code-context-control 2.96.1__tar.gz → 2.102.0__tar.gz

{code_context_control-2.96.1/code_context_control.egg-info → code_context_control-2.102.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.96.1
+Version: 2.102.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.96.1 → code_context_control-2.102.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.96.1"
+__version__ = "2.102.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -4212,6 +4212,7 @@ def cmd_pipe(args):
 
 
 from services.claude_md import C3_COMPACT_WORKFLOW as _SHARED_C3_COMPACT_WORKFLOW
+from services.claude_md import VSCODE_INSTRUCTIONS_FILE
 from services.claude_md import VSCODE_SESSION_INIT as _VSCODE_SESSION_INIT
 from services.claude_md import adapt_workflow_for_ide as _adapt_workflow_for_ide
 
@@ -4433,14 +4434,27 @@ def _toml_section_bool_value(toml_path: Path, section: str, key: str) -> bool |
     return None
 
 
-def _ensure_instruction_workflow(instructions_path: Path, template: str, required_markers: list[str]) -> str:
-    """Ensure an instructions file has required C3 workflow markers.
+def _ensure_instruction_workflow(instructions_path: Path, template: str,
+                                 required_markers: list[str],
+                                 project_path: str = "") -> str:
+    """Ensure an instructions file carries the CURRENT C3 workflow.
 
     Returns one of: "written", "updated", "kept".
+
+    Marker PRESENCE used to mean "up to date", which is why this function
+    could report `kept` on a doc generated four releases ago: the markers are
+    stable words like "SEARCH FIRST" and "c3_edit", so they survive every
+    template change. A doc carrying the managed sentinels is now refreshed
+    through ``merge_c3_block`` — the same non-destructive regeneration
+    CLAUDE.md and AGENTS.md get — and `kept` means the block already matches
+    byte for byte (v2.102.0). A marker-less legacy doc keeps the old
+    prepend-and-preserve path, which ``write_c3_instruction_doc`` handles.
     """
+    from services.claude_md import C3_BLOCK_BEGIN, merge_c3_block, wrap_c3_block, write_c3_instruction_doc
+
     if not instructions_path.exists():
-        instructions_path.parent.mkdir(parents=True, exist_ok=True)
-        instructions_path.write_text(template, encoding="utf-8")
+        write_c3_instruction_doc(instructions_path, template,
+                                 project_path=project_path or None)
         return "written"
 
     try:
@@ -4448,6 +4462,14 @@ def _ensure_instruction_workflow(instructions_path: Path, template: str, require
     except Exception:
         existing = ""
 
+    # Managed doc → regenerate the block in place, preserving user content.
+    if C3_BLOCK_BEGIN in existing:
+        if merge_c3_block(existing, wrap_c3_block(template)) == existing:
+            return "kept"
+        write_c3_instruction_doc(instructions_path, template,
+                                 project_path=project_path or None)
+        return "updated"
+
     if all(marker in existing for marker in required_markers):
         return "kept"
 
@@ -4460,7 +4482,8 @@ def _ensure_instruction_workflow(instructions_path: Path, template: str, require
     return "updated"
 
 
-def _ensure_codex_agents_workflow(agents_md_path: Path) -> str:
+def _ensure_codex_agents_workflow(agents_md_path: Path,
+                                  project_path: str = "") -> str:
     """Ensure AGENTS.md contains the mandatory C3 workflow for Codex sessions."""
     required_markers = [
         "C3 Tools",
@@ -4474,10 +4497,12 @@ def _ensure_codex_agents_workflow(agents_md_path: Path) -> str:
         "c3_memory",
         "c3_filter",
     ]
-    return _ensure_instruction_workflow(agents_md_path, _AGENTS_MD_CONTENT, required_markers)
+    return _ensure_instruction_workflow(agents_md_path, _AGENTS_MD_CONTENT,
+                                        required_markers, project_path)
 
 
-def _ensure_vscode_instructions_workflow(instructions_path: Path) -> str:
+def _ensure_vscode_instructions_workflow(instructions_path: Path,
+                                         project_path: str = "") -> str:
     """Ensure VS Code Copilot instructions include the latest C3 workflow markers."""
     required_markers = [
         "C3 Tools",
@@ -4491,7 +4516,9 @@ def _ensure_vscode_instructions_workflow(instructions_path: Path) -> str:
         "c3_memory",
         "c3_filter",
     ]
-    return _ensure_instruction_workflow(instructions_path, _COPILOT_INSTRUCTIONS_CONTENT, required_markers)
+    return _ensure_instruction_workflow(instructions_path,
+                                        _COPILOT_INSTRUCTIONS_CONTENT,
+                                        required_markers, project_path)
 
 
 def _safe_read_json(path: Path, label: str = "") -> dict:
@@ -4957,6 +4984,7 @@ back to native tools as the task progresses.
 - **Bitbucket** (v2.30.0+, when `c3 bitbucket login` has run): `c3_bitbucket(action='list_prs|get_pr|merge_pr|...')` — self-hosted Bitbucket Data Center / Server. Token in OS keyring; mutating actions auto-log to the edit ledger.
 - **Cross-project** (v2.31.0+): `c3_project(action='list|scan|search|read|edit|...', project='<name|path>')` — discover and operate on OTHER c3-installed projects. Reads run freely; writes (edit/shell/memory) need `allow_write=true`.
 - **Masked paths** (v2.63.0+): content prefixed `[c3-mask:transformed]` is a policy-transformed VIEW, not the file. Values may be synthetic, rows withheld, bodies stripped — don't copy literals out of it or infer completeness from it. Masked paths are read-only and refuse shell/git/validate/impact/filter/delegate (`[c3-mask:unsupported]`). That's policy, not a transient error — report the block instead of routing around it.
+- **Confirm holds** (v2.97.0+): `[c3-access:confirm]` is a PAUSE, not a block — a human must approve this exact write. Since v2.100.0 the agent-config files (`.mcp.json`, instruction docs, `.claude` hook/skill/agent/command bodies) hold by default in EVERY C3 project, reads stay open. Read the S8 tail: it names the filed request (`c3_override(action='wait', request_id='...', timeout_s=180)`, then retry the same call once if approved), or names a surface that files one, or gives a reason to obey. Never retry before a decision and never route around a hold via the shell.
 
 ## Self-Check
 If you haven't called a c3_* tool in several turns during active development, re-engage
@@ -5034,10 +5062,20 @@ def _instruction_documents_for_project() -> list[tuple[str, str]]:
 
     Used by uninstall/cleanup paths, so it must keep listing legacy docs
     (GEMINI.md — profile removed in v2.52; empty template, never generated).
+
+    ``.github/copilot-instructions.md`` was absent from this list until
+    v2.102.0, and that absence was the whole bug: the managed-block sync
+    that regenerates CLAUDE.md and AGENTS.md on every install-mcp never
+    touched it, while ``_ensure_vscode_instructions_workflow`` reported
+    `kept` on marker presence alone. In a vscode-primary project the third
+    git-tracked instruction doc silently drifted a release behind on every
+    template change — v2.100.0's agent-config confirm tier reached the
+    Claude Code and Codex docs and never reached Copilot's.
     """
     return [
         ("CLAUDE.md", _CLAUDE_MD_CONTENT),
         ("AGENTS.md", _AGENTS_MD_CONTENT),
+        (VSCODE_INSTRUCTIONS_FILE, _COPILOT_INSTRUCTIONS_CONTENT),
         ("GEMINI.md", ""),
     ]
 
@@ -5692,7 +5730,8 @@ def cmd_install_mcp(args):
     if profile.name == "vscode":
         # 1. Ensure copilot-instructions.md has the latest C3 workflow markers
         instructions_path = target / ".github" / "copilot-instructions.md"
-        vs_state = _ensure_vscode_instructions_workflow(instructions_path)
+        vs_state = _ensure_vscode_instructions_workflow(instructions_path,
+                                                        str(target))
         if vs_state == "written":
             print(f"Wrote {instructions_path}")
         elif vs_state == "updated":
@@ -5731,7 +5770,8 @@ def cmd_install_mcp(args):
     # ── Codex AGENTS.md enforcement file ──────────────────────
     if profile.name == "codex":
         agents_md_path = target / "AGENTS.md"
-        agents_state = _ensure_codex_agents_workflow(agents_md_path)
+        agents_state = _ensure_codex_agents_workflow(agents_md_path,
+                                                     str(target))
         if agents_state == "written":
             print(f"Wrote {agents_md_path}")
         elif agents_state == "updated":
@@ -7266,7 +7306,8 @@ def _access_cmd_list(args, project_path: str) -> None:
              "project": ".c3/config.json"}
     for scope in ("builtin", "global", "project"):
         sec = scopes.get(scope) or {}
-        rules = [(k, g) for k in ("deny", "read_only") for g in sec.get(k, [])]
+        rules = [(k, g) for k in ("deny", "read_only", "confirm")
+                 for g in sec.get(k, [])]
         masks = sec.get("mask") or []
         print(f"[{scope}] ({notes[scope]}) — {len(rules) + len(masks)} rule(s)")
         for kind, glob in rules:
@@ -7286,12 +7327,22 @@ def _access_cmd_list(args, project_path: str) -> None:
                 for glob in off:
                     print(f"    {'off':<10} {glob}")
                 print("    re-enable: c3 access builtin enable <glob>")
+            moded = {g: m for g, m in (sec.get("modes") or {}).items()
+                     if m not in ("default", "allow")}
+            if moded:
+                print("  MODE set by you (departs from the shipped default):")
+                for glob, m in sorted(moded.items()):
+                    print(f"    {m:<10} {glob}")
+                print("    reset: c3 access builtin mode <glob> default")
             can = [g for g in (sec.get("disableable") or [])
-                   if access_guard._norm_builtin(g) not in set(off)]
+                   if access_guard._norm_builtin(g) not in set(off)
+                   and access_guard._norm_builtin(g) not in moded]
             if can:
                 print("  disableable (currently on): "
                       + ", ".join(can))
-                print("    disable: c3 access builtin disable <glob>")
+                print("    disable: c3 access builtin disable <glob>  ·  "
+                      "granular: c3 access builtin mode <glob> "
+                      "{deny,confirm,allow}")
             if sec.get("absolute"):
                 print("  absolute (credential vault, cannot be disabled): "
                       + ", ".join(sec["absolute"]))
@@ -7318,12 +7369,17 @@ def _access_cmd_builtin(args, project_path: str) -> None:
 
     action = getattr(args, "builtin_cmd", None)
     glob = getattr(args, "glob", None)
-    if action not in ("disable", "enable") or not glob:
+    if action not in ("disable", "enable", "mode") or not glob:
         print("Usage: c3 access builtin {disable,enable} <glob>")
+        print("       c3 access builtin mode <glob> {deny,confirm,allow,default}")
         print("       disableable: "
               + ", ".join(access_guard.DISABLEABLE_BUILTINS))
         return
 
+    if action == "mode":
+        _access_cmd_builtin_mode(args, glob, project_path)
+        return
+
     disabling = action == "disable"
     if disabling and not getattr(args, "yes", False):
         print(f"About to STOP enforcing the builtin guard on: {glob}")
@@ -7359,6 +7415,63 @@ def _access_cmd_builtin(args, project_path: str) -> None:
                   "builtin is enforced anyway (config entry removed).")
 
 
+_BUILTIN_MODE_HELP = {
+    "deny": "full block — read, write and enumeration all refuse (tightens "
+            "a write-only guard)",
+    "confirm": "each governed operation pauses and files an approval request "
+               "you answer from the Hub, phone, or `c3 override`",
+    "allow": "the guard stops enforcing entirely (same as disable)",
+    "default": "the shipped behaviour",
+}
+
+
+def _access_cmd_builtin_mode(args, glob: str, project_path: str) -> None:
+    """`c3 access builtin mode <glob> <mode>` — granular builtin control.
+
+    `deny` and `default` never prompt (tightening / reset). `confirm` and
+    `allow` weaken the guard, so they get the same typed-glob beat of
+    friction as `builtin disable`, unless --yes.
+    """
+    from services import access_guard
+
+    mode = getattr(args, "mode", None)
+    if mode in ("confirm", "allow") and not getattr(args, "yes", False):
+        widening = ("STOP enforcing" if mode == "allow"
+                    else "PAUSE (not block) and ask you to approve")
+        print(f"About to make the builtin guard on {glob} {widening}.")
+        if mode == "allow":
+            print("  While off, any agent with C3 tools can touch those paths.")
+        else:
+            print("  Each hit files an Override Request; one tap approves one "
+                  "single-use retry.")
+        if glob.endswith("settings*.json") or ".claude" in glob:
+            print("  This guards the file that configures the agent itself — "
+                  "hooks, permissions, model.")
+        reply = input("Type the glob again to confirm: ").strip()
+        if reply != glob:
+            print("[abort] Not confirmed; nothing changed.")
+            return
+
+    try:
+        result = access_guard.set_builtin_mode(glob, mode)
+    except ValueError as exc:
+        print(f"[error] {exc}")
+        return
+
+    _access_audit(f"builtin_mode_{result['mode']}", result["glob"],
+                  "builtin", "global", project_path)
+    if not result["changed"]:
+        print(f"[=] {result['glob']} — already {result['mode']}")
+        return
+    print(f"[OK] Builtin '{result['glob']}' mode = {result['mode']} "
+          f"(global scope): {_BUILTIN_MODE_HELP[result['mode']]}.")
+    if result["mode"] != "default":
+        print(f"     Reset with: c3 access builtin mode {result['glob']} default")
+    if not result["attested"]:
+        print("     [warn] keyring attestation could not be cleared; the "
+              "default is enforced anyway (config entry removed).")
+
+
 def _access_cmd_add(args, project_path: str) -> None:
     from services import access_guard
 

{code_context_control-2.96.1 → code_context_control-2.102.0}/cli/commands/parser.py

@@ -751,15 +751,19 @@ def build_parser(version: str, parse_cli_ide_arg):
 
     ac_add = access_subs.add_parser("add", help="Add a rule to the project (or --global) scope")
     ac_add.add_argument("glob", help="POSIX glob (** crosses directories), e.g. 'secrets/**' or '*.pem'")
-    ac_add.add_argument("--kind", choices=["deny", "read_only"], required=True,
-                        help="deny = no read/write/enumerate; read_only = no write")
+    ac_add.add_argument("--kind", choices=["deny", "read_only", "confirm"],
+                        required=True,
+                        help="deny = no read/write/enumerate; read_only = no "
+                             "write; confirm = writes pause for your approval "
+                             "(reads unaffected)")
     ac_add.add_argument("--global", dest="use_global", action="store_true",
                         help="Store in the global scope (~/.c3) so every C3 project enforces it")
     ac_add.add_argument("--path", dest="project_path", default=".", help="Project directory (default: current)")
 
     ac_remove = access_subs.add_parser("remove", help="Remove a rule from the project (or --global) scope")
     ac_remove.add_argument("glob", help="The stored glob to remove (case-insensitive match)")
-    ac_remove.add_argument("--kind", choices=["deny", "read_only"], required=True,
+    ac_remove.add_argument("--kind", choices=["deny", "read_only", "confirm"],
+                           required=True,
                            help="Which rule list the glob lives in")
     ac_remove.add_argument("--global", dest="use_global", action="store_true",
                            help="Remove from the global scope (~/.c3)")
@@ -805,6 +809,21 @@ def build_parser(version: str, parse_cli_ide_arg):
             _p.add_argument("--yes", action="store_true",
                             help="Skip the typed confirmation (scripts/CI)")
 
+    # Granular per-builtin mode (docs/confirm-guard.md §7): deny tightens a
+    # write-deny to a full deny, confirm turns the block into a pause that
+    # auto-files an approval request, allow switches it off (same two-key
+    # construction as disable), default restores the shipped behaviour.
+    bm = builtin_subs.add_parser(
+        "mode", help="Set a built-in guard to deny | confirm | allow | default")
+    bm.add_argument("glob", help="One of: **/.env*, **/.c3/**, **/.claude/settings*.json, **/.git/**")
+    bm.add_argument("mode", choices=["deny", "confirm", "allow", "default"],
+                    help="deny = full block (tighten); confirm = pause for your "
+                         "approval; allow = off (two-key); default = shipped behaviour")
+    bm.add_argument("--path", dest="project_path", default=".",
+                    help="Project directory used for the audit log (default: current)")
+    bm.add_argument("--yes", action="store_true",
+                    help="Skip the typed confirmation (scripts/CI)")
+
     # ── Mask Guard (v2.63.0, docs/mask-guard.md) ────────────────────────
     # Masking exposes a path but transforms what the agent sees. Rules are
     # human-only, like the rest of Access Guard.

{code_context_control-2.96.1 → code_context_control-2.102.0}/cli/hook_access_guard.py

@@ -6,9 +6,11 @@ dispatcher's deny-beats-allow merge makes a deny here final. hook_dispatch
 treats this module as _FAIL_CLOSED: if it fails to import or raises, write-
 class native tools are denied instead of sailing through.
 
-Bash coverage is a best-effort, existence-gated token scan — advisory by
-design (docs/access-guard.md §3/§6); it catches an agent naming a denied
-path, not an adversary hiding one.
+Bash coverage is a best-effort token scan — advisory by design
+(docs/access-guard.md §3/§6); it catches an agent naming a denied path, not
+an adversary hiding one. Two passes: every path-shaped token as a READ
+(existence-gated), then the command's WRITE targets as writes (v2.102.0), so
+a redirect into a confirm-held or read-only file holds like any other write.
 """
 import os
 import re
@@ -29,6 +31,16 @@ try:
 except Exception:  # pragma: no cover — telemetry is never load-bearing
     access_telemetry = None
 
+# The same write-target extractor the edit ledger uses after the fact. Its
+# absence degrades the shell branch to the read-only scan, never to a crash.
+try:
+    from _shell_writes import shell_write_targets
+except Exception:  # pragma: no cover — package-style import (dispatcher, tests)
+    try:
+        from cli._shell_writes import shell_write_targets
+    except Exception:
+        shell_write_targets = None
+
 _WRITE_TOOLS = {"Edit", "Write", "MultiEdit", "NotebookEdit"}
 _READ_TOOLS = {"Read", "SearchText"}
 _SEARCH_TOOLS = {"Grep", "Glob", "FindFiles"}
@@ -206,21 +218,60 @@ def _record(denial, tool: str, operation: str, path: str,
 
 
 def _override_allows(base: str, denial, *, tool: str, op: str, path: str,
-                     session_id: str):
+                     session_id: str, peek: bool = False):
     """A live override grant covering this exact call, or None (spec §5).
 
     Lazy import and policy-before-grants ordering keep the hot path free: a
     project that never turned overrides on pays one dict lookup and never
     opens the grants file. Any failure returns None — the denial stands.
+
+    ``peek`` looks without consuming; see ``_granted`` for why.
     """
     try:
         from services import override_grants as og  # noqa: PLC0415 — lazy
         return og.gate_access(base, denial, tool=tool, op=op, path=path,
-                              session_id=session_id)
+                              session_id=session_id, peek=peek)
     except Exception:
         return None  # fail closed: no grant, ordinary denial
 
 
+def _granted(line: str, defer: bool, consume) -> dict:
+    """The allow-by-grant output.
+
+    Under the dispatcher (``defer`` True) the use is NOT burned here: the
+    provisional line goes out with an ``_on_allow`` callable, and
+    hook_dispatch runs it only once every PreToolUse sub-hook has voted
+    allow. Before v2.102.0 this hook consumed first and a strict-mode
+    discipline deny from hook_pretool_enforce then won the merge — grant
+    spent, nothing written, and the user asked twice for one edit. Run
+    standalone (``defer`` False) the use was already consumed by the peek-
+    less lookup, so the line is final.
+    """
+    out = {"additionalContext": line}
+    if defer:
+        out["_on_allow"] = consume
+    return out
+
+
+def _confirm_request(base: str, denial, *, tool: str, op: str, path: str,
+                     session_id: str) -> tuple:
+    """Auto-file an Override Request for a ``confirm`` denial (S8).
+
+    ``(request_id, note)`` — one of them is always ''. Lazy import, never
+    raises: a broken request store degrades to S8's "could not be filed"
+    tail, and the hold stands either way (docs/confirm-guard.md §3).
+    """
+    try:
+        from services import override_requests as orq  # noqa: PLC0415 — lazy
+        row, reason = orq.auto_file(base, denial=denial, tool=tool, op=op,
+                                    path=path, session_id=session_id)
+        if row:
+            return str(row.get("id") or ""), ""
+        return "", reason
+    except Exception as exc:
+        return "", f"request store unavailable ({exc})"
+
+
 def _target(tool_input: dict) -> str:
     return str(
         tool_input.get("file_path")
@@ -330,7 +381,68 @@ def _scan_shell(cmd: str, base: str):
     return None, ""
 
 
-def run(payload: dict, project_path: Path | None = None) -> dict | None:
+def _scan_shell_writes(cmd: str, base: str, session_id: str,
+                       defer: bool) -> dict | None:
+    """WRITE-class verdict for the files a shell command writes (v2.102.0).
+
+    ``_scan_shell`` evaluates every token as a READ. Confirm holds, read_only
+    rules and the builtin write-denies are all write-class, so ``cat >>
+    CLAUDE.md``, ``sed -i`` on .mcp.json or a heredoc into a hook body sailed
+    through with no hold — the one bypass docs/confirm-guard.md could only
+    ask the agent not to use. Targets come from the extractor the edit
+    ledger already trusts after the fact (cli/_shell_writes), with the same
+    best-effort caveat: a missed target costs a missed hold, a false one
+    costs a hold the human clears in one tap. Synthetic spelling denials are
+    skipped exactly as the read scan skips them (a token that is not a path
+    must not veto the command); the corrupt-config deny-all still refuses.
+
+    Grant identity is ``tool="Bash", op="write", path=<target>`` — bound to
+    the file, not the command text, the same stated limitation as the
+    shell_warn layer. Several held targets need several grants; the command
+    runs only when every one is covered, and the uses are burned together
+    (or not at all) by the dispatcher's settle step.
+    """
+    if shell_write_targets is None:
+        return None
+    lines, consumers = [], []
+    for target in shell_write_targets(cmd, base):
+        denial = ag.check(target, "write", base)
+        if denial is None:
+            continue
+        if denial.rule.startswith("<") and denial.rule != "<corrupt-config>":
+            continue
+        granted = _override_allows(base, denial, tool="Bash", op="write",
+                                   path=target, session_id=session_id,
+                                   peek=defer)
+        if granted:
+            lines.append(granted)
+            if defer:
+                consumers.append(lambda t=target, d=denial: _override_allows(
+                    base, d, tool="Bash", op="write", path=t,
+                    session_id=session_id))
+            continue
+        _record(denial, "Bash", "write", target, base, session_id)
+        if denial.kind == "confirm":
+            rid, note = _confirm_request(base, denial, tool="Bash", op="write",
+                                         path=target, session_id=session_id)
+            return _deny(ag.refusal(denial, target, "write", surface="hook",
+                                    tool="Bash", request_id=rid,
+                                    request_note=note)
+                         + " (best-effort shell scan)")
+        return _deny(ag.refusal(denial, target, "write", surface="hook",
+                                tool="Bash") + " (best-effort shell scan)")
+    if not lines:
+        return None
+
+    def _settle():
+        got = [fn() for fn in consumers]
+        return "\n".join(got) if all(got) else None
+
+    return _granted("\n".join(lines), bool(consumers), _settle)
+
+
+def run(payload: dict, project_path: Path | None = None,
+        defer_consume: bool = False) -> dict | None:
     tool = normalize_tool_name(payload.get("tool_name", ""))
     tool_input = payload.get("tool_input", {}) or {}
     base = str(project_path if project_path is not None else Path.cwd())
@@ -344,10 +456,22 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
         denial = ag.check(fp, op, base)
         if denial:
             granted = _override_allows(base, denial, tool=tool, op=op,
-                                       path=fp, session_id=session_id)
+                                       path=fp, session_id=session_id,
+                                       peek=defer_consume)
             if granted:
-                return {"additionalContext": granted}
+                return _granted(granted, defer_consume,
+                                lambda: _override_allows(
+                                    base, denial, tool=tool, op=op, path=fp,
+                                    session_id=session_id))
             _record(denial, tool, op, fp, base, session_id)
+            if denial.kind == "confirm":
+                # A confirm hold files its own request (grants were consulted
+                # above, so an approved retry lands in the granted branch).
+                rid, note = _confirm_request(base, denial, tool=tool, op=op,
+                                             path=fp, session_id=session_id)
+                return _deny(ag.refusal(denial, fp, op, surface="hook",
+                                        tool=tool, request_id=rid,
+                                        request_note=note))
             return _deny(ag.refusal(denial, fp, op, surface="hook", tool=tool))
         return None
 
@@ -374,6 +498,6 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
             return _deny(ag.refusal(denial, tok, "read",
                                     surface="hook", tool=tool)
                          + " (best-effort shell scan)")
-        return None
+        return _scan_shell_writes(cmd, base, session_id, defer_consume)
 
     return None

{code_context_control-2.96.1 → code_context_control-2.102.0}/cli/hook_dispatch.py

@@ -36,6 +36,7 @@ emit a short "[c3:hook-error] ..." additionalContext warning so enforcement
 cannot silently stop enforcing.
 """
 import importlib
+import inspect
 import json
 import sys
 from pathlib import Path
@@ -166,6 +167,16 @@ def _routes(event: str, raw_tool: str, norm_tool: str, host: str = HOST_CLAUDE):
 
 _RUN_CACHE: dict = {}
 
+# PreToolUse sub-hooks that consult override grants. Under the dispatcher
+# they are asked to DEFER consumption (`defer_consume=True`): each returns a
+# provisional allow carrying an `_on_allow` callable, and `_settle_grants`
+# runs those only once every sub-hook has voted allow. Before v2.102.0 the
+# access guard consumed a grant first and a strict-mode discipline deny from
+# the next sub-hook then won the merge — grant spent, nothing written, the
+# user asked twice for one edit. The same hole ran the other way for a
+# discipline grant followed by a policy deny.
+_DEFER_CONSUME = {"hook_access_guard", "hook_pretool_enforce"}
+
 # Modules whose failure must DENY rather than fall through (fail closed).
 # Scoped to write-class tools + shell: a broken guard must not let mutations
 # sail through, but read-class fail-open avoids bricking whole sessions.
@@ -189,6 +200,77 @@ def _fail_closed_deny(module_name: str, err: str) -> dict:
     }
 
 
+def _is_deny(out) -> bool:
+    hso = out.get("hookSpecificOutput") if isinstance(out, dict) else None
+    return isinstance(hso, dict) and hso.get("permissionDecision") == "deny"
+
+
+def _call_run(run_fn, module_name: str, event: str, payload: dict,
+              project_path):
+    """Invoke a sub-hook, asking the grant-aware ones to defer consumption.
+
+    Signature-checked rather than assumed: tests stub these modules with
+    two-argument lambdas, and a legacy single-file hook must keep working.
+    """
+    if event == "pretool" and module_name in _DEFER_CONSUME:
+        try:
+            accepts = "defer_consume" in inspect.signature(run_fn).parameters
+        except (TypeError, ValueError):
+            accepts = False
+        if accepts:
+            return run_fn(payload, project_path, defer_consume=True)
+    return run_fn(payload, project_path)
+
+
+def _grant_lost_deny() -> dict:
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": (
+                "[c3-override:spent] the override grant that would have "
+                "allowed this call was used up between check and use (a "
+                "concurrent call spent it). The rule stands — ask again "
+                "with c3_override if it is still needed."
+            ),
+        }
+    }
+
+
+def _settle_grants(outputs: list) -> list:
+    """Burn deferred grant uses — only when the merged verdict is allow.
+
+    Any deny among the outputs means the call will not run, so every
+    `_on_allow` is dropped unrun and the grants stay live for the retry. On
+    an allow each consumer runs; the line it returns replaces the
+    provisional one (it carries the post-consumption uses count). A consumer
+    that finds nothing left — the grant was spent by a concurrent call
+    between peek and settle — turns its allow into a deny: the call must
+    not proceed on a grant that no longer exists.
+    """
+    denied = any(_is_deny(o) for o in outputs)
+    settled = []
+    for out in outputs:
+        if not isinstance(out, dict):
+            settled.append(out)
+            continue
+        consume = out.pop("_on_allow", None)
+        if consume is None or denied:
+            settled.append(out)
+            continue
+        try:
+            line = consume()
+        except Exception as exc:
+            log_hook_error("hook_dispatch:settle", exc)
+            line = None
+        if line:
+            out["additionalContext"] = str(line)
+            settled.append(out)
+        else:
+            settled.append(_grant_lost_deny())
+    return settled
+
+
 def _load_run(module_name: str):
     """Import cli.<module_name> and return its run() (cached).
 
@@ -353,7 +435,7 @@ def dispatch(event: str, payload: dict, project_path: Path | None = None) -> dic
                 outputs.append(_fail_closed_deny(module_name, err))
             continue
         try:
-            out = run_fn(payload, project_path)
+            out = _call_run(run_fn, module_name, event, payload, project_path)
             if out:
                 outputs.append(out)
         except Exception as exc:
@@ -368,7 +450,15 @@ def dispatch(event: str, payload: dict, project_path: Path | None = None) -> dic
         # Critical state-layer warnings (corrupt enforcement_state.json)
         # become visible instead of silently disabling enforcement.
         warnings.extend(_hook_utils.drain_state_warnings())
+        # A PreToolUse deny is final — merge keeps the first deny and no
+        # allow readmits it — so the sub-hooks after it have nothing to add,
+        # and running them could only spend a grant or log a block for a
+        # call that will not happen.
+        if event == "pretool" and outputs and _is_deny(outputs[-1]):
+            break
 
+    if event == "pretool":
+        outputs = _settle_grants(outputs)
     return merge_outputs(outputs, warnings, event=event, host=host)