code-context-control 2.124.0__tar.gz → 2.125.0__tar.gz

{code_context_control-2.124.0/code_context_control.egg-info → code_context_control-2.125.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.124.0
+Version: 2.125.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -380,7 +380,7 @@ C3 also records real per-tool usage to `.c3/tool_telemetry.jsonl`, so estimates
 ## Security & privacy
 
 - **All web servers bind `127.0.0.1` by default** and are guarded against browser-based attacks even on loopback — a Host-header allowlist (defeats DNS rebinding) plus an Origin/Referer check on every request (defeats cross-origin CSRF), with scoped, non-wildcard CORS. There is still **no user authentication**, so do not expose these servers to an untrusted network without auth/TLS in front. Binding to a non-loopback interface is opt-in and warned at startup. *(Hardening added in v2.33.0.)*
-- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires the **Discovery Bearer token on every method, GETs included**, validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (QR code carrying URL + token). Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
+- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires a **Bearer token on every method, GETs included** — the Discovery token, or (v2.125.0+) a **per-client token**: one credential per paired device, stored hashed in `~/.c3/oracle/clients.json`, revocable one at a time, and carrying a kind (`mobile` or `desk`) that override decisions are audited under. It validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (the QR carries the URL and a freshly minted per-device token; a legacy Discovery-token code is one button away). A same-machine client such as C3 Desk pairs itself with `POST /api/mobile/clients` and the owner-only `~/.c3/oracle/bootstrap.key`. Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`; with such a bind the Oracle also listens on `127.0.0.1` (`loopback_listener`, default on) so local clients are not refused. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
 - **The mobile gateway never returns a credential value.** It has no reveal route by design: entries cross the wire through an allowlist serializer, and a value can only be identified by its length and an on-demand fingerprint. Two further levers ship **off** — `mobile_creds_agent_readable_raise` (raising `agent_readable` from the phone) and `mobile_access_global_scope` (machine-wide access rules) — because each exceeds what a leaked Bearer token could otherwise reach. Deliberately absent from the surface: bulk `.env` import, denial-counter clearing, `set_builtin_disabled`, and the raw-content access preview.
 - **No telemetry by default.** The OSS package collects nothing. Opt-in Sentry crash reporting requires the `[telemetry]` extra plus both `SENTRY_DSN` and `C3_TELEMETRY_OPT_IN=1`; even then request bodies, local variables, and prompts are stripped.
 - **LLM memory distillation is local-first.** Cloud distillation (v2.51.0) is off by default and opt-in per project.

{code_context_control-2.124.0 → code_context_control-2.125.0}/README.md

@@ -314,7 +314,7 @@ C3 also records real per-tool usage to `.c3/tool_telemetry.jsonl`, so estimates
 ## Security & privacy
 
 - **All web servers bind `127.0.0.1` by default** and are guarded against browser-based attacks even on loopback — a Host-header allowlist (defeats DNS rebinding) plus an Origin/Referer check on every request (defeats cross-origin CSRF), with scoped, non-wildcard CORS. There is still **no user authentication**, so do not expose these servers to an untrusted network without auth/TLS in front. Binding to a non-loopback interface is opt-in and warned at startup. *(Hardening added in v2.33.0.)*
-- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires the **Discovery Bearer token on every method, GETs included**, validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (QR code carrying URL + token). Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
+- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires a **Bearer token on every method, GETs included** — the Discovery token, or (v2.125.0+) a **per-client token**: one credential per paired device, stored hashed in `~/.c3/oracle/clients.json`, revocable one at a time, and carrying a kind (`mobile` or `desk`) that override decisions are audited under. It validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (the QR carries the URL and a freshly minted per-device token; a legacy Discovery-token code is one button away). A same-machine client such as C3 Desk pairs itself with `POST /api/mobile/clients` and the owner-only `~/.c3/oracle/bootstrap.key`. Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`; with such a bind the Oracle also listens on `127.0.0.1` (`loopback_listener`, default on) so local clients are not refused. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
 - **The mobile gateway never returns a credential value.** It has no reveal route by design: entries cross the wire through an allowlist serializer, and a value can only be identified by its length and an on-demand fingerprint. Two further levers ship **off** — `mobile_creds_agent_readable_raise` (raising `agent_readable` from the phone) and `mobile_access_global_scope` (machine-wide access rules) — because each exceeds what a leaked Bearer token could otherwise reach. Deliberately absent from the surface: bulk `.env` import, denial-counter clearing, `set_builtin_disabled`, and the raw-content access preview.
 - **No telemetry by default.** The OSS package collects nothing. Opt-in Sentry crash reporting requires the `[telemetry]` extra plus both `SENTRY_DSN` and `C3_TELEMETRY_OPT_IN=1`; even then request bodies, local variables, and prompts are stripped.
 - **LLM memory distillation is local-first.** Cloud distillation (v2.51.0) is off by default and opt-in per project.

{code_context_control-2.124.0 → code_context_control-2.125.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.124.0"
+__version__ = "2.125.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

{code_context_control-2.124.0 → code_context_control-2.125.0/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.124.0
+Version: 2.125.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -380,7 +380,7 @@ C3 also records real per-tool usage to `.c3/tool_telemetry.jsonl`, so estimates
 ## Security & privacy
 
 - **All web servers bind `127.0.0.1` by default** and are guarded against browser-based attacks even on loopback — a Host-header allowlist (defeats DNS rebinding) plus an Origin/Referer check on every request (defeats cross-origin CSRF), with scoped, non-wildcard CORS. There is still **no user authentication**, so do not expose these servers to an untrusted network without auth/TLS in front. Binding to a non-loopback interface is opt-in and warned at startup. *(Hardening added in v2.33.0.)*
-- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires the **Discovery Bearer token on every method, GETs included**, validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (QR code carrying URL + token). Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
+- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires a **Bearer token on every method, GETs included** — the Discovery token, or (v2.125.0+) a **per-client token**: one credential per paired device, stored hashed in `~/.c3/oracle/clients.json`, revocable one at a time, and carrying a kind (`mobile` or `desk`) that override decisions are audited under. It validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (the QR carries the URL and a freshly minted per-device token; a legacy Discovery-token code is one button away). A same-machine client such as C3 Desk pairs itself with `POST /api/mobile/clients` and the owner-only `~/.c3/oracle/bootstrap.key`. Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`; with such a bind the Oracle also listens on `127.0.0.1` (`loopback_listener`, default on) so local clients are not refused. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
 - **The mobile gateway never returns a credential value.** It has no reveal route by design: entries cross the wire through an allowlist serializer, and a value can only be identified by its length and an on-demand fingerprint. Two further levers ship **off** — `mobile_creds_agent_readable_raise` (raising `agent_readable` from the phone) and `mobile_access_global_scope` (machine-wide access rules) — because each exceeds what a leaked Bearer token could otherwise reach. Deliberately absent from the surface: bulk `.env` import, denial-counter clearing, `set_builtin_disabled`, and the raw-content access preview.
 - **No telemetry by default.** The OSS package collects nothing. Opt-in Sentry crash reporting requires the `[telemetry]` extra plus both `SENTRY_DSN` and `C3_TELEMETRY_OPT_IN=1`; even then request bodies, local variables, and prompts are stripped.
 - **LLM memory distillation is local-first.** Cloud distillation (v2.51.0) is off by default and opt-in per project.

{code_context_control-2.124.0 → code_context_control-2.125.0}/code_context_control.egg-info/SOURCES.txt

@@ -141,6 +141,7 @@ core/mcp_toml.py
 core/web_security.py
 oracle/__init__.py
 oracle/config.py
+oracle/listeners.py
 oracle/mcp_oracle.py
 oracle/oracle_server.py
 oracle/oracle_ui.html
@@ -151,6 +152,7 @@ oracle/services/c3_bridge.py
 oracle/services/chat_engine.py
 oracle/services/chat_poll.py
 oracle/services/chat_store.py
+oracle/services/client_tokens.py
 oracle/services/cross_memory.py
 oracle/services/discovery_audit.py
 oracle/services/federated_graph.py
@@ -410,6 +412,7 @@ tests/test_memory_graph_api.py
 tests/test_memory_queue.py
 tests/test_memory_system.py
 tests/test_mobile_api.py
+tests/test_mobile_clients.py
 tests/test_mobile_extras.py
 tests/test_mobile_override_routes.py
 tests/test_mobile_security_api.py
@@ -426,6 +429,7 @@ tests/test_oracle_discovery_api.py
 tests/test_oracle_discovery_audit.py
 tests/test_oracle_health_probe.py
 tests/test_oracle_local_auth.py
+tests/test_oracle_loopback.py
 tests/test_oracle_ollama_bridge.py
 tests/test_oracle_scanner_cache.py
 tests/test_oracle_security_fixes.py

{code_context_control-2.124.0 → code_context_control-2.125.0}/oracle/config.py

@@ -11,6 +11,11 @@ DEFAULTS = {
     "port": 3331,
     # ── Discovery API (external LLM tool surface, v2.32.0) ──
     "bind_host": "127.0.0.1",       # loopback only by default (was 0.0.0.0)
+    # When bind_host is a specific non-loopback address (a Tailscale / LAN
+    # IP), ALSO serve the same app on 127.0.0.1 so same-machine clients (the
+    # desk tray client, `c3 oracle open`, curl) are not refused. No effect on
+    # a loopback or wildcard bind. See oracle/listeners.py.
+    "loopback_listener": True,
     "api_enabled": True,            # expose /api/discovery/* REST surface
     "api_require_auth": True,       # require Bearer token on /api/discovery/*
     "api_max_tier": "action",       # cap exposed tools: "read" | "action"

code_context_control-2.125.0/oracle/listeners.py

@@ -0,0 +1,210 @@
+"""Serve the Oracle on its configured bind host AND on loopback.
+
+Why
+---
+``bind_host`` exists so a phone on the tailnet can reach the Oracle: set it
+to the Tailscale address and the server listens there — and ONLY there. A
+process on the same machine dialling ``http://127.0.0.1:3331`` was refused,
+which broke every same-box client that reasonably assumes loopback: the
+desk tray client, ``c3 oracle open``'s health probe, the single-instance
+check in ``run_oracle``, curl in a terminal.
+
+So when the bind host is a specific non-loopback address, the same Flask app
+is served a second time on ``127.0.0.1``, same port. Same app object means
+the same guards: the Host allowlist (``core.web_security``) always admits
+``localhost`` / ``127.0.0.1``, the Bearer gates do not care which socket a
+request arrived on, and ``local_session.is_local`` already treats loopback
+as same-machine. A wildcard bind (``0.0.0.0`` / ``::``) already answers on
+loopback, and a loopback bind needs no second socket, so neither gets one.
+
+Config: ``loopback_listener`` in ``~/.c3/oracle/config.json`` (default
+true). Off = the pre-v2.125.0 behaviour, one socket on ``bind_host``.
+
+Shape
+-----
+``werkzeug.serving.make_server`` builds one threaded WSGI server per host;
+every listener but the first runs ``serve_forever`` in a daemon thread, the
+first blocks the calling thread exactly as ``app.run`` did. ``shutdown()``
+stops every listener, and ``serve_forever`` calls it on the way out
+(Ctrl-C included) so a secondary socket never outlives the primary.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import logging
+import threading
+
+LOOPBACK_HOST = "127.0.0.1"
+
+# Binds that already answer on loopback, so a second socket would only
+# collide with the first.
+_WILDCARD_HOSTS = frozenset({"", "0.0.0.0", "::", "*"})
+
+_log = logging.getLogger("oracle.listeners")
+
+
+def is_loopback_host(host: str | None) -> bool:
+    """True for ``localhost`` and any loopback IP literal (v4 or v6)."""
+    h = (host or "").strip().lower()
+    if h == "localhost":
+        return True
+    try:
+        return ipaddress.ip_address(h.strip("[]")).is_loopback
+    except ValueError:
+        return False
+
+
+def listener_hosts(bind_host: str | None, loopback_listener: bool = True) -> list[str]:
+    """The hosts to listen on, primary first.
+
+    >>> listener_hosts("100.77.40.101")
+    ['100.77.40.101', '127.0.0.1']
+    >>> listener_hosts("127.0.0.1")
+    ['127.0.0.1']
+    >>> listener_hosts("0.0.0.0")
+    ['0.0.0.0']
+    >>> listener_hosts("100.77.40.101", loopback_listener=False)
+    ['100.77.40.101']
+    """
+    primary = (bind_host or "").strip() or LOOPBACK_HOST
+    hosts = [primary]
+    if not loopback_listener:
+        return hosts
+    if primary.lower() in _WILDCARD_HOSTS or is_loopback_host(primary):
+        return hosts
+    hosts.append(LOOPBACK_HOST)
+    return hosts
+
+
+class OracleListeners:
+    """One Flask app, N sockets. See the module docstring."""
+
+    def __init__(self, app, hosts: list[str], port: int, *, threaded: bool = True):
+        if not hosts:
+            raise ValueError("at least one host is required")
+        self.app = app
+        self.hosts = list(hosts)
+        self.port = int(port)
+        self.threaded = threaded
+        self.servers: list = []
+        # Servers whose serve_forever loop has been entered. socketserver's
+        # shutdown() waits on an Event that only serve_forever sets, so
+        # calling it on a server that was never served blocks forever.
+        self._serving: list = []
+        self._threads: list[threading.Thread] = []
+        self._lock = threading.Lock()
+        self._started = False
+        self._stopped = False
+
+    # ── lifecycle ──────────────────────────────────────────
+
+    def start(self) -> OracleListeners:
+        """Bind every socket. The primary is NOT served yet — call
+        :meth:`serve_forever` (blocking) or :meth:`serve_in_background`.
+
+        A secondary bind that fails (something else already holds the port on
+        loopback, say) is logged and skipped; the primary failing raises, as
+        ``app.run`` would have.
+        """
+        from werkzeug.serving import make_server
+
+        with self._lock:
+            if self._started:
+                return self
+            self._started = True
+        primary_host = self.hosts[0]
+        primary = make_server(primary_host, self.port, self.app, threaded=self.threaded)
+        self.servers.append(primary)
+        # A port of 0 asks the OS for one; every secondary must then share it.
+        if self.port == 0:
+            self.port = int(primary.socket.getsockname()[1])
+        for host in self.hosts[1:]:
+            try:
+                srv = make_server(host, self.port, self.app, threaded=self.threaded)
+            except (OSError, SystemExit) as exc:
+                # werkzeug turns a failed bind into sys.exit(1) after printing
+                # the reason; for a SECONDARY socket that is a warning, not
+                # the end of the server.
+                _log.warning("loopback listener on %s:%s not started: %s",
+                             host, self.port, exc)
+                continue
+            self.servers.append(srv)
+            self._serving.append(srv)
+            t = threading.Thread(target=srv.serve_forever, daemon=True,
+                                 name=f"oracle-listener-{host}")
+            t.start()
+            self._threads.append(t)
+        return self
+
+    def serve_forever(self) -> None:
+        """Serve the primary listener on the calling thread until shutdown.
+
+        Every other listener is stopped on the way out, whichever way the
+        primary exits (``shutdown()`` from another thread, Ctrl-C, an error).
+        """
+        if not self._started:
+            self.start()
+        primary = self.servers[0]
+        self._serving.append(primary)
+        try:
+            primary.serve_forever()
+        finally:
+            self.shutdown()
+
+    def serve_in_background(self) -> OracleListeners:
+        """Serve the primary on a daemon thread too (tests, embedders)."""
+        if not self._started:
+            self.start()
+        primary = self.servers[0]
+        self._serving.append(primary)
+        t = threading.Thread(target=primary.serve_forever, daemon=True,
+                             name=f"oracle-listener-{self.hosts[0]}")
+        t.start()
+        self._threads.insert(0, t)
+        return self
+
+    def shutdown(self) -> None:
+        """Stop every listener and close its socket. Idempotent, and safe to
+        call from any thread that is not itself inside ``serve_forever``."""
+        with self._lock:
+            if self._stopped:
+                return
+            self._stopped = True
+        for srv in self.servers:
+            if srv in self._serving:
+                try:
+                    srv.shutdown()
+                except Exception:
+                    pass
+            try:
+                srv.server_close()
+            except Exception:
+                pass
+        for t in self._threads:
+            if t is not threading.current_thread():
+                t.join(timeout=5)
+
+    # ── introspection ──────────────────────────────────────
+
+    @property
+    def addresses(self) -> list[tuple[str, int]]:
+        """``(host, port)`` per live listener, primary first."""
+        out = []
+        for srv in self.servers:
+            try:
+                name = srv.socket.getsockname()
+                out.append((str(name[0]), int(name[1])))
+            except OSError:
+                continue
+        return out
+
+    @property
+    def urls(self) -> list[str]:
+        out = []
+        for host, port in self.addresses:
+            shown = "127.0.0.1" if host in ("0.0.0.0", "") else host
+            if ":" in shown and not shown.startswith("["):
+                shown = f"[{shown}]"
+            out.append(f"http://{shown}:{port}")
+        return out

{code_context_control-2.124.0 → code_context_control-2.125.0}/oracle/oracle_server.py

@@ -19,8 +19,9 @@ if str(_PROJECT_ROOT) not in sys.path:
 from flask import Flask, Response, jsonify, redirect, request, url_for  # noqa: E402
 
 from oracle.config import ORACLE_DIR, load_config, save_config  # noqa: E402
+from oracle.listeners import OracleListeners, listener_hosts  # noqa: E402
 from oracle.mcp_oracle import mcp_url, start_mcp_thread  # noqa: E402
-from oracle.services import api_auth, local_session  # noqa: E402
+from oracle.services import api_auth, client_tokens, local_session  # noqa: E402
 from oracle.services.activity_reporter import ActivityReporter  # noqa: E402
 from oracle.services.api_auth import extract_bearer  # noqa: E402
 from oracle.services.api_auth import verify as verify_api_key  # noqa: E402
@@ -233,6 +234,14 @@ def _local_write_guard():
     path = request.path or ""
     if not path.startswith("/api/") or path.startswith("/api/discovery"):
         return None
+    # The mobile gateway authenticates itself: both of its blueprints gate
+    # EVERY method (GETs included) on a Bearer — the Discovery token or a
+    # per-client token (v2.125.0) — and the one route that takes no Bearer,
+    # ``POST /api/mobile/clients``, runs its own local-address + bootstrap-key
+    # check. Applying this cookie-or-Discovery gate on top would refuse every
+    # per-client token before the blueprint ever saw it.
+    if path.startswith("/api/mobile/"):
+        return None
     if request.method in ("GET", "HEAD", "OPTIONS"):
         return None
     # The bootstrap mint is how a browser ACQUIRES the cookie, so it cannot
@@ -1086,6 +1095,63 @@ def api_apikey_clear():
         return jsonify({"error": str(e)}), 500
 
 
+# ── Paired clients (dashboard side of oracle/services/client_tokens.py) ──
+# Cookie-authenticated like the apikey routes: the mutations sit behind
+# _local_write_guard, the list is a GET and returns no secret. The QR the
+# Settings tab renders now carries a per-device token minted here, so
+# rotating the Discovery token no longer un-pairs every phone.
+
+@app.route("/api/pair/clients", methods=["GET"])
+def api_pair_clients():
+    """Every paired client (never a hash or token). Signed-in dashboard only
+    — the list names devices, which is more than an anonymous local process
+    should learn."""
+    if not (verify_api_key(extract_bearer(request.headers.get("Authorization")))
+            or local_session.verify(request.cookies.get(local_session.COOKIE_NAME))):
+        return jsonify({"error": "unauthorized"}), 401
+    try:
+        return jsonify({"clients": client_tokens.list_clients()})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+
+@app.route("/api/pair/mobile", methods=["POST"])
+def api_pair_mobile():
+    """Mint a per-device ``mobile`` client token for the pairing QR.
+
+    Body ``{label?}``. The token is revealed exactly once, here, for the QR;
+    the store keeps only its hash. ``url`` is what the phone should dial —
+    the dashboard overrides it with the Tailscale/LAN address it entered.
+    """
+    data = request.get_json(silent=True) or {}
+    try:
+        row, token = client_tokens.mint("mobile", str(data.get("label") or "phone"))
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 400
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+    return jsonify({
+        "client_id": row["client_id"],
+        "kind": row["kind"],
+        "label": row["label"],
+        "created": row["created"],
+        "token": token,
+        "url": request.host_url.rstrip("/"),
+    }), 201
+
+
+@app.route("/api/pair/clients/<client_id>", methods=["DELETE"])
+def api_pair_revoke(client_id):
+    """Un-pair one device. Its token fails on the next request."""
+    try:
+        row = client_tokens.revoke(str(client_id))
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+    if row is None:
+        return jsonify({"error": "unknown client"}), 404
+    return jsonify({"client": row, "revoked": True})
+
+
 # ── Error handlers ────────────────────────────────────────
 @app.errorhandler(404)
 def not_found(e):
@@ -1215,7 +1281,27 @@ def run_oracle(port: int = None, open_browser: bool = None):
         signed_in = f"{url}/?{local_session.BOOTSTRAP_PARAM}={local_session.mint_code()}"
         threading.Timer(0.8, lambda: webbrowser.open(signed_in)).start()
 
-    app.run(host=cfg.get("bind_host", "127.0.0.1"), port=actual_port, debug=False, use_reloader=False)
+    _serve(bind_host, actual_port,
+           loopback_listener=bool(cfg.get("loopback_listener", True)))
+
+
+def _serve(bind_host: str, port: int, *, loopback_listener: bool = True) -> None:
+    """Block serving ``app`` on ``bind_host`` — and on loopback too when the
+    bind is a specific non-loopback address (``oracle/listeners.py``).
+
+    Replaces ``app.run``: the same threaded werkzeug server, minus the
+    dev-server banner, plus the second socket. Every listener is stopped on
+    the way out (Ctrl-C, service stop, an error) and at interpreter exit.
+    """
+    hosts = listener_hosts(bind_host, loopback_listener)
+    listeners = OracleListeners(app, hosts, port).start()
+    atexit.register(listeners.shutdown)
+    if len(listeners.servers) > 1:
+        print(f"Loopback listener  →  {listeners.urls[-1]}  (same app, same guards)")
+    elif len(hosts) > 1:
+        print(f"Warning: loopback listener on 127.0.0.1:{port} could not start "
+              f"(port in use?) — same-machine clients must dial {bind_host}.")
+    listeners.serve_forever()
 
 
 if __name__ == "__main__":

{code_context_control-2.124.0 → code_context_control-2.125.0}/oracle/oracle_ui.html

@@ -1198,19 +1198,25 @@
     <!-- ── Mobile pairing (companion app) ── -->
     <h2 style="font-size:16px;font-weight:600;margin:28px 0 16px">Mobile app <span style="font-size:11px;color:var(--text2);font-weight:400">— pair the C3 companion app</span></h2>
     <div class="card">
-      <p style="font-size:12px;color:var(--text2);margin:0 0 14px;line-height:1.5">Scan a QR code from the C3 mobile companion to pair it with this Oracle. The code carries the server URL and the <b>Discovery API token</b> above — treat it like a password, and note that rotating the token un-pairs every client that uses it.</p>
+      <p style="font-size:12px;color:var(--text2);margin:0 0 14px;line-height:1.5">Scan a QR code from the C3 mobile companion to pair it with this Oracle. The code carries the server URL and a <b>per-device token</b> minted for that phone — treat it like a password. Each device gets its own token, so one can be revoked below without touching the others, and rotating the Discovery API token above no longer un-pairs phones.</p>
       <div class="field">
         <label>Server URL (as reachable from the phone)</label>
         <input id="mpUrl" type="text" placeholder="e.g. http://100.x.y.z:3331 (Tailscale IP)">
         <div style="font-size:11px;color:var(--text2);margin-top:6px">Defaults to this page's origin — replace it with the Tailscale/LAN address the phone can reach. Remote access needs <code>bind_host</code> and <code>allowed_hosts</code> set in <code>~/.c3/oracle/config.json</code>.</div>
       </div>
-      <div style="display:flex;gap:8px;margin-top:4px">
+      <div style="display:flex;gap:8px;margin-top:4px;flex-wrap:wrap">
         <button class="btn btn-primary" onclick="showMobilePairQr()">Show pairing code</button>
+        <button class="btn btn-ghost" onclick="showDiscoveryPairQr()" title="Legacy: the shared Discovery token, for an app build that predates per-device tokens">Discovery-token code (legacy)</button>
         <button class="btn btn-ghost" id="mpHideBtn" onclick="hideMobilePairQr()" style="display:none">Hide</button>
       </div>
       <div id="mpQrWrap" style="display:none;margin-top:14px">
         <div id="mpQr" style="display:inline-block;background:#fff;padding:14px;border-radius:8px;line-height:0"></div>
-        <div style="font-size:11px;color:var(--text2);margin-top:8px">Contains the raw API token — don't screenshot or share it.</div>
+        <div id="mpQrNote" style="font-size:11px;color:var(--text2);margin-top:8px"></div>
+        <div style="font-size:11px;color:var(--text2);margin-top:4px">Contains a raw Bearer token — don't screenshot or share it.</div>
+      </div>
+      <div style="margin-top:16px">
+        <label style="font-size:12px;font-weight:600">Paired devices</label>
+        <div id="mpClients" style="margin-top:6px"></div>
       </div>
     </div>
   </div>

{code_context_control-2.124.0 → code_context_control-2.125.0}/oracle/services/chat_poll.py

@@ -33,9 +33,8 @@ import threading
 import time
 import uuid
 
-from flask import Blueprint, jsonify, request
+from flask import Blueprint, g, jsonify, request
 
-from oracle.services import api_auth
 from oracle.services.api_auth import extract_bearer
 
 #: Capability advertised on ``/api/mobile/info``. Wired into
@@ -115,8 +114,14 @@ def _chat_auth_guard():
         return None  # CORS preflight
     if not _cfg().get("mobile_api_enabled", True):
         return jsonify({"error": "mobile API disabled"}), 404
-    if not api_auth.verify(extract_bearer(request.headers.get("Authorization"))):
+    # Same credential set as the gateway proper (Discovery token OR a live
+    # per-client token, v2.125.0), resolved by the one shared function so a
+    # device paired with a client token can chat too.
+    from oracle.services import mobile_api
+    who = mobile_api.authenticate(extract_bearer(request.headers.get("Authorization")))
+    if who is None:
         return jsonify({"error": "unauthorized"}), 401
+    g.c3_client = who
     return None