+    ``c3_edit`` — which is frequently absolute, and which the ledger stores
+    project-relative with forward slashes. Making them convert by hand is how a
+    verification tool goes unused at the moment it is needed.
+    """
+    p = Path(file_path)
+    if not p.is_absolute():
+        p = Path(project_path) / p
+    try:
+        p = p.resolve()
+    except OSError:
+        pass
+    try:
+        return str(p.relative_to(Path(project_path).resolve())).replace("\\", "/")
+    except (ValueError, OSError):
+        return str(file_path).replace("\\", "/")
+
+
+def _read(path: Path):
+    """File text with EOLs normalized the way ``c3_edit`` normalizes them.
+
+    Without this, an edit to a CRLF file verifies as NOT_APPLIED: c3_edit
+    matches against LF-normalized content, so a multi-line ``new_string`` the
+    caller passed never appears verbatim in the bytes on disk.
+    """
+    try:
+        raw = path.read_bytes()
+    except OSError:
+        return None
+    text = raw.decode("utf-8", errors="surrogateescape")
+    return text.replace("\r\n", "\n").replace("\r", "\n")
+
+
+def _pairs_from_ledger(entry: dict) -> list:
+    """Every (old, new) pair an entry records — single edits and batches alike."""
+    detail = entry.get("detail") or {}
+    if not isinstance(detail, dict):
+        return []
+    patches = detail.get("patches")
+    if isinstance(patches, list):
+        return [
+            (str(p.get("old_string", "")), str(p.get("new_string", "")))
+            for p in patches if isinstance(p, dict)
+        ]
+    if "old_string" in detail or "new_string" in detail:
+        return [(str(detail.get("old_string", "")),
+                 str(detail.get("new_string", "")))]
+    return []
+
+
+def _ledger_match(ledger, rel: str, old: str, new: str, limit: int):
+    """The most recent ledger entry recording this exact old/new pair, or None.
+
+    Compared against the ledger's truncated prefixes, not the full strings — see
+    ``_DETAIL_CAP``. Truncation means a *prefix* match is the strongest claim
+    available here, so two edits sharing a 2000-character prefix would be
+    indistinguishable. That is a real limit, and it is why the file check leads
+    and this one only corroborates.
+    """
+    if ledger is None:
+        return None
+    try:
+        entries = ledger.get_history(file=rel, limit=limit)
+    except Exception:
+        return None
+    want = (old[:_DETAIL_CAP], new[:_DETAIL_CAP])
+    for entry in reversed(entries or []):
+        for pair in _pairs_from_ledger(entry):
+            if pair == want:
+                return entry
+    return None
+
+
+def _verify_one(content, old: str, new: str, ledger, rel: str,
+                limit: int) -> dict:
+    """Verdict for one (old, new) pair. Pure apart from the ledger read."""
+    if content is None:
+        return {
+            "verdict": VERDICT_NOT_APPLIED,
+            "why": "the file does not exist or could not be read, so nothing "
+                   "was written to it",
+            "entry": None,
+        }
+    if not new:
+        # A deletion: new_string is empty. "Is the replacement present" has no
+        # answer, so the ledger is the only positive evidence available.
+        entry = _ledger_match(ledger, rel, old, new, limit)
+        if old and old in content:
+            return {"verdict": VERDICT_NOT_APPLIED,
+                    "why": "the text this edit removes is still present",
+                    "entry": None}
+        if entry is not None:
+            return {"verdict": VERDICT_APPLIED,
+                    "why": f"the removed text is gone and ledger entry "
+                           f"{entry.get('id', '')} records this deletion",
+                    "entry": entry}
+        return {"verdict": VERDICT_INCONCLUSIVE,
+                "why": "the text is absent but no ledger entry records this "
+                       "deletion — it may never have been there",
+                "entry": None}
+
+    if new not in content:
+        return {
+            "verdict": VERDICT_NOT_APPLIED,
+            "why": "new_string is not in the file; had this edit landed, its "
+                   "own replacement text would be there",
+            "entry": None,
+        }
+
+    entry = _ledger_match(ledger, rel, old, new, limit)
+    if entry is not None:
+        return {
+            "verdict": VERDICT_APPLIED,
+            "why": f"new_string is present and ledger entry "
+                   f"{entry.get('id', '')} ({entry.get('timestamp', '')[:19]}) "
+                   f"records this exact old/new pair",
+            "entry": entry,
+        }
+    return {
+        "verdict": VERDICT_INCONCLUSIVE,
+        "why": "new_string is present but no ledger entry records this edit — "
+               "the text may have been there already, or been written by "
+               "something other than c3_edit. Read the file before retrying",
+        "entry": None,
+    }
+
+
+def verify(file_path: str, old_string: str, new_string: str, edits: str,
+           svc, limit: int = _DEFAULT_LOOKBACK):
+    """Verify one edit or a batch. Returns (body, summary) for ``finalize``.
+
+    Takes the same arguments the original ``c3_edit`` call took, so recovering
+    from an aborted edit means re-sending it to a different action rather than
+    reconstructing anything.
+    """
+    if not file_path:
+        return "file is required", "missing file"
+
+    project_path = str(getattr(svc, "project_path", "") or "")
+    rel = _rel(file_path, project_path)
+    path = Path(file_path)
+    if not path.is_absolute():
+        path = Path(project_path) / path
+
+    # Access Guard, read verdict, before a single byte is read. Caught by
+    # tests/test_access_guard_meta.py rather than by review — and it was right
+    # to catch it. This tool returns a verdict rather than content, which is
+    # exactly why it is worth guarding: "does .env contain X" answered one
+    # substring at a time is a content read with extra steps.
+    denial = access_guard.check(str(path), "read", project_path)
+    if denial and not _grants.allow(svc, denial, tool="c3_edits", op="read",
+                                    path=str(path)):
+        return (access_guard.refusal(denial, file_path, "read"),
+                "access-denied")
+
+    content = _read(path)
+    ledger = getattr(svc, "edit_ledger", None)
+
+    if edits:
+        try:
+            edit_list = json.loads(edits) if isinstance(edits, str) else edits
+        except json.JSONDecodeError as exc:
+            return f"edits must be a valid JSON list: {exc}", "bad edits param"
+        if not isinstance(edit_list, list) or not edit_list:
+            return "edits must be a non-empty JSON list", "bad edits param"
+
+        lines = [f"[edits:verify] {rel} — {len(edit_list)} patch(es)"]
+        verdicts = []
+        for i, patch in enumerate(edit_list):
+            if not isinstance(patch, dict):
+                lines.append(f"  patch[{i}]: INCONCLUSIVE — not an object")
+                verdicts.append(VERDICT_INCONCLUSIVE)
+                continue
+            r = _verify_one(content, str(patch.get("old_string", "")),
+                            str(patch.get("new_string", "")), ledger, rel, limit)
+            verdicts.append(r["verdict"])
+            lines.append(f"  patch[{i}]: {r['verdict']} — {r['why']}")
+        # A batch writes once, so a mixed result means individual hunks did not
+        # match — not that the file was left half-written. Say so, rather than
+        # letting the caller infer a torn write that cannot happen.
+        lines.append("  note: c3_edit's batch mode writes the file once after "
+                     "applying every hunk in memory, so a mixed result means "
+                     "some hunks did not match — not a partial write.")
+        counts = {v: verdicts.count(v) for v in sorted(set(verdicts))}
+        summary = ", ".join(f"{n} {v.lower()}" for v, n in counts.items())
+        return "\n".join(lines), f"{rel}: {summary}"
+
+    if not old_string and not new_string:
+        return ("old_string and/or new_string are required — verify answers "
+                "'did THIS edit land', which needs the edit"), "missing params"
+
+    r = _verify_one(content, old_string, new_string, ledger, rel, limit)
+    lines = [f"[edits:verify] {rel} — {r['verdict']}", f"  {r['why']}"]
+    if r["verdict"] == VERDICT_NOT_APPLIED:
+        lines.append("  → safe to re-send the original c3_edit call.")
+    elif r["verdict"] == VERDICT_APPLIED:
+        lines.append("  → do NOT retry; re-sending would either fail to match "
+                     "or apply a second time.")
+    else:
+        lines.append("  → read the file before deciding; do not retry blind.")
+    return "\n".join(lines), f"{rel}: {r['verdict']}"

{code_context_control-2.73.0 → code_context_control-2.75.0}/cli/tools/edits.py

@@ -1,11 +1,26 @@
 """c3_edits — AI-tracked edit ledger: log, query, and version file changes."""
 
+from cli.tools.edit_verify import verify as _verify
+
 
 def handle_edits(action: str, file: str, change_type: str, summary: str,
                  lines_changed: str, tags: str, limit: int, since: str,
-                 edit_id: str, tag: str, svc, finalize, branch: str = "") -> str:
+                 edit_id: str, tag: str, svc, finalize, branch: str = "",
+                 old_string: str = "", new_string: str = "",
+                 edits: str = "") -> str:
     """Route c3_edits actions."""
     ledger = svc.edit_ledger
+
+    # verify runs BEFORE the ledger-availability gate. It leads on the file, and
+    # the file is readable whether or not the ledger is: answering "did my edit
+    # land" with "ledger disabled" would withhold the evidence that matters most
+    # at the one moment a caller has no other way to find out (#74).
+    if action == "verify":
+        body, summ = _verify(file, old_string, new_string, edits, svc,
+                             limit=limit or 200)
+        return finalize("c3_edits", {"action": "verify", "file": file},
+                        body, summ)
+
     if ledger is None:
         return finalize("c3_edits", {"action": action}, "Edit ledger not available", "ledger disabled")
 
@@ -119,5 +134,6 @@ def handle_edits(action: str, file: str, change_type: str, summary: str,
 
     else:
         return finalize("c3_edits", {"action": action},
-                        f"Unknown action: {action}. Use: log, history, versions, stats, tag",
+                        f"Unknown action: {action}. "
+                        "Use: log, history, versions, stats, tag, verify",
                         "unknown action")

{code_context_control-2.73.0 → code_context_control-2.75.0}/cli/tools/project.py

@@ -337,8 +337,12 @@ def _proxy(action, fsvc, *, query, file_path, symbols, lines, mode, view, top_k,
     if action == "edits":
         from cli.tools.edits import handle_edits
 
+        # old_string/new_string/edits are threaded through for edits_action=
+        # 'verify'. A cross-project edit that times out is the same problem as a
+        # local one, and the proxy carries those params already (#74).
         return handle_edits(edits_action, file, "", "", "", tags, limit, "", "",
-                           tag, fsvc, _foreign_finalize)
+                           tag, fsvc, _foreign_finalize, "",
+                           old_string, new_string, edits)
     if action == "validate":
         from cli.tools.validate import handle_validate
 

{code_context_control-2.73.0 → code_context_control-2.75.0/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.73.0
+Version: 2.75.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -204,7 +204,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
-| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter |
+| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter, `verify` (did a failed `c3_edit` still land?) |
 | `c3_task` | Per-project PM — tasks, dependencies, milestones, time tracking (v2.53.0) |
 | `c3_artifacts` | Agent-config version history, diff & restore (v2.46.0) |
 | `c3_credentials` | Named-secret vault; values never enter model context (v2.58.0) |

{code_context_control-2.73.0 → code_context_control-2.75.0}/code_context_control.egg-info/SOURCES.txt

@@ -78,6 +78,7 @@ cli/tools/compress.py
 cli/tools/credentials.py
 cli/tools/delegate.py
 cli/tools/edit.py
+cli/tools/edit_verify.py
 cli/tools/edits.py
 cli/tools/federate.py
 cli/tools/filter.py
@@ -286,6 +287,7 @@ tests/test_e2e_benchmark.py
 tests/test_edit_ledger_hook.py
 tests/test_edit_locking.py
 tests/test_edit_normalization.py
+tests/test_edit_verify.py
 tests/test_embedding_index_deadlock.py
 tests/test_enforcement_flip.py
 tests/test_enforcement_policy.py

{code_context_control-2.73.0 → code_context_control-2.75.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-context-control"
-version = "2.73.0"
+version = "2.75.0"
 description = "Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub."
 readme = "README.md"
 requires-python = ">=3.10"

{code_context_control-2.73.0 → code_context_control-2.75.0}/services/access_guard.py

@@ -709,11 +709,12 @@ def _override_offer(denial: Denial, path, operation: str, tool: str) -> str:
     that can never be escalated: an agent must not learn from a refusal that
     a request surface exists for the credential vault (§6).
 
-    Restricted to the hook surface on purpose. The offer promises that a human
-    'yes' makes the retry work, and today only the PreToolUse gates consult
-    grants — the ``c3_*`` content surfaces do not (see §13, phase P2a). An
-    offer on a surface that would still refuse after approval is worse than
-    no offer.
+    Restricted to the hook surface on purpose — see ``refusal``. The rule was
+    written when only the PreToolUse gates consulted grants; P2a taught the
+    ``c3_*`` content surfaces to consult them too, so extending the offer to
+    the MCP surface is now defensible. It is deliberately NOT done here: that
+    is a separate, wider change (every c3_* refusal grows a line) and belongs
+    in its own review, not smuggled in beside a fix for the branch ordering.
     """
     try:
         from services import override_policy as _op  # noqa: PLC0415 — cycle
@@ -738,7 +739,26 @@ def refusal(denial: Denial, path, operation: str, *, surface: str = "mcp",
     the agent it may ASK (docs/override-requests.md §6). The pinned strings
     above are unchanged: the append is absent unless the project opted in,
     which is off by default.
+
+    The append happens HERE, once, for every kind — not inside a branch. It
+    used to live at the tail of the deny branch, which sits below the mask and
+    read-only early returns, so those two kinds could never carry an offer on
+    any surface even though `rule_class_for_denial` marks both escalatable.
+    `access_readonly` was the only layer anyone had turned on, so in practice
+    the invitation half of Override Requests had never fired once.
     """
+    body = _refusal_body(denial, path, operation, surface=surface,
+                         tool=tool, project=project)
+    # Hook only, still: the offer promises that a 'yes' makes the retry work,
+    # and the proxy surface answers for a DIFFERENT project's policy.
+    if surface == "hook":
+        return body + _override_offer(denial, path, operation, tool)
+    return body
+
+
+def _refusal_body(denial: Denial, path, operation: str, *, surface: str,
+                  tool: str, project: str) -> str:
+    """The pinned string itself, with no override append."""
     p, glob, scope = _cap(path), denial.rule, denial.scope
     if denial.kind == _KIND_MASK:
         if operation in ("write", "create", "delete"):
@@ -762,12 +782,20 @@ def refusal(denial: Denial, path, operation: str, *, surface: str = "mcp",
             "`c3 access list` or the Access tab."
         )
     if denial.kind == _KIND_READ_ONLY:
+        # `{operation}`, not a hardcoded "write". A read-only rule blocks the
+        # whole write class, and for a file that does not exist yet the tools
+        # call that operation `create`. Saying "write" told the agent to ask
+        # the user to approve `op='write'`, the approval was minted for
+        # `write`, and the grant matcher — which compares op exactly — then
+        # refused the `create` the tool actually attempted. A real approval
+        # was spent and silently discarded (§4 near_miss).
         return (
-            f"{TAG_READ_ONLY} write denied for {p} by Access Guard rule "
+            f"{TAG_READ_ONLY} {operation} denied for {p} by Access Guard rule "
             f"'{glob}' ({scope} scope). The effective policy is read-only; "
-            "reads are evaluated separately. Do not retry the write. Mark "
-            "the affected step blocked and continue with unaffected files; "
-            "report the skip. Rules: `c3 access list` or the Access tab."
+            f"reads are evaluated separately. Do not retry the {operation}. "
+            "Mark the affected step blocked and continue with unaffected "
+            "files; report the skip. Rules: `c3 access list` or the Access "
+            "tab."
         )
     if surface == "hook":
         return (
@@ -776,7 +804,7 @@ def refusal(denial: Denial, path, operation: str, *, surface: str = "mcp",
             "decision, not a transient error — do not retry through another "
             "tool or the shell. Mark the affected step blocked and continue "
             "with unaffected files. Rules: `c3 access list`."
-        ) + _override_offer(denial, path, operation, tool)
+        )
     if surface == "proxy":
         return (
             f"{TAG_DENIED} {operation} denied for {p} through project "

{code_context_control-2.73.0 → code_context_control-2.75.0}/services/notifications.py

@@ -43,7 +43,8 @@ class NotificationStore:
         self._collapsed = False
 
     def add(self, agent: str, severity: str, title: str, message: str,
-            ai_enhanced: bool = False, replace_if_unacked: bool = False) -> dict | None:
+            ai_enhanced: bool = False, replace_if_unacked: bool = False,
+            kind: str = "", ref_id: str = "") -> dict | None:
         """Append a notification. Dedup: an identical (agent, title, message)
         that is still unacknowledged collapses into the existing record — its
         ``count`` is bumped and ``last_seen`` refreshed instead of appending a
@@ -54,6 +55,13 @@ class NotificationStore:
             already exists, update its message/severity in-place (bumping
             count/last_seen) instead of appending a new entry. Use for
             high-frequency agents (budget, index, key-file drift) to prevent pile-up.
+        kind: machine-readable class for clients that ROUTE on a tap rather
+            than parse the title — 'override' for an approval request. Omitted
+            from the record when empty, so every existing producer and every
+            stored line is unchanged.
+        ref_id: the id of the thing the notification is ABOUT (e.g. the
+            override request), which is not the notification's own ``id``.
+            A client needs both: ``id`` to acknowledge, ``ref_id`` to navigate.
         Returns the entry if written/updated, None if deduped.
         """
         with self._lock:
@@ -75,6 +83,13 @@ class NotificationStore:
                         existing["last_seen"] = now.isoformat()
                         existing["count"] = _entry_count(existing) + 1
                         existing["ai_enhanced"] = ai_enhanced
+                        # Refresh the routing fields too: an in-place update
+                        # keeps the record but the thing it points AT may have
+                        # changed (a new request id under the same title).
+                        if kind:
+                            existing["kind"] = kind
+                        if ref_id:
+                            existing["ref_id"] = ref_id
                         self._write_all(entries)
                         return existing
                     # Same notification still pending — collapse into the
@@ -108,6 +123,12 @@ class NotificationStore:
                 "acknowledged": False,
                 "ai_enhanced": ai_enhanced,
             }
+            # Additive only: absent keys rather than empty ones, so a client
+            # can test presence and old lines stay byte-identical in shape.
+            if kind:
+                entry["kind"] = kind
+            if ref_id:
+                entry["ref_id"] = ref_id
             with open(self._file, "a", encoding="utf-8") as f:
                 f.write(json.dumps(entry) + "\n")
             return entry