code-context-control 2.74.0__tar.gz → 2.76.2__tar.gz

{code_context_control-2.74.0/code_context_control.egg-info → code_context_control-2.76.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.74.0
+Version: 2.76.2
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -204,7 +204,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
-| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter |
+| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter, `verify` (did a failed `c3_edit` still land?) |
 | `c3_task` | Per-project PM — tasks, dependencies, milestones, time tracking (v2.53.0) |
 | `c3_artifacts` | Agent-config version history, diff & restore (v2.46.0) |
 | `c3_credentials` | Named-secret vault; values never enter model context (v2.58.0) |

{code_context_control-2.74.0 → code_context_control-2.76.2}/README.md

@@ -141,7 +141,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
-| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter |
+| `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter, `verify` (did a failed `c3_edit` still land?) |
 | `c3_task` | Per-project PM — tasks, dependencies, milestones, time tracking (v2.53.0) |
 | `c3_artifacts` | Agent-config version history, diff & restore (v2.46.0) |
 | `c3_credentials` | Named-secret vault; values never enter model context (v2.58.0) |

{code_context_control-2.74.0 → code_context_control-2.76.2}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.74.0"
+__version__ = "2.76.2"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

{code_context_control-2.74.0 → code_context_control-2.76.2}/cli/hook_access_guard.py

@@ -48,12 +48,96 @@ _IPV6_RE = re.compile(
     re.IGNORECASE,
 )
 
+# Characters that make a token a compound expression rather than a path
+# argument: what Windows forbids in a filename outright (< > " | ? *) plus the
+# bracketing and quoting that marks structure ({} [] () ' ` &).
+#
+# NOT in this set, deliberately: ':' is the thing under test; '$' and '=' are
+# legal in a real path AND in a real ADS spelling — './notes.txt:$DATA' is the
+# canonical default-stream syntax, and dropping it here silently deleted an
+# existing negative control the first time this was written. Every genuinely
+# dangerous shell use of '$' arrives with '(' or '{' anyway, which are covered.
+#
+# This is the general form of the fix #50 attempted with _is_network_token, and
+# the reason that one was not enough: it whitelisted two *shapes* — a token
+# STARTING with a scheme, or a bare IPv6 — so a URL that was not the whole token
+# still tripped, and syntax carrying no URL at all was never covered:
+#
+#     echo "see [#1](https://example.com/a/b)"   -> token '[#1](https://…' , scheme not at position 0
+#     echo '{a:.x,b:("/"+.y)}'                   -> a jq filter, no URL anywhere
+#     python -c "… ['src/a.py','src/b.py'] …"    -> a list literal
+#
+# All three contain '/', so the token gate admitted them; all three canonicalize
+# to something with a residual colon, and <ads> is exempt from existence-gating,
+# so each became a hard deny on text that names no file at all.
+_SYNTAX_CHARS = frozenset("{}[]()<>\"'`|&*?")
+
+# `pkg/mod.py::TestThing`, `ns::Type` — a pytest node id or a C++/Rust scope.
+# NTFS spells a stream `file:name:$TYPE`, and the doubled-colon default-stream
+# form `file::$DATA` is real, so "contains ::" is NOT safe on its own. What is
+# safe is the type slot: stream types are `$`-prefixed system constants, so a
+# `::` NOT followed by `$` cannot be a stream spelling.
+_DOUBLE_COLON_RE = re.compile(r"::(?!\$)")
+
+# `<rev>:<path>` — how git names a blob: `git show HEAD:setup.py`,
+# `git cat-file -p origin/main:src/a.py`.
+_GIT_REVSPEC_RE = re.compile(r"^(?P<rev>[^:\s]+):(?P<path>[^:\s]+)$")
+_GIT_CMD_RE = re.compile(r"^\s*(?:[\w.\-]*[/\\])?git(?:\.exe)?\b", re.IGNORECASE)
+
 
 def _is_network_token(tok: str) -> bool:
     """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling."""
     return bool(_SCHEME_RE.match(tok) or _IPV6_RE.match(tok))
 
 
+def _is_scope_token(tok: str) -> bool:
+    """True for `a/b.py::Thing` and `ns::Type` — never an ADS spelling."""
+    return bool(_DOUBLE_COLON_RE.search(tok))
+
+
+def _git_revspec_path(cmd: str, tok: str):
+    """The path half of a git ``<rev>:<path>`` token, or None.
+
+    Returned so the caller can check **the path** rather than the whole token,
+    which is the fix and a tightening at once. Today every git revspec is denied
+    by accident: ``<rev>:<path>`` canonicalizes to something with a residual
+    colon and trips ``<ads>``, so ``git show origin/main:pyproject.toml`` — an
+    everyday command naming nothing sensitive — is refused.
+
+    Whitelisting the shape outright would go too far the other way, because
+    ``git show HEAD:.env`` really does print a denied file's contents, and right
+    now the only thing stopping it is the false positive. Checking the path half
+    gets both right: `.env` is denied on its own rule, `pyproject.toml` is
+    allowed on its own merits, and neither answer depends on a rule misfiring.
+
+    Gated on the command actually being ``git``, since ``<word>:<word>`` means
+    something else almost everywhere else.
+    """
+    if not _GIT_CMD_RE.match(cmd or ""):
+        return None
+    if len(tok) > 1 and tok[1] == ":":
+        return None  # a drive letter is not a revspec separator
+    m = _GIT_REVSPEC_RE.match(tok)
+    if not m:
+        return None
+    path = m.group("path")
+    # A `$`-prefixed suffix is a stream type, not a path. Do not reinterpret it.
+    return None if path.startswith("$") else path
+
+
+def _looks_like_a_path(tok: str) -> bool:
+    """False for tokens that are shell syntax rather than a path argument.
+
+    Deliberately asymmetric, because the two errors are not equal. Skipping a
+    token that WAS a path costs a missed advisory flag in a best-effort scanner
+    — the real gates (the Read/Write/Edit path check above, and every c3 tool)
+    still refuse it. Flagging a token that was NOT a path costs a hard,
+    unappealable deny on a command that touches nothing, which is what #50 was.
+    So this errs toward skipping.
+    """
+    return not (_SYNTAX_CHARS & set(tok))
+
+
 def _deny(reason: str) -> dict:
     return {
         "hookSpecificOutput": {
@@ -113,9 +197,10 @@ def _scan_shell(cmd: str, base: str):
     covers (existence-gating keeps regex/pattern arguments like '\\.env'
     from false-denying), or the evaluator flags the spelling itself.
 
-    URLs and IPv6 literals are skipped outright: they trip the ADS spelling
-    check, which is exempt from existence-gating, so a token naming nothing
-    on disk would otherwise hard-deny (#50).
+    Tokens that are shell syntax rather than path arguments are skipped
+    outright, as are URLs and IPv6 literals: all of them trip the ADS spelling
+    check, which is exempt from existence-gating, so a token naming nothing on
+    disk would otherwise hard-deny (#50).
     """
     for raw in _TOKEN_SPLIT.split(cmd)[:_MAX_TOKENS]:
         tok = raw.strip("\"'`;,()")
@@ -123,8 +208,22 @@ def _scan_shell(cmd: str, base: str):
             continue
         if "/" not in tok and "\\" not in tok and not tok.startswith("."):
             continue
-        if _is_network_token(tok):
+        # Order matters only for readability: a URL is also syntax-free, so
+        # either check alone would skip 'https://x'. Both are kept because they
+        # answer different questions — "is this a network literal" and "is this
+        # a path at all" — and the second is the one that generalizes.
+        if not _looks_like_a_path(tok) or _is_network_token(tok):
+            continue
+        # `tests/x.py::TestThing` is a node id, not a stream spelling.
+        if _is_scope_token(tok):
             continue
+        # `git show <rev>:<path>` — judge the PATH, not the whole token. This
+        # is the one place the scan rewrites what it checks rather than skipping
+        # it, because skipping would let `git show HEAD:.env` through.
+        revspec_path = _git_revspec_path(cmd, tok)
+        from_revspec = revspec_path is not None
+        if from_revspec:
+            tok = revspec_path
         if re.match(r"^/[a-z]/", tok):  # MSYS /c/foo → C:/foo
             tok = f"{tok[1]}:{tok[2:]}"
         denial = ag.check(tok, "read", base)
@@ -134,7 +233,11 @@ def _scan_shell(cmd: str, base: str):
                 exists = (p if p.is_absolute() else Path(base) / p).exists()
             except OSError:
                 exists = False
-            if exists or denial.rule.startswith("<"):
+            # A revspec names a path in HISTORY, so the working tree is the
+            # wrong place to ask whether it is real. `git show HEAD~5:.env`
+            # reads a denied file whether or not that file exists today, and
+            # existence-gating it would be a hole this rewrite opened.
+            if exists or from_revspec or denial.rule.startswith("<"):
                 return denial, tok
     return None, ""
 

{code_context_control-2.74.0 → code_context_control-2.76.2}/cli/mcp_server.py

@@ -708,7 +708,9 @@ async def c3_edit(file_path: str, old_string: str = "", new_string: str = "",
     """EDIT — read+patch+write+log in one step. Primary code-change tool; always prefer over native Edit.
     old_string: text to replace. new_string: replacement. summary: ledger description.
     edits: JSON list of {old_string, new_string, summary?} for multi-hunk batch on one file.
-    Parallel across files. Create new file: non-existent file_path + old_string='' + new_string=<content>."""
+    Parallel across files. Create new file: non-existent file_path + old_string='' + new_string=<content>.
+    If this call ERRORS OR TIMES OUT, do not retry blind — a failed c3_edit may still have
+    written the file. Re-send the same args to c3_edits(action='verify') for a verdict."""
     path_err = validate_file_path(file_path)
     if path_err:
         return f"[c3_edit:error] {path_err}"
@@ -725,10 +727,15 @@ async def c3_edit(file_path: str, old_string: str = "", new_string: str = "",
 async def c3_edits(action: str, file: str = "", change_type: str = "modified",
              summary: str = "", lines_changed: str = "", tags: str = "",
              limit: int = 50, since: str = "", edit_id: str = "",
-             tag: str = "", branch: str = "", ctx: Context = None) -> str:
+             tag: str = "", branch: str = "", old_string: str = "",
+             new_string: str = "", edits: str = "", ctx: Context = None) -> str:
     """EDIT HISTORY — inspect the ledger. Different from c3_edit (which writes); this one reads.
-    actions: log (append entry), history (recent edits), versions (per-file), stats, tag (mark edit_id).
-    branch: filter history to edits stamped with a given git branch."""
+    actions: log (append entry), history (recent edits), versions (per-file), stats, tag (mark edit_id),
+    verify (did an edit land?).
+    branch: filter history to edits stamped with a given git branch.
+    verify: pass the SAME file/old_string/new_string (or edits) you gave the c3_edit that errored or
+    timed out. Answers APPLIED (do not retry) / NOT_APPLIED (safe to retry) / INCONCLUSIVE (read the
+    file) — a failed c3_edit may still have written, so retrying blind can apply an edit twice."""
     svc = _svc(ctx)
 
     def finalize(name, args, resp, summ, **kw):
@@ -737,7 +744,8 @@ async def c3_edits(action: str, file: str = "", change_type: str = "modified",
     from cli.tools.edits import handle_edits
     return await asyncio.to_thread(handle_edits, action, file, change_type, summary,
                                    lines_changed, tags, limit, since, edit_id, tag,
-                                   svc, finalize, branch)
+                                   svc, finalize, branch, old_string, new_string,
+                                   edits)
 
 
 @mcp.tool()

{code_context_control-2.74.0 → code_context_control-2.76.2}/cli/tools/edit.py

@@ -387,10 +387,12 @@ def _edit_locked(path: Path, rel: str, file_path: str, old_string: str,
         tag_list = [t.strip() for t in tags.split(",") if t.strip()] if tags else None
         n_new = new_string.count("\n") + 1 if new_string else 0
         create_summary = summary or f"Created {rel} ({n_new}L)"
-        _log_to_ledger(rel, create_summary, tag_list, svc,
-                       detail={"old_string": "", "new_string": new_string[:_DETAIL_CAP], "created": True})
+        deferred = _log_to_ledger(
+            rel, create_summary, tag_list, svc,
+            detail={"old_string": "", "new_string": new_string[:_DETAIL_CAP], "created": True})
         short = f"✓ {rel} [created, +{n_new}L]" + (f" — {summary}" if summary else "")
-        return finalize("c3_edit", {"file": file_path}, short, f"{rel} created")
+        return finalize("c3_edit", {"file": file_path}, short + deferred,
+                        f"{rel} created")
 
     # Parse tag list once
     tag_list = [t.strip() for t in tags.split(",") if t.strip()] if tags else None
@@ -477,6 +479,7 @@ def _edit_locked(path: Path, rel: str, file_path: str, old_string: str,
                                 f"Write error: {e}", "write error")
 
         # Log batch to ledger as one entry (store each patch's old/new for diff view)
+        deferred = ""
         if any_applied:
             batch_detail = {"patches": [
                 {
@@ -486,7 +489,9 @@ def _edit_locked(path: Path, rel: str, file_path: str, old_string: str,
                 }
                 for p in edit_list if p.get("old_string") is not None
             ]}
-            _log_to_ledger(rel, summary or f"Batch edit: {len(edit_list)} patches", tag_list, svc, detail=batch_detail)
+            deferred = _log_to_ledger(
+                rel, summary or f"Batch edit: {len(edit_list)} patches",
+                tag_list, svc, detail=batch_detail)
 
         # Classify from the structured status list, not by substring-scanning
         # the human-readable result lines — a patch *summary* containing words
@@ -499,7 +504,7 @@ def _edit_locked(path: Path, rel: str, file_path: str, old_string: str,
             short += "\n" + "\n".join(failed)
             if first_miss:
                 short += first_miss
-        return finalize("c3_edit", {"file": file_path}, short,
+        return finalize("c3_edit", {"file": file_path}, short + deferred,
                         f"{rel} patched ({len(edit_list)} patches)")
 
     # ── Single-edit mode ──────────────────────────────────────────────────────
@@ -548,7 +553,8 @@ def _edit_locked(path: Path, rel: str, file_path: str, old_string: str,
     }
     if used_fallback:
         single_detail["unicode_normalized"] = True
-    _log_to_ledger(rel, auto_summary, tag_list, svc, detail=single_detail)
+    deferred = _log_to_ledger(rel, auto_summary, tag_list, svc,
+                              detail=single_detail)
 
     n_old = old_string.count("\n") + 1
     n_new = new_string.count("\n") + 1
@@ -556,14 +562,73 @@ def _edit_locked(path: Path, rel: str, file_path: str, old_string: str,
     occ = f" ({occurrences}x)" if occurrences > 1 else ""
     norm_tag = " [unicode-normalized]" if used_fallback else ""
     short = f"✓ {rel} [{delta}]{occ}{norm_tag}" + (f" — {summary}" if summary else "")
-    return finalize("c3_edit", {"file": file_path}, short, f"{rel} patched")
+    return finalize("c3_edit", {"file": file_path}, short + deferred,
+                    f"{rel} patched")
 
 
 _DETAIL_CAP = 2000  # chars stored per old/new string in the ledger
 
+#: How long the post-write bookkeeping gets before the caller stops waiting on
+#: it. Normal is milliseconds — a JSONL append and a git call that already caps
+#: itself at 4s. Ten seconds is far outside normal and far inside the harness's
+#: idle timeout, which is the number this exists to stay away from.
+_LEDGER_DEADLINE_S = 10.0
+
+_DEFERRED_NOTE = (
+    "\n  [c3:ledger-deferred] The FILE WRITE SUCCEEDED. Recording it in the "
+    "ledger outran {sec:.0f}s and was left running in the background, so the "
+    "edit may be missing from c3_edits history and from "
+    "c3_edits(action='verify') corroboration.\n"
+    "  Do not re-apply this edit on the strength of that absence — the file is "
+    "the evidence, and it already has the change."
+)
+
+
+def _log_to_ledger(rel: str, summary: str, tag_list, svc,
+                   detail: dict = None) -> str:
+    """Record an edit in the ledger, activity log, and session manager.
+
+    Never raises, and — since #74 — never blocks the caller indefinitely.
+
+    The write has already happened by the time this runs. That ordering is what
+    makes a stall here so expensive: one logged `c3_edit` hung until the harness
+    aborted it at 1800s while the file on disk was already correct, so half an
+    hour bought a report of work that had finished in milliseconds.
+
+    The host-side cause of that stall is not C3's (see #74 — the box hits
+    commit-charge exhaustion in short unpredictable windows), and nothing here
+    prevents it. What this does prevent is *paying 1800s to find out*. The
+    bookkeeping runs on a daemon thread; if it outlives the deadline the caller
+    returns anyway, with the response saying plainly that the write landed and
+    the record may not have. The thread is left alone rather than killed — it
+    may well finish a moment later, and a half-written ledger entry would be
+    worse than a late one.
+
+    Returns "" normally, or a note to append to the response when the deadline
+    passed. Reporting a degraded record is the point; a silent one would make
+    this indistinguishable from a clean run, which is the failure class this
+    whole subsystem exists to remove.
+    """
+    if not svc.edit_ledger:
+        return ""
+    done = threading.Event()
+
+    def _record() -> None:
+        try:
+            _log_to_ledger_blocking(rel, summary, tag_list, svc, detail)
+        finally:
+            done.set()
+
+    threading.Thread(target=_record, name="c3-edit-ledger",
+                     daemon=True).start()
+    if done.wait(_LEDGER_DEADLINE_S):
+        return ""
+    return _DEFERRED_NOTE.format(sec=_LEDGER_DEADLINE_S)
+
 
-def _log_to_ledger(rel: str, summary: str, tag_list, svc, detail: dict = None) -> None:
-    """Log an edit to the ledger, activity log, and session manager. Never raises."""
+def _log_to_ledger_blocking(rel: str, summary: str, tag_list, svc,
+                            detail: dict = None) -> None:
+    """The bookkeeping itself. Never raises; may block. Always run on a thread."""
     if not svc.edit_ledger:
         return
     try:

code_context_control-2.76.2/cli/tools/edit_verify.py

@@ -0,0 +1,267 @@
+"""`c3_edits(action='verify')` — did that edit land?
+
+Written for #74. A `c3_edit` call can fail *after* doing its work: one call in a
+logged session hung until the harness aborted it at the 1800s MCP idle timeout,
+and the write had fully landed; another dropped the MCP connection and had
+written nothing. Both reached the caller as an error, and nothing distinguished
+them.
+
+That ambiguity is the defect, separately from whatever causes the stall. The
+retry that is safe after the second incident is a double-apply after the first,
+and the case where that actually corrupts a file is not exotic — any edit whose
+``new_string`` contains its ``old_string`` (appending a line, wrapping a call)
+matches again on a retry and applies twice. `c3_edit`'s own not-found error is
+what saves the ordinary case, which is luck rather than a property.
+
+**The file is the primary evidence; the ledger corroborates.** In that order,
+because they answer different questions: the file says whether the intended text
+is there now, the ledger says whether *this* edit is what put it there. Neither
+alone is enough —
+
+- text present, no ledger entry → it may have been there all along;
+- ledger entry, text absent → something wrote and something else overwrote it.
+
+So there are three verdicts, and the third one is the honest half:
+
+- ``NOT_APPLIED`` — ``new_string`` is absent from the file. Definitive: had the
+  edit landed, its own replacement text would be there. Safe to retry.
+- ``APPLIED`` — ``new_string`` is present *and* a ledger entry for this file
+  records this exact old/new pair. Definitive: do not retry.
+- ``INCONCLUSIVE`` — everything else, with the specific check that failed named
+  in the output. Never collapsed into either of the above; a verifier that
+  guesses is worth less than one that says it cannot tell, because the caller
+  can always fall back to reading the file.
+
+Batch (`edits=`) verification reports per patch, since `c3_edit`'s batch mode
+writes the file once after applying every hunk in memory — so "half written" is
+not a state it can leave behind, but "patch 2 missed while 1 and 3 applied" very
+much is, and that is what the caller needs itemized.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from cli.tools import _grants
+from services import access_guard
+
+VERDICT_APPLIED = "APPLIED"
+VERDICT_NOT_APPLIED = "NOT_APPLIED"
+VERDICT_INCONCLUSIVE = "INCONCLUSIVE"
+
+#: How far back to look for a corroborating ledger entry. Generous on purpose:
+#: the failure this exists for is a call that hung for half an hour, so a window
+#: measured in a handful of entries would miss the case it was built for.
+_DEFAULT_LOOKBACK = 200
+
+#: The ledger caps stored old/new strings (``_DETAIL_CAP`` in cli/tools/edit.py).
+#: A long ``new_string`` is therefore recorded truncated, and comparing it whole
+#: would report INCONCLUSIVE for every large edit — which is to say, for exactly
+#: the edits most likely to have timed out. Compare on the stored prefix.
+_DETAIL_CAP = 2000
+
+
+def _rel(file_path: str, project_path: str) -> str:
+    """The ledger's spelling of ``file_path``.
+
+    The caller should be able to paste the same ``file_path`` they gave
+    ``c3_edit`` — which is frequently absolute, and which the ledger stores
+    project-relative with forward slashes. Making them convert by hand is how a
+    verification tool goes unused at the moment it is needed.
+    """
+    p = Path(file_path)
+    if not p.is_absolute():
+        p = Path(project_path) / p
+    try:
+        p = p.resolve()
+    except OSError:
+        pass
+    try:
+        return str(p.relative_to(Path(project_path).resolve())).replace("\\", "/")
+    except (ValueError, OSError):
+        return str(file_path).replace("\\", "/")
+
+
+def _read(path: Path):
+    """File text with EOLs normalized the way ``c3_edit`` normalizes them.
+
+    Without this, an edit to a CRLF file verifies as NOT_APPLIED: c3_edit
+    matches against LF-normalized content, so a multi-line ``new_string`` the
+    caller passed never appears verbatim in the bytes on disk.
+    """
+    try:
+        raw = path.read_bytes()
+    except OSError:
+        return None
+    text = raw.decode("utf-8", errors="surrogateescape")
+    return text.replace("\r\n", "\n").replace("\r", "\n")
+
+
+def _pairs_from_ledger(entry: dict) -> list:
+    """Every (old, new) pair an entry records — single edits and batches alike."""
+    detail = entry.get("detail") or {}
+    if not isinstance(detail, dict):
+        return []
+    patches = detail.get("patches")
+    if isinstance(patches, list):
+        return [
+            (str(p.get("old_string", "")), str(p.get("new_string", "")))
+            for p in patches if isinstance(p, dict)
+        ]
+    if "old_string" in detail or "new_string" in detail:
+        return [(str(detail.get("old_string", "")),
+                 str(detail.get("new_string", "")))]
+    return []
+
+
+def _ledger_match(ledger, rel: str, old: str, new: str, limit: int):
+    """The most recent ledger entry recording this exact old/new pair, or None.
+
+    Compared against the ledger's truncated prefixes, not the full strings — see
+    ``_DETAIL_CAP``. Truncation means a *prefix* match is the strongest claim
+    available here, so two edits sharing a 2000-character prefix would be
+    indistinguishable. That is a real limit, and it is why the file check leads
+    and this one only corroborates.
+    """
+    if ledger is None:
+        return None
+    try:
+        entries = ledger.get_history(file=rel, limit=limit)
+    except Exception:
+        return None
+    want = (old[:_DETAIL_CAP], new[:_DETAIL_CAP])
+    for entry in reversed(entries or []):
+        for pair in _pairs_from_ledger(entry):
+            if pair == want:
+                return entry
+    return None
+
+
+def _verify_one(content, old: str, new: str, ledger, rel: str,
+                limit: int) -> dict:
+    """Verdict for one (old, new) pair. Pure apart from the ledger read."""
+    if content is None:
+        return {
+            "verdict": VERDICT_NOT_APPLIED,
+            "why": "the file does not exist or could not be read, so nothing "
+                   "was written to it",
+            "entry": None,
+        }
+    if not new:
+        # A deletion: new_string is empty. "Is the replacement present" has no
+        # answer, so the ledger is the only positive evidence available.
+        entry = _ledger_match(ledger, rel, old, new, limit)
+        if old and old in content:
+            return {"verdict": VERDICT_NOT_APPLIED,
+                    "why": "the text this edit removes is still present",
+                    "entry": None}
+        if entry is not None:
+            return {"verdict": VERDICT_APPLIED,
+                    "why": f"the removed text is gone and ledger entry "
+                           f"{entry.get('id', '')} records this deletion",
+                    "entry": entry}
+        return {"verdict": VERDICT_INCONCLUSIVE,
+                "why": "the text is absent but no ledger entry records this "
+                       "deletion — it may never have been there",
+                "entry": None}
+
+    if new not in content:
+        return {
+            "verdict": VERDICT_NOT_APPLIED,
+            "why": "new_string is not in the file; had this edit landed, its "
+                   "own replacement text would be there",
+            "entry": None,
+        }
+
+    entry = _ledger_match(ledger, rel, old, new, limit)
+    if entry is not None:
+        return {
+            "verdict": VERDICT_APPLIED,
+            "why": f"new_string is present and ledger entry "
+                   f"{entry.get('id', '')} ({entry.get('timestamp', '')[:19]}) "
+                   f"records this exact old/new pair",
+            "entry": entry,
+        }
+    return {
+        "verdict": VERDICT_INCONCLUSIVE,
+        "why": "new_string is present but no ledger entry records this edit — "
+               "the text may have been there already, or been written by "
+               "something other than c3_edit. Read the file before retrying",
+        "entry": None,
+    }
+
+
+def verify(file_path: str, old_string: str, new_string: str, edits: str,
+           svc, limit: int = _DEFAULT_LOOKBACK):
+    """Verify one edit or a batch. Returns (body, summary) for ``finalize``.
+
+    Takes the same arguments the original ``c3_edit`` call took, so recovering
+    from an aborted edit means re-sending it to a different action rather than
+    reconstructing anything.
+    """
+    if not file_path:
+        return "file is required", "missing file"
+
+    project_path = str(getattr(svc, "project_path", "") or "")
+    rel = _rel(file_path, project_path)
+    path = Path(file_path)
+    if not path.is_absolute():
+        path = Path(project_path) / path
+
+    # Access Guard, read verdict, before a single byte is read. Caught by
+    # tests/test_access_guard_meta.py rather than by review — and it was right
+    # to catch it. This tool returns a verdict rather than content, which is
+    # exactly why it is worth guarding: "does .env contain X" answered one
+    # substring at a time is a content read with extra steps.
+    denial = access_guard.check(str(path), "read", project_path)
+    if denial and not _grants.allow(svc, denial, tool="c3_edits", op="read",
+                                    path=str(path)):
+        return (access_guard.refusal(denial, file_path, "read"),
+                "access-denied")
+
+    content = _read(path)
+    ledger = getattr(svc, "edit_ledger", None)
+
+    if edits:
+        try:
+            edit_list = json.loads(edits) if isinstance(edits, str) else edits
+        except json.JSONDecodeError as exc:
+            return f"edits must be a valid JSON list: {exc}", "bad edits param"
+        if not isinstance(edit_list, list) or not edit_list:
+            return "edits must be a non-empty JSON list", "bad edits param"
+
+        lines = [f"[edits:verify] {rel} — {len(edit_list)} patch(es)"]
+        verdicts = []
+        for i, patch in enumerate(edit_list):
+            if not isinstance(patch, dict):
+                lines.append(f"  patch[{i}]: INCONCLUSIVE — not an object")
+                verdicts.append(VERDICT_INCONCLUSIVE)
+                continue
+            r = _verify_one(content, str(patch.get("old_string", "")),
+                            str(patch.get("new_string", "")), ledger, rel, limit)
+            verdicts.append(r["verdict"])
+            lines.append(f"  patch[{i}]: {r['verdict']} — {r['why']}")
+        # A batch writes once, so a mixed result means individual hunks did not
+        # match — not that the file was left half-written. Say so, rather than
+        # letting the caller infer a torn write that cannot happen.
+        lines.append("  note: c3_edit's batch mode writes the file once after "
+                     "applying every hunk in memory, so a mixed result means "
+                     "some hunks did not match — not a partial write.")
+        counts = {v: verdicts.count(v) for v in sorted(set(verdicts))}
+        summary = ", ".join(f"{n} {v.lower()}" for v, n in counts.items())
+        return "\n".join(lines), f"{rel}: {summary}"
+
+    if not old_string and not new_string:
+        return ("old_string and/or new_string are required — verify answers "
+                "'did THIS edit land', which needs the edit"), "missing params"
+
+    r = _verify_one(content, old_string, new_string, ledger, rel, limit)
+    lines = [f"[edits:verify] {rel} — {r['verdict']}", f"  {r['why']}"]
+    if r["verdict"] == VERDICT_NOT_APPLIED:
+        lines.append("  → safe to re-send the original c3_edit call.")
+    elif r["verdict"] == VERDICT_APPLIED:
+        lines.append("  → do NOT retry; re-sending would either fail to match "
+                     "or apply a second time.")
+    else:
+        lines.append("  → read the file before deciding; do not retry blind.")
+    return "\n".join(lines), f"{rel}: {r['verdict']}"

{code_context_control-2.74.0 → code_context_control-2.76.2}/cli/tools/edits.py

@@ -1,11 +1,26 @@
 """c3_edits — AI-tracked edit ledger: log, query, and version file changes."""
 
+from cli.tools.edit_verify import verify as _verify
+
 
 def handle_edits(action: str, file: str, change_type: str, summary: str,
                  lines_changed: str, tags: str, limit: int, since: str,
-                 edit_id: str, tag: str, svc, finalize, branch: str = "") -> str:
+                 edit_id: str, tag: str, svc, finalize, branch: str = "",
+                 old_string: str = "", new_string: str = "",
+                 edits: str = "") -> str:
     """Route c3_edits actions."""
     ledger = svc.edit_ledger
+
+    # verify runs BEFORE the ledger-availability gate. It leads on the file, and
+    # the file is readable whether or not the ledger is: answering "did my edit
+    # land" with "ledger disabled" would withhold the evidence that matters most
+    # at the one moment a caller has no other way to find out (#74).
+    if action == "verify":
+        body, summ = _verify(file, old_string, new_string, edits, svc,
+                             limit=limit or 200)
+        return finalize("c3_edits", {"action": "verify", "file": file},
+                        body, summ)
+
     if ledger is None:
         return finalize("c3_edits", {"action": action}, "Edit ledger not available", "ledger disabled")
 
@@ -119,5 +134,6 @@ def handle_edits(action: str, file: str, change_type: str, summary: str,
 
     else:
         return finalize("c3_edits", {"action": action},
-                        f"Unknown action: {action}. Use: log, history, versions, stats, tag",
+                        f"Unknown action: {action}. "
+                        "Use: log, history, versions, stats, tag, verify",
                         "unknown action")