code-context-control 2.82.0__py3-none-any.whl → 2.85.0__py3-none-any.whl

cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.82.0"
+__version__ = "2.85.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -6055,6 +6055,15 @@ def _ci_main(args) -> int:
     from cli.tools.ci import handle_ci
 
     sub = getattr(args, "ci_cmd", None) or "inspect"
+    if sub == "publish":
+        if getattr(args, "dry_run", False):
+            args.job = "dry-run"
+        if getattr(args, "force", False):
+            args.allow_side_effects = True
+    if sub == "cache" and getattr(args, "clear", False):
+        # `--clear` is a flag on the CLI; the shared handler takes it
+        # positionally so both surfaces route through one code path.
+        args.job = "clear"
     project_path = getattr(args, "project_path", ".") or "."
     as_json = bool(getattr(args, "json", False))
 
@@ -6106,7 +6115,11 @@ def _ci_main(args) -> int:
         getattr(args, "event", "") or "",
         getattr(args, "engine", "auto") or "auto",
         bool(getattr(args, "allow_side_effects", False)),
-        getattr(args, "network", "") or "")
+        getattr(args, "network", "") or "",
+        "required" if getattr(args, "required", False) else "full",
+        getattr(args, "base", "") or "",
+        bool(getattr(args, "allow_host_mutation", False)),
+        bool(getattr(args, "no_cache", False)))
     print(out)
     # Exit code is the finding: a non-full verdict must not read as success to
     # a shell script or a pre-push hook.

cli/commands/parser.py

@@ -507,6 +507,17 @@ def build_parser(version: str, parse_cli_ide_arg):
     ci_run.add_argument("--allow-side-effects", action="store_true",
                         help="Let the act engine run jobs that look like they "
                              "publish or deploy. Refused by default.")
+    ci_run.add_argument("--required", action="store_true",
+                        help="Run only the jobs a change could have broken "
+                             "(conservative; see `c3 ci plan`)")
+    ci_run.add_argument("--base", default="",
+                        help="Diff against this ref instead of the working tree")
+    ci_run.add_argument("--allow-host-mutation", action="store_true",
+                        help="Permit native steps that reconfigure this machine "
+                             "(pip/npm -g/apt install). Refused by default.")
+    ci_run.add_argument("--no-cache", action="store_true",
+                        help="Ignore cached results and execute every "
+                             "selected job")
     ci_run.add_argument("--network", default="",
                         help="Container network for the act engine (e.g. `none` "
                              "to cut egress). Default: act's own.")
@@ -530,6 +541,22 @@ def build_parser(version: str, parse_cli_ide_arg):
     ci_logs.add_argument("--tail", type=int, default=200)
 
     _ci_common(ci_subs.add_parser("runs", help="Recent local CI runs"))
+    ci_plan = _ci_common(ci_subs.add_parser(
+        "plan", help="Show which jobs a change requires, and why"))
+    ci_plan.add_argument("--base", default="",
+                         help="Diff against this ref instead of the working tree")
+    ci_pub = _ci_common(ci_subs.add_parser(
+        "publish", help="Post the last run as a GitHub commit status"))
+    ci_pub.add_argument("--run", dest="run_id", default="")
+    ci_pub.add_argument("--dry-run", action="store_true")
+    ci_pub.add_argument("--force", action="store_true",
+                        help="Publish a PARTIAL result as `pending`")
+    _ci_common(ci_subs.add_parser(
+        "history", help="Per-job pass/fail history and flake detection"))
+    ci_cache_p = _ci_common(ci_subs.add_parser(
+        "cache", help="Cached-result store: size, or --clear it"))
+    ci_cache_p.add_argument("--clear", action="store_true",
+                            help="Drop every cached result and dependency cache")
     _ci_common(ci_subs.add_parser(
         "doctor", help="Which execution engines are available on this machine"))
 

cli/mcp_server.py

@@ -771,10 +771,25 @@ async def c3_ci(action: str = "inspect", job: str = "", run_id: str = "",
                 allow_foreign: bool = False, workflow: str = "",
                 tail: int = 200, timeout: int = 0, event: str = "",
                 engine: str = "auto", allow_side_effects: bool = False,
-                network: str = "", ctx: Context = None) -> str:
+                network: str = "", mode: str = "full", base: str = "",
+                allow_host_mutation: bool = False,
+                no_cache: bool = False, ctx: Context = None) -> str:
     """RUN THIS REPO'S REAL CI LOCALLY — before pushing, not after.
     Reads .github/workflows/*.yml as the source of truth (no second CI config).
-    actions: inspect | run | rerun | status | failures | logs | runs | doctor.
+    actions: inspect | plan | run | rerun | status | failures | logs | runs |
+      cache | history | publish | doctor. publish posts the last run as a
+      GitHub COMMIT STATUS via your gh auth; it refuses a dirty tree, an
+      unpushed commit, and (unless forced) a PARTIAL result. history reports per-job fail rates and
+      flags FLAKY jobs — ones that both passed and failed on identical
+      inputs, so the code cannot be the cause. A job whose inputs are unchanged since it last passed
+      is reused (status `cached`, nothing executed); no_cache forces it.
+    mode: full (default) | required. required runs only the jobs a change
+      could have broken; it is CONSERVATIVE — anything unmapped runs. Use
+      action='plan' to see the decision and reason for every job first.
+    allow_host_mutation: the NATIVE engine refuses steps that would
+      reconfigure this machine (pip/npm -g/apt/brew install...). It has no
+      isolation; running this repo's own CI natively once uninstalled C3.
+      Prefer engine='act'.
     inspect: workflows, the job DAG, and which jobs are runnable on THIS host.
     run: execute in dependency order; job='lint' or 'test (ubuntu-latest, 3.12)'
       selects one (bare job name = all its matrix cells). A job whose dependency
@@ -798,7 +813,9 @@ async def c3_ci(action: str = "inspect", job: str = "", run_id: str = "",
     return await asyncio.to_thread(handle_ci, action, job, run_id,
                                    allow_foreign, workflow, tail, timeout,
                                    svc, finalize, event, engine,
-                                   allow_side_effects, network)
+                                   allow_side_effects, network,
+                                   mode, base, allow_host_mutation,
+                                   no_cache)
 
 
 @mcp.tool()

cli/tools/ci.py

@@ -12,13 +12,14 @@ That distinction is the product.
 """
 from __future__ import annotations
 
+from services import ci_impact
 from services import ci_runner as cr
 from services.ci_workflow import inspect_project
 
 _MARK = {
     cr.PASSED: "PASS", cr.FAILED: "FAIL", cr.SKIPPED: "SKIP",
     cr.UNSUPPORTED: "UNSUP", cr.FOREIGN: "OTHER-OS", cr.TIMEOUT: "TIMEOUT",
-    cr.DESELECTED: "-",
+    cr.DESELECTED: "-", cr.CACHED: "CACHED",
 }
 
 # Verdicts an agent may treat as "safe to push". Deliberately one item long.
@@ -81,7 +82,10 @@ def _failure_rows(jobs: list, limit: int = 25) -> list:
 def handle_ci(action: str, job: str, run_id: str, allow_foreign: bool,
               workflow: str, tail: int, timeout: int, svc, finalize,
               event: str = "", engine: str = "auto",
-              allow_side_effects: bool = False, network: str = "") -> str:
+              allow_side_effects: bool = False, network: str = "",
+              mode: str = "full", base: str = "",
+              allow_host_mutation: bool = False,
+              no_cache: bool = False) -> str:
     """Route c3_ci actions."""
     project = str(svc.project_path)
     action = (action or "inspect").strip().lower()
@@ -152,6 +156,43 @@ def handle_ci(action: str, job: str, run_id: str, allow_foreign: bool,
         return finalize("c3_ci", args, "\n".join(lines),
                         f"{len(data['jobs'])} jobs, {len(data['runnable'])} runnable")
 
+    # ── plan (required mode, no execution) ───────────────────────────────
+    if action == "plan":
+        from services.ci_workflow import (
+            build_dag,
+            discover_workflows,
+            git_context,
+            parse_workflow,
+        )
+        wfs = [parse_workflow(p) for p in discover_workflows(project)]
+        dag = build_dag([w for w in wfs if not w.error],
+                        event=event, git=git_context(project))
+        try:
+            ordered = dag.topo_order()
+        except Exception:
+            ordered = dag.instances
+        plan = ci_impact.plan_required(project, ordered, wfs, base=base,
+                                       event=event)
+        lines = [
+            f"Required-mode plan ({len(plan.selected)} run / "
+            f"{len(plan.skipped)} skip) vs {base or 'the working tree'}",
+            f"changed files: {len(plan.changed)}",
+        ]
+        for path in plan.changed[:10]:
+            lines.append(f"  {path}")
+        if len(plan.changed) > 10:
+            lines.append(f"  ... and {len(plan.changed) - 10} more")
+        lines.append("")
+        for decision in plan.decisions:
+            mark = "RUN " if decision.decision == ci_impact.RUN else "skip"
+            lines.append(f"  {mark} {decision.job}")
+            lines.append(f"       {decision.reason}")
+        if plan.note:
+            lines.append(f"\n{plan.note}")
+        lines.append("\nRun it: c3_ci(action='run', mode='required')")
+        return finalize("c3_ci", args, "\n".join(lines),
+                        f"{len(plan.selected)} required")
+
     # ── run / rerun ──────────────────────────────────────────────────────
     if action in ("run", "rerun"):
         only = None
@@ -172,7 +213,9 @@ def handle_ci(action: str, job: str, run_id: str, allow_foreign: bool,
                            only=only, timeout=timeout or cr.DEFAULT_STEP_TIMEOUT,
                            workflow=workflow, event=event, engine=engine,
                            allow_side_effects=allow_side_effects,
-                           network=network)
+                           network=network, mode=mode, base=base,
+                           allow_host_mutation=allow_host_mutation,
+                           no_cache=no_cache)
         run = result.to_dict()
         lines = [_verdict_line(run), f"run {run['run_id']}  host={run['host_os']}"]
         fp = run.get("fingerprint") or {}
@@ -245,6 +288,86 @@ def handle_ci(action: str, job: str, run_id: str, allow_foreign: bool,
                          f"{row.get('started_at', '')[:19]}  {tally}")
         return finalize("c3_ci", args, "\n".join(lines), f"{len(rows)} runs")
 
+    # ── history / intelligence ───────────────────────────────────────────
+    if action in ("history", "intel", "flaky"):
+        from services import ci_intel
+        data = ci_intel.analyse(project)
+        if not data["runs_analysed"]:
+            return finalize("c3_ci", args, data["note"], "no history")
+        lines = [data["note"], ""]
+        if data["flaky"]:
+            lines.append("FLAKY — passed AND failed on identical inputs:")
+            for job in data["flaky"]:
+                lines.append(f"  {job['key']}  {job['failed']}/{job['executed']} failed")
+                lines.append("      same fingerprint gave both answers, so the "
+                             "code did not change between them")
+            lines.append("")
+        lines.append(f"{'job':<40}{'exec':>5}{'fail':>6}{'rate':>7}{'avg':>8}")
+        for job in data["jobs"][:15]:
+            rate = f"{job['fail_rate']:.0%}" if job["executed"] else "-"
+            avg = f"{job['avg_ms'] / 1000:.1f}s" if job["avg_ms"] else "-"
+            mark = "" if job["confident"] else "  (low n)"
+            lines.append(f"  {job['key']:<38}{job['executed']:>5}"
+                         f"{job['failed']:>6}{rate:>7}{avg:>8}{mark}")
+        if data["slowest"]:
+            lines.append("\nSlowest: " + ", ".join(
+                f"{j['key']} {j['avg_ms'] / 1000:.1f}s" for j in data["slowest"][:3]))
+        return finalize("c3_ci", args, "\n".join(lines),
+                        f"{len(data['flaky'])} flaky")
+
+    # ── publish (GitHub commit status) ───────────────────────────────────
+    if action == "publish":
+        from services import ci_github
+        run = cr.load_run(project, run_id)
+        if not run:
+            return finalize("c3_ci", args, "No run to publish.", "no runs")
+        res = ci_github.publish(project, run,
+                                force=allow_side_effects,
+                                dry_run=(job or "").lower() == "dry-run")
+        if res.get("dry_run"):
+            body = "\n".join([
+                f"Would POST {res['endpoint']}",
+                f"  state={res['state']}",
+                f"  {res['description']}",
+            ])
+            return finalize("c3_ci", args, body, "dry run")
+        if not res.get("published"):
+            return finalize("c3_ci", args,
+                            f"Not published: {res.get('reason')}", "refused")
+        body = (f"Published {res['state']} to {res['sha'][:8]} "
+                f"as {res['context']}.\n  {res['description']}")
+        return finalize("c3_ci", args, body, res["state"])
+
+    # ── cache ────────────────────────────────────────────────────────────
+    if action == "cache":
+        from services import ci_cache
+        if (job or "").strip().lower() == "clear" or run_id == "clear":
+            freed = ci_cache.clear(project)
+            return finalize("c3_ci", args,
+                            f"Cleared the CI cache ({freed / 1024:.0f} KB).",
+                            "cache cleared")
+        info = ci_cache.stats(project)
+        rules = ci_impact.load_rules(project)
+        lines = [
+            f"Cached results: {info['results']}",
+            f"Dependency cache keys: {info['dependency_keys']}",
+            f"Location: {info['dir']}",
+            "",
+            "A job is reused when its definition, engine and inputs are all "
+            "unchanged since it last passed.",
+        ]
+        if rules:
+            lines.append(
+                f"{len(rules)} job(s) declare inputs via ci.required_map, so "
+                "only those paths invalidate them.")
+        else:
+            lines.append(
+                "No ci.required_map: every job is fingerprinted over the whole "
+                "tree, so any edit invalidates every cached result. Declaring "
+                "inputs is what makes the cache bite.")
+        return finalize("c3_ci", args, "\n".join(lines),
+                        f"{info['results']} cached")
+
     # ── doctor ───────────────────────────────────────────────────────────
     if action == "doctor":
         from services import ci_act

{code_context_control-2.82.0.dist-info → code_context_control-2.85.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.82.0
+Version: 2.85.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.82.0.dist-info → code_context_control-2.85.0.dist-info}/RECORD

@@ -1,6 +1,6 @@
 cli/__init__.py,sha256=ec66drCZGNMRU4V6ov0zVhYZph1us12Vn8OvG_LJyRY,22
 cli/_hook_utils.py,sha256=bx8246vdJQ0eCsmDSx2nrSw19t0MI1tde76SZr0uuCo,19168
-cli/c3.py,sha256=5sAcJUntM7JliLwZWr1NkdP_3Li-cSocJVxIhIUyWdE,372641
+cli/c3.py,sha256=cdpKnoQymVSrAgNs9I9VoGb5mvonS3rbWEUVOhsW2hE,373267
 cli/docs.html,sha256=X9M7qC7LWi8pPJNF-4yEM57jhuZ3WeTESECbdDOeNaA,143172
 cli/edits.html,sha256=UjAhoCmBmQ89cklGvJqzC6eyNP2tc8H6T-e01DVkLvE,43418
 cli/hook_access_guard.py,sha256=UGXZ6-3gVNxjVasAuCV9eUOBwqDHl3YnuDc3XVTpvL0,15942
@@ -21,7 +21,7 @@ cli/hook_terse_advisor.py,sha256=W_zaTfX2akgX-ifuUTsLu2H1atM8XmWt6jpPoeU7Pm0,625
 cli/hub_server.py,sha256=Wqq6LenxvMLnJ93NX64Yx6UJcOFGyJngUq2IXoA-5Uw,145557
 cli/hub_ui.html,sha256=nnGqWhWGCLfNisGUnoAlQFcBr6wPNsq-AEOR7uFtVkE,2942
 cli/mcp_proxy.py,sha256=92htuT-p0j-cDTbyqlIJpGoQ85_Aw7UuB8L_Toi_u20,17511
-cli/mcp_server.py,sha256=Kl-5opUI0LeBdbt1mBng4rVGlpO4-qoYXrSEEM2heLQ,51225
+cli/mcp_server.py,sha256=7XenAdF-gKbP4KlHEzTy8PpWpRhRTR_F_nKXxpNeZjU,52424
 cli/progress.py,sha256=qTkNy0howOD3hXraMo4ok3dYTpBW5yG_tenKfF4UDM0,1470
 cli/server.py,sha256=xJ0bGyY5V7hSyNl6wZycwJYt8ug5N_kbsxOihXvHlS0,165450
 cli/ui.html,sha256=xcdt74nlFEXx-0Bx6-Okw-WSVZPAXL0iukxU0ytI6CA,5694
@@ -29,7 +29,7 @@ cli/ui_legacy.html,sha256=cI8tC6RKmE2NIJOcsu7CY-zT4VznjcbD6NTjxb_fvUY,378460
 cli/ui_nano.html,sha256=UAwQ6bbTOXAoGq191AZ7slhngR9edJSa3IhqpynveDg,27740
 cli/commands/__init__.py,sha256=0Z8MABNzwSFJGT4Xv9R5AJVR8XxraTsuVTz5b0bShmo,38
 cli/commands/common.py,sha256=eh9x6r3E2k7qf_ZFFBbsBZ4wh5q7Z3bR4RWp3jcAk-Y,13340
-cli/commands/parser.py,sha256=YD8xpVkC5XyTEIt8bVB3hNMtY807zw2b7JLBEm_ZKvk,52414
+cli/commands/parser.py,sha256=jhRYDP4-0BNOC1k_Jk_u_wzkKbBdMJ4IEWGQHdyFveo,54118
 cli/guide/access.html,sha256=BelnEc4p7XgcH_ysTlMXL9ZHCD0O4CPLq3h5rvqPIh8,14790
 cli/guide/bitbucket.html,sha256=G6xzhN0zFFfZJ3PuNoCiLkxQHl4xFayfHaZeN60WUhA,33606
 cli/guide/credentials.html,sha256=ZRv5NwWFxPoI6rQH3VbGCKA67B2DHGUoyH-5eO2iKb8,36576
@@ -72,7 +72,7 @@ cli/tools/_helpers.py,sha256=Yo_ol8bFT2R5ayjT54pXLVZhW_PgpBVoM8I7pDoomCI,7823
 cli/tools/agent.py,sha256=Fp9XLrOqjSP7_Ihq7VXjYXcGoXjw17-Hx3JMvoOVnhc,48105
 cli/tools/artifacts.py,sha256=LkSdjRz1TuYSFD1H_GSsxvhXOogaMt_JMbOnmkLOSUU,7784
 cli/tools/bitbucket.py,sha256=_hgORCW9-IF5xZJaznoONVfaTGKaX8VcU7ALrBeLhWo,27518
-cli/tools/ci.py,sha256=17O51h_09mKMpFpfQqbseyWeNbGU7NAbNQFWsRCC3Sk,13225
+cli/tools/ci.py,sha256=fQ03RENywS5gqHjH26Fa4YiraBTvchlPcPSnVYwwKBs,19444
 cli/tools/compress.py,sha256=IW2I2duAwj1Z2NPG7znX6rDcG3f83r5RvCVpR0yinmY,12881
 cli/tools/credentials.py,sha256=nUsunY09zXYAX-D5oEPD6B2WaWicMLJDNjjxbdce4gE,10566
 cli/tools/delegate.py,sha256=KXy4wZhex9HKixj9HVNIGKsHJHJwiPi6LAP3GRkZoxs,59469
@@ -114,7 +114,7 @@ cli/ui/components/sessions.js,sha256=FIKtil76B8tCkAmcFV7hlj6GQ_DCJK2jCzvEmdK7NBE
 cli/ui/components/settings.js,sha256=ATbAjBlVIwCNpxq7s191b49a_INQV38iwmySqtJLYwY,79066
 cli/ui/components/sidebar.js,sha256=K2ym2kUgpbyG-EBA_wBIIiqQY8qTatsiBZwzseMWuIQ,9939
 cli/ui/components/tasks.js,sha256=vyKQ3uwoppMwvdEaHlhWXW4oWcAisx4NveqzMhsYqHo,38438
-code_context_control-2.82.0.dist-info/licenses/LICENSE,sha256=l8Kh5QCNWNvR6kIt8L0BUZvc2LAFiHv2c-FnsGnUZf4,11301
+code_context_control-2.85.0.dist-info/licenses/LICENSE,sha256=l8Kh5QCNWNvR6kIt8L0BUZvc2LAFiHv2c-FnsGnUZf4,11301
 core/__init__.py,sha256=TSDCEcM4V7gcZVM3w2ykJaqEUch4Dkon-rivV17T73s,2501
 core/config.py,sha256=YmkcZwedz_lfDM0ZuI_f4xpe98ixPLcSQFcTCHgRiRg,19206
 core/ide.py,sha256=V6VVMVsFdmmcsMyxikjQp7z9xa42CWiHKS-ya-MAcG4,6172
@@ -177,11 +177,15 @@ services/auto_memory.py,sha256=LAQZtz5qbnn5FSw8hapO9kwbhqLpnQi70IWdNoNQ1V0,15258
 services/benchmark_dashboard.py,sha256=iR-DnqnoKbqHMJ4d-ZkIvJBYfzwTa7r-jzO6j2BYDfQ,27711
 services/bitbucket_client.py,sha256=JByovvtVZ6F4NcU611KVuTgKlT1rIsX2A2VlBDfvRV8,17509
 services/bitbucket_credentials.py,sha256=2qLA9pQMol4y95y4DJMNBsBBPUsJQCKbLFo2iiCnfvI,7364
-services/ci_act.py,sha256=v18c-meAcquFDsrGSM0z9kUGDKgGXQr5DyPQdn0i5DY,11387
+services/ci_act.py,sha256=fLcDsToaVbWmCDwWNOG7tgMWGvYKy09coa0HlBs1dak,13291
+services/ci_cache.py,sha256=Too3XyeE-oeiqQm4IJ10giFvhIEr29YfDLUpZDl8SBU,13256
 services/ci_expr.py,sha256=BsCUoL4ZN1Q8KjYJ07xWsPynV04Q8dg-ryIIKNOYk70,15641
 services/ci_failures.py,sha256=32aJ_R5S-JE4fErhzs06ZQzhBVLawZ4brtXtdoJrnE0,8087
-services/ci_runner.py,sha256=TxSPawHa08CE4rOg5eFDZGMI3VIqjQFj8IEH6yB7Dxw,33839
-services/ci_workflow.py,sha256=RRHGUUrbMPsJS-zNp4rmEkFEDGtcDJpdwJ0KB-Fn5gc,31123
+services/ci_github.py,sha256=2yXsVAiWMIvhxH7xsMJIO_3DxCvZbKJcSWt4zXyyWxE,6699
+services/ci_impact.py,sha256=9_CJv2sNza0_qW7cSsMnxhJy_AGflDONjL9jKQeoWmc,10966
+services/ci_intel.py,sha256=frr1jL-FXU_JNUoRW8TwnZo04fqUElAGGEsDEvgIeUs,7161
+services/ci_runner.py,sha256=egkFGaOjAa45KIMFbGX7108R2wUQwUuLgJ4Iq7ygx9I,40768
+services/ci_workflow.py,sha256=xfeUvzcm9GHiDdi7QAbg4SAvnzzuCCV3bmwdAMUTZKA,31133
 services/circuit_breaker.py,sha256=ES6PpjL40gfDhtK88GeS6GFzsz5EOEEkZsB-DzX_tbw,3179
 services/claude_md.py,sha256=WK2HsUxgYsDHFEWxxrA1GPyY9JLEkc_6vJkH_MQO2jU,51629
 services/compressor.py,sha256=1K6LzOt7Qg3F50YJAFs2xky_jlrctDf2OqHQQoGuQGU,36022
@@ -272,8 +276,8 @@ tui/screens/search_view.py,sha256=MMHjVdlk3HZSuDBSvq8IGrqv_Mh5Us6YqXQ80bcWSMk,19
 tui/screens/session_view.py,sha256=eZ1eDwHTvPOck1wCCviixtOaCxIkBT_95ytNNNriGNA,5991
 tui/screens/stats.py,sha256=p81PjzdaIv7hllb8f45-rlVe4lJZwSdIMqu7e86_u5s,6223
 tui/screens/ui_view.py,sha256=1QJCgLh2YfgWIpvzRG1KOGXYEaOYX6ojN61Azjf2oX0,2125
-code_context_control-2.82.0.dist-info/METADATA,sha256=TxYE7P24HDT9sYkz59TuE9i96nllsaCc7J2STlALGLA,25825
-code_context_control-2.82.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-code_context_control-2.82.0.dist-info/entry_points.txt,sha256=7kX_WUsDCF2hbXzvbNyscyaBb9AeA-DJY5v_5hN0DlU,93
-code_context_control-2.82.0.dist-info/top_level.txt,sha256=wRt41zBybVF3qAiNXHz9BURbkKvUvfhmWWtKMhaw6eE,29
-code_context_control-2.82.0.dist-info/RECORD,,
+code_context_control-2.85.0.dist-info/METADATA,sha256=kiLaxzH8a0HhMA8YE8uUjQF3Jxb1ARn6-cN6FlR9ofQ,25825
+code_context_control-2.85.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+code_context_control-2.85.0.dist-info/entry_points.txt,sha256=7kX_WUsDCF2hbXzvbNyscyaBb9AeA-DJY5v_5hN0DlU,93
+code_context_control-2.85.0.dist-info/top_level.txt,sha256=wRt41zBybVF3qAiNXHz9BURbkKvUvfhmWWtKMhaw6eE,29
+code_context_control-2.85.0.dist-info/RECORD,,

services/ci_act.py

@@ -154,6 +154,42 @@ def side_effects(inst) -> list:
     return found
 
 
+# ── Host-mutation gate (native engine only) ─────────────────────────────────
+# Learned the hard way, on this repository. A required-mode run selected every
+# job and the native engine executed C3's own `test` job, whose steps are
+# `python -m pip install -e ".[dev]"`. That uninstalled the copied C3 from
+# site-packages and replaced it with an editable install pointing at the repo;
+# the run then timed out mid-write and left the package — and every project's
+# hooks — broken.
+#
+# The native engine has no isolation: a `run:` step executes as the user, on
+# the user's machine, against the user's interpreter. Most CI jobs begin by
+# installing dependencies, so "run the repo's real CI natively" means "let a
+# YAML file reconfigure this machine". Under act the same step is contained and
+# harmless, which is why the refusal points there rather than just saying no.
+_HOST_MUTATION = re.compile(
+    r"(?:^|[\s;&|])(?:"
+    r"pip\s+(?:install|uninstall)|pip3\s+(?:install|uninstall)"
+    r"|python\s+-m\s+pip\s+(?:install|uninstall)"
+    r"|npm\s+(?:i|install)\s+(?:-g|--global)|npm\s+uninstall\s+(?:-g|--global)"
+    r"|yarn\s+global\s+add|pnpm\s+add\s+(?:-g|--global)"
+    r"|apt(?:-get)?\s+(?:install|remove|purge)|yum\s+install|dnf\s+install"
+    r"|brew\s+(?:install|uninstall)|choco\s+install|winget\s+install"
+    r"|cargo\s+install|go\s+install|gem\s+install"
+    r"|rustup\s|nvm\s+install|conda\s+(?:install|remove)"
+    r")\b", re.IGNORECASE)
+
+
+def host_mutations(inst) -> list:
+    """Steps that would reconfigure THIS machine if run without a container."""
+    found: list = []
+    for step in getattr(inst, "steps", []):
+        match = _HOST_MUTATION.search(str(getattr(step, "run", "") or ""))
+        if match:
+            found.append(f"step {step.index} runs `{match.group(0).strip()}`")
+    return found
+
+
 # ── Command construction ────────────────────────────────────────────────────
 
 def build_command(inst, project, act_path: str, event: str = "",