code-context-control 2.85.0__py3-none-any.whl → 2.86.0__py3-none-any.whl

cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.85.0"
+__version__ = "2.86.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -5535,6 +5535,14 @@ def cmd_install_mcp(args):
     except Exception as e:
         print(f"Warning: Could not update global CLAUDE.md: {e}")
 
+    # ── Default Access Guard rules (first run only) ─────────────
+    from services import access_guard
+    seeded = access_guard.seed_default_global_rules()
+    if seeded.get("seeded"):
+        rules = ", ".join(seeded["rules"])
+        print(f"Seeded default Access Guard deny rules into global scope: {rules}")
+        print("  (remove with: c3 access remove <glob> --kind deny --global)")
+
     # ── Install /terse skill for supported IDEs ──────────────────
     if profile.name in ("claude-code", "codex"):
         try:
@@ -6603,6 +6611,16 @@ def _override_audit(grant: dict, project_path: str) -> None:
 
 def cmd_access(args):
     """Access Guard rule management — human-only mutation surface (spec §1)."""
+    from services import access_guard
+
+    # First `c3 access` touch seeds the removable defaults (spec §1). A
+    # no-op forever after: any existing access section, even an emptied
+    # one, means the user has taken over the scope.
+    seeded = access_guard.seed_default_global_rules()
+    if seeded.get("seeded"):
+        print(f"[seeded] default global deny rules: {', '.join(seeded['rules'])}")
+        print("  Remove any of them: c3 access remove <glob> --kind deny --global\n")
+
     sub = getattr(args, "access_cmd", None)
     if not sub:
         print("Usage: c3 access {list,add,remove,check,stats,mask,builtin} [args]")

cli/hook_access_guard.py

@@ -41,7 +41,24 @@ _MAX_TOKENS = 200
 # "NTFS alternate data stream". The ADS check stays strict for real path
 # arguments (_WRITE_TOOLS/_READ_TOOLS); here it only produced false denies on
 # commit messages, curl, and gh (#50).
-_SCHEME_RE = re.compile(r"^[a-z][a-z0-9+.\-]*://", re.IGNORECASE)
+#
+# UNANCHORED, and that is the fix rather than an oversight. `^…://` only ever
+# recognised a token that BEGINS with a scheme, which is the same
+# whitelist-a-shape mistake #50 made and this module's own header calls out —
+# and the `_SYNTAX_CHARS` generalisation does not cover the gap, because a
+# token can carry a URL and no syntax at all. Observed 2026-08-11: the single
+# argument of
+#     printf '\n---\n\nhttps://claude.ai/code/session_01Hs28…\n' >> body.md
+# strips to `\n---\n\nhttps://claude.ai/…`, which has a separator (`\` and
+# `/`), no syntax characters, no `::`, and no leading scheme. It reached
+# ag.check, canonicalised to a residual colon, and hard-denied a command whose
+# only file argument was an ordinary markdown path. Third logged instance of
+# this class in five days (two on 2026-08-07 were Windows paths inside Python
+# string literals).
+#
+# A token containing `://` anywhere is a network literal, not an NTFS stream:
+# a real stream is `file:name:$TYPE`, and no spelling of it contains `//`.
+_SCHEME_RE = re.compile(r"[a-z][a-z0-9+.\-]*://", re.IGNORECASE)
 # IPv6 literal or CIDR: >=2 colons, hex groups only, optional [] and /prefix.
 # 'C:/x/f.txt:stream' has one colon and non-hex parts, so it never matches.
 _IPV6_RE = re.compile(
@@ -104,8 +121,13 @@ _CD_RE = re.compile(
 
 
 def _is_network_token(tok: str) -> bool:
-    """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling."""
-    return bool(_SCHEME_RE.match(tok) or _IPV6_RE.match(tok))
+    """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling.
+
+    ``search`` for the scheme (a URL anywhere in the token disqualifies it as
+    a path), ``match`` for IPv6 — that pattern is a whole-token shape and
+    anchoring is what keeps `C:/x/f.txt:stream` from matching it.
+    """
+    return bool(_SCHEME_RE.search(tok) or _IPV6_RE.match(tok))
 
 
 def _is_scope_token(tok: str) -> bool:

cli/hub_server.py

@@ -2740,6 +2740,20 @@ def api_pm_milestone():
         return jsonify({"error": "id is required"}), 400
 
     if request.method == "PUT":
+        # {complete: true} / {reopen: true} switch lifecycle; tasks keep
+        # their milestone link (unlike DELETE = archive + detach).
+        if data.get("complete"):
+            res = store.complete_milestone(ms_id)
+            if "error" in res:
+                return jsonify(res), 400
+            _pm_audit(resolved, "milestone", "complete", res["id"])
+            return jsonify({"completed": True, "milestone": res})
+        if data.get("reopen"):
+            res = store.reopen_milestone(ms_id)
+            if "error" in res:
+                return jsonify(res), 400
+            _pm_audit(resolved, "milestone", "reopen", res["id"])
+            return jsonify({"reopened": True, "milestone": res})
         res = store.update_milestone(ms_id, expected_rev=data.get("expected_rev"),
                                      **(data.get("fields") or {}))
         if "error" in res:

cli/mcp_server.py

@@ -1105,7 +1105,9 @@ async def c3_task(
     Time: time_add (minutes 1-1440 [+note/due_date=date/task_id]), time_update / time_delete (ref=entry id),
       time_list (manual entries + recent auto sessions), time_summary (today/7d/30d, auto vs manual).
       Auto-tracking: server startup + tool calls ping .c3/time; idle gaps >15min close a session.
-    Milestones: milestone_add (name [+target_date]), milestone_update, milestone_list (with progress %), milestone_archive.
+    Milestones: milestone_add (name [+target_date]), milestone_update, milestone_list (with progress %),
+      milestone_complete (close a shipped milestone; refuses while open tasks remain; tasks KEEP their link),
+      milestone_reopen (undo complete), milestone_archive (removal: detaches tasks).
     Notes: note_add (note [+kind=decision] [+task_id]), note_list.
     History: history ([+task_id] [+limit]) — append-only event log (who/what/when, before->after), newest first.
     task_id accepts any unique id prefix (>=4 chars); milestone accepts id or unique name.

cli/server.py

@@ -1295,6 +1295,20 @@ def api_pm_milestone():
     if not ms_id:
         return jsonify({"error": "id is required"}), 400
     if request.method == "PUT":
+        # {complete: true} / {reopen: true} switch lifecycle; tasks keep
+        # their milestone link (unlike DELETE = archive + detach).
+        if data.get("complete"):
+            res = store.complete_milestone(ms_id)
+            if "error" in res:
+                return jsonify(res), 400
+            _pm_audit("milestone", "complete", res["id"])
+            return jsonify({"completed": True, "milestone": res})
+        if data.get("reopen"):
+            res = store.reopen_milestone(ms_id)
+            if "error" in res:
+                return jsonify(res), 400
+            _pm_audit("milestone", "reopen", res["id"])
+            return jsonify({"reopened": True, "milestone": res})
         res = store.update_milestone(ms_id, expected_rev=data.get("expected_rev"),
                                      **(data.get("fields") or {}))
         if "error" in res:

cli/tools/shell.py

@@ -69,6 +69,45 @@ _SOFT_WARN = re.compile(
 
 _DEFAULT_TIMEOUT = 60
 _MAX_TIMEOUT = 600
+
+# The transport's own ceiling, and the reason _MAX_TIMEOUT alone is a lie.
+#
+# An MCP client kills a tool call at MCP_TOOL_TIMEOUT (Claude Code ships
+# 120_000 ms and the value is set per-environment) — a limit this process does
+# not choose and cannot raise. Until this existed, `c3_shell(timeout=600)` was
+# accepted, clamped to 600, and then killed by the client at 120s with the
+# subprocess still running: the caller saw the call "moved to background" and
+# then fail, with no line anywhere naming the real limit or attributing the
+# kill. The subprocess was NOT reaped by us, because our own deadline never
+# arrived.
+#
+# The cost was not hypothetical. Two Higgsfield image generations (2-4 min
+# each) were requested at timeout=420, killed at 120s, and the remote jobs
+# completed and were BILLED while the local process died before downloading —
+# one image landed, one was paid for and stranded.
+#
+# So: discover the client's ceiling, run just inside it, and SAY SO. Running
+# inside it means OUR deadline fires first, which turns a phantom
+# client-side kill into an ordinary `[c3_shell:TIMEOUT]` with stdout, a
+# duration, and a process tree we actually killed.
+_TRANSPORT_MARGIN_S = 5
+
+
+def _transport_ceiling_s() -> int | None:
+    """Seconds this call may run before the MCP client kills it, if knowable.
+
+    None when the variable is unset or unparseable — then nothing is capped
+    and behaviour is exactly what it was, because a guess here would cap
+    legitimate work on a client with no such limit.
+    """
+    raw = (os.environ.get("MCP_TOOL_TIMEOUT") or "").strip()
+    if not raw:
+        return None
+    try:
+        ceiling = int(float(raw)) // 1000
+    except (TypeError, ValueError):
+        return None
+    return ceiling if ceiling > _TRANSPORT_MARGIN_S else None
 _FILTER_THRESHOLD_LINES = 30
 _JQ_INVOCATION = re.compile(r"(?:^|&&|\|\||[;|(])\s*jq(?:\s|$)", re.IGNORECASE)
 
@@ -468,6 +507,13 @@ async def handle_shell(cmd: str, cwd: str, timeout: int, filter_output: bool,
         )
 
     timeout = max(1, min(int(timeout or _DEFAULT_TIMEOUT), _MAX_TIMEOUT))
+    # Cap to what the transport will actually allow, and remember that we did
+    # so — the caller asked for a number, and a number quietly not honoured is
+    # the whole defect (see _transport_ceiling_s).
+    capped_from = 0
+    _ceiling = _transport_ceiling_s()
+    if _ceiling is not None and timeout > _ceiling - _TRANSPORT_MARGIN_S:
+        capped_from, timeout = timeout, _ceiling - _TRANSPORT_MARGIN_S
     work_cwd = cwd or svc.project_path
     work_cwd = str(Path(work_cwd).resolve())
 
@@ -601,6 +647,16 @@ async def handle_shell(cmd: str, cwd: str, timeout: int, filter_output: bool,
     warn = ""
     if _SOFT_WARN.search(cmd):
         warn = "[c3_shell:warn] destructive pattern detected — verify before re-running\n"
+    if capped_from:
+        # Named at the moment of the mistake, not in documentation nobody
+        # reads at the moment they need it. The alternative IS the escape
+        # hatch, so the line says which one.
+        warn += (
+            f"[c3_shell:capped] timeout={capped_from}s was requested but this "
+            f"MCP client kills a tool call at {_ceiling}s; ran with {timeout}s. "
+            f"For longer work use the native Bash tool with "
+            f"run_in_background, which is not bound by this limit.\n"
+        )
 
     if result["timed_out"]:
         status = "TIMEOUT"

cli/tools/tasks.py

@@ -5,7 +5,8 @@ READ_ACTIONS = {"list", "get", "board", "history", "report",
 
 _TASK_ACTIONS = ("add, update, done, list, get, board, history, report, archive, "
                  "block, unblock, link, unlink, "
-                 "milestone_add, milestone_update, milestone_list, milestone_archive, "
+                 "milestone_add, milestone_update, milestone_list, "
+                 "milestone_complete, milestone_reopen, milestone_archive, "
                  "note_add, note_list, "
                  "time_add, time_update, time_delete, time_list, time_summary")
 
@@ -368,6 +369,26 @@ def handle_task(action, svc, finalize, *, title="", task_id="", status="",
             return done_resp(f"[task:error] {res['error']}", "error")
         return done_resp(f"[milestone:updated] {res['id'][:8]} \"{res['name']}\"", "updated")
 
+    if action == "milestone_complete":
+        if not milestone:
+            return done_resp("[task:error] milestone_complete requires milestone.", "error")
+        ms = store.resolve_milestone(milestone)
+        if ms is None:
+            return done_resp(f"[task:error] no milestone matches: {milestone}", "error")
+        res = store.complete_milestone(ms["id"])
+        if "error" in res:
+            return done_resp(f"[task:error] {res['error']}", "error")
+        return done_resp(f"[milestone:completed] \"{res['name']}\" "
+                         f"(tasks keep their milestone link)", "completed")
+
+    if action == "milestone_reopen":
+        if not milestone:
+            return done_resp("[task:error] milestone_reopen requires milestone.", "error")
+        res = store.reopen_milestone(milestone)
+        if "error" in res:
+            return done_resp(f"[task:error] {res['error']}", "error")
+        return done_resp(f"[milestone:reopened] \"{res['name']}\"", "reopened")
+
     if action == "milestone_archive":
         if not milestone:
             return done_resp("[task:error] milestone_archive requires milestone.", "error")

{code_context_control-2.85.0.dist-info → code_context_control-2.86.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.85.0
+Version: 2.86.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -178,7 +178,7 @@ Twelve tabs. The dashboard above shows token savings, indexed files, the live se
   <img src="https://raw.githubusercontent.com/drknowhow/code-context-control/main/docs/screenshots/2026-07/ui_tasks.png" alt="C3 Tasks" width="900">
 </p>
 
-**Tasks** (v2.45.0, extended v2.53.0) is a durable per-project tracker — dependencies and subtasks, milestones, decision notes, full event history, health reports, and both automatic and manual time tracking. It rolls up into the Hub's cross-project board.
+**Tasks** (v2.45.0, extended v2.53.0) is a durable per-project tracker — dependencies and subtasks, milestones, decision notes, full event history, health reports, and both automatic and manual time tracking. It rolls up into the Hub's cross-project board. Shipped milestones can be **completed** (v2.86.0) — they leave the board while their tasks keep the milestone link, unlike archiving, which detaches them.
 
 **Instructions** keeps your agent-facing docs in sync. C3-generated content sits inside a `<!-- C3:BEGIN … -->` block; anything you write outside it is preserved. Since v2.60.0 generated docs point at `.c3/MAP.md` — a machine-owned, byte-stable repo map C3 refreshes automatically — instead of embedding a tree that goes stale. `AGENTS.md` serves both Codex and Antigravity; `GEMINI.md` is read if present but no longer generated (the Gemini CLI profile was removed in v2.52).
 
@@ -243,6 +243,7 @@ c3 access mask activate                         # purge pre-mask artifacts, buil
 - **`deny` means deny-enumerate too** — denied paths never appear in search results, maps, or the vector index.
 - **Masked means read-only, always.** Cropped rows have no inverse, so an edit in transformed coordinates would corrupt the one file you protected.
 - **Four deterministic presets, no LLM in the read path:** `redact_secrets`, `redact_columns` (salted one-way pseudonyms — joins survive, no reverse dictionary), `sample_rows`, `signatures_only`.
+- **Sensible defaults out of the box** (v2.86.0). A fresh install seeds `*.pem`, `id_rsa*`, and `*.key` as deny rules in global scope — visible in `c3 access list` and removable like any rule you wrote yourself. Delete one and it stays deleted.
 - **Rule changes are human-only** (UI tab or CLI) and ledger-logged. Agents have no mutation surface.
 - **Built-ins can be switched off when you need to** (v2.65.0). `**/.env*`, `**/.c3/**`, `**/.claude/settings*.json` and `**/.git/**` yield to `c3 access builtin disable <glob>`, which makes you retype the glob first. It takes **two keys** — a config entry *and* a keyring attestation — so an agent that manages to write `config.json` still cannot grant itself write access to your settings. The credential vault stays absolute.
 - **Honest coverage.** This guards *cooperative* agents against mistakes and prompt injection. It is not a sandbox — a raw shell outside C3's tools still sees the real bytes.

{code_context_control-2.85.0.dist-info → code_context_control-2.86.0.dist-info}/RECORD

@@ -1,9 +1,9 @@
 cli/__init__.py,sha256=ec66drCZGNMRU4V6ov0zVhYZph1us12Vn8OvG_LJyRY,22
 cli/_hook_utils.py,sha256=bx8246vdJQ0eCsmDSx2nrSw19t0MI1tde76SZr0uuCo,19168
-cli/c3.py,sha256=cdpKnoQymVSrAgNs9I9VoGb5mvonS3rbWEUVOhsW2hE,373267
+cli/c3.py,sha256=AmXOVzrxuyHTY_aO4u9TF6-yQHgLN5UZfXAWR-7P6n8,374181
 cli/docs.html,sha256=X9M7qC7LWi8pPJNF-4yEM57jhuZ3WeTESECbdDOeNaA,143172
 cli/edits.html,sha256=UjAhoCmBmQ89cklGvJqzC6eyNP2tc8H6T-e01DVkLvE,43418
-cli/hook_access_guard.py,sha256=UGXZ6-3gVNxjVasAuCV9eUOBwqDHl3YnuDc3XVTpvL0,15942
+cli/hook_access_guard.py,sha256=4SIX-A4-tlXcOpzV4k5PZvyXibRvw9buqAV1-_doJpg,17200
 cli/hook_artifact.py,sha256=Se1CNBfoBFyvJQlRmYdNtdRXIkQp9zaF0O6ndRMo7ts,2198
 cli/hook_auto_snapshot.py,sha256=yGFqRANtw8qNqRNr-oCgpuyaUyTkSzIOFxXt5kauq4I,5271
 cli/hook_c3_signal.py,sha256=FPvs-9nD9ZiKA8r2tmusgj79yT9w9F173cRDKn-PYeI,2149
@@ -18,12 +18,12 @@ cli/hook_prompt_recall.py,sha256=LHyubu36pf5h3hbLBe0yH-yGhAlwLJdsc7hfa7WB1h4,347
 cli/hook_read.py,sha256=ZWZldgqGSNz78COhlgETQ7yxdOW5vWIIHUet9gZKhxk,8176
 cli/hook_session_stats.py,sha256=hZiX0r1SLOstu1PXvygWae0cIqHCcC3mb0SbFL6nCic,2083
 cli/hook_terse_advisor.py,sha256=W_zaTfX2akgX-ifuUTsLu2H1atM8XmWt6jpPoeU7Pm0,6252
-cli/hub_server.py,sha256=Wqq6LenxvMLnJ93NX64Yx6UJcOFGyJngUq2IXoA-5Uw,145557
+cli/hub_server.py,sha256=x8MABHxO3baScsuh9Tgyb_H_vE441RADkWacCce3j2I,146268
 cli/hub_ui.html,sha256=nnGqWhWGCLfNisGUnoAlQFcBr6wPNsq-AEOR7uFtVkE,2942
 cli/mcp_proxy.py,sha256=92htuT-p0j-cDTbyqlIJpGoQ85_Aw7UuB8L_Toi_u20,17511
-cli/mcp_server.py,sha256=7XenAdF-gKbP4KlHEzTy8PpWpRhRTR_F_nKXxpNeZjU,52424
+cli/mcp_server.py,sha256=FMpA1uE_nGexhpiUFms6jQH2FzZDk74bPQ4TuwxOH3E,52600
 cli/progress.py,sha256=qTkNy0howOD3hXraMo4ok3dYTpBW5yG_tenKfF4UDM0,1470
-cli/server.py,sha256=xJ0bGyY5V7hSyNl6wZycwJYt8ug5N_kbsxOihXvHlS0,165450
+cli/server.py,sha256=QiK20rocUC9vn0fF8J5WuqECocwKuQAzQKAYRDdrq_k,166141
 cli/ui.html,sha256=xcdt74nlFEXx-0Bx6-Okw-WSVZPAXL0iukxU0ytI6CA,5694
 cli/ui_legacy.html,sha256=cI8tC6RKmE2NIJOcsu7CY-zT4VznjcbD6NTjxb_fvUY,378460
 cli/ui_nano.html,sha256=UAwQ6bbTOXAoGq191AZ7slhngR9edJSa3IhqpynveDg,27740
@@ -90,9 +90,9 @@ cli/tools/project.py,sha256=-i6vf8v7AB2pMdguL-OhyaSvSyW36a3Izxw05dfMt2Q,20697
 cli/tools/read.py,sha256=sqTzn6FDaTQ3TFyP3J8fg61WemOsH-2oLIt19hmZXlI,16091
 cli/tools/search.py,sha256=cW0h5_yK7b1s3aqFKk3Z7nz4GSDhuJYDHdSXUH9uli0,17091
 cli/tools/session.py,sha256=ailQiRqXhi9NcBB3XS3Dv72GEkEZaYivB0bqDlhmgTA,5202
-cli/tools/shell.py,sha256=ZjBN_iID6oGSzjaZ19IAlFik4DP8M0JkD3nh4r0pRdE,26283
+cli/tools/shell.py,sha256=B5qq1LIRg8sHiaPwd5aFHorOAfTYR1Fzj4iqoh4YIUI,29033
 cli/tools/status.py,sha256=TRbiHVaDcrH96m5p1dMtbBlwGxTax3DcUih4dLs9CEw,16158
-cli/tools/tasks.py,sha256=kS0K73c6D5aaKGtarGI8XAYUjzPWBmIQqlsGGg5meJ4,20697
+cli/tools/tasks.py,sha256=MFOVHbzQAH4pd7rMTmUFiAlaVaTZAlEUxXL9Fyk4oVI,21745
 cli/tools/validate.py,sha256=Y7-jMfelMeENJ3GExvC0qshfFmD6PE3aTfOJg8V_qtg,13847
 cli/ui/api.js,sha256=wSviW2AgkSUwLjjQCcgsLHuRYhE56Mkcr2q2xHNq08s,1815
 cli/ui/app.js,sha256=8QwyCxT_6nNqiFibKESA9vgW_s2bVWWKeHU4fFm-Szg,10169
@@ -114,7 +114,7 @@ cli/ui/components/sessions.js,sha256=FIKtil76B8tCkAmcFV7hlj6GQ_DCJK2jCzvEmdK7NBE
 cli/ui/components/settings.js,sha256=ATbAjBlVIwCNpxq7s191b49a_INQV38iwmySqtJLYwY,79066
 cli/ui/components/sidebar.js,sha256=K2ym2kUgpbyG-EBA_wBIIiqQY8qTatsiBZwzseMWuIQ,9939
 cli/ui/components/tasks.js,sha256=vyKQ3uwoppMwvdEaHlhWXW4oWcAisx4NveqzMhsYqHo,38438
-code_context_control-2.85.0.dist-info/licenses/LICENSE,sha256=l8Kh5QCNWNvR6kIt8L0BUZvc2LAFiHv2c-FnsGnUZf4,11301
+code_context_control-2.86.0.dist-info/licenses/LICENSE,sha256=l8Kh5QCNWNvR6kIt8L0BUZvc2LAFiHv2c-FnsGnUZf4,11301
 core/__init__.py,sha256=TSDCEcM4V7gcZVM3w2ykJaqEUch4Dkon-rivV17T73s,2501
 core/config.py,sha256=YmkcZwedz_lfDM0ZuI_f4xpe98ixPLcSQFcTCHgRiRg,19206
 core/ide.py,sha256=V6VVMVsFdmmcsMyxikjQp7z9xa42CWiHKS-ya-MAcG4,6172
@@ -140,7 +140,7 @@ oracle/services/insight_engine.py,sha256=lwcdXtjt3CSZLqHVpXx6SG5gDhZYUKwXt4Z8dGy
 oracle/services/local_session.py,sha256=51iKUPTM2C4kuk-rnHpjvuc688ofD6AzjTMrd_RYw6E,5263
 oracle/services/memory_reader.py,sha256=rSEmoIXQu2JkolHJIQWpn0piPJpyuf1KZvW_9liQwkU,3727
 oracle/services/memory_writer.py,sha256=hpvYsxjhl293jEjGcRKfjG5njUaAOXKqbmJaUu1WdUU,6997
-oracle/services/mobile_api.py,sha256=HLWGpsNT-U_esNynVvE-mG1VRJXqwkoaBAJx07JGfwc,115294
+oracle/services/mobile_api.py,sha256=lKx4X9siLsM0CLHtEw0aKa36hCo-5f7gGvBLRWZvHsU,115999
 oracle/services/project_scanner.py,sha256=gHpXihRZSu2gXCp4vvOWp5gMAsmfINE9ESiqVF1uV3A,5587
 oracle/services/review_agent.py,sha256=m_fzoHowpiibf0_iz3dF72LWSrwB_FbDd1am-SbeWXg,11273
 oracle/services/tool_executor.py,sha256=xtAkBWkclh_FwOgzprjGkyRIV8-A7Lc3bz0UFPShrv0,1113
@@ -165,7 +165,7 @@ oracle/ui/chat/send.js,sha256=k2qGN_asb7FTjcLa204Zjq4X_QWHIKHQnI33IEuxvaQ,11558
 oracle/ui/chat/stream_renderer.js,sha256=RZndI2mu5xbzZF-4NG9jeOqXTcmIqfZqxgkrBvTzWmk,29861
 oracle/ui/chat/toolbar.js,sha256=ZDexIIpGwsQ6XsY4Tyo082rJoofdD_JBTV97-mLQUVM,12027
 services/__init__.py,sha256=3Kn4cZweLm7at8wFdBdZ-Zwo8hHcnVIsmY5f29nzi2Y,116
-services/access_guard.py,sha256=RKvbW12aRLUwkPPssxmLWpSk7_z4DDeB8S7g1BNg2hc,52947
+services/access_guard.py,sha256=rPw_qOMBIwG0wfNYY17XrmiXAIdt5ZYtVDwJfQDZpNU,54146
 services/access_telemetry.py,sha256=9pOCLS9LgDtM7Z4cCEyl7osxhj-m3wsPubcXolBKuV4,9568
 services/activity_log.py,sha256=PNGeEYlw1Aux-mRU4pKCQdbsSuzLvOg7MYiq-cb4n8g,4473
 services/agent_base.py,sha256=a-gdSd_jtZtbjXo1WS8CnWCagXgKaGZd5ShcG6s0kT4,4809
@@ -239,12 +239,12 @@ services/retention.py,sha256=I2_RV233kWBBXox5rc_w-1h1aPua93o9huuPf-pJVuE,18629
 services/retrieval_broker.py,sha256=9X67VZ_6AkbAzopHuuMFKmP4CGZLnW576kjSKMenBnw,5261
 services/router.py,sha256=Cz10nx2fKTbaGn14mSBePWIDrw5rdcs_1JFYXeik084,15626
 services/runtime.py,sha256=b79gN0dFlzBO4rPaUMWier8FZFamMZlwIM3aywLmbB4,12840
-services/scanner.py,sha256=LsQqogv2FzXGafF6Dnm0Lh7Llkn0Al0zmcA54aTwi6Y,7838
+services/scanner.py,sha256=-DL8BQ4ncivJec7E7k8Hz_s6H3CfRSRs1GTls66kQ-M,9542
 services/session_benchmark.py,sha256=GX3H8OwKC0X9Kk5U-vfY6Y7qq9Qaz2HwadNA7mjO8RY,105047
 services/session_manager.py,sha256=nSZcemk34U4yxn3AvKnOuYrNfiIDRgE3s7FXTNYKG0A,52617
 services/session_preloader.py,sha256=DsTAXMKVtrX9yu1sEFojYDi9-jkSAj1Ylt9JTy57Dow,9883
 services/subprojects.py,sha256=KNA-qGVPsd7Tg92Pt_kLWMLyER2YHmdQWO44sOelTIg,25123
-services/task_store.py,sha256=IHNeLipdyWtbWYu2-3ItIDeSDI9WoMKj6YwPPc1TgW0,46487
+services/task_store.py,sha256=QoyhLcAyd-JZxn1nMfnZ11tTLgFqY-xwmlx1q8w_1p8,49477
 services/telemetry.py,sha256=KbWCe7F8lGY9DufVPWGyGFo-IBcPgWh0kd3ySJnIgFE,11377
 services/text_index.py,sha256=r3o4CobTG9jAO9PWazgbWYLY9oi_FgEJ3xwEXrF4KM0,2783
 services/time_tracker.py,sha256=sZNz8QAYpWhCBwfmvopVyxpMb8H-CrBT25C0_VOT1LY,11056
@@ -276,8 +276,8 @@ tui/screens/search_view.py,sha256=MMHjVdlk3HZSuDBSvq8IGrqv_Mh5Us6YqXQ80bcWSMk,19
 tui/screens/session_view.py,sha256=eZ1eDwHTvPOck1wCCviixtOaCxIkBT_95ytNNNriGNA,5991
 tui/screens/stats.py,sha256=p81PjzdaIv7hllb8f45-rlVe4lJZwSdIMqu7e86_u5s,6223
 tui/screens/ui_view.py,sha256=1QJCgLh2YfgWIpvzRG1KOGXYEaOYX6ojN61Azjf2oX0,2125
-code_context_control-2.85.0.dist-info/METADATA,sha256=kiLaxzH8a0HhMA8YE8uUjQF3Jxb1ARn6-cN6FlR9ofQ,25825
-code_context_control-2.85.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-code_context_control-2.85.0.dist-info/entry_points.txt,sha256=7kX_WUsDCF2hbXzvbNyscyaBb9AeA-DJY5v_5hN0DlU,93
-code_context_control-2.85.0.dist-info/top_level.txt,sha256=wRt41zBybVF3qAiNXHz9BURbkKvUvfhmWWtKMhaw6eE,29
-code_context_control-2.85.0.dist-info/RECORD,,
+code_context_control-2.86.0.dist-info/METADATA,sha256=g5lfHV5MFY4KFu0PUiQD3R3zvze-_oEbChXgX8zQdfU,26229
+code_context_control-2.86.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+code_context_control-2.86.0.dist-info/entry_points.txt,sha256=7kX_WUsDCF2hbXzvbNyscyaBb9AeA-DJY5v_5hN0DlU,93
+code_context_control-2.86.0.dist-info/top_level.txt,sha256=wRt41zBybVF3qAiNXHz9BURbkKvUvfhmWWtKMhaw6eE,29
+code_context_control-2.86.0.dist-info/RECORD,,

oracle/services/mobile_api.py

@@ -811,6 +811,20 @@ def mobile_pm_milestone():
         return jsonify({"error": "id is required"}), 400
 
     if request.method == "PUT":
+        # {complete: true} / {reopen: true} switch lifecycle; tasks keep
+        # their milestone link (unlike DELETE = archive + detach).
+        if data.get("complete"):
+            res = store.complete_milestone(ms_id)
+            if "error" in res:
+                return _pm_error(res)
+            _pm_audit(resolved, "milestone", "complete", res["id"])
+            return jsonify({"completed": True, "milestone": res})
+        if data.get("reopen"):
+            res = store.reopen_milestone(ms_id)
+            if "error" in res:
+                return _pm_error(res)
+            _pm_audit(resolved, "milestone", "reopen", res["id"])
+            return jsonify({"reopened": True, "milestone": res})
         res = store.update_milestone(ms_id, expected_rev=data.get("expected_rev"),
                                      **(data.get("fields") or {}))
         if "error" in res:

services/access_guard.py

@@ -1087,6 +1087,33 @@ def _write_scope_config(cfg: Path, data: dict) -> None:
     os.replace(tmp, cfg)
 
 
+def seed_default_global_rules() -> dict:
+    """Seed DEFAULT_GLOBAL_RULES as deny rules in GLOBAL scope, once ever.
+
+    Spec §1: the defaults ship as visible, removable rules — so they are
+    written to ``~/.c3/config.json`` only when that file has never carried
+    an ``access`` section. Any existing section (even an emptied one) means
+    the user has touched the scope and removal stays sticky. A corrupt or
+    unreadable config is never rewritten. Never raises: install and CLI
+    call this on every run and must not break on a bad home dir.
+
+    Returns {"seeded": bool, "rules": [...]} — ``rules`` only when seeded.
+    """
+    try:
+        cfg = _scope_config_path("global")
+        data = {}
+        if cfg.is_file():
+            data = json.loads(cfg.read_text(encoding="utf-8")) or {}
+            if not isinstance(data, dict) or "access" in data:
+                return {"seeded": False}
+        data["access"] = {_KIND_DENY: [_norm_glob(g)
+                                       for g in DEFAULT_GLOBAL_RULES]}
+        _write_scope_config(cfg, data)
+        return {"seeded": True, "rules": list(DEFAULT_GLOBAL_RULES)}
+    except Exception:
+        return {"seeded": False}
+
+
 def set_rule(glob, kind: str, scope: str, project_path: str = ".") -> dict:
     """Add one rule to *scope*'s config. Human surfaces only; callers log.
 

services/scanner.py

@@ -65,6 +65,39 @@ def gitignore_dir_names(root) -> set:
     return gitignore_dir_patterns(root)[0]
 
 
+def is_nested_checkout(path) -> bool:
+    """True when ``path`` is the root of a DIFFERENT checkout than ours.
+
+    ``SKIP_DIRS`` cannot express this, because it matches directory NAMES and
+    a nested checkout is named whatever somebody called it. A linked git
+    worktree is the case that matters: its marker is a ``.git`` FILE holding
+    ``gitdir: …`` rather than a ``.git`` directory, so pruning the name
+    ``.git`` skips a file that was never a directory and descends into the
+    entire copy of the repository sitting beside it.
+
+    Measured on the Yep project, 2026-08-11 — 112 registered worktrees, most
+    of them agent scratch under ``.claude/worktrees/``:
+
+        .py files in the real tree      1,108
+        .py files under worktree dirs 100,629     (91x amplification)
+
+    A cross-project exact search there took 147.6s, against 0.11s to build
+    the runtime. The MCP transport kills a tool call at 120s, so the search
+    could never return — not slow, unreachable, and the reason
+    ``c3_project`` was unusable against that project at all.
+
+    Indexing them is also wrong on the merits, independent of cost: they are
+    other commits of files this project already has, so every hit is
+    duplicated ~112 times and the top result is whichever stale copy sorted
+    first. The search that exposed this returned a hit inside
+    ``.claude/worktrees/bridge-cse_01MPoh…`` rather than from src/.
+    """
+    try:
+        return os.path.exists(os.path.join(str(path), '.git'))
+    except (OSError, ValueError):
+        return False
+
+
 def make_dir_pruner(root, extra_skip=(), respect_gitignore: bool = True):
     """Predicate ``dirname -> bool`` (True = prune this directory).
 
@@ -177,6 +210,8 @@ def iter_files(
                 continue
             if guard_excluded(os.path.join(dirpath, d)):
                 continue  # denied subtree — never descended, never listed
+            if is_nested_checkout(os.path.join(dirpath, d)):
+                continue  # another checkout's copy of files we already index
             kept.append(d)
         dirnames[:] = kept
         seen += len(filenames) + len(kept)

services/task_store.py

@@ -864,6 +864,69 @@ class TaskStore:
             self._save(doc)
             return {**ms, "detached_tasks": detached}
 
+    def complete_milestone(self, milestone_id) -> dict:
+        """Close a finished milestone; its tasks KEEP their milestone link.
+
+        The happy-path close, distinct from archive_milestone (removal:
+        detaches tasks, eligible for purge). A completed milestone leaves
+        default listings, the board, and the report, but history still
+        records which tasks shipped under it. Refuses while open active
+        tasks remain; undo with reopen_milestone().
+        """
+        with self._guard():
+            doc = self._load()
+            ms = self._resolve(doc["milestones"], milestone_id)
+            if ms is None:
+                return {"error": f"no milestone matches: {milestone_id}"}
+            old = ms.get("lifecycle", "active")
+            if old != "active":
+                return {"error": f"milestone is {old}, not active"}
+            open_tasks = [t for t in doc["tasks"]
+                          if t.get("milestone_id") == ms["id"]
+                          and t.get("lifecycle", "active") == "active"
+                          and t.get("status") != "done"]
+            if open_tasks:
+                names = ", ".join(t["id"][:8] for t in open_tasks[:5])
+                return {"error": f"{len(open_tasks)} open task(s) block "
+                                 f"completion: {names}"}
+            now = _now()
+            ms["lifecycle"] = "completed"
+            ms["completed_at"] = now
+            ms["updated_at"] = now
+            self._event("milestone", "complete", ms["id"],
+                        patch={"lifecycle": [old, "completed"]})
+            self._save(doc)
+            return dict(ms)
+
+    def reopen_milestone(self, milestone_id) -> dict:
+        """Completed -> active again; clears completed_at.
+
+        Accepts id, unique id prefix, or — because resolve_milestone's
+        name matching deliberately covers only ACTIVE milestones — a
+        unique case-insensitive name among the completed ones.
+        """
+        with self._guard():
+            doc = self._load()
+            ms = self._resolve(doc["milestones"], milestone_id)
+            if ms is None:
+                want = (milestone_id or "").strip().lower()
+                matches = [m for m in doc["milestones"]
+                           if m.get("lifecycle") == "completed"
+                           and (m.get("name") or "").lower() == want]
+                ms = matches[0] if len(matches) == 1 else None
+            if ms is None:
+                return {"error": f"no milestone matches: {milestone_id}"}
+            old = ms.get("lifecycle", "active")
+            if old != "completed":
+                return {"error": f"milestone is {old}, not completed"}
+            ms["lifecycle"] = "active"
+            ms["completed_at"] = None
+            ms["updated_at"] = _now()
+            self._event("milestone", "reopen", ms["id"],
+                        patch={"lifecycle": [old, "active"]})
+            self._save(doc)
+            return dict(ms)
+
     def resolve_milestone(self, ref: str):
         """Resolve by id, unique id prefix, or unique case-insensitive name."""
         doc = self._load()