code-context-control 2.86.0__tar.gz → 2.89.0__tar.gz

{code_context_control-2.86.0/code_context_control.egg-info → code_context_control-2.89.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.86.0
+Version: 2.89.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.86.0 → code_context_control-2.89.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.86.0"
+__version__ = "2.89.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -5899,7 +5899,7 @@ def cmd_creds(args):
     """Credential vault management (global + per-project scopes)."""
     sub = getattr(args, "creds_cmd", None)
     if not sub:
-        print("Usage: c3 creds {set,get,list,rm,import} [args]")
+        print("Usage: c3 creds {set,get,list,rm,import,usage} [args]")
         return
 
     project_path = getattr(args, "project_path", ".") or "."
@@ -5914,6 +5914,8 @@ def cmd_creds(args):
         _creds_cmd_rm(args, project_path)
     elif sub == "import":
         _creds_cmd_import(args, project_path)
+    elif sub == "usage":
+        _creds_cmd_usage(args, project_path)
     else:
         print(f"Unknown creds subcommand: {sub}")
 
@@ -5928,6 +5930,9 @@ def _creds_entry_line(name: str, entry: dict) -> str:
         f"{name:<24} {entry.get('scope', '?'):<8} {entry.get('type', 'token'):<10}"
         f" len={entry.get('value_len', '?')}",
     ]
+    display = entry.get("display") or {}
+    if display:
+        parts.append(" ".join(str(v) for v in display.values() if v))
     if entry.get("env_var"):
         parts.append(f"env_var={entry['env_var']}")
     if flags:
@@ -5937,16 +5942,49 @@ def _creds_entry_line(name: str, entry: dict) -> str:
     return "  ".join(parts)
 
 
+_CREDS_HIDDEN_FIELDS = {"number", "cvc", "ssn"}  # prompted via getpass
+
+
+def _creds_prompt_structured(name: str, ctype: str) -> str:
+    """Interactive per-field prompt for a structured entry; returns JSON.
+    Sensitive fields use a hidden prompt; empty optional fields are skipped."""
+    import getpass
+    import json as _json
+
+    from services import credential_store as cred_store
+
+    required, optional = cred_store.schema_fields(ctype)
+    print(f"Enter {ctype} fields for '{name}' "
+          "(optional fields: press Enter to skip):")
+    fields: dict = {}
+    for fname in list(required) + list(optional):
+        tag = "" if fname in required else " (optional)"
+        if fname in _CREDS_HIDDEN_FIELDS:
+            raw = getpass.getpass(f"  {fname}{tag}: ")
+        else:
+            raw = input(f"  {fname}{tag}: ")
+        if raw.strip():
+            fields[fname] = raw.strip()
+    return _json.dumps(fields)
+
+
 def _creds_cmd_set(args, project_path: str) -> None:
     import getpass
 
     from services import credential_store as cred_store
 
+    ctype = getattr(args, "ctype", "token") or "token"
     value = getattr(args, "value", "") or ""
     if getattr(args, "stdin", False):
         value = sys.stdin.read().rstrip("\n")
     if not value:
-        value = getpass.getpass(f"Value for {args.name}: ")
+        if ctype in cred_store.STRUCTURED_TYPES:
+            value = _creds_prompt_structured(args.name, ctype)
+            if value == "{}":
+                print("Cancelled -- no fields entered.")
+                return
+        else:
+            value = getpass.getpass(f"Value for {args.name}: ")
     if not value:
         print("Cancelled -- value required.")
         return
@@ -5956,7 +5994,7 @@ def _creds_cmd_set(args, project_path: str) -> None:
             args.name, value,
             scope=scope, project_path=project_path,
             description=getattr(args, "desc", "") or "",
-            ctype=getattr(args, "ctype", "token") or "token",
+            ctype=ctype,
             env_var=getattr(args, "env_var", "") or "",
             agent_readable=bool(getattr(args, "agent_readable", False)),
             inject=bool(getattr(args, "inject", False)),
@@ -5971,6 +6009,19 @@ def _creds_cmd_set(args, project_path: str) -> None:
               "into its context and transcripts.")
 
 
+def _creds_count_show(refs, project_path: str) -> None:
+    """Count a terminal --show like any other use: state counter + history."""
+    from services import credential_store as cred_store
+    try:
+        cred_store.touch_last_used(
+            sorted({str(r).partition(".")[0] for r in refs}), project_path)
+        from services import cred_telemetry as ct
+        ct.record_use(refs, project_path=project_path,
+                      action=ct.ACTION_CLI_SHOW, surface="cli")
+    except Exception:
+        pass
+
+
 def _creds_cmd_get(args, project_path: str) -> None:
     from services import credential_store as cred_store
 
@@ -5981,11 +6032,46 @@ def _creds_cmd_get(args, project_path: str) -> None:
     print(_creds_entry_line(args.name, entry))
     print(f"storage={entry.get('storage', 'keyring')}  "
           f"created={entry.get('created', '?')}  updated={entry.get('updated', '?')}")
-    fp = cred_store.fingerprint(args.name, project_path=project_path)
-    print(f"fingerprint={fp or 'unresolvable'}")
-    if getattr(args, "show", False):
-        value = cred_store.get_value(args.name, project_path=project_path)
-        print(value if value is not None else "[error] value missing from store")
+    stype = cred_store.structured_type(args.name, project_path=project_path)
+    field = (getattr(args, "field", "") or "").strip()
+    if not stype:
+        fp = cred_store.fingerprint(args.name, project_path=project_path)
+        print(f"fingerprint={fp or 'unresolvable'}")
+        if field:
+            print(f"[error] '{args.name}' is not structured -- --field does not apply")
+            return
+        if getattr(args, "show", False):
+            value = cred_store.get_value(args.name, project_path=project_path)
+            print(value if value is not None
+                  else "[error] value missing from store")
+            if value is not None:
+                _creds_count_show([args.name], project_path)
+        return
+    print(f"fields: {', '.join(entry.get('fields') or []) or 'none recorded'}")
+    if not getattr(args, "show", False):
+        if field:
+            print("[hint] add --show to print the field value")
+        return
+    # --show: the deliberate human read-back path (terminal only; the wire
+    # never carries these values). Counted as usage like any other reveal.
+    if field:
+        value = cred_store.get_value(args.name, project_path=project_path,
+                                     field=field)
+        if value is None:
+            print(f"[error] no field '{field}' on '{args.name}'")
+            return
+        print(value)
+        _creds_count_show([f"{args.name}.{field}"], project_path)
+    else:
+        fields = cred_store.get_structured_fields(
+            args.name, project_path=project_path)
+        if fields is None:
+            print("[error] value missing from store")
+            return
+        width = max(len(k) for k in fields)
+        for key in sorted(fields):
+            print(f"{key:<{width}}  {fields[key]}")
+        _creds_count_show([args.name], project_path)
 
 
 def _creds_cmd_list(args, project_path: str) -> None:
@@ -6039,6 +6125,39 @@ def _creds_cmd_import(args, project_path: str) -> None:
               "(use --overwrite to replace)")
 
 
+def _creds_cmd_usage(args, project_path: str) -> None:
+    import json as _json
+
+    from services import cred_telemetry as ct
+
+    name = getattr(args, "name", "") or ""
+    limit = max(1, int(getattr(args, "limit", 20) or 20))
+    agg = ct.aggregate(project_path, name=name)
+    recent = ct.search_events(project_path, name=name, limit=limit)
+    if getattr(args, "as_json", False):
+        print(_json.dumps({"aggregate": agg, "recent": recent}, indent=2))
+        return
+    if not agg["total"]:
+        target = f" for '{name}'" if name else ""
+        print(f"No recorded credential uses{target} yet.")
+        return
+    surf = "  ".join(f"{s}:{c}" for s, c in sorted(agg["by_surface"].items()))
+    print(f"{agg['total']} use(s) across {len(agg['rows'])} credential(s)"
+          f"  [{surf}]")
+    for row in agg["rows"]:
+        fields = f"  fields: {', '.join(row['fields'])}" if row["fields"] else ""
+        print(f"  {row['name']:<24} {row['hits']:>4}x  last {row['last_ts'] or '?'}"
+              f"  projects={row['projects']}{fields}")
+    print(f"recent (newest first, {len(recent['events'])}"
+          f"/{recent['matched']}):")
+    for e in recent["events"]:
+        ref = e["name"] + (f".{e['field']}" if e.get("field") else "")
+        exit_part = f" exit={e['exit']}" if "exit" in e else ""
+        cmd_part = f"  {e['cmd']}" if e.get("cmd") else ""
+        print(f"  {e.get('ts', '?')}  {e.get('action', '?'):<10} {ref:<28}"
+              f" [{e.get('surface', '?')}]{exit_part}{cmd_part}")
+
+
 def cmd_ci(args):
     """AgentCI entry point — exits with the finding.
 

{code_context_control-2.86.0 → code_context_control-2.89.0}/cli/commands/parser.py

@@ -417,9 +417,14 @@ def build_parser(version: str, parse_cli_ide_arg):
         "set", help="Create or update a credential (value via hidden prompt)"
     )
     cr_set.add_argument("name", help="Entry name (env-var safe: [A-Za-z_][A-Za-z0-9_]*)")
-    cr_set.add_argument("--value", default="", help="Secret value (prompted via getpass if omitted — preferred)")
+    cr_set.add_argument("--value", default="", help="Secret value (prompted via getpass if omitted — preferred). Structured types take a JSON object of fields")
     cr_set.add_argument("--stdin", action="store_true", help="Read the value from stdin (piped/multiline values)")
-    cr_set.add_argument("--type", dest="ctype", choices=["token", "env", "multiline"], default="token", help="Entry type")
+    cr_set.add_argument("--type", dest="ctype",
+                        choices=["token", "env", "multiline",
+                                 "address", "identity", "card"],
+                        default="token",
+                        help="Entry type; address/identity/card are structured "
+                             "(field payload, inject-only, never revealable to the agent)")
     cr_set.add_argument("--desc", default="", help="Human description shown in list/UI")
     cr_set.add_argument("--env-var", default="", help="Env var name used at injection (default: entry name)")
     cr_set.add_argument("--agent-readable", action="store_true", help="Allow the agent to reveal the decoded value into its context (default: injection-only)")
@@ -432,6 +437,7 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_get = creds_subs.add_parser("get", help="Show entry metadata (masked; --show prints the value)")
     cr_get.add_argument("name")
     cr_get.add_argument("--show", action="store_true", help="Print the decoded value to the terminal")
+    cr_get.add_argument("--field", default="", help="For structured entries: limit --show to one field (e.g. number)")
     cr_get.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
     cr_list = creds_subs.add_parser("list", help="List credentials visible to this project")
@@ -448,6 +454,13 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_import.add_argument("--overwrite", action="store_true", help="Replace entries already registered in the target scope")
     cr_import.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
+    cr_usage = creds_subs.add_parser(
+        "usage", help="Usage history — when, where, and how often credentials were used")
+    cr_usage.add_argument("name", nargs="?", default="", help="Limit to one credential (default: all)")
+    cr_usage.add_argument("--limit", type=int, default=20, help="Recent events to show (default: 20)")
+    cr_usage.add_argument("--json", dest="as_json", action="store_true", help="Emit raw JSON")
+    cr_usage.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
+
     # ── Agent Locks (docs/agent-locks.md) ───────────────────────────────
     # force-release is human-only: it bumps the fencing counter so a holder
     # that comes back is stale by construction. Agents get c3_locks instead,

{code_context_control-2.86.0 → code_context_control-2.89.0}/cli/guide/bitbucket.html

@@ -266,6 +266,8 @@ c3_bitbucket(action=<span class="str">'get_pr'</span>, pr_id=<span class="num">4
           <tr><td class="grp-read"><code>get_pr</code></td>       <td><code>project, repo, pr_id</code></td><td>Full PR detail incl. version, reviewers, description, open-tasks</td></tr>
           <tr><td class="grp-read"><code>get_pr_diff</code></td>  <td><code>project, repo, pr_id, context_lines?</code></td><td>Unified diff (truncated to 6000 chars in the response)</td></tr>
           <tr><td class="grp-read"><code>get_pr_activities</code></td><td><code>project, repo, pr_id</code></td><td>PR event timeline (comments, approvals, reviewer changes)</td></tr>
+          <tr><td class="grp-read"><code>get_pr_commits</code></td><td><code>project, repo, pr_id</code></td><td>Commits on the PR, newest first</td></tr>
+          <tr><td class="grp-read"><code>list_pr_tasks</code></td><td><code>project, repo, pr_id, state?</code></td><td>PR tasks (BLOCKER-severity comments); <code>state=OPEN|RESOLVED</code> filters</td></tr>
           <tr><td class="grp-read"><code>list_branches</code></td><td><code>project, repo, filter?</code></td><td>Branches with ahead/behind counts and default-branch flag</td></tr>
           <tr><td class="grp-read"><code>list_commits</code></td> <td><code>project, repo, branch?, path?, limit?</code></td><td>Commit log on a branch / path</td></tr>
           <tr><td class="grp-read"><code>list_activity</code></td><td><code>project, repo, limit?</code></td><td>Repo activity feed (commit-based)</td></tr>
@@ -278,9 +280,15 @@ c3_bitbucket(action=<span class="str">'get_pr'</span>, pr_id=<span class="num">4
         <thead><tr><th>Action</th><th>Args</th><th>Description</th></tr></thead>
         <tbody>
           <tr><td class="grp-write"><code>create_pr</code></td>   <td><code>title, from_branch, to_branch, description?, reviewers?</code></td><td>Open a new PR. <code>reviewers</code> may be a list or comma-separated string.</td></tr>
+          <tr><td class="grp-write"><code>update_pr</code></td>   <td><code>pr_id, title?, description?, to_branch?, reviewers?</code></td><td>Edit an open PR. Unchanged fields are merged from the live PR; the current version is auto-fetched. <code>reviewers</code> is the full replacement set.</td></tr>
           <tr><td class="grp-write"><code>comment_pr</code></td>  <td><code>pr_id, body</code></td>            <td>Add a top-level comment</td></tr>
+          <tr><td class="grp-write"><code>update_pr_comment</code></td><td><code>pr_id, comment_id, body</code></td><td>Edit a comment's text. The comment's current version is auto-fetched.</td></tr>
+          <tr><td class="grp-write"><code>delete_pr_comment</code></td><td><code>pr_id, comment_id</code></td> <td>Delete a comment (version auto-fetched)</td></tr>
+          <tr><td class="grp-write"><code>create_pr_task</code></td><td><code>pr_id, body</code></td>          <td>Open a task on the PR — a BLOCKER-severity comment that gates merge</td></tr>
+          <tr><td class="grp-write"><code>resolve_pr_task</code></td><td><code>pr_id, comment_id</code></td>   <td>Resolve a task by its id (from <code>list_pr_tasks</code>)</td></tr>
           <tr><td class="grp-write"><code>approve_pr</code></td>  <td><code>pr_id</code></td>                  <td>Mark the PR approved as the current user</td></tr>
           <tr><td class="grp-write"><code>unapprove_pr</code></td><td><code>pr_id</code></td>                  <td>Withdraw approval</td></tr>
+          <tr><td class="grp-write"><code>needs_work_pr</code></td><td><code>pr_id</code></td>                 <td>Mark the PR "needs work" as the current user (the third reviewer verdict)</td></tr>
           <tr><td class="grp-write"><code>decline_pr</code></td>  <td><code>pr_id</code></td>                  <td>Decline the PR. Auto-fetches the current PR version first.</td></tr>
           <tr><td class="grp-write"><code>merge_pr</code></td>    <td><code>pr_id, message?</code></td>        <td>Merge the PR. Auto-fetches the current PR version first; logs to the C3 edit ledger.</td></tr>
         </tbody>
@@ -365,9 +373,10 @@ c3_bitbucket(action=<span class="str">'get_pr'</span>, pr_id=<span class="num">4
       <table class="params-table">
         <thead><tr><th>Action</th><th>Why it's logged</th></tr></thead>
         <tbody>
-          <tr><td><code>create_pr</code></td>            <td>New PR opened — relevant for review timeline</td></tr>
-          <tr><td><code>comment_pr</code></td>           <td>Discussion contribution worth recovering on / clear</td></tr>
-          <tr><td><code>approve_pr</code> / <code>unapprove_pr</code></td><td>Reviewer state changes</td></tr>
+          <tr><td><code>create_pr</code> / <code>update_pr</code></td><td>PR opened or its title/description/reviewers/target edited — relevant for review timeline</td></tr>
+          <tr><td><code>comment_pr</code> / <code>update_pr_comment</code> / <code>delete_pr_comment</code></td><td>Discussion contributions worth recovering on / clear</td></tr>
+          <tr><td><code>create_pr_task</code> / <code>resolve_pr_task</code></td><td>Merge-gating task opened or closed</td></tr>
+          <tr><td><code>approve_pr</code> / <code>unapprove_pr</code> / <code>needs_work_pr</code></td><td>Reviewer state changes</td></tr>
           <tr><td><code>decline_pr</code></td>           <td>PR closed without merge</td></tr>
           <tr><td><code>merge_pr</code></td>             <td>Code now lives in the target branch — high-impact</td></tr>
           <tr><td><code>create_branch</code> / <code>delete_branch</code></td><td>Branch topology changed</td></tr>

{code_context_control-2.86.0 → code_context_control-2.89.0}/cli/guide/credentials.html

@@ -105,11 +105,13 @@
       <a href="#storage"         class="sidebar-link"><span class="icon">🗄️</span> Where values live</a>
       <a href="#scopes"          class="sidebar-link"><span class="icon">🌍</span> Scopes &amp; overriding</a>
       <a href="#agent-use"       class="sidebar-link"><span class="icon">🤖</span> How agents use them</a>
+      <a href="#structured"      class="sidebar-link"><span class="icon">💳</span> Structured kinds</a>
       <a href="#exposure"        class="sidebar-link"><span class="icon">⚠️</span> Exposure flags</a>
       <a href="#hub-ui"          class="sidebar-link"><span class="icon">🖥️</span> Hub UI</a>
       <a href="#search"          class="sidebar-link"><span class="icon">🔎</span> Search &amp; qualifiers</a>
       <a href="#cli"             class="sidebar-link"><span class="icon">💻</span> CLI commands</a>
       <a href="#actions"         class="sidebar-link"><span class="icon">⚙️</span> Tool actions</a>
+      <a href="#usage"           class="sidebar-link"><span class="icon">📊</span> Usage history</a>
       <a href="#audit"           class="sidebar-link"><span class="icon">📝</span> Audit trail</a>
       <a href="#troubleshooting" class="sidebar-link"><span class="icon">🛠️</span> Troubleshooting</a>
     </div>
@@ -293,6 +295,48 @@ c3_shell(cmd=<span class="str">'terraform apply'</span>, env_creds=<span class="
 
     <hr class="divider">
 
+    <!-- ═══════════════════════════════════ STRUCTURED ═══ -->
+    <section id="structured" class="tool-section">
+      <h2>Structured kinds — cards, addresses, identity (v2.87.0)</h2>
+
+      <p>Three entry types hold <strong>named fields</strong> instead of one opaque value:
+      <code>card</code> (cardholder, number, expiry, optional cvc/billing_zip — Luhn-checked),
+      <code>address</code> (street1, city, state, zip, optional recipient/street2/country/phone) and
+      <code>identity</code> (full_name, optional dob/ssn/phone/email). The payload is stored as one
+      canonical JSON object through the same keyring / encrypted-sidecar path as any other value.</p>
+
+      <p>They are <strong>inject-only by construction</strong>, which is stricter than a normal secret:</p>
+      <ul>
+        <li><strong>Reveal is permanently disabled</strong> — <code>agent_readable</code> and
+        <code>inject</code> are refused at every surface, for every caller, forever. There is no flag to flip.</li>
+        <li><strong>Only single fields cross the boundary.</strong> The agent addresses a field —
+        <code>env_creds='CARD.number'</code> (exported as <code>$CARD_NUMBER</code>) or
+        <code>{{cred:CARD.number}}</code> inline — and a bare <code>{{cred:CARD}}</code> fails with
+        the field list rather than expanding the whole payload.</li>
+        <li><strong>The registry shows a projection, not the data.</strong> Lists and the UI display
+        <code>visa ••••4242</code> for a card (brand + last4, deliberately <em>not</em> expiry),
+        city/state for an address, the name for an identity. Field <em>names</em> are public;
+        field <em>values</em> never transit any HTTP response — a sweep test enforces this.</li>
+        <li><strong>Echoes redact per field</strong> to <code>[cred:NAME.field]</code>. Caveat: the
+        redactor only tracks values of 4+ characters, so a 3-digit CVC or 2-letter state that a
+        child process echoes cannot be scrubbed after the fact. The real guarantee remains
+        decode-at-the-subprocess-boundary; redaction is the belt over it.</li>
+        <li><strong>The type boundary is immutable.</strong> A card cannot be rewritten into a
+        plain token (or vice versa) by <code>set</code>, metadata update, or <code>.env</code>
+        import — delete and re-create is the only path across, and a keyring attestation keeps an
+        entry structured even if <code>.c3/config.json</code> is edited by hand.</li>
+      </ul>
+
+      <p>Updating one field never requires retyping the rest: a partial payload
+      <strong>merges</strong> (<code>{"expiry": "01/30"}</code> updates the expiry, JSON
+      <code>null</code> deletes an optional field). Read-back for <em>you</em> is terminal-only:
+      <code>c3 creds get NAME --show</code> (all fields) or <code>--show --field number</code> —
+      the browser and the mobile gateway never carry the values, and mobile cannot create
+      structured entries at all.</p>
+    </section>
+
+    <hr class="divider">
+
     <!-- ═══════════════════════════════════════ EXPOSURE ═══ -->
     <section id="exposure" class="tool-section">
       <h2>Exposure flags</h2>
@@ -478,6 +522,42 @@ c3_shell(cmd=<span class="str">'terraform apply'</span>, env_creds=<span class="
     <hr class="divider">
 
     <!-- ═══════════════════════════════════════ AUDIT ═══ -->
+    <section id="usage" class="tool-section">
+      <h2>Usage history (v2.88.0)</h2>
+
+      <p>Every time a value leaves the vault — an <code>env_creds</code> injection, a
+      <code>{{cred:NAME}}</code> expansion, a gated reveal, a terminal
+      <code>c3 creds get --show</code> — one event is appended to the owning scope's
+      <code>.c3/cred_usage.jsonl</code>: timestamp, name (and field for structured entries),
+      action, surface, project, exit code, and the command in its <strong>raw template
+      form</strong>, capped at 120 characters. Never the expanded string, never a value.
+      A global credential's usage from every project lands in <code>~/.c3</code>, so its
+      history is complete in one place.</p>
+
+      <p>Reading it back:</p>
+      <ul>
+        <li><strong>UI</strong> — the Credentials tab's <em>usage</em> sub-view (totals,
+        per-credential counts by surface, expandable recent events) and the hub drawer's
+        “Usage &amp; relationships” section.</li>
+        <li><strong>CLI</strong> — <code>c3 creds usage [NAME] [--limit N] [--json]</code>.</li>
+        <li><strong>Agent</strong> — <code>c3_credentials(action='usage')</code>. Scoped on
+        purpose: the agent sees full events (including command previews) only for the
+        <em>current</em> project; other projects' use of a shared global credential is
+        reduced to counts, so one project's agent cannot read another's command lines
+        through the vault. Your surfaces (UI/CLI) show everything.</li>
+        <li><strong>REST</strong> — <code>GET /api/credentials/usage</code> and
+        <code>GET /api/credentials/&lt;name&gt;/usage</code> (hub:
+        <code>/api/projects/credentials/usage</code>).</li>
+      </ul>
+
+      <p>The log rotates at 512KB (one <code>.1</code> generation retained), both filenames
+      are vault-write-protected and gitignored, and the lightweight
+      <code>last_used</code>/<code>use_count</code> counters you already see on list rows
+      keep working exactly as before — they are the summary; this is the history.</p>
+    </section>
+
+    <hr class="divider">
+
     <section id="audit" class="tool-section">
       <h2>Audit trail</h2>
 

{code_context_control-2.86.0 → code_context_control-2.89.0}/cli/guide/tools.html

@@ -1217,8 +1217,10 @@ c3_artifacts(action=<span class="str">'show'</span>, artifact=<span class="str">
               <tr><td class="param-name">status</td><td>Read</td><td class="param-desc">Active account, accounts list, defaults, server-version probe</td></tr>
               <tr><td class="param-name">whoami</td><td>Read</td><td class="param-desc">Current authenticated user (PAT owner)</td></tr>
               <tr><td class="param-name">list_projects, list_repos, get_repo</td><td>Read</td><td class="param-desc">Project / repository discovery</td></tr>
-              <tr><td class="param-name">list_prs, get_pr, get_pr_diff, get_pr_activities</td><td>Read</td><td class="param-desc">PR browsing + diff + activity feed</td></tr>
-              <tr><td class="param-name">create_pr, comment_pr, approve_pr, unapprove_pr, decline_pr, merge_pr</td><td>Write</td><td class="param-desc">PR write actions. <code>merge_pr</code> and <code>decline_pr</code> auto-fetch the PR's current version</td></tr>
+              <tr><td class="param-name">list_prs, get_pr, get_pr_diff, get_pr_activities, get_pr_commits</td><td>Read</td><td class="param-desc">PR browsing + diff + activity feed + commit list</td></tr>
+              <tr><td class="param-name">create_pr, update_pr, comment_pr, approve_pr, unapprove_pr, needs_work_pr, decline_pr, merge_pr</td><td>Write</td><td class="param-desc">PR write actions. <code>update_pr</code> edits title/description/reviewers/to_branch (unchanged fields preserved); <code>merge_pr</code>, <code>decline_pr</code>, and <code>update_pr</code> auto-fetch the PR's current version; <code>needs_work_pr</code> marks "needs work" as the current user</td></tr>
+              <tr><td class="param-name">update_pr_comment, delete_pr_comment</td><td>Write</td><td class="param-desc">Edit or remove a PR comment by <code>comment_id</code> — the comment's current version is fetched automatically</td></tr>
+              <tr><td class="param-name">list_pr_tasks, create_pr_task, resolve_pr_task</td><td>Tasks</td><td class="param-desc">PR tasks (Bitbucket 7.2+ model: a task is a BLOCKER-severity comment). <code>list_pr_tasks</code> filters by <code>state=OPEN|RESOLVED</code>; resolve takes the task's <code>comment_id</code></td></tr>
               <tr><td class="param-name">list_branches, create_branch, delete_branch</td><td>Branch</td><td class="param-desc">Branch listing and admin (uses the <code>branch-utils</code> API)</td></tr>
               <tr><td class="param-name">list_commits, list_activity, build_status</td><td>Read</td><td class="param-desc">Recent commits, activity, build/CI status (defaults to default-branch HEAD)</td></tr>
               <tr><td class="param-name">repo_settings, update_repo_settings, list_webhooks, create_webhook, delete_webhook, list_permissions</td><td>Admin</td><td class="param-desc">Repository administration</td></tr>
@@ -1310,9 +1312,15 @@ c3_shell(cmd=<span class="str">'curl -H "Authorization: Bearer {{cred:API_KEY}}"
               <tr><td class="param-name">status, whoami</td><td>Read</td><td class="param-desc">Active account, deployment, defaults, server probe / authenticated user</td></tr>
               <tr><td class="param-name">search</td><td>Read</td><td class="param-desc">Raw JQL, paginated (helper-built JQL elsewhere is always quoted)</td></tr>
               <tr><td class="param-name">my_issues</td><td>Read</td><td class="param-desc">Open issues assigned to the token's user (statusCategory-aware)</td></tr>
-              <tr><td class="param-name">get_issue, list_projects, list_transitions</td><td>Read</td><td class="param-desc">Issue detail with comments / project discovery / legal transitions for an issue</td></tr>
-              <tr><td class="param-name">get_create_metadata, search_users</td><td>Read</td><td class="param-desc">Required + allowed fields per project/type; user lookup for assignment</td></tr>
-              <tr><td class="param-name">create_issue</td><td>Write</td><td class="param-desc">Pre-validates against create metadata and returns machine-readable missing required fields instead of guessing defaults</td></tr>
+              <tr><td class="param-name">get_issue, list_projects, list_transitions</td><td>Read</td><td class="param-desc">Issue detail with comments, parent, and typed links / project discovery / legal transitions for an issue</td></tr>
+              <tr><td class="param-name">get_create_metadata, search_users, list_link_types</td><td>Read</td><td class="param-desc">Field configuration per project/type (ids + names; the create screen may accept fewer — Jira over-reports, Epic Link is the classic case); user lookup for assignment; the server's issue-link type catalog</td></tr>
+              <tr><td class="param-name">list_boards, list_sprints, list_worklogs</td><td>Read</td><td class="param-desc">Agile boards (project fallback applies) &rarr; sprints per board (<code>sprint_state=active|future|closed</code>); an issue's logged time</td></tr>
+              <tr><td class="param-name">move_to_sprint, move_to_backlog</td><td>Write</td><td class="param-desc">Sprint assignment via the Agile API — <code>issue</code> takes one key or a comma-list; <code>sprint_id</code> comes from <code>list_sprints</code></td></tr>
+              <tr><td class="param-name">add_worklog, attach_file</td><td>Write</td><td class="param-desc">Log time (<code>time_spent='2h 30m'</code>, optional <code>body</code> comment); upload one local file as an attachment (20MB local cap)</td></tr>
+              <tr><td class="param-name">unlink_issues, delete_issue</td><td>Write</td><td class="param-desc">Remove a typed link by <code>link_id</code> (shown on get_issue); permanently delete an issue — refuses one with subtasks unless <code>delete_subtasks=true</code></td></tr>
+              <tr><td class="param-name">create_issue</td><td>Write</td><td class="param-desc">Pre-validates against create metadata and returns machine-readable missing required fields instead of guessing defaults. <code>parent=EPIC-KEY</code> files the new issue under an epic (deployment-mapped)</td></tr>
+              <tr><td class="param-name">update_issue</td><td>Write</td><td class="param-desc">Edit an existing issue: summary, description, <code>parent</code> (epic/parent key; <code>'none'</code> clears), or a fields JSON of field ids &rarr; values — the fallback when the create screen rejects a field ("not on the appropriate screen")</td></tr>
+              <tr><td class="param-name">link_issues</td><td>Write</td><td class="param-desc">Typed link reading <code>&lt;issue&gt; &lt;link_type&gt; &lt;target&gt;</code> — accepts a type name or either directional phrasing (an inward match flips the pair); unknown types answer with the catalog</td></tr>
               <tr><td class="param-name">comment, transition, assign</td><td>Write</td><td class="param-desc">Comment on / move (accepts transition id <em>or</em> name) / assign an issue</td></tr>
             </tbody>
           </table>
@@ -1330,12 +1338,31 @@ c3_jira(action=<span class="str">'get_create_metadata'</span>, project=<span cla
 c3_jira(action=<span class="str">'create_issue'</span>, project=<span class="str">'PROJ'</span>, issue_type=<span class="str">'Task'</span>,
         summary=<span class="str">'Fix login flow'</span>, description=<span class="str">'Steps in thread'</span>)
 
+<span class="com"># Field rejected on create ("not on the appropriate screen")? Set it post-create</span>
+c3_jira(action=<span class="str">'update_issue'</span>, issue=<span class="str">'PROJ-124'</span>, fields=<span class="str">'{"customfield_10014": "PROJ-42"}'</span>)
+
+<span class="com"># Put an issue under an epic — no customfield hunting (Cloud parent field
+# vs Data Center Epic Link customfield is resolved for you)</span>
+c3_jira(action=<span class="str">'update_issue'</span>, issue=<span class="str">'PROJ-124'</span>, parent=<span class="str">'PROJ-42'</span>)
+
+<span class="com"># Typed links: reads "PROJ-1 blocks PROJ-2"</span>
+c3_jira(action=<span class="str">'link_issues'</span>, issue=<span class="str">'PROJ-1'</span>, link_type=<span class="str">'blocks'</span>, target=<span class="str">'PROJ-2'</span>)
+
+<span class="com"># Sprint flow: board -> sprint -> assign</span>
+c3_jira(action=<span class="str">'list_boards'</span>)
+c3_jira(action=<span class="str">'list_sprints'</span>, board_id=<span class="num">7</span>, sprint_state=<span class="str">'active'</span>)
+c3_jira(action=<span class="str">'move_to_sprint'</span>, issue=<span class="str">'PROJ-1, PROJ-2'</span>, sprint_id=<span class="num">42</span>)
+
+<span class="com"># Time + evidence</span>
+c3_jira(action=<span class="str">'add_worklog'</span>, issue=<span class="str">'PROJ-1'</span>, time_spent=<span class="str">'2h 30m'</span>, body=<span class="str">'pairing'</span>)
+c3_jira(action=<span class="str">'attach_file'</span>, issue=<span class="str">'PROJ-1'</span>, file_path=<span class="str">'logs/build.log'</span>)
+
 <span class="com"># Move it along — id or name both work</span>
 c3_jira(action=<span class="str">'list_transitions'</span>, issue=<span class="str">'PROJ-123'</span>)
 c3_jira(action=<span class="str">'transition'</span>, issue=<span class="str">'PROJ-123'</span>, transition=<span class="str">'In Progress'</span>)
 c3_jira(action=<span class="str">'comment'</span>, issue=<span class="str">'PROJ-123'</span>, body=<span class="str">'Deployed to staging'</span>)</code></pre>
 
-          <p class="tool-desc"><strong>Surfaces &amp; audit:</strong> the per-project dashboard gets a <strong>Jira tab</strong> (My Work board grouped by statusCategory, JQL search, an issue drawer with transition buttons + comments, and an Activity view) backed by <code>/api/jira/*</code> routes. Issue keys like <code>PROJ-123</code> are auto-linked from branch names and edit-ledger entries (acronym denylist, so UTF-8 / SHA-256 / CVE-2024 never match), and the issue drawer shows the local ledger activity for the open issue — that Activity view works with no account configured. Mutations (<code>create_issue</code>, <code>comment</code>, <code>transition</code>, <code>assign</code>) are edit-ledger-logged with identifiers only — bodies are never logged. Read actions are safe in plan mode.</p>
+          <p class="tool-desc"><strong>Surfaces &amp; audit:</strong> the per-project dashboard gets a <strong>Jira tab</strong> (My Work board grouped by statusCategory, JQL search, an issue drawer with transition buttons + comments, and an Activity view) backed by <code>/api/jira/*</code> routes. Issue keys like <code>PROJ-123</code> are auto-linked from branch names and edit-ledger entries (acronym denylist, so UTF-8 / SHA-256 / CVE-2024 never match), and the issue drawer shows the local ledger activity for the open issue — that Activity view works with no account configured. Mutations (<code>create_issue</code>, <code>update_issue</code>, <code>comment</code>, <code>transition</code>, <code>assign</code>, <code>link_issues</code>, <code>unlink_issues</code>, <code>move_to_sprint</code>, <code>move_to_backlog</code>, <code>add_worklog</code>, <code>attach_file</code>, <code>delete_issue</code>) are edit-ledger-logged with identifiers only — bodies are never logged. Read actions are safe in plan mode.</p>
         </div>
       </div>
     </div>

{code_context_control-2.86.0 → code_context_control-2.89.0}/cli/hook_pretool_enforce.py

@@ -113,7 +113,8 @@ _WRITE_CLASS_ALWAYS = frozenset({"Edit", "Write", "MultiEdit"})
 # Vault files no native write may touch, regardless of unlock state.
 # Mirrors services.credential_store.VAULT_PROTECTED_FILES (parity-tested);
 # duplicated because hooks must stay import-light.
-_VAULT_FILES = frozenset({"config.json", "secrets.enc", "cred_state.json"})
+_VAULT_FILES = frozenset({"config.json", "secrets.enc", "cred_state.json",
+                          "cred_usage.jsonl", "cred_usage.jsonl.1"})
 
 # Redirect messages per native tool
 _REDIRECTS = {

{code_context_control-2.86.0 → code_context_control-2.89.0}/cli/hub_server.py

@@ -2026,7 +2026,9 @@ def api_projects_credentials_set():
         str(data.get("path") or "").strip(), scope, mutation=True)
     if err:
         return err
-    value = str(data.get("value") or "")
+    value = data.get("value")
+    # Structured kinds submit a field OBJECT; the store takes JSON text.
+    value = json.dumps(value) if isinstance(value, dict) else str(value or "")
     ctype = str(data.get("type") or data.get("ctype") or "token")
     try:
         if value:
@@ -2123,11 +2125,40 @@ def api_projects_credentials_check(name):
         "name": name,
         "scope": entry["scope"],
         "storage": entry.get("storage", "keyring"),
-        "resolvable": cred_store.get_value(name, project_path=store_path) is not None,
+        # is_resolvable, not get_value: a structured entry never resolves
+        # whole, but its payload being decodable is what "check" asks.
+        "resolvable": cred_store.is_resolvable(name, project_path=store_path),
         "fingerprint": cred_store.fingerprint(name, project_path=store_path),
     })
 
 
+@app.route("/api/projects/credentials/usage", methods=["GET"])
+def api_projects_credentials_usage():
+    """Usage history — `path` scopes to a project (merged view); omit it for
+    the global vault only. `name` filters to one credential. Names, counts
+    and cmd previews only; never values."""
+    from services import cred_telemetry as ct
+    from services import credential_store as cred_store
+    path = (request.args.get("path") or "").strip()
+    if path:
+        try:
+            base = str(_resolve_project_path(path))
+        except ValueError as e:
+            return jsonify({"error": str(e)}), 404
+    else:
+        home = cred_store.global_base()
+        if home is None:
+            return jsonify({"error": "global scope unresolvable"}), 500
+        base = str(home)
+    name = (request.args.get("name") or "").strip()
+    return jsonify({
+        "path": base if path else "",
+        "aggregate": ct.aggregate(base, name=name),
+        "recent": ct.search_events(base, name=name,
+                                   limit=request.args.get("limit", 100)),
+    })
+
+
 @app.route("/api/hub/credentials/overview", methods=["GET"])
 def api_hub_credentials_overview():
     """Cross-project credential inventory: the global vault plus each

{code_context_control-2.86.0 → code_context_control-2.89.0}/cli/hub_ui/components/drill_panel.js

@@ -182,8 +182,8 @@ function DrillPanel({ project, tab, setTab, onClose, onChanged, onOpenModal, pro
           </button>
         </div>
         <div style={{
-          display: 'flex', gap: 2, padding: '4px 20px 0',
-          borderBottom: `1px solid ${T.border}`, overflowX: 'auto', flexShrink: 0,
+          display: 'flex', flexWrap: 'wrap', gap: 2, padding: '4px 20px 0',
+          borderBottom: `1px solid ${T.border}`, flexShrink: 0,
         }}>
           {tabs.map(([id, label]) => (
             <button key={id} onClick={() => setTab(id)} style={{