code-context-control 2.124.0__tar.gz → 2.126.1__tar.gz

{code_context_control-2.124.0/code_context_control.egg-info → code_context_control-2.126.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.124.0
+Version: 2.126.1
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -380,7 +380,7 @@ C3 also records real per-tool usage to `.c3/tool_telemetry.jsonl`, so estimates
 ## Security & privacy
 
 - **All web servers bind `127.0.0.1` by default** and are guarded against browser-based attacks even on loopback — a Host-header allowlist (defeats DNS rebinding) plus an Origin/Referer check on every request (defeats cross-origin CSRF), with scoped, non-wildcard CORS. There is still **no user authentication**, so do not expose these servers to an untrusted network without auth/TLS in front. Binding to a non-loopback interface is opt-in and warned at startup. *(Hardening added in v2.33.0.)*
-- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires the **Discovery Bearer token on every method, GETs included**, validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (QR code carrying URL + token). Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
+- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires a **Bearer token on every method, GETs included** — the Discovery token, or (v2.125.0+) a **per-client token**: one credential per paired device, stored hashed in `~/.c3/oracle/clients.json`, revocable one at a time, and carrying a kind (`mobile` or `desk`) that override decisions are audited under. It validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (the QR carries the URL and a freshly minted per-device token; a legacy Discovery-token code is one button away). A same-machine client such as C3 Desk pairs itself with `POST /api/mobile/clients` and the owner-only `~/.c3/oracle/bootstrap.key`. Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`; with such a bind the Oracle also listens on `127.0.0.1` (`loopback_listener`, default on) so local clients are not refused. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
 - **The mobile gateway never returns a credential value.** It has no reveal route by design: entries cross the wire through an allowlist serializer, and a value can only be identified by its length and an on-demand fingerprint. Two further levers ship **off** — `mobile_creds_agent_readable_raise` (raising `agent_readable` from the phone) and `mobile_access_global_scope` (machine-wide access rules) — because each exceeds what a leaked Bearer token could otherwise reach. Deliberately absent from the surface: bulk `.env` import, denial-counter clearing, `set_builtin_disabled`, and the raw-content access preview.
 - **No telemetry by default.** The OSS package collects nothing. Opt-in Sentry crash reporting requires the `[telemetry]` extra plus both `SENTRY_DSN` and `C3_TELEMETRY_OPT_IN=1`; even then request bodies, local variables, and prompts are stripped.
 - **LLM memory distillation is local-first.** Cloud distillation (v2.51.0) is off by default and opt-in per project.

{code_context_control-2.124.0 → code_context_control-2.126.1}/README.md

@@ -314,7 +314,7 @@ C3 also records real per-tool usage to `.c3/tool_telemetry.jsonl`, so estimates
 ## Security & privacy
 
 - **All web servers bind `127.0.0.1` by default** and are guarded against browser-based attacks even on loopback — a Host-header allowlist (defeats DNS rebinding) plus an Origin/Referer check on every request (defeats cross-origin CSRF), with scoped, non-wildcard CORS. There is still **no user authentication**, so do not expose these servers to an untrusted network without auth/TLS in front. Binding to a non-loopback interface is opt-in and warned at startup. *(Hardening added in v2.33.0.)*
-- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires the **Discovery Bearer token on every method, GETs included**, validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (QR code carrying URL + token). Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
+- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires a **Bearer token on every method, GETs included** — the Discovery token, or (v2.125.0+) a **per-client token**: one credential per paired device, stored hashed in `~/.c3/oracle/clients.json`, revocable one at a time, and carrying a kind (`mobile` or `desk`) that override decisions are audited under. It validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (the QR carries the URL and a freshly minted per-device token; a legacy Discovery-token code is one button away). A same-machine client such as C3 Desk pairs itself with `POST /api/mobile/clients` and the owner-only `~/.c3/oracle/bootstrap.key`. Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`; with such a bind the Oracle also listens on `127.0.0.1` (`loopback_listener`, default on) so local clients are not refused. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
 - **The mobile gateway never returns a credential value.** It has no reveal route by design: entries cross the wire through an allowlist serializer, and a value can only be identified by its length and an on-demand fingerprint. Two further levers ship **off** — `mobile_creds_agent_readable_raise` (raising `agent_readable` from the phone) and `mobile_access_global_scope` (machine-wide access rules) — because each exceeds what a leaked Bearer token could otherwise reach. Deliberately absent from the surface: bulk `.env` import, denial-counter clearing, `set_builtin_disabled`, and the raw-content access preview.
 - **No telemetry by default.** The OSS package collects nothing. Opt-in Sentry crash reporting requires the `[telemetry]` extra plus both `SENTRY_DSN` and `C3_TELEMETRY_OPT_IN=1`; even then request bodies, local variables, and prompts are stripped.
 - **LLM memory distillation is local-first.** Cloud distillation (v2.51.0) is off by default and opt-in per project.

{code_context_control-2.124.0 → code_context_control-2.126.1}/cli/_hook_utils.py

@@ -500,6 +500,40 @@ def record_json_unlocks(
         pass
 
 
+_PROJECT_WALK_UP_LEVELS = 4
+
+
+def find_project(payload: dict, project_path=None) -> Path | None:
+    """The nearest ancestor (≤ 4 levels) of ``project_path`` / ``payload.cwd``
+    that owns a ``.c3`` directory, or None.
+
+    Claude Code runs hooks from the project root, Codex passes ``--project``;
+    either way the payload's ``cwd`` may be a subdirectory (a session opened
+    in ``src/``). The walk is lexical on purpose — no path canonicalisation
+    happens here (see tests/test_access_guard_meta.py).
+    """
+    candidates = []
+    if project_path:
+        candidates.append(Path(str(project_path)))
+    cwd = payload.get("cwd") if isinstance(payload, dict) else None
+    if cwd:
+        candidates.append(Path(str(cwd)))
+    if not candidates:
+        candidates.append(Path.cwd())
+    for base in candidates:
+        node = base
+        for _ in range(_PROJECT_WALK_UP_LEVELS):
+            try:
+                if (node / ".c3").is_dir():
+                    return node
+            except OSError:
+                break
+            if node.parent == node:
+                break
+            node = node.parent
+    return None
+
+
 def emit_additional_context(text: str, is_gemini: bool) -> None:
     """Write additionalContext JSON to stdout in the correct format for the IDE."""
     if is_gemini:

{code_context_control-2.124.0 → code_context_control-2.126.1}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.124.0"
+__version__ = "2.126.1"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -5558,6 +5558,8 @@ def cmd_install_mcp(args):
         hook_posttool_cmd = f"{_dispatch_base} posttool"
         hook_stop_cmd     = f"{_dispatch_base} stop"
         hook_prompt_cmd   = f"{_dispatch_base} prompt"
+        hook_start_cmd    = f"{_dispatch_base} start"
+        hook_end_cmd      = f"{_dispatch_base} end"
 
         shell_matcher  = "Bash"
         read_matcher   = "Read"
@@ -5696,6 +5698,25 @@ def cmd_install_mcp(args):
         )
         settings.setdefault("hooks", {})[prompt_event] = existing_prompt
 
+        # ── SessionStart / SessionEnd hooks (v2.126.0: session_open /
+        # session_end activity rows + `session` notifications, the join key
+        # a desktop client needs). Same merge discipline: replace only C3's
+        # own dispatcher entries, keep user-added ones. SessionStart's
+        # matcher is the payload `source` (startup|resume|clear|compact);
+        # empty matches all — the hook itself ignores `compact`.
+        for _lifecycle_event, _lifecycle_cmd in (
+            ("SessionStart", hook_start_cmd),
+            ("SessionEnd", hook_end_cmd),
+        ):
+            _kept = [
+                h for h in settings.get("hooks", {}).get(_lifecycle_event, [])
+                if not _is_c3_prompt_hook(h)
+            ]
+            _kept.append(
+                {"matcher": "", "hooks": [{"type": "command", "command": _lifecycle_cmd}]}
+            )
+            settings.setdefault("hooks", {})[_lifecycle_event] = _kept
+
         # Claude Code only: enable MCP server prompt settings
         if profile.name == "claude-code":
             settings["enableAllProjectMcpServers"] = True
@@ -5742,6 +5763,7 @@ def cmd_install_mcp(args):
         print(f"  Hooks ({hook_event}): dispatcher (1 spawn/event) — filter/ghost/read-guard/ledger/unlock/signal via cli/hook_dispatch.py posttool")
         print(f"  Hooks ({pre_event}): dispatcher — {read_matcher}/{grep_matcher}/{glob_matcher}/{edit_matcher}/{write_matcher} (c3 enforcement)")
         print("  Hooks (Stop): dispatcher — session_stats + auto_snapshot + terse_advisor")
+        print("  Hooks (SessionStart/SessionEnd): dispatcher — session_open / session_end rows + session notifications")
         if profile.name == "claude-code":
             print("  Claude MCP prompt settings enabled for this project")
         if perm_tier and profile.name == "claude-code":

{code_context_control-2.124.0 → code_context_control-2.126.1}/cli/hook_dispatch.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """Per-event hook dispatcher: ONE process per Claude Code / Gemini hook event.
 
-Usage: python hook_dispatch.py <pretool|posttool|stop|prompt>
+Usage: python hook_dispatch.py <pretool|posttool|stop|prompt|start|compact|end>
 
 Before v2.42 every hook was registered as its own "cmd /c python <hook>.py"
 subprocess, so a single native Read fired up to three interpreter spawns
@@ -167,8 +167,17 @@ def _routes(event: str, raw_tool: str, norm_tool: str, host: str = HOST_CLAUDE):
         yield "hook_terse_advisor"
     elif event == "prompt":
         yield "hook_prompt_recall"
-    elif event in ("start", "compact", "end") and host == HOST_CODEX:
-        yield "hook_codex_lifecycle"
+    elif event in ("start", "compact", "end"):
+        # Codex's thread-bound handoff runs first (it may return context on
+        # SessionStart); the session bookkeeping below is host-agnostic and
+        # returns nothing (v2.126.0: session_open / session_end rows + the
+        # `session` notifications a desktop client wakes on).
+        if host == HOST_CODEX:
+            yield "hook_codex_lifecycle"
+        if event == "start":
+            yield "hook_session_open"
+        elif event == "end":
+            yield "hook_session_end"
 
 
 _RUN_CACHE: dict = {}

code_context_control-2.126.1/cli/hook_session_end.py

@@ -0,0 +1,103 @@
+"""SessionEnd hook: record that a host session ended (D0b, v2.126.0).
+
+Claude Code's ``SessionEnd`` event delivers on stdin::
+
+    {
+      "session_id": "<Claude Code UUID>",
+      "transcript_path": "...",
+      "cwd": "...",
+      "hook_event_name": "SessionEnd",
+      "reason": "clear" | "logout" | "prompt_input_exit" | "other"
+    }
+
+Codex's ``SessionEnd`` carries its thread id in the same ``session_id``
+field; the dispatcher routes both here (``hook_dispatch._routes``, event
+``end``).
+
+Why this exists: this repo's activity log held 525 ``session_start`` rows
+and 14 ``session_save`` rows — ``session_save`` is only written when a human
+ends a session from the hub, so for a client the end of a conversation was
+invisible. Two records fix that:
+
+- ``{type: "session_end", session_id: <C3 id if known>, host_session_id,
+  reason, source}`` appended to ``.c3/activity_log.jsonl``. The C3 id comes
+  from the link file the MCP server wrote at session start
+  (``services.host_sessions``); it is ``""`` when the server never learned
+  the host id.
+- a ``session`` notification (``kind="session"``, ``ref_id=host id``,
+  severity ``info``, title ``Session ended <short id>``) in
+  ``.c3/notifications.jsonl`` — the write that wakes a ``/feed?wait=``
+  client.
+
+Runs in a short-lived subprocess with a few seconds of budget; every step is
+best-effort and nothing here can fail the session that is already ending.
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from cli._hook_utils import detect_host, find_project, log_hook_error  # noqa: E402
+
+SHORT_ID_CHARS = 8
+
+
+def short_id(session_id: str) -> str:
+    return str(session_id or "")[:SHORT_ID_CHARS] or "?"
+
+
+def run(payload: dict, project_path: Path | None = None):
+    """Core logic — importable by the dispatcher and tests. Returns None."""
+    project = find_project(payload, project_path)
+    if project is None:
+        return None
+    host = detect_host(payload)
+    host_sid = str(payload.get("session_id") or "").strip()
+    reason = str(payload.get("reason") or "").strip()
+    c3_sid = ""
+    try:
+        from services.host_sessions import linked_c3_session_id
+        c3_sid = linked_c3_session_id(project, host, host_sid)
+    except Exception:
+        c3_sid = ""
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(str(project)).log("session_end", {
+            "session_id": c3_sid,
+            "host_session_id": host_sid,
+            "reason": reason,
+            "source": host,
+        })
+    except Exception as exc:
+        log_hook_error("hook_session_end", exc)
+    try:
+        from services.notifications import notify
+        notify(project, agent="session", severity="info",
+               title=f"Session ended {short_id(host_sid)}",
+               message=(f"{host} session {host_sid or '?'} ended"
+                        + (f" ({reason})" if reason else "")
+                        + (f"; C3 session {c3_sid}" if c3_sid else "")),
+               kind="session", ref_id=host_sid)
+    except Exception:
+        pass
+    return None
+
+
+def main() -> None:
+    import json
+    try:
+        data = json.load(sys.stdin)
+    except Exception as exc:
+        log_hook_error("hook_session_end", exc)
+        sys.exit(0)
+    try:
+        run(data)
+    except Exception as exc:
+        log_hook_error("hook_session_end", exc)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

code_context_control-2.126.1/cli/hook_session_open.py

@@ -0,0 +1,97 @@
+"""SessionStart hook: record that a host session opened (D0b, v2.126.0).
+
+Claude Code's ``SessionStart`` event delivers on stdin::
+
+    {
+      "session_id": "<Claude Code UUID>",
+      "transcript_path": "...",
+      "cwd": "...",
+      "hook_event_name": "SessionStart",
+      "source": "startup" | "resume" | "clear" | "compact"
+    }
+
+Codex's ``SessionStart`` carries its thread id in the same ``session_id``
+field and no ``source``; the dispatcher routes both here (event ``start``).
+
+Records:
+
+- ``{type: "session_open", host_session_id, source: <host>, start_source}``
+  in ``.c3/activity_log.jsonl``. ``source`` is the HOST (``claude`` /
+  ``codex`` / ``gemini``), matching ``session_end``; the payload's own
+  ``source`` (startup / resume / clear) is kept as ``start_source``.
+- a ``session`` notification (``kind="session"``, ``ref_id=host id``,
+  ``info``, title ``Session started <short id>``).
+
+``source: "compact"`` writes NOTHING: a compaction is the same session and
+the same MCP process, and a "Session started" toast on every compaction
+would teach the user to ignore the real ones.
+
+The MCP server's own ``session_start`` row is untouched — it carries the C3
+id and, when the host put its id in the environment, ``host_session_id``
+too. This hook is what lets a client see the session before the runtime has
+finished starting (~seconds), and it is the row the desktop's "MCP failed to
+connect" sentinel starts its 30 s clock from.
+
+Returns None always: SessionStart hook stdout becomes model context, and
+this hook has nothing to tell the model.
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from cli._hook_utils import detect_host, find_project, log_hook_error  # noqa: E402
+from cli.hook_session_end import short_id  # noqa: E402
+
+_SILENT_SOURCES = {"compact"}
+
+
+def run(payload: dict, project_path: Path | None = None):
+    """Core logic — importable by the dispatcher and tests. Returns None."""
+    start_source = str(payload.get("source") or "").strip().lower()
+    if start_source in _SILENT_SOURCES:
+        return None
+    project = find_project(payload, project_path)
+    if project is None:
+        return None
+    host = detect_host(payload)
+    host_sid = str(payload.get("session_id") or "").strip()
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(str(project)).log("session_open", {
+            "host_session_id": host_sid,
+            "source": host,
+            "start_source": start_source,
+        })
+    except Exception as exc:
+        log_hook_error("hook_session_open", exc)
+    try:
+        from services.notifications import notify
+        notify(project, agent="session", severity="info",
+               title=f"Session started {short_id(host_sid)}",
+               message=(f"{host} session {host_sid or '?'} started"
+                        + (f" ({start_source})" if start_source else "")),
+               kind="session", ref_id=host_sid)
+    except Exception:
+        pass
+    return None
+
+
+def main() -> None:
+    import json
+    try:
+        data = json.load(sys.stdin)
+    except Exception as exc:
+        log_hook_error("hook_session_open", exc)
+        sys.exit(0)
+    try:
+        run(data)
+    except Exception as exc:
+        log_hook_error("hook_session_open", exc)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

{code_context_control-2.124.0 → code_context_control-2.126.1}/cli/mcp_server.py

@@ -100,6 +100,92 @@ def _build_instructions(ide_name: str) -> str:
     )
 
 
+# ── Host session id (the join key between hook rows and MCP rows) ──────────
+# The PreToolUse hooks write .c3/enforcement_state.json with `session_id` =
+# the host's id for the session that just called. When the host also put its
+# id in this process's environment (CLAUDE_CODE_SESSION_ID / CODEX_THREAD_ID)
+# the SessionManager already carries it and no file is read. Otherwise the
+# state file is consulted at most once per _HOST_SID_TTL_S — a tool call is
+# far hotter than that, and a per-call read would be a stat+parse on every
+# c3_* invocation for a value that changes once per session.
+_HOST_SID_TTL_S = 5.0
+_host_sid_cache = {"value": "", "read_at": 0.0, "linked": ""}
+_host_sid_lock = threading.Lock()
+
+
+def _host_session_id(svc) -> str:
+    """The host session id for this process, or ``""`` when nobody knows it."""
+    try:
+        session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
+        env_sid = str(session.get("host_session_id") or "").strip()
+    except Exception:
+        env_sid = ""
+    if env_sid:
+        _link_host_session(svc, env_sid)
+        return env_sid
+    now = time.monotonic()
+    with _host_sid_lock:
+        if now - _host_sid_cache["read_at"] < _HOST_SID_TTL_S:
+            return _host_sid_cache["value"]
+        _host_sid_cache["read_at"] = now
+    value = ""
+    try:
+        import json as _json
+
+        from cli._hook_utils import ENFORCEMENT_STATE_FILE
+        state_path = Path(svc.project_path) / ENFORCEMENT_STATE_FILE
+        if state_path.is_file():
+            data = _json.loads(state_path.read_text(encoding="utf-8"))
+            if isinstance(data, dict):
+                value = str(data.get("session_id") or "").strip()
+    except Exception:
+        value = ""
+    with _host_sid_lock:
+        _host_sid_cache["value"] = value
+    if value:
+        _link_host_session(svc, value)
+    return value
+
+
+def _link_host_session(svc, host_sid: str) -> None:
+    """Write the host→C3 link file once per distinct host id (services.host_sessions)."""
+    with _host_sid_lock:
+        if _host_sid_cache["linked"] == host_sid:
+            return
+        _host_sid_cache["linked"] = host_sid
+    try:
+        session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
+        c3_id = str(session.get("id") or "")
+        if c3_id:
+            from services.host_sessions import write_link
+            write_link(svc.project_path, getattr(svc, "ide_name", "") or _IDE_NAME, host_sid, c3_id)
+    except Exception:
+        pass
+
+
+def _notify_mcp_ready(svc) -> None:
+    """``kind="mcp"`` / ``C3 connected`` — the runtime is ready to serve (D0b).
+
+    ref_id is the C3 session id, the same value ``session_start`` carries;
+    the host id rides in the message when known. Best-effort: a notification
+    failure must never keep the server from serving.
+    """
+    try:
+        session = getattr(getattr(svc, "session_mgr", None), "current_session", None) or {}
+        c3_id = str(session.get("id") or "")
+        host_sid = _host_session_id(svc)
+        short = (host_sid or c3_id)[:8] or "?"
+        from services.notifications import notify
+        notify(svc.project_path, agent="c3", severity="info",
+               title=f"C3 connected {short}",
+               message=(f"C3 {C3_VERSION} MCP runtime ready for {_IDE_NAME}"
+                        f" (session {c3_id}"
+                        + (f", host {host_sid}" if host_sid else "") + ")"),
+               kind="mcp", ref_id=c3_id)
+    except Exception:
+        pass
+
+
 @asynccontextmanager
 async def lifespan(server):
     """Initialize all services, auto-start session, start file watcher."""
@@ -223,9 +309,16 @@ async def lifespan(server):
     services.auto_memory = AutoMemory(services.memory, services.session_mgr, auto_mem_cfg)
 
     if services.session_mgr.current_session:
+        # host_session_id (the Claude Code UUID / Codex thread id) joins this
+        # row to the hooks' session_open / session_end rows, which only know
+        # the host id. Absent when the host did not put its id in the
+        # environment; the link file below is written lazily in that case
+        # the first time a hook reveals it (see _host_session_id).
+        _host_sid = _host_session_id(services)
         services.activity_log.log("session_start", {
             "session_id": services.session_mgr.current_session["id"],
             "source_system": started_session.get("source_system", ""),
+            **({"host_session_id": _host_sid} if _host_sid else {}),
         })
 
     # Auto-restore latest snapshot if recent (< 30 min).
@@ -288,6 +381,12 @@ async def lifespan(server):
                 )
         _t.Thread(target=_bg_validation_sweep, daemon=True, name="c3-validate-sweep").start()
 
+    # Runtime is ready to serve: say so where a client can hear it. A desktop
+    # "MCP failed to connect" sentinel keys on a session_open with no `mcp`
+    # notification within 30 s, so this must be the LAST thing before the
+    # handshake proceeds and must never be skipped on a partial init.
+    _notify_mcp_ready(services)
+
     try:
         yield services
     finally:
@@ -430,8 +529,22 @@ def _finalize_response(ctx: Context, tool_name: str, args: dict,
         call_ok = not _failed(response)
     except Exception:
         call_ok = True
+    # Both session ids on every tool_call row (D0b): C3's own id joins the
+    # row to session_start / the saved session file, the host id joins it to
+    # the hooks' session_open / session_end rows. Either may be absent.
+    _ids: dict = {}
+    try:
+        _c3_sid = str((svc.session_mgr.current_session or {}).get("id") or "")
+        if _c3_sid:
+            _ids["session_id"] = _c3_sid
+        _host_sid = _host_session_id(svc)
+        if _host_sid:
+            _ids["host_session_id"] = _host_sid
+    except Exception:
+        pass
     svc.activity_log.log("tool_call", {"tool": tool_name, "args": args,
-                                       "result_summary": summary, "ok": call_ok})
+                                       "result_summary": summary, "ok": call_ok,
+                                       **_ids})
     tracker = getattr(svc, "time_tracker", None)
     if tracker is not None:
         try:

{code_context_control-2.124.0 → code_context_control-2.126.1/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.124.0
+Version: 2.126.1
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -380,7 +380,7 @@ C3 also records real per-tool usage to `.c3/tool_telemetry.jsonl`, so estimates
 ## Security & privacy
 
 - **All web servers bind `127.0.0.1` by default** and are guarded against browser-based attacks even on loopback — a Host-header allowlist (defeats DNS rebinding) plus an Origin/Referer check on every request (defeats cross-origin CSRF), with scoped, non-wildcard CORS. There is still **no user authentication**, so do not expose these servers to an untrusted network without auth/TLS in front. Binding to a non-loopback interface is opt-in and warned at startup. *(Hardening added in v2.33.0.)*
-- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires the **Discovery Bearer token on every method, GETs included**, validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (QR code carrying URL + token). Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
+- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires a **Bearer token on every method, GETs included** — the Discovery token, or (v2.125.0+) a **per-client token**: one credential per paired device, stored hashed in `~/.c3/oracle/clients.json`, revocable one at a time, and carrying a kind (`mobile` or `desk`) that override decisions are audited under. It validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (the QR carries the URL and a freshly minted per-device token; a legacy Discovery-token code is one button away). A same-machine client such as C3 Desk pairs itself with `POST /api/mobile/clients` and the owner-only `~/.c3/oracle/bootstrap.key`. Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`; with such a bind the Oracle also listens on `127.0.0.1` (`loopback_listener`, default on) so local clients are not refused. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
 - **The mobile gateway never returns a credential value.** It has no reveal route by design: entries cross the wire through an allowlist serializer, and a value can only be identified by its length and an on-demand fingerprint. Two further levers ship **off** — `mobile_creds_agent_readable_raise` (raising `agent_readable` from the phone) and `mobile_access_global_scope` (machine-wide access rules) — because each exceeds what a leaked Bearer token could otherwise reach. Deliberately absent from the surface: bulk `.env` import, denial-counter clearing, `set_builtin_disabled`, and the raw-content access preview.
 - **No telemetry by default.** The OSS package collects nothing. Opt-in Sentry crash reporting requires the `[telemetry]` extra plus both `SENTRY_DSN` and `C3_TELEMETRY_OPT_IN=1`; even then request bodies, local variables, and prompts are stripped.
 - **LLM memory distillation is local-first.** Cloud distillation (v2.51.0) is off by default and opt-in per project.

{code_context_control-2.124.0 → code_context_control-2.126.1}/code_context_control.egg-info/SOURCES.txt

@@ -21,6 +21,8 @@ cli/hook_ghost_files.py
 cli/hook_pretool_enforce.py
 cli/hook_prompt_recall.py
 cli/hook_read.py
+cli/hook_session_end.py
+cli/hook_session_open.py
 cli/hook_session_stats.py
 cli/hook_terse_advisor.py
 cli/hub_server.py
@@ -141,6 +143,7 @@ core/mcp_toml.py
 core/web_security.py
 oracle/__init__.py
 oracle/config.py
+oracle/listeners.py
 oracle/mcp_oracle.py
 oracle/oracle_server.py
 oracle/oracle_ui.html
@@ -151,6 +154,7 @@ oracle/services/c3_bridge.py
 oracle/services/chat_engine.py
 oracle/services/chat_poll.py
 oracle/services/chat_store.py
+oracle/services/client_tokens.py
 oracle/services/cross_memory.py
 oracle/services/discovery_audit.py
 oracle/services/federated_graph.py
@@ -229,6 +233,7 @@ services/error_reporting.py
 services/file_map.py
 services/file_memory.py
 services/git_context.py
+services/host_sessions.py
 services/hub_service.py
 services/index_store.py
 services/indexer.py
@@ -370,6 +375,7 @@ tests/test_hook_codex_compat.py
 tests/test_hook_dispatch.py
 tests/test_hook_pretool_enforce.py
 tests/test_hook_prompt_recall.py
+tests/test_hook_session_end.py
 tests/test_hook_smoke.py
 tests/test_hook_state.py
 tests/test_hook_utf8_stdio.py
@@ -410,12 +416,15 @@ tests/test_memory_graph_api.py
 tests/test_memory_queue.py
 tests/test_memory_system.py
 tests/test_mobile_api.py
+tests/test_mobile_clients.py
 tests/test_mobile_extras.py
+tests/test_mobile_jobs_ci.py
 tests/test_mobile_override_routes.py
 tests/test_mobile_security_api.py
 tests/test_no_stale_model_pins.py
 tests/test_notification_dedup.py
 tests/test_notification_discipline.py
+tests/test_notification_kinds.py
 tests/test_ollama_credentials.py
 tests/test_oracle_api_auth.py
 tests/test_oracle_apikey_api.py
@@ -426,6 +435,7 @@ tests/test_oracle_discovery_api.py
 tests/test_oracle_discovery_audit.py
 tests/test_oracle_health_probe.py
 tests/test_oracle_local_auth.py
+tests/test_oracle_loopback.py
 tests/test_oracle_ollama_bridge.py
 tests/test_oracle_scanner_cache.py
 tests/test_oracle_security_fixes.py

{code_context_control-2.124.0 → code_context_control-2.126.1}/oracle/config.py

@@ -11,6 +11,11 @@ DEFAULTS = {
     "port": 3331,
     # ── Discovery API (external LLM tool surface, v2.32.0) ──
     "bind_host": "127.0.0.1",       # loopback only by default (was 0.0.0.0)
+    # When bind_host is a specific non-loopback address (a Tailscale / LAN
+    # IP), ALSO serve the same app on 127.0.0.1 so same-machine clients (the
+    # desk tray client, `c3 oracle open`, curl) are not refused. No effect on
+    # a loopback or wildcard bind. See oracle/listeners.py.
+    "loopback_listener": True,
     "api_enabled": True,            # expose /api/discovery/* REST surface
     "api_require_auth": True,       # require Bearer token on /api/discovery/*
     "api_max_tier": "action",       # cap exposed tools: "read" | "action"