code-context-control 2.76.2__tar.gz → 2.77.0__tar.gz

{code_context_control-2.76.2/code_context_control.egg-info → code_context_control-2.77.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.76.2
+Version: 2.77.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.76.2 → code_context_control-2.77.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.76.2"
+__version__ = "2.77.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

{code_context_control-2.76.2 → code_context_control-2.77.0}/cli/hook_access_guard.py

@@ -10,6 +10,7 @@ Bash coverage is a best-effort, existence-gated token scan — advisory by
 design (docs/access-guard.md §3/§6); it catches an agent naming a denied
 path, not an adversary hiding one.
 """
+import os
 import re
 import sys
 from pathlib import Path
@@ -84,6 +85,23 @@ _DOUBLE_COLON_RE = re.compile(r"::(?!\$)")
 _GIT_REVSPEC_RE = re.compile(r"^(?P<rev>[^:\s]+):(?P<path>[^:\s]+)$")
 _GIT_CMD_RE = re.compile(r"^\s*(?:[\w.\-]*[/\\])?git(?:\.exe)?\b", re.IGNORECASE)
 
+# Where one command ends and the next begins. Anchoring "is this git?" to the
+# start of the whole string was wrong in the most ordinary way possible:
+# `cd /repo && git show origin/main:pyproject.toml` starts with `cd`, so the
+# revspec rewrite never fired for the shape people actually type. Caught by a
+# live probe after release, not by the unit tests — which passed the command as
+# `git show …` because that is how the test author writes it, not how a shell
+# call arrives.
+_SEGMENT_SPLIT = re.compile(r"&&|\|\||[;|\n]")
+
+# `cd <dir>` — the segment that moves the ground under every later one. Handles
+# a quoted target, since project paths on this platform contain spaces, and the
+# Windows `/d` flag.
+_CD_RE = re.compile(
+    r"""^\s*cd\s+(?:/d\s+)?(?P<dir>"[^"]+"|'[^']+'|\S+)\s*$""",
+    re.IGNORECASE,
+)
+
 
 def _is_network_token(tok: str) -> bool:
     """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling."""
@@ -190,6 +208,20 @@ def _target(tool_input: dict) -> str:
     )
 
 
+def _cd_target(segment: str, cwd: str) -> str | None:
+    """The directory a `cd` segment moves to, resolved against ``cwd``."""
+    m = _CD_RE.match(segment or "")
+    if not m:
+        return None
+    target = m.group("dir").strip("\"'")
+    if not target or target.startswith("-"):
+        return None
+    try:
+        return os.path.abspath(os.path.join(cwd, os.path.expanduser(target)))
+    except (OSError, ValueError):
+        return None
+
+
 def _scan_shell(cmd: str, base: str):
     """(denial, token) for the first confident deny-rule hit, else (None, '').
 
@@ -201,44 +233,78 @@ def _scan_shell(cmd: str, base: str):
     outright, as are URLs and IPv6 literals: all of them trip the ADS spelling
     check, which is exempt from existence-gating, so a token naming nothing on
     disk would otherwise hard-deny (#50).
+
+    Scanning is per **command segment**, not per whole string. A segment is what
+    sits between `&&`, `||`, `;`, `|` or a newline, and each one answers "am I a
+    git command?" for itself — so the revspec rewrite applies to the tokens of
+    the git segment and to no others. `cat notes.txt:hidden && git status` must
+    not have its first token reinterpreted just because a later segment is git.
     """
-    for raw in _TOKEN_SPLIT.split(cmd)[:_MAX_TOKENS]:
-        tok = raw.strip("\"'`;,()")
-        if not tok or tok.startswith("-"):
-            continue
-        if "/" not in tok and "\\" not in tok and not tok.startswith("."):
-            continue
-        # Order matters only for readability: a URL is also syntax-free, so
-        # either check alone would skip 'https://x'. Both are kept because they
-        # answer different questions — "is this a network literal" and "is this
-        # a path at all" — and the second is the one that generalizes.
-        if not _looks_like_a_path(tok) or _is_network_token(tok):
-            continue
-        # `tests/x.py::TestThing` is a node id, not a stream spelling.
-        if _is_scope_token(tok):
-            continue
-        # `git show <rev>:<path>` — judge the PATH, not the whole token. This
-        # is the one place the scan rewrites what it checks rather than skipping
-        # it, because skipping would let `git show HEAD:.env` through.
-        revspec_path = _git_revspec_path(cmd, tok)
-        from_revspec = revspec_path is not None
-        if from_revspec:
-            tok = revspec_path
-        if re.match(r"^/[a-z]/", tok):  # MSYS /c/foo → C:/foo
-            tok = f"{tok[1]}:{tok[2:]}"
-        denial = ag.check(tok, "read", base)
-        if denial and denial.kind == "deny":
-            try:
-                p = Path(tok)
-                exists = (p if p.is_absolute() else Path(base) / p).exists()
-            except OSError:
-                exists = False
-            # A revspec names a path in HISTORY, so the working tree is the
-            # wrong place to ask whether it is real. `git show HEAD~5:.env`
-            # reads a denied file whether or not that file exists today, and
-            # existence-gating it would be a hole this rewrite opened.
-            if exists or from_revspec or denial.rule.startswith("<"):
-                return denial, tok
+    budget = _MAX_TOKENS
+    cwd = base
+    for segment in _SEGMENT_SPLIT.split(cmd or ""):
+        if budget <= 0:
+            break
+        is_git = bool(_GIT_CMD_RE.match(segment))
+        for raw in _TOKEN_SPLIT.split(segment)[:budget]:
+            budget -= 1
+            tok = raw.strip("\"'`;,()")
+            if not tok or tok.startswith("-"):
+                continue
+            # A revspec's path half need not contain a separator — `HEAD:.env`
+            # has none, so it used to be dropped here before any rule saw it.
+            if ("/" not in tok and "\\" not in tok and not tok.startswith(".")
+                    and not (is_git and _GIT_REVSPEC_RE.match(tok))):
+                continue
+            # Order matters only for readability: a URL is also syntax-free, so
+            # either check alone would skip 'https://x'. Both are kept because
+            # they answer different questions — "is this a network literal" and
+            # "is this a path at all" — and the second is the one that
+            # generalizes.
+            if not _looks_like_a_path(tok) or _is_network_token(tok):
+                continue
+            # `tests/x.py::TestThing` is a node id, not a stream spelling.
+            if _is_scope_token(tok):
+                continue
+            # `git show <rev>:<path>` — judge the PATH, not the whole token.
+            # This is the one place the scan rewrites what it checks rather than
+            # skipping it, because skipping would let `git show HEAD:.env`
+            # through.
+            revspec_path = _git_revspec_path(segment, tok) if is_git else None
+            from_revspec = revspec_path is not None
+            if from_revspec:
+                tok = revspec_path
+            if re.match(r"^/[a-z]/", tok):  # MSYS /c/foo → C:/foo
+                tok = f"{tok[1]}:{tok[2:]}"
+            # Resolve against the cwd the command will actually run in, not the
+            # session root. `cd /elsewhere && cat .env` used to compute the
+            # denial correctly and then throw it away, because the existence
+            # gate looked for `.env` under the project root where it does not
+            # live (#82). The rule base stays `base` — policy is the project's;
+            # only the path being judged follows the shell.
+            probe = tok
+            if not os.path.isabs(probe):
+                try:
+                    probe = os.path.join(cwd, probe)
+                except (OSError, ValueError):
+                    probe = tok
+            denial = ag.check(probe, "read", base)
+            if denial and denial.kind == "deny":
+                try:
+                    exists = Path(probe).exists()
+                except OSError:
+                    exists = False
+                # A revspec names a path in HISTORY, so the working tree is the
+                # wrong place to ask whether it is real. `git show HEAD~5:.env`
+                # reads a denied file whether or not that file exists today, and
+                # existence-gating it would be a hole this rewrite opened.
+                if exists or from_revspec or denial.rule.startswith("<"):
+                    return denial, tok
+        # AFTER the segment's own tokens: `cd x` moves the ground for what
+        # follows, not for its own argument.
+        moved = _cd_target(segment, cwd)
+        if moved is not None:
+            cwd = moved
     return None, ""
 
 

{code_context_control-2.76.2 → code_context_control-2.77.0/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.76.2
+Version: 2.77.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.76.2 → code_context_control-2.77.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-context-control"
-version = "2.76.2"
+version = "2.77.0"
 description = "Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub."
 readme = "README.md"
 requires-python = ">=3.10"

{code_context_control-2.76.2 → code_context_control-2.77.0}/tests/test_hook_access_guard.py

@@ -323,6 +323,144 @@ class TestShellScanSyntaxTokens(HookGuardBase):
         self.assertIsNotNone(denial)
         self.assertEqual(tok, "secrets/gone.txt")
 
+    def test_a_git_command_is_recognised_after_a_shell_separator(self):
+        """`cd /repo && git show <rev>:<path>` — the shape people actually type.
+
+        The first cut anchored "is this git?" to the start of the whole command
+        string, so a leading `cd` disabled the rewrite entirely. Every unit test
+        passed, because a test author writes the command as `git show …`. A live
+        probe after release is what caught it.
+        """
+        for cmd in (
+            "cd /tmp/repo && git show origin/main:pyproject.toml",
+            "git fetch -q; git show origin/main:pyproject.toml",
+            "cd x || git show HEAD:setup.py",
+        ):
+            with self.subTest(cmd=cmd):
+                denial, tok = hag._scan_shell(cmd, str(self.proj))
+                self.assertIsNone(denial, f"{cmd!r} denied on {tok!r}")
+
+    def test_a_denied_revspec_is_still_caught_after_a_separator(self):
+        denial, tok = hag._scan_shell(
+            f'cd "{self.proj}" && git show HEAD:secrets/key.txt', str(self.proj))
+        self.assertIsNotNone(denial)
+        self.assertEqual(tok, "secrets/key.txt")
+
+    def test_a_revspec_path_without_a_separator_now_reaches_the_rules(self):
+        """`HEAD:.env` — no slash, so the token gate used to drop it (#82).
+
+        It also never reached the ADS check, which is the claim #81's body got
+        wrong. It reaches the rules now, and the revspec bypass of the existence
+        gate is what makes the verdict right: a blob in history is denied
+        whether or not that file is in the working tree today.
+        """
+        denial, tok = hag._scan_shell(
+            "git show HEAD:.env", str(self.proj))
+        self.assertIsNotNone(denial)
+        self.assertEqual(tok, ".env")
+
+
+class TestShellScanFollowsCd(HookGuardBase):
+    """#82 — the scan judged paths against the session root, not the cwd.
+
+    `cd <elsewhere> && cat .env` computed the denial correctly and then threw it
+    away, because the existence gate looked for `.env` under the project root
+    where it does not live. The rule was never wrong; the question was asked
+    about the wrong directory.
+    """
+
+    def test_a_denied_file_read_after_cd_is_caught(self):
+        """The reported case, reproduced with the rule that made it reachable.
+
+        Session rooted in one directory, command `cd`-ing to another, and a
+        builtin `**/.env*` deny — builtin because it binds on any path, which is
+        why the live failure was a secret file rather than a project-scoped one.
+        Before this fix the denial was computed and then discarded, because the
+        existence gate looked under the session root.
+        """
+        (self.proj / ".env").write_text("SECRET=x", encoding="utf-8")
+        denial, _ = hag._scan_shell(
+            f'cd "{self.proj}" && cat .env', str(self.proj.parent))
+        self.assertIsNotNone(denial)
+        self.assertEqual(denial.rule, "**/.env*")
+
+    def test_cd_out_then_relative_back_in_is_caught(self):
+        denial, _ = hag._scan_shell(
+            f'cd "{self.proj.parent}" && cat {self.proj.name}/secrets/key.txt',
+            str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_cd_out_then_absolute_back_in_is_caught(self):
+        denial, _ = hag._scan_shell(
+            f'cd "{self.proj.parent}" && cat "{self.proj / "secrets/key.txt"}"',
+            str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_the_existence_gate_still_applies_at_the_new_cwd(self):
+        """Following the shell must not mean flagging files that are not there.
+
+        A `cd` into a directory without the file leaves nothing to read, and a
+        deny on nothing is the false positive this scanner keeps being fixed for.
+        """
+        denial, _ = hag._scan_shell(
+            f'cd "{self.proj.parent}" && cat secrets/key.txt', str(self.proj))
+        self.assertIsNone(denial)
+
+    def test_cd_moves_only_the_segments_after_it(self):
+        """`cat secrets/key.txt && cd /elsewhere` reads before it moves."""
+        denial, _ = hag._scan_shell(
+            "cat secrets/key.txt && cd /tmp", str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_a_quoted_cd_target_with_spaces_is_parsed(self):
+        spaced = self.proj / "a dir"
+        spaced.mkdir()
+        denial, _ = hag._scan_shell(
+            f'cd "{spaced}" && cat ../secrets/key.txt', str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_the_cd_target_itself_is_still_scanned(self):
+        """`cd` into a denied directory is itself a token worth refusing."""
+        denial, tok = hag._scan_shell(
+            f'cd "{self.proj / "secrets"}"', str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_a_bare_filename_is_still_out_of_scope(self):
+        """Stated rather than implied: the token gate is unchanged.
+
+        `cd <denied dir> && type key.txt` is caught only incidentally, by the
+        `cd` argument. A separator-free filename still never reaches the rules,
+        which is a known limit of the token gate and not what #82 was about.
+        """
+        self.assertIsNone(hag._cd_target("type key.txt", str(self.proj)))
+        denial, tok = hag._scan_shell(
+            f'cd "{self.proj / "secrets"}" && type key.txt', str(self.proj))
+        self.assertIsNotNone(denial)
+        self.assertNotIn("key.txt", tok)
+
+    def test_a_git_segment_does_not_license_rewrites_in_other_segments(self):
+        """Per-segment, not per-string: `cat a:b && git status` is two commands.
+
+        Attributing the whole string to git would let a non-git token be
+        reinterpreted — the scan would check `hidden` instead of the real
+        spelling, which is a hole rather than a false positive.
+        """
+        self.assertIsNone(
+            hag._git_revspec_path("cat ./notes.txt:hidden", "./notes.txt:hidden"))
+
+    @unittest.skipUnless(WIN, "NTFS ADS semantics")
+    def test_a_non_git_segment_beside_a_git_one_still_denies(self):
+        """The end-to-end half of the above, and Windows-only for a reason.
+
+        `<ads>` is an NTFS spelling rule, so on POSIX this command denies
+        nothing and the assertion would be about the platform rather than the
+        code. Shipping it undecorated turned six of nine CI jobs red — the
+        matrix caught in a minute what a Windows-only local run could not.
+        """
+        denial, _ = hag._scan_shell(
+            "cat ./secrets/key.txt:hidden && git status", str(self.proj))
+        self.assertIsNotNone(denial)
+
     def test_revspec_rewriting_only_applies_to_git(self):
         """`<word>:<word>` means something else in every other command."""
         path = hag._git_revspec_path("cat HEAD:secrets/key.txt", "HEAD:secrets/key.txt")