code-context-control 2.85.0__tar.gz → 2.86.0__tar.gz

{code_context_control-2.85.0/code_context_control.egg-info → code_context_control-2.86.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.85.0
+Version: 2.86.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -178,7 +178,7 @@ Twelve tabs. The dashboard above shows token savings, indexed files, the live se
   <img src="https://raw.githubusercontent.com/drknowhow/code-context-control/main/docs/screenshots/2026-07/ui_tasks.png" alt="C3 Tasks" width="900">
 </p>
 
-**Tasks** (v2.45.0, extended v2.53.0) is a durable per-project tracker — dependencies and subtasks, milestones, decision notes, full event history, health reports, and both automatic and manual time tracking. It rolls up into the Hub's cross-project board.
+**Tasks** (v2.45.0, extended v2.53.0) is a durable per-project tracker — dependencies and subtasks, milestones, decision notes, full event history, health reports, and both automatic and manual time tracking. It rolls up into the Hub's cross-project board. Shipped milestones can be **completed** (v2.86.0) — they leave the board while their tasks keep the milestone link, unlike archiving, which detaches them.
 
 **Instructions** keeps your agent-facing docs in sync. C3-generated content sits inside a `<!-- C3:BEGIN … -->` block; anything you write outside it is preserved. Since v2.60.0 generated docs point at `.c3/MAP.md` — a machine-owned, byte-stable repo map C3 refreshes automatically — instead of embedding a tree that goes stale. `AGENTS.md` serves both Codex and Antigravity; `GEMINI.md` is read if present but no longer generated (the Gemini CLI profile was removed in v2.52).
 
@@ -243,6 +243,7 @@ c3 access mask activate                         # purge pre-mask artifacts, buil
 - **`deny` means deny-enumerate too** — denied paths never appear in search results, maps, or the vector index.
 - **Masked means read-only, always.** Cropped rows have no inverse, so an edit in transformed coordinates would corrupt the one file you protected.
 - **Four deterministic presets, no LLM in the read path:** `redact_secrets`, `redact_columns` (salted one-way pseudonyms — joins survive, no reverse dictionary), `sample_rows`, `signatures_only`.
+- **Sensible defaults out of the box** (v2.86.0). A fresh install seeds `*.pem`, `id_rsa*`, and `*.key` as deny rules in global scope — visible in `c3 access list` and removable like any rule you wrote yourself. Delete one and it stays deleted.
 - **Rule changes are human-only** (UI tab or CLI) and ledger-logged. Agents have no mutation surface.
 - **Built-ins can be switched off when you need to** (v2.65.0). `**/.env*`, `**/.c3/**`, `**/.claude/settings*.json` and `**/.git/**` yield to `c3 access builtin disable <glob>`, which makes you retype the glob first. It takes **two keys** — a config entry *and* a keyring attestation — so an agent that manages to write `config.json` still cannot grant itself write access to your settings. The credential vault stays absolute.
 - **Honest coverage.** This guards *cooperative* agents against mistakes and prompt injection. It is not a sandbox — a raw shell outside C3's tools still sees the real bytes.

{code_context_control-2.85.0 → code_context_control-2.86.0}/README.md

@@ -115,7 +115,7 @@ Twelve tabs. The dashboard above shows token savings, indexed files, the live se
   <img src="https://raw.githubusercontent.com/drknowhow/code-context-control/main/docs/screenshots/2026-07/ui_tasks.png" alt="C3 Tasks" width="900">
 </p>
 
-**Tasks** (v2.45.0, extended v2.53.0) is a durable per-project tracker — dependencies and subtasks, milestones, decision notes, full event history, health reports, and both automatic and manual time tracking. It rolls up into the Hub's cross-project board.
+**Tasks** (v2.45.0, extended v2.53.0) is a durable per-project tracker — dependencies and subtasks, milestones, decision notes, full event history, health reports, and both automatic and manual time tracking. It rolls up into the Hub's cross-project board. Shipped milestones can be **completed** (v2.86.0) — they leave the board while their tasks keep the milestone link, unlike archiving, which detaches them.
 
 **Instructions** keeps your agent-facing docs in sync. C3-generated content sits inside a `<!-- C3:BEGIN … -->` block; anything you write outside it is preserved. Since v2.60.0 generated docs point at `.c3/MAP.md` — a machine-owned, byte-stable repo map C3 refreshes automatically — instead of embedding a tree that goes stale. `AGENTS.md` serves both Codex and Antigravity; `GEMINI.md` is read if present but no longer generated (the Gemini CLI profile was removed in v2.52).
 
@@ -180,6 +180,7 @@ c3 access mask activate                         # purge pre-mask artifacts, buil
 - **`deny` means deny-enumerate too** — denied paths never appear in search results, maps, or the vector index.
 - **Masked means read-only, always.** Cropped rows have no inverse, so an edit in transformed coordinates would corrupt the one file you protected.
 - **Four deterministic presets, no LLM in the read path:** `redact_secrets`, `redact_columns` (salted one-way pseudonyms — joins survive, no reverse dictionary), `sample_rows`, `signatures_only`.
+- **Sensible defaults out of the box** (v2.86.0). A fresh install seeds `*.pem`, `id_rsa*`, and `*.key` as deny rules in global scope — visible in `c3 access list` and removable like any rule you wrote yourself. Delete one and it stays deleted.
 - **Rule changes are human-only** (UI tab or CLI) and ledger-logged. Agents have no mutation surface.
 - **Built-ins can be switched off when you need to** (v2.65.0). `**/.env*`, `**/.c3/**`, `**/.claude/settings*.json` and `**/.git/**` yield to `c3 access builtin disable <glob>`, which makes you retype the glob first. It takes **two keys** — a config entry *and* a keyring attestation — so an agent that manages to write `config.json` still cannot grant itself write access to your settings. The credential vault stays absolute.
 - **Honest coverage.** This guards *cooperative* agents against mistakes and prompt injection. It is not a sandbox — a raw shell outside C3's tools still sees the real bytes.

{code_context_control-2.85.0 → code_context_control-2.86.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.85.0"
+__version__ = "2.86.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -5535,6 +5535,14 @@ def cmd_install_mcp(args):
     except Exception as e:
         print(f"Warning: Could not update global CLAUDE.md: {e}")
 
+    # ── Default Access Guard rules (first run only) ─────────────
+    from services import access_guard
+    seeded = access_guard.seed_default_global_rules()
+    if seeded.get("seeded"):
+        rules = ", ".join(seeded["rules"])
+        print(f"Seeded default Access Guard deny rules into global scope: {rules}")
+        print("  (remove with: c3 access remove <glob> --kind deny --global)")
+
     # ── Install /terse skill for supported IDEs ──────────────────
     if profile.name in ("claude-code", "codex"):
         try:
@@ -6603,6 +6611,16 @@ def _override_audit(grant: dict, project_path: str) -> None:
 
 def cmd_access(args):
     """Access Guard rule management — human-only mutation surface (spec §1)."""
+    from services import access_guard
+
+    # First `c3 access` touch seeds the removable defaults (spec §1). A
+    # no-op forever after: any existing access section, even an emptied
+    # one, means the user has taken over the scope.
+    seeded = access_guard.seed_default_global_rules()
+    if seeded.get("seeded"):
+        print(f"[seeded] default global deny rules: {', '.join(seeded['rules'])}")
+        print("  Remove any of them: c3 access remove <glob> --kind deny --global\n")
+
     sub = getattr(args, "access_cmd", None)
     if not sub:
         print("Usage: c3 access {list,add,remove,check,stats,mask,builtin} [args]")

{code_context_control-2.85.0 → code_context_control-2.86.0}/cli/hook_access_guard.py

@@ -41,7 +41,24 @@ _MAX_TOKENS = 200
 # "NTFS alternate data stream". The ADS check stays strict for real path
 # arguments (_WRITE_TOOLS/_READ_TOOLS); here it only produced false denies on
 # commit messages, curl, and gh (#50).
-_SCHEME_RE = re.compile(r"^[a-z][a-z0-9+.\-]*://", re.IGNORECASE)
+#
+# UNANCHORED, and that is the fix rather than an oversight. `^…://` only ever
+# recognised a token that BEGINS with a scheme, which is the same
+# whitelist-a-shape mistake #50 made and this module's own header calls out —
+# and the `_SYNTAX_CHARS` generalisation does not cover the gap, because a
+# token can carry a URL and no syntax at all. Observed 2026-08-11: the single
+# argument of
+#     printf '\n---\n\nhttps://claude.ai/code/session_01Hs28…\n' >> body.md
+# strips to `\n---\n\nhttps://claude.ai/…`, which has a separator (`\` and
+# `/`), no syntax characters, no `::`, and no leading scheme. It reached
+# ag.check, canonicalised to a residual colon, and hard-denied a command whose
+# only file argument was an ordinary markdown path. Third logged instance of
+# this class in five days (two on 2026-08-07 were Windows paths inside Python
+# string literals).
+#
+# A token containing `://` anywhere is a network literal, not an NTFS stream:
+# a real stream is `file:name:$TYPE`, and no spelling of it contains `//`.
+_SCHEME_RE = re.compile(r"[a-z][a-z0-9+.\-]*://", re.IGNORECASE)
 # IPv6 literal or CIDR: >=2 colons, hex groups only, optional [] and /prefix.
 # 'C:/x/f.txt:stream' has one colon and non-hex parts, so it never matches.
 _IPV6_RE = re.compile(
@@ -104,8 +121,13 @@ _CD_RE = re.compile(
 
 
 def _is_network_token(tok: str) -> bool:
-    """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling."""
-    return bool(_SCHEME_RE.match(tok) or _IPV6_RE.match(tok))
+    """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling.
+
+    ``search`` for the scheme (a URL anywhere in the token disqualifies it as
+    a path), ``match`` for IPv6 — that pattern is a whole-token shape and
+    anchoring is what keeps `C:/x/f.txt:stream` from matching it.
+    """
+    return bool(_SCHEME_RE.search(tok) or _IPV6_RE.match(tok))
 
 
 def _is_scope_token(tok: str) -> bool:

{code_context_control-2.85.0 → code_context_control-2.86.0}/cli/hub_server.py

@@ -2740,6 +2740,20 @@ def api_pm_milestone():
         return jsonify({"error": "id is required"}), 400
 
     if request.method == "PUT":
+        # {complete: true} / {reopen: true} switch lifecycle; tasks keep
+        # their milestone link (unlike DELETE = archive + detach).
+        if data.get("complete"):
+            res = store.complete_milestone(ms_id)
+            if "error" in res:
+                return jsonify(res), 400
+            _pm_audit(resolved, "milestone", "complete", res["id"])
+            return jsonify({"completed": True, "milestone": res})
+        if data.get("reopen"):
+            res = store.reopen_milestone(ms_id)
+            if "error" in res:
+                return jsonify(res), 400
+            _pm_audit(resolved, "milestone", "reopen", res["id"])
+            return jsonify({"reopened": True, "milestone": res})
         res = store.update_milestone(ms_id, expected_rev=data.get("expected_rev"),
                                      **(data.get("fields") or {}))
         if "error" in res:

{code_context_control-2.85.0 → code_context_control-2.86.0}/cli/mcp_server.py

@@ -1105,7 +1105,9 @@ async def c3_task(
     Time: time_add (minutes 1-1440 [+note/due_date=date/task_id]), time_update / time_delete (ref=entry id),
       time_list (manual entries + recent auto sessions), time_summary (today/7d/30d, auto vs manual).
       Auto-tracking: server startup + tool calls ping .c3/time; idle gaps >15min close a session.
-    Milestones: milestone_add (name [+target_date]), milestone_update, milestone_list (with progress %), milestone_archive.
+    Milestones: milestone_add (name [+target_date]), milestone_update, milestone_list (with progress %),
+      milestone_complete (close a shipped milestone; refuses while open tasks remain; tasks KEEP their link),
+      milestone_reopen (undo complete), milestone_archive (removal: detaches tasks).
     Notes: note_add (note [+kind=decision] [+task_id]), note_list.
     History: history ([+task_id] [+limit]) — append-only event log (who/what/when, before->after), newest first.
     task_id accepts any unique id prefix (>=4 chars); milestone accepts id or unique name.

{code_context_control-2.85.0 → code_context_control-2.86.0}/cli/server.py

@@ -1295,6 +1295,20 @@ def api_pm_milestone():
     if not ms_id:
         return jsonify({"error": "id is required"}), 400
     if request.method == "PUT":
+        # {complete: true} / {reopen: true} switch lifecycle; tasks keep
+        # their milestone link (unlike DELETE = archive + detach).
+        if data.get("complete"):
+            res = store.complete_milestone(ms_id)
+            if "error" in res:
+                return jsonify(res), 400
+            _pm_audit("milestone", "complete", res["id"])
+            return jsonify({"completed": True, "milestone": res})
+        if data.get("reopen"):
+            res = store.reopen_milestone(ms_id)
+            if "error" in res:
+                return jsonify(res), 400
+            _pm_audit("milestone", "reopen", res["id"])
+            return jsonify({"reopened": True, "milestone": res})
         res = store.update_milestone(ms_id, expected_rev=data.get("expected_rev"),
                                      **(data.get("fields") or {}))
         if "error" in res:

{code_context_control-2.85.0 → code_context_control-2.86.0}/cli/tools/shell.py

@@ -69,6 +69,45 @@ _SOFT_WARN = re.compile(
 
 _DEFAULT_TIMEOUT = 60
 _MAX_TIMEOUT = 600
+
+# The transport's own ceiling, and the reason _MAX_TIMEOUT alone is a lie.
+#
+# An MCP client kills a tool call at MCP_TOOL_TIMEOUT (Claude Code ships
+# 120_000 ms and the value is set per-environment) — a limit this process does
+# not choose and cannot raise. Until this existed, `c3_shell(timeout=600)` was
+# accepted, clamped to 600, and then killed by the client at 120s with the
+# subprocess still running: the caller saw the call "moved to background" and
+# then fail, with no line anywhere naming the real limit or attributing the
+# kill. The subprocess was NOT reaped by us, because our own deadline never
+# arrived.
+#
+# The cost was not hypothetical. Two Higgsfield image generations (2-4 min
+# each) were requested at timeout=420, killed at 120s, and the remote jobs
+# completed and were BILLED while the local process died before downloading —
+# one image landed, one was paid for and stranded.
+#
+# So: discover the client's ceiling, run just inside it, and SAY SO. Running
+# inside it means OUR deadline fires first, which turns a phantom
+# client-side kill into an ordinary `[c3_shell:TIMEOUT]` with stdout, a
+# duration, and a process tree we actually killed.
+_TRANSPORT_MARGIN_S = 5
+
+
+def _transport_ceiling_s() -> int | None:
+    """Seconds this call may run before the MCP client kills it, if knowable.
+
+    None when the variable is unset or unparseable — then nothing is capped
+    and behaviour is exactly what it was, because a guess here would cap
+    legitimate work on a client with no such limit.
+    """
+    raw = (os.environ.get("MCP_TOOL_TIMEOUT") or "").strip()
+    if not raw:
+        return None
+    try:
+        ceiling = int(float(raw)) // 1000
+    except (TypeError, ValueError):
+        return None
+    return ceiling if ceiling > _TRANSPORT_MARGIN_S else None
 _FILTER_THRESHOLD_LINES = 30
 _JQ_INVOCATION = re.compile(r"(?:^|&&|\|\||[;|(])\s*jq(?:\s|$)", re.IGNORECASE)
 
@@ -468,6 +507,13 @@ async def handle_shell(cmd: str, cwd: str, timeout: int, filter_output: bool,
         )
 
     timeout = max(1, min(int(timeout or _DEFAULT_TIMEOUT), _MAX_TIMEOUT))
+    # Cap to what the transport will actually allow, and remember that we did
+    # so — the caller asked for a number, and a number quietly not honoured is
+    # the whole defect (see _transport_ceiling_s).
+    capped_from = 0
+    _ceiling = _transport_ceiling_s()
+    if _ceiling is not None and timeout > _ceiling - _TRANSPORT_MARGIN_S:
+        capped_from, timeout = timeout, _ceiling - _TRANSPORT_MARGIN_S
     work_cwd = cwd or svc.project_path
     work_cwd = str(Path(work_cwd).resolve())
 
@@ -601,6 +647,16 @@ async def handle_shell(cmd: str, cwd: str, timeout: int, filter_output: bool,
     warn = ""
     if _SOFT_WARN.search(cmd):
         warn = "[c3_shell:warn] destructive pattern detected — verify before re-running\n"
+    if capped_from:
+        # Named at the moment of the mistake, not in documentation nobody
+        # reads at the moment they need it. The alternative IS the escape
+        # hatch, so the line says which one.
+        warn += (
+            f"[c3_shell:capped] timeout={capped_from}s was requested but this "
+            f"MCP client kills a tool call at {_ceiling}s; ran with {timeout}s. "
+            f"For longer work use the native Bash tool with "
+            f"run_in_background, which is not bound by this limit.\n"
+        )
 
     if result["timed_out"]:
         status = "TIMEOUT"

{code_context_control-2.85.0 → code_context_control-2.86.0}/cli/tools/tasks.py

@@ -5,7 +5,8 @@ READ_ACTIONS = {"list", "get", "board", "history", "report",
 
 _TASK_ACTIONS = ("add, update, done, list, get, board, history, report, archive, "
                  "block, unblock, link, unlink, "
-                 "milestone_add, milestone_update, milestone_list, milestone_archive, "
+                 "milestone_add, milestone_update, milestone_list, "
+                 "milestone_complete, milestone_reopen, milestone_archive, "
                  "note_add, note_list, "
                  "time_add, time_update, time_delete, time_list, time_summary")
 
@@ -368,6 +369,26 @@ def handle_task(action, svc, finalize, *, title="", task_id="", status="",
             return done_resp(f"[task:error] {res['error']}", "error")
         return done_resp(f"[milestone:updated] {res['id'][:8]} \"{res['name']}\"", "updated")
 
+    if action == "milestone_complete":
+        if not milestone:
+            return done_resp("[task:error] milestone_complete requires milestone.", "error")
+        ms = store.resolve_milestone(milestone)
+        if ms is None:
+            return done_resp(f"[task:error] no milestone matches: {milestone}", "error")
+        res = store.complete_milestone(ms["id"])
+        if "error" in res:
+            return done_resp(f"[task:error] {res['error']}", "error")
+        return done_resp(f"[milestone:completed] \"{res['name']}\" "
+                         f"(tasks keep their milestone link)", "completed")
+
+    if action == "milestone_reopen":
+        if not milestone:
+            return done_resp("[task:error] milestone_reopen requires milestone.", "error")
+        res = store.reopen_milestone(milestone)
+        if "error" in res:
+            return done_resp(f"[task:error] {res['error']}", "error")
+        return done_resp(f"[milestone:reopened] \"{res['name']}\"", "reopened")
+
     if action == "milestone_archive":
         if not milestone:
             return done_resp("[task:error] milestone_archive requires milestone.", "error")

{code_context_control-2.85.0 → code_context_control-2.86.0/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.85.0
+Version: 2.86.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -178,7 +178,7 @@ Twelve tabs. The dashboard above shows token savings, indexed files, the live se
   <img src="https://raw.githubusercontent.com/drknowhow/code-context-control/main/docs/screenshots/2026-07/ui_tasks.png" alt="C3 Tasks" width="900">
 </p>
 
-**Tasks** (v2.45.0, extended v2.53.0) is a durable per-project tracker — dependencies and subtasks, milestones, decision notes, full event history, health reports, and both automatic and manual time tracking. It rolls up into the Hub's cross-project board.
+**Tasks** (v2.45.0, extended v2.53.0) is a durable per-project tracker — dependencies and subtasks, milestones, decision notes, full event history, health reports, and both automatic and manual time tracking. It rolls up into the Hub's cross-project board. Shipped milestones can be **completed** (v2.86.0) — they leave the board while their tasks keep the milestone link, unlike archiving, which detaches them.
 
 **Instructions** keeps your agent-facing docs in sync. C3-generated content sits inside a `<!-- C3:BEGIN … -->` block; anything you write outside it is preserved. Since v2.60.0 generated docs point at `.c3/MAP.md` — a machine-owned, byte-stable repo map C3 refreshes automatically — instead of embedding a tree that goes stale. `AGENTS.md` serves both Codex and Antigravity; `GEMINI.md` is read if present but no longer generated (the Gemini CLI profile was removed in v2.52).
 
@@ -243,6 +243,7 @@ c3 access mask activate                         # purge pre-mask artifacts, buil
 - **`deny` means deny-enumerate too** — denied paths never appear in search results, maps, or the vector index.
 - **Masked means read-only, always.** Cropped rows have no inverse, so an edit in transformed coordinates would corrupt the one file you protected.
 - **Four deterministic presets, no LLM in the read path:** `redact_secrets`, `redact_columns` (salted one-way pseudonyms — joins survive, no reverse dictionary), `sample_rows`, `signatures_only`.
+- **Sensible defaults out of the box** (v2.86.0). A fresh install seeds `*.pem`, `id_rsa*`, and `*.key` as deny rules in global scope — visible in `c3 access list` and removable like any rule you wrote yourself. Delete one and it stays deleted.
 - **Rule changes are human-only** (UI tab or CLI) and ledger-logged. Agents have no mutation surface.
 - **Built-ins can be switched off when you need to** (v2.65.0). `**/.env*`, `**/.c3/**`, `**/.claude/settings*.json` and `**/.git/**` yield to `c3 access builtin disable <glob>`, which makes you retype the glob first. It takes **two keys** — a config entry *and* a keyring attestation — so an agent that manages to write `config.json` still cannot grant itself write access to your settings. The credential vault stays absolute.
 - **Honest coverage.** This guards *cooperative* agents against mistakes and prompt injection. It is not a sandbox — a raw shell outside C3's tools still sees the real bytes.

{code_context_control-2.85.0 → code_context_control-2.86.0}/oracle/services/mobile_api.py

@@ -811,6 +811,20 @@ def mobile_pm_milestone():
         return jsonify({"error": "id is required"}), 400
 
     if request.method == "PUT":
+        # {complete: true} / {reopen: true} switch lifecycle; tasks keep
+        # their milestone link (unlike DELETE = archive + detach).
+        if data.get("complete"):
+            res = store.complete_milestone(ms_id)
+            if "error" in res:
+                return _pm_error(res)
+            _pm_audit(resolved, "milestone", "complete", res["id"])
+            return jsonify({"completed": True, "milestone": res})
+        if data.get("reopen"):
+            res = store.reopen_milestone(ms_id)
+            if "error" in res:
+                return _pm_error(res)
+            _pm_audit(resolved, "milestone", "reopen", res["id"])
+            return jsonify({"reopened": True, "milestone": res})
         res = store.update_milestone(ms_id, expected_rev=data.get("expected_rev"),
                                      **(data.get("fields") or {}))
         if "error" in res:

{code_context_control-2.85.0 → code_context_control-2.86.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-context-control"
-version = "2.85.0"
+version = "2.86.0"
 description = "Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub."
 readme = "README.md"
 requires-python = ">=3.10"

{code_context_control-2.85.0 → code_context_control-2.86.0}/services/access_guard.py

@@ -1087,6 +1087,33 @@ def _write_scope_config(cfg: Path, data: dict) -> None:
     os.replace(tmp, cfg)
 
 
+def seed_default_global_rules() -> dict:
+    """Seed DEFAULT_GLOBAL_RULES as deny rules in GLOBAL scope, once ever.
+
+    Spec §1: the defaults ship as visible, removable rules — so they are
+    written to ``~/.c3/config.json`` only when that file has never carried
+    an ``access`` section. Any existing section (even an emptied one) means
+    the user has touched the scope and removal stays sticky. A corrupt or
+    unreadable config is never rewritten. Never raises: install and CLI
+    call this on every run and must not break on a bad home dir.
+
+    Returns {"seeded": bool, "rules": [...]} — ``rules`` only when seeded.
+    """
+    try:
+        cfg = _scope_config_path("global")
+        data = {}
+        if cfg.is_file():
+            data = json.loads(cfg.read_text(encoding="utf-8")) or {}
+            if not isinstance(data, dict) or "access" in data:
+                return {"seeded": False}
+        data["access"] = {_KIND_DENY: [_norm_glob(g)
+                                       for g in DEFAULT_GLOBAL_RULES]}
+        _write_scope_config(cfg, data)
+        return {"seeded": True, "rules": list(DEFAULT_GLOBAL_RULES)}
+    except Exception:
+        return {"seeded": False}
+
+
 def set_rule(glob, kind: str, scope: str, project_path: str = ".") -> dict:
     """Add one rule to *scope*'s config. Human surfaces only; callers log.
 

{code_context_control-2.85.0 → code_context_control-2.86.0}/services/scanner.py

@@ -65,6 +65,39 @@ def gitignore_dir_names(root) -> set:
     return gitignore_dir_patterns(root)[0]
 
 
+def is_nested_checkout(path) -> bool:
+    """True when ``path`` is the root of a DIFFERENT checkout than ours.
+
+    ``SKIP_DIRS`` cannot express this, because it matches directory NAMES and
+    a nested checkout is named whatever somebody called it. A linked git
+    worktree is the case that matters: its marker is a ``.git`` FILE holding
+    ``gitdir: …`` rather than a ``.git`` directory, so pruning the name
+    ``.git`` skips a file that was never a directory and descends into the
+    entire copy of the repository sitting beside it.
+
+    Measured on the Yep project, 2026-08-11 — 112 registered worktrees, most
+    of them agent scratch under ``.claude/worktrees/``:
+
+        .py files in the real tree      1,108
+        .py files under worktree dirs 100,629     (91x amplification)
+
+    A cross-project exact search there took 147.6s, against 0.11s to build
+    the runtime. The MCP transport kills a tool call at 120s, so the search
+    could never return — not slow, unreachable, and the reason
+    ``c3_project`` was unusable against that project at all.
+
+    Indexing them is also wrong on the merits, independent of cost: they are
+    other commits of files this project already has, so every hit is
+    duplicated ~112 times and the top result is whichever stale copy sorted
+    first. The search that exposed this returned a hit inside
+    ``.claude/worktrees/bridge-cse_01MPoh…`` rather than from src/.
+    """
+    try:
+        return os.path.exists(os.path.join(str(path), '.git'))
+    except (OSError, ValueError):
+        return False
+
+
 def make_dir_pruner(root, extra_skip=(), respect_gitignore: bool = True):
     """Predicate ``dirname -> bool`` (True = prune this directory).
 
@@ -177,6 +210,8 @@ def iter_files(
                 continue
             if guard_excluded(os.path.join(dirpath, d)):
                 continue  # denied subtree — never descended, never listed
+            if is_nested_checkout(os.path.join(dirpath, d)):
+                continue  # another checkout's copy of files we already index
             kept.append(d)
         dirnames[:] = kept
         seen += len(filenames) + len(kept)

{code_context_control-2.85.0 → code_context_control-2.86.0}/services/task_store.py

@@ -864,6 +864,69 @@ class TaskStore:
             self._save(doc)
             return {**ms, "detached_tasks": detached}
 
+    def complete_milestone(self, milestone_id) -> dict:
+        """Close a finished milestone; its tasks KEEP their milestone link.
+
+        The happy-path close, distinct from archive_milestone (removal:
+        detaches tasks, eligible for purge). A completed milestone leaves
+        default listings, the board, and the report, but history still
+        records which tasks shipped under it. Refuses while open active
+        tasks remain; undo with reopen_milestone().
+        """
+        with self._guard():
+            doc = self._load()
+            ms = self._resolve(doc["milestones"], milestone_id)
+            if ms is None:
+                return {"error": f"no milestone matches: {milestone_id}"}
+            old = ms.get("lifecycle", "active")
+            if old != "active":
+                return {"error": f"milestone is {old}, not active"}
+            open_tasks = [t for t in doc["tasks"]
+                          if t.get("milestone_id") == ms["id"]
+                          and t.get("lifecycle", "active") == "active"
+                          and t.get("status") != "done"]
+            if open_tasks:
+                names = ", ".join(t["id"][:8] for t in open_tasks[:5])
+                return {"error": f"{len(open_tasks)} open task(s) block "
+                                 f"completion: {names}"}
+            now = _now()
+            ms["lifecycle"] = "completed"
+            ms["completed_at"] = now
+            ms["updated_at"] = now
+            self._event("milestone", "complete", ms["id"],
+                        patch={"lifecycle": [old, "completed"]})
+            self._save(doc)
+            return dict(ms)
+
+    def reopen_milestone(self, milestone_id) -> dict:
+        """Completed -> active again; clears completed_at.
+
+        Accepts id, unique id prefix, or — because resolve_milestone's
+        name matching deliberately covers only ACTIVE milestones — a
+        unique case-insensitive name among the completed ones.
+        """
+        with self._guard():
+            doc = self._load()
+            ms = self._resolve(doc["milestones"], milestone_id)
+            if ms is None:
+                want = (milestone_id or "").strip().lower()
+                matches = [m for m in doc["milestones"]
+                           if m.get("lifecycle") == "completed"
+                           and (m.get("name") or "").lower() == want]
+                ms = matches[0] if len(matches) == 1 else None
+            if ms is None:
+                return {"error": f"no milestone matches: {milestone_id}"}
+            old = ms.get("lifecycle", "active")
+            if old != "completed":
+                return {"error": f"milestone is {old}, not completed"}
+            ms["lifecycle"] = "active"
+            ms["completed_at"] = None
+            ms["updated_at"] = _now()
+            self._event("milestone", "reopen", ms["id"],
+                        patch={"lifecycle": [old, "active"]})
+            self._save(doc)
+            return dict(ms)
+
     def resolve_milestone(self, ref: str):
         """Resolve by id, unique id prefix, or unique case-insensitive name."""
         doc = self._load()

{code_context_control-2.85.0 → code_context_control-2.86.0}/tests/test_access_guard.py

@@ -289,5 +289,77 @@ class TestEnforce(GuardBase):
         ag.enforce(str(self.proj / "src/ok.py"), "read", str(self.proj))
 
 
+class TestSeedDefaults(GuardBase):
+    """seed_default_global_rules — spec §1 removable defaults, sticky removal."""
+
+    def setUp(self):
+        super().setUp()
+        import unittest.mock as mock
+        self._home = Path(tempfile.mkdtemp())
+        self._gb = mock.patch.object(ag, "_global_base",
+                                     return_value=self._home)
+        self._gb.start()
+        self.global_cfg = self._home / ".c3" / "config.json"
+
+    def tearDown(self):
+        self._gb.stop()
+        import shutil
+        shutil.rmtree(self._home, ignore_errors=True)
+        super().tearDown()
+
+    def test_seeds_on_first_run(self):
+        res = ag.seed_default_global_rules()
+        self.assertTrue(res["seeded"])
+        data = json.loads(self.global_cfg.read_text(encoding="utf-8"))
+        self.assertEqual(data["access"]["deny"],
+                         list(ag.DEFAULT_GLOBAL_RULES))
+
+    def test_seeded_rules_are_enforced(self):
+        ag.seed_default_global_rules()
+        d = ag.check(str(self.proj / "server.pem"), "read", str(self.proj))
+        self.assertIsNotNone(d)
+        self.assertEqual(d.scope, "global")
+
+    def test_second_run_is_noop(self):
+        ag.seed_default_global_rules()
+        self.assertFalse(ag.seed_default_global_rules()["seeded"])
+
+    def test_removal_stays_sticky(self):
+        ag.seed_default_global_rules()
+        for glob in ag.DEFAULT_GLOBAL_RULES:
+            ag.remove_rule(glob, "deny", "global")
+        self.assertFalse(ag.seed_default_global_rules()["seeded"])
+        data = json.loads(self.global_cfg.read_text(encoding="utf-8"))
+        self.assertEqual(data["access"]["deny"], [])
+
+    def test_existing_access_section_never_touched(self):
+        self._write_access({"deny": ["mine/**"]}, base=self._home)
+        self.assertFalse(ag.seed_default_global_rules()["seeded"])
+        data = json.loads(self.global_cfg.read_text(encoding="utf-8"))
+        self.assertEqual(data["access"]["deny"], ["mine/**"])
+
+    def test_config_without_access_section_preserves_other_keys(self):
+        self.global_cfg.parent.mkdir(parents=True, exist_ok=True)
+        self.global_cfg.write_text(json.dumps({"other": {"k": 1}}),
+                                   encoding="utf-8")
+        res = ag.seed_default_global_rules()
+        self.assertTrue(res["seeded"])
+        data = json.loads(self.global_cfg.read_text(encoding="utf-8"))
+        self.assertEqual(data["other"], {"k": 1})
+        self.assertEqual(data["access"]["deny"],
+                         list(ag.DEFAULT_GLOBAL_RULES))
+
+    def test_corrupt_config_never_rewritten(self):
+        self.global_cfg.parent.mkdir(parents=True, exist_ok=True)
+        self.global_cfg.write_text("{nope", encoding="utf-8")
+        self.assertFalse(ag.seed_default_global_rules()["seeded"])
+        self.assertEqual(self.global_cfg.read_text(encoding="utf-8"), "{nope")
+
+    def test_no_home_is_a_noop(self):
+        import unittest.mock as mock
+        with mock.patch.object(ag, "_global_base", return_value=None):
+            self.assertFalse(ag.seed_default_global_rules()["seeded"])
+
+
 if __name__ == "__main__":
     unittest.main()