code-context-control 2.92.0__tar.gz → 2.92.1__tar.gz

{code_context_control-2.92.0/code_context_control.egg-info → code_context_control-2.92.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.92.0
+Version: 2.92.1
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/_hook_utils.py

@@ -7,6 +7,7 @@ All hook reads/writes of enforcement state MUST go through this module.
 """
 import json
 import os
+import re
 import sys
 import traceback
 from datetime import datetime, timezone
@@ -440,6 +441,43 @@ def get_tool_output(data: dict) -> tuple:
     return resp if isinstance(resp, str) else "", False
 
 
+# A c3 tool that failed did not read, search or edit anything, so its
+# completion is not evidence that c3 was used (field report 2026-08-22,
+# ISSUE-3: c3_compress on a missing path -> "Error: File not found" -> the
+# sticky unlock and the signal both fired -> native Write allowed). Tools
+# report failure as a leading "Error" / "[<tool>:error]" line, the masked-path
+# refusal tag, or an MCP isError flag.
+_FAILED_RESPONSE_RE = re.compile(
+    r"^\s*(?:Error\b|\[[a-z0-9_\-]+:error\]|\[c3-mask:unsupported\])", re.IGNORECASE)
+
+
+def response_text_failed(text) -> bool:
+    """True when a c3 tool's response text reads as a failure."""
+    return bool(_FAILED_RESPONSE_RE.match(str(text or "")))
+
+
+def tool_response_failed(data: dict) -> bool:
+    """True when the PostToolUse payload carries a failed c3 tool response.
+
+    Handles Claude Code's plain string, an MCP-style dict with ``isError`` /
+    ``content`` parts, a bare list of parts, and Gemini's ``llmContent``.
+    """
+    resp = data.get("tool_response")
+    if isinstance(resp, dict):
+        if resp.get("isError") is True or resp.get("is_error") is True:
+            return True
+        content = resp.get("content")
+        if isinstance(content, list):
+            text = "\n".join((p.get("text") or "") for p in content if isinstance(p, dict))
+            return response_text_failed(text)
+        text, _ = get_tool_output(data)
+        return response_text_failed(text)
+    if isinstance(resp, list):
+        text = "\n".join((p.get("text") or "") if isinstance(p, dict) else str(p) for p in resp)
+        return response_text_failed(text)
+    return response_text_failed(resp if isinstance(resp, str) else "")
+
+
 def get_tool_input_path(data: dict) -> str:
     """Extract file path from tool_input, handling Claude (file_path),
     Gemini (path), and NotebookEdit (notebook_path)."""

code_context_control-2.92.1/cli/_shell_writes.py

@@ -0,0 +1,120 @@
+"""Best-effort extraction of the files a shell command writes.
+
+Field report 2026-08-22, ISSUE-1's buried finding: ``Bash`` sits in the
+PreToolUse matcher, but tool discipline never looked at what a shell
+command does to files. An inline ``python -c`` write, ``cat > f <<EOF`` and
+``sed -i`` were never nudged toward c3_edit and never reached the ledger,
+so every agent that met a blocked ``Write`` simply went round it. This
+module is the one place that answers "which files does this command
+probably write?" for both the PreToolUse nudge (hook_pretool_enforce) and
+the after-the-fact ledger entry (hook_edit_ledger).
+
+Deliberately conservative, like the access guard's shell scan: a missed
+target costs one missing advisory line and one missing ledger row; a false
+target costs a misleading hint, so tokens that are shell syntax, streams
+(``/dev/null``, ``&1``) or pip-style ``>=`` version specs are skipped.
+Paths resolve against the directory the command runs in, following ``cd``.
+Never raises.
+"""
+from __future__ import annotations
+
+import os
+import re
+from pathlib import Path
+
+_SEGMENT_SPLIT = re.compile(r"&&|\|\||[;\n]")
+_CD_RE = re.compile(r"""^\s*cd\s+(?:/d\s+)?(?P<dir>"[^"]+"|'[^']+'|\S+)\s*$""", re.IGNORECASE)
+# `>` / `>>` / `>|` preceded by whitespace or line start (so `foo>=3.0` is not a redirect).
+_REDIRECT_RE = re.compile(r"""(?:^|\s)\d?>{1,2}\|?\s*(?P<t>"[^"]+"|'[^']+'|\S+)""")
+_TEE_RE = re.compile(r"""(?:^|\|)\s*tee\s+(?:-[a-zA-Z]+\s+)*(?P<t>"[^"]+"|'[^']+'|\S+)""")
+_SED_INPLACE_RE = re.compile(r"""(?:^|\s)sed\s+(?P<rest>.*)$""")
+_PY_OPEN_RE = re.compile(r"""open\(\s*(?P<q>['"])(?P<t>[^'"]+)(?P=q)\s*,\s*['"][wax]""")
+_PY_WRITE_TEXT_RE = re.compile(r"""Path\(\s*(?P<q>['"])(?P<t>[^'"]+)(?P=q)\s*\)\s*\.write_(?:text|bytes)\(""")
+_FILE_CMDS = {"cp", "mv", "touch", "rm", "install"}
+_STREAMS = {"/dev/null", "/dev/stdout", "/dev/stderr", "nul", "&1", "&2", "-"}
+_SYNTAX = set("$`(){}|<>*?")
+MAX_TARGETS = 20
+
+
+def _clean(tok: str) -> str:
+    return tok.strip().strip("\"'`;,")
+
+
+def _skip(tok: str) -> bool:
+    if not tok or tok.startswith("-") or tok.startswith("=") or tok in _STREAMS:
+        return True
+    if tok.lower() in _STREAMS or tok.startswith("&"):
+        return True
+    return bool(_SYNTAX & set(tok))
+
+
+def _segment_targets(segment: str) -> list[str]:
+    out: list[str] = []
+    for m in _REDIRECT_RE.finditer(segment):
+        out.append(_clean(m.group("t")))
+    for m in _TEE_RE.finditer(segment):
+        out.append(_clean(m.group("t")))
+    for m in _PY_OPEN_RE.finditer(segment):
+        out.append(m.group("t"))
+    for m in _PY_WRITE_TEXT_RE.finditer(segment):
+        out.append(m.group("t"))
+    words = [w for w in re.split(r"\s+", segment.strip()) if w]
+    if words:
+        head = words[0].rsplit("/", 1)[-1].lower()
+        args = [_clean(w) for w in words[1:] if not w.startswith("-")]
+        if head in ("cp", "mv", "install") and len(args) >= 2:
+            out.append(args[-1])
+        elif head in ("touch", "rm") and args:
+            out.extend(args)
+        elif head == "sed":
+            flags = [w for w in words[1:] if w.startswith("-")]
+            if any(f.startswith("-i") or f == "--in-place" for f in flags):
+                # last non-flag, non-script argument(s): the files
+                files = [a for a in args if not (a.startswith("s/") or a.startswith("s|") or "/" in a and a.count("/") >= 2 and a.startswith("s"))]
+                out.extend(files[-2:] if files else [])
+    return [t for t in out if not _skip(t)]
+
+
+def _cd_target(segment: str, cwd: str) -> str | None:
+    m = _CD_RE.match(segment)
+    if not m:
+        return None
+    target = m.group("dir").strip("\"'")
+    try:
+        return target if os.path.isabs(target) else os.path.normpath(os.path.join(cwd, target))
+    except (OSError, ValueError):
+        return None
+
+
+def shell_write_targets(cmd: str, cwd: str) -> list[str]:
+    """Absolute paths the command probably writes, in order, de-duplicated.
+
+    ``cwd`` is the directory the command runs in (the project root for
+    Claude Code hooks). Relative targets resolve against it, and a ``cd``
+    segment moves it for the segments that follow.
+    """
+    found: list[str] = []
+    seen: set[str] = set()
+    here = cwd
+    try:
+        for segment in _SEGMENT_SPLIT.split(cmd or ""):
+            for tok in _segment_targets(segment):
+                if re.match(r"^/[a-z]/", tok):  # MSYS /c/foo -> C:/foo
+                    tok = f"{tok[1]}:{tok[2:]}"
+                try:
+                    p = Path(tok) if os.path.isabs(tok) else Path(here) / tok
+                    key = os.path.normcase(os.path.normpath(str(p)))
+                except (OSError, ValueError):
+                    continue
+                if key in seen:
+                    continue
+                seen.add(key)
+                found.append(str(p))
+                if len(found) >= MAX_TARGETS:
+                    return found
+            moved = _cd_target(segment, here)
+            if moved is not None:
+                here = moved
+    except Exception:
+        return found
+    return found

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.92.0"
+__version__ = "2.92.1"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/hook_c3_signal.py

@@ -26,7 +26,7 @@ from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
-from cli._hook_utils import log_hook_error, record_c3_signal  # noqa: E402
+from cli._hook_utils import log_hook_error, record_c3_signal, tool_response_failed  # noqa: E402
 
 # Tools that unlock generic read operations (Grep/Glob without a file path)
 _READ_UNLOCK_TOOLS = {"c3_search", "c3_compress", "c3_filter", "c3_read", "c3_impact", "c3_validate"}
@@ -45,6 +45,10 @@ def run(payload: dict, project_path: Path | None = None):
     if not short_name.startswith("c3_"):
         return None
 
+    # A failed call read nothing and edited nothing: no signal (ISSUE-3).
+    if tool_response_failed(payload):
+        return None
+
     record_c3_signal(
         short_name,
         short_name in _READ_UNLOCK_TOOLS,

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/hook_dispatch.py

@@ -152,6 +152,10 @@ def _routes(event: str, raw_tool: str, norm_tool: str, host: str = HOST_CLAUDE):
             yield "hook_artifact"
         if raw_tool in _GHOST_TOOLS:
             yield "hook_ghost_files"
+        # Shell file writes land in the ledger after the fact (after the
+        # ghost sweep, so a 0-byte redirect artifact is never logged).
+        if norm_tool == "Bash":
+            yield "hook_edit_ledger"
     elif event == "stop":
         yield "hook_session_stats"
         yield "hook_auto_snapshot"

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/hook_edit_ledger.py

@@ -139,6 +139,9 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     """
     tool_name = normalize_tool_name(payload.get("tool_name", ""))
 
+    if tool_name == "Bash":
+        return _run_shell(payload, project_path)
+
     if tool_name not in ("Edit", "Write", "NotebookEdit"):
         return None
 
@@ -230,6 +233,89 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     }
 
 
+# A file named by the command counts as written by it only if it changed
+# this recently — `rm`, a stale name in a quoted string, or a path that was
+# merely mentioned must not become a ledger row.
+_SHELL_WRITE_WINDOW_S = 120
+
+
+def _run_shell(payload: dict, project_path: Path | None) -> dict | None:
+    """After-the-fact ledger rows for files a shell command wrote.
+
+    Field report 2026-08-22 (ISSUE-1): writes through `python -c`, heredocs
+    and `sed -i` never reached the ledger, so the audit trail had holes
+    exactly where the agent had gone round the Write block. There is no
+    pre-edit snapshot to take here — the command already ran — so the row
+    is marked change_type "shell" and carries the command.
+    """
+    tool_input = payload.get("tool_input", {}) or {}
+    cmd = str(tool_input.get("command") or "")
+    if not cmd.strip():
+        return None
+    if project_path is None:
+        project_path = Path.cwd()
+    c3_dir = project_path / ".c3"
+    if not c3_dir.exists():
+        return None
+    config = load_hybrid_config(str(project_path))
+    ledger_cfg = config.get("edit_ledger", {})
+    if not ledger_cfg.get("enabled", True):
+        return None
+    tracking_level = ledger_cfg.get("tracking_level", "standard")
+    try:
+        from cli._shell_writes import shell_write_targets
+    except Exception:
+        return None
+
+    ledger_file = c3_dir / "edit_ledger.jsonl"
+    now = datetime.now(timezone.utc)
+    root = project_path.resolve()
+    logged = []
+    for target in shell_write_targets(cmd, str(project_path)):
+        p = Path(target)
+        try:
+            if not p.is_file() or p.suffix.lower() not in EDITABLE_EXTS:
+                continue
+            rel = str(p.resolve().relative_to(root)).replace("\\", "/")
+            if now.timestamp() - p.stat().st_mtime > _SHELL_WRITE_WINDOW_S:
+                continue
+        except (OSError, ValueError):
+            continue
+        entry = {
+            "id": f"edit_{now.strftime('%Y%m%d_%H%M%S')}_{_next_seq(ledger_file, now):03d}_{uuid.uuid4().hex[:4]}",
+            "timestamp": now.isoformat(),
+            "session_id": str(payload.get("session_id") or ""),
+            "file": rel,
+            "change_type": "shell",
+            "summary": "shell" if tracking_level == "minimal" else f"shell: {cmd.strip()[:160]}",
+            "lines_changed": None,
+            "version": _next_version(ledger_file, rel),
+            "git": {},
+            "diff_summary": "",
+            "git_pending": tracking_level != "minimal",
+            "tags": ["auto", "shell"] if ledger_cfg.get("auto_tag", True) else ["shell"],
+        }
+        if tracking_level == "detailed":
+            entry["detail"] = {"command": cmd.strip()[:300]}
+        with open(ledger_file, "a", encoding="utf-8") as f:
+            f.write(json.dumps(entry) + "\n")
+        logged.append(f"{rel} {entry['version']}")
+        try:
+            from services.repo_map import is_structural_change, mark_map_dirty
+            if is_structural_change(rel, "shell"):
+                mark_map_dirty(project_path, f"shell:{rel}")
+        except Exception:
+            pass
+    if not logged:
+        return None
+    return {
+        "_text": (
+            f"[c3:ledger] shell write logged after the fact: {', '.join(logged)} "
+            f"— no pre-edit snapshot; prefer c3_edit for file changes."
+        )
+    }
+
+
 def main():
     ensure_utf8_stdio()
     try:

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/hook_edit_unlock.py

@@ -21,6 +21,7 @@ from cli._hook_utils import (  # noqa: E402
     emit_additional_context,
     log_hook_error,
     record_json_unlocks,
+    tool_response_failed,
 )
 
 EDITABLE_EXTS = {
@@ -98,6 +99,13 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
 
     base = project_path if project_path is not None else Path.cwd()
 
+    # "c3_compress on a path that does not exist" returned an error and still
+    # unlocked native Write for that path (field report 2026-08-22, ISSUE-3).
+    # An error response gathered no context, so it grants nothing. New files
+    # are created through c3_edit(old_string=""), which needs no unlock.
+    if tool_response_failed(payload):
+        return None
+
     tool_input = payload.get("tool_input", {}) or {}
     tool_response = payload.get("tool_response", "")
     if isinstance(tool_response, dict):

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/hook_pretool_enforce.py

@@ -35,6 +35,7 @@ advisory path instead of granting stale unlocks.
 Supports both Claude Code and Gemini CLI via _hook_utils.
 """
 import json
+import os
 import re
 import sys
 from datetime import datetime, timezone
@@ -54,8 +55,17 @@ from _hook_utils import (  # noqa: E402
     log_hook_error,
     normalize_tool_name,
     record_unlocked_files,
+    response_text_failed,
 )
 
+try:
+    from _shell_writes import shell_write_targets
+except Exception:  # pragma: no cover - package-style import (tests, dispatcher)
+    try:
+        from cli._shell_writes import shell_write_targets
+    except Exception:
+        shell_write_targets = None
+
 try:
     from services import access_telemetry, enforcement_policy
 except Exception:  # pragma: no cover — degrade to hardcoded strict behavior
@@ -142,7 +152,8 @@ _REDIRECTS = {
     ),
     "Write": (
         "Use c3_edit(file_path='...', old_string='...', new_string='...', summary='...') "
-        "for file modifications. For new files, use native Write only after c3_search/c3_compress."
+        "for file modifications. For a NEW file, c3_edit(file_path='...', old_string='', "
+        "new_string='<content>') creates it and logs it."
     ),
 }
 
@@ -313,6 +324,11 @@ def _check_c3_used(
         tool = entry.get("tool", "")
         if tool not in allowed:
             continue
+        # ISSUE-3: the log used to count a call that returned "Error: File
+        # not found" as "c3 was used". Newer entries carry ok=False; older
+        # ones are judged by the summary text.
+        if entry.get("ok") is False or response_text_failed(entry.get("result_summary") or ""):
+            continue
 
         if native_target:
             grant = _C3_GRANTS.get(tool, required_cat)
@@ -514,6 +530,9 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     """
     tool_name = normalize_tool_name(payload.get("tool_name", ""))
 
+    if tool_name == "Bash":
+        return _shell_advisory(payload, project_path)
+
     if tool_name not in _PREREQS:
         return None  # Not a tool we enforce — pass through
 
@@ -617,6 +636,55 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     }, policy)
 
 
+def _shell_advisory(payload: dict, project_path: Path | None) -> dict | None:
+    """Bash is the escape hatch tool discipline never looked at (field
+    report 2026-08-22, ISSUE-1's buried finding): an inline ``python -c`` write
+    or a heredoc was never nudged toward c3_edit and never snapshotted. It
+    is NOT denied — blocking shell writes outright would break far more
+    legitimate work than it protects — it gets the advisory hint that names
+    the files, in strict and advisory modes alike, and hook_edit_ledger
+    records the writes after the fact. A fresh write-class c3 signal
+    (c3_edit just ran) means the agent is already on the c3 path: silent.
+    """
+    if shell_write_targets is None:
+        return None
+    tool_input = payload.get("tool_input", {}) or {}
+    cmd = str(tool_input.get("command") or "")
+    if not cmd.strip():
+        return None
+    base = project_path if project_path is not None else Path.cwd()
+    policy = _resolve_policy(base)
+    mode = getattr(policy, "mode", None) or "strict"
+    if mode == "off":
+        return _policy_warnings(policy)
+    targets = [t for t in shell_write_targets(cmd, str(base))
+               if not _outside_project(base, {"file_path": t})]
+    if not targets:
+        return _policy_warnings(policy)
+    session_id = str(payload.get("session_id") or "")
+    state = load_enforcement_state(base, session_id=session_id)
+    ttl_s = getattr(policy, "signal_ttl_s", _SIGNAL_MAX_AGE_SECS)
+    recent, _read_unlocked, signal_tool = _check_signal(state, ttl_s)
+    if recent and signal_tool in _PREREQS["Write"]:
+        return _policy_warnings(policy)
+    shown = []
+    for t in targets[:3]:
+        try:  # display only; no path resolution here (canonical_key owns that)
+            shown.append(os.path.relpath(t, str(base)).replace("\\", "/"))
+        except (OSError, ValueError):
+            shown.append(t)
+    more = f" (+{len(targets) - 3} more)" if len(targets) > 3 else ""
+    return _with_warnings({
+        "additionalContext": (
+            f"[c3:hint] This shell command looks like it writes {', '.join(shown)}{more}. "
+            f"Shell writes bypass c3_edit: no pre-edit snapshot, and the ledger can only "
+            f"record them after the fact as `shell` changes. Prefer "
+            f"c3_edit(file_path='...', old_string='...', new_string='...') — old_string='' "
+            f"creates a file. (advisory: shell is never blocked)"
+        )
+    }, policy)
+
+
 def _record_block(tool_name: str, tool_input: dict, session_id: str,
                   base: Path) -> None:
     """Log a discipline block so `c3 access stats` can show what it costs."""

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/mcp_server.py

@@ -415,7 +415,15 @@ def _finalize_response(ctx: Context, tool_name: str, args: dict,
         svc.activity_log.log("budget_auto_reset", {"gap_seconds": gap_reset_seconds})
 
     svc.session_mgr.log_tool_call(tool_name, args, summary)
-    svc.activity_log.log("tool_call", {"tool": tool_name, "args": args, "result_summary": summary})
+    # ok=False lets hook_pretool_enforce's activity scan skip a failed call
+    # (ISSUE-3: "Error: File not found" used to count as "c3 was used").
+    try:
+        from cli._hook_utils import response_text_failed as _failed
+        call_ok = not _failed(response)
+    except Exception:
+        call_ok = True
+    svc.activity_log.log("tool_call", {"tool": tool_name, "args": args,
+                                       "result_summary": summary, "ok": call_ok})
     tracker = getattr(svc, "time_tracker", None)
     if tracker is not None:
         try:

{code_context_control-2.92.0 → code_context_control-2.92.1}/cli/tools/compress.py

@@ -147,7 +147,8 @@ def _compress_single(file_path: str, mode: str, svc, finalize, maybe_facts) -> s
 
     if mode in ("map", "dense_map"):
         if not full.exists():
-            return "[file_map:error] not found"
+            return ("[file_map:error] not found. To create a new file use "
+                    "c3_edit(file_path=..., old_string='', new_string=<content>).")
         rel = str(full.resolve().relative_to(Path(svc.project_path).resolve())).replace("\\", "/")
         queued = svc.file_memory.drain_queue()
         completed = []

{code_context_control-2.92.0 → code_context_control-2.92.1/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.92.0
+Version: 2.92.1
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.92.0 → code_context_control-2.92.1}/code_context_control.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ README.md
 pyproject.toml
 cli/__init__.py
 cli/_hook_utils.py
+cli/_shell_writes.py
 cli/c3.py
 cli/docs.html
 cli/edits.html
@@ -321,6 +322,7 @@ tests/test_embedding_index_deadlock.py
 tests/test_enforcement_flip.py
 tests/test_enforcement_policy.py
 tests/test_enforcement_routes.py
+tests/test_failed_calls_do_not_unlock.py
 tests/test_federated_graph.py
 tests/test_filter_backoff.py
 tests/test_ghost_files.py
@@ -411,6 +413,8 @@ tests/test_session_benchmark.py
 tests/test_session_budget.py
 tests/test_shell_creds.py
 tests/test_shell_robustness.py
+tests/test_shell_write_ledger.py
+tests/test_shell_writes.py
 tests/test_subproject_exclusion.py
 tests/test_subproject_federation.py
 tests/test_subprojects.py

{code_context_control-2.92.0 → code_context_control-2.92.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-context-control"
-version = "2.92.0"
+version = "2.92.1"
 description = "Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub."
 readme = "README.md"
 requires-python = ">=3.10"

code_context_control-2.92.1/tests/test_failed_calls_do_not_unlock.py

@@ -0,0 +1,124 @@
+"""A c3_* call that FAILED is not evidence that c3 was used (ISSUE-3).
+
+Before: c3_compress on a missing path returned "Error: File not found",
+hook_c3_signal recorded a fresh signal, hook_edit_unlock stuck an unlock on
+that path, and the activity log counted the call — so native Write on the
+very path was allowed. Now all three routes read the result first.
+"""
+import json
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO_ROOT))
+
+from cli import _hook_utils  # noqa: E402
+from cli._hook_utils import (  # noqa: E402
+    load_enforcement_state,
+    response_text_failed,
+    tool_response_failed,
+)
+
+sys.modules.setdefault("_hook_utils", _hook_utils)
+
+from cli import hook_c3_signal, hook_edit_unlock  # noqa: E402
+from cli.hook_pretool_enforce import run as enforce  # noqa: E402
+
+
+class TestFailureHeuristic(unittest.TestCase):
+    def test_text(self):
+        self.assertTrue(response_text_failed("Error: File not found: x.py"))
+        self.assertTrue(response_text_failed("  Error reading file"))
+        self.assertTrue(response_text_failed("[read:error] File not found: x"))
+        self.assertTrue(response_text_failed("[file_map:error] not found"))
+        self.assertTrue(response_text_failed("[c3-mask:unsupported] policy"))
+        self.assertFalse(response_text_failed("## results\nError handling lives in errors.py"))
+        self.assertFalse(response_text_failed("# a.py (.py) — 12 lines"))
+        self.assertFalse(response_text_failed(""))
+        self.assertFalse(response_text_failed(None))
+
+    def test_payload_shapes(self):
+        self.assertTrue(tool_response_failed({"tool_response": "Error: nope"}))
+        self.assertTrue(tool_response_failed({"tool_response": {"isError": True, "content": [{"type": "text", "text": "ok?"}]}}))
+        self.assertTrue(tool_response_failed({"tool_response": {"content": [{"type": "text", "text": "Error: x"}]}}))
+        self.assertTrue(tool_response_failed({"tool_response": [{"type": "text", "text": "[read:error] x"}]}))
+        self.assertTrue(tool_response_failed({"tool_response": {"llmContent": "Error: gemini shape"}}))
+        self.assertFalse(tool_response_failed({"tool_response": "fine"}))
+        self.assertFalse(tool_response_failed({"tool_response": {"content": [{"type": "text", "text": "fine"}]}}))
+        self.assertFalse(tool_response_failed({}))
+
+
+class _Project(unittest.TestCase):
+    def setUp(self):
+        self.tmp = Path(tempfile.mkdtemp())
+        (self.tmp / ".c3").mkdir()
+        _hook_utils.drain_state_warnings()
+
+    def tearDown(self):
+        _hook_utils.drain_state_warnings()
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def _payload(self, tool, file_path, response, session="s1"):
+        return {"tool_name": tool, "session_id": session,
+                "tool_input": {"file_path": file_path, "mode": "map"},
+                "tool_response": response}
+
+
+class TestSignalHook(_Project):
+    def test_failed_call_writes_no_signal(self):
+        hook_c3_signal.run(self._payload("mcp__c3__c3_compress", "ghost.py", "Error: File not found: ghost.py"), self.tmp)
+        self.assertIsNone(load_enforcement_state(self.tmp, session_id="s1").get("last_c3_call"))
+
+    def test_successful_call_writes_signal(self):
+        hook_c3_signal.run(self._payload("mcp__c3__c3_compress", "a.py", "# a.py map"), self.tmp)
+        self.assertEqual(load_enforcement_state(self.tmp, session_id="s1")["last_c3_call"]["tool"], "c3_compress")
+
+
+class TestUnlockHook(_Project):
+    def test_failed_compress_unlocks_nothing(self):
+        target = str(self.tmp / "ghost.py")
+        out = hook_edit_unlock.run(self._payload("mcp__c3__c3_compress", target, "Error: File not found"), self.tmp)
+        self.assertIsNone(out)
+        self.assertEqual(load_enforcement_state(self.tmp, session_id="s1").get("unlocked_files"), {})
+        deny = enforce({"tool_name": "Write", "session_id": "s1",
+                        "tool_input": {"file_path": target, "content": "x"}}, project_path=self.tmp)
+        self.assertEqual(deny["hookSpecificOutput"]["permissionDecision"], "deny")
+
+    def test_successful_compress_still_unlocks(self):
+        target = str(self.tmp / "real.py")
+        out = hook_edit_unlock.run(self._payload("mcp__c3__c3_compress", target, "# real.py (.py) — 3 lines"), self.tmp)
+        self.assertIsNotNone(out)
+        self.assertTrue(load_enforcement_state(self.tmp, session_id="s1").get("unlocked_files"))
+
+
+class TestActivityLogScan(_Project):
+    def _log(self, tool, summary, ok=None):
+        entry = {"timestamp": "2026-08-22T12:00:00+00:00", "type": "tool_call", "tool": tool,
+                 "args": {}, "result_summary": summary}
+        if ok is not None:
+            entry["ok"] = ok
+        with open(self.tmp / ".c3" / "activity_log.jsonl", "a", encoding="utf-8") as f:
+            f.write(json.dumps(entry) + "\n")
+
+    def _write(self):
+        return enforce({"tool_name": "Write", "session_id": "s9",
+                        "tool_input": {"file_path": str(self.tmp / "n.py"), "content": "x"}}, project_path=self.tmp)
+
+    def test_failed_entry_by_flag_is_skipped(self):
+        self._log("c3_edit", "120->40tok", ok=False)
+        self.assertEqual(self._write()["hookSpecificOutput"]["permissionDecision"], "deny")
+
+    def test_failed_entry_by_text_is_skipped(self):
+        self._log("c3_edit", "Error: File not found: n.py")
+        self.assertEqual(self._write()["hookSpecificOutput"]["permissionDecision"], "deny")
+
+    def test_successful_entry_still_counts(self):
+        self._log("c3_edit", "edited n.py", ok=True)
+        self.assertNotIn("hookSpecificOutput", self._write() or {})
+
+
+if __name__ == "__main__":
+    unittest.main()