code-context-control 2.125.0__tar.gz → 2.127.0__tar.gz

{code_context_control-2.125.0/code_context_control.egg-info → code_context_control-2.127.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.125.0
+Version: 2.127.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.125.0 → code_context_control-2.127.0}/cli/_hook_utils.py

@@ -500,6 +500,40 @@ def record_json_unlocks(
         pass
 
 
+_PROJECT_WALK_UP_LEVELS = 4
+
+
+def find_project(payload: dict, project_path=None) -> Path | None:
+    """The nearest ancestor (≤ 4 levels) of ``project_path`` / ``payload.cwd``
+    that owns a ``.c3`` directory, or None.
+
+    Claude Code runs hooks from the project root, Codex passes ``--project``;
+    either way the payload's ``cwd`` may be a subdirectory (a session opened
+    in ``src/``). The walk is lexical on purpose — no path canonicalisation
+    happens here (see tests/test_access_guard_meta.py).
+    """
+    candidates = []
+    if project_path:
+        candidates.append(Path(str(project_path)))
+    cwd = payload.get("cwd") if isinstance(payload, dict) else None
+    if cwd:
+        candidates.append(Path(str(cwd)))
+    if not candidates:
+        candidates.append(Path.cwd())
+    for base in candidates:
+        node = base
+        for _ in range(_PROJECT_WALK_UP_LEVELS):
+            try:
+                if (node / ".c3").is_dir():
+                    return node
+            except OSError:
+                break
+            if node.parent == node:
+                break
+            node = node.parent
+    return None
+
+
 def emit_additional_context(text: str, is_gemini: bool) -> None:
     """Write additionalContext JSON to stdout in the correct format for the IDE."""
     if is_gemini:

{code_context_control-2.125.0 → code_context_control-2.127.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.125.0"
+__version__ = "2.127.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -5558,6 +5558,8 @@ def cmd_install_mcp(args):
         hook_posttool_cmd = f"{_dispatch_base} posttool"
         hook_stop_cmd     = f"{_dispatch_base} stop"
         hook_prompt_cmd   = f"{_dispatch_base} prompt"
+        hook_start_cmd    = f"{_dispatch_base} start"
+        hook_end_cmd      = f"{_dispatch_base} end"
 
         shell_matcher  = "Bash"
         read_matcher   = "Read"
@@ -5696,6 +5698,25 @@ def cmd_install_mcp(args):
         )
         settings.setdefault("hooks", {})[prompt_event] = existing_prompt
 
+        # ── SessionStart / SessionEnd hooks (v2.126.0: session_open /
+        # session_end activity rows + `session` notifications, the join key
+        # a desktop client needs). Same merge discipline: replace only C3's
+        # own dispatcher entries, keep user-added ones. SessionStart's
+        # matcher is the payload `source` (startup|resume|clear|compact);
+        # empty matches all — the hook itself ignores `compact`.
+        for _lifecycle_event, _lifecycle_cmd in (
+            ("SessionStart", hook_start_cmd),
+            ("SessionEnd", hook_end_cmd),
+        ):
+            _kept = [
+                h for h in settings.get("hooks", {}).get(_lifecycle_event, [])
+                if not _is_c3_prompt_hook(h)
+            ]
+            _kept.append(
+                {"matcher": "", "hooks": [{"type": "command", "command": _lifecycle_cmd}]}
+            )
+            settings.setdefault("hooks", {})[_lifecycle_event] = _kept
+
         # Claude Code only: enable MCP server prompt settings
         if profile.name == "claude-code":
             settings["enableAllProjectMcpServers"] = True
@@ -5742,6 +5763,7 @@ def cmd_install_mcp(args):
         print(f"  Hooks ({hook_event}): dispatcher (1 spawn/event) — filter/ghost/read-guard/ledger/unlock/signal via cli/hook_dispatch.py posttool")
         print(f"  Hooks ({pre_event}): dispatcher — {read_matcher}/{grep_matcher}/{glob_matcher}/{edit_matcher}/{write_matcher} (c3 enforcement)")
         print("  Hooks (Stop): dispatcher — session_stats + auto_snapshot + terse_advisor")
+        print("  Hooks (SessionStart/SessionEnd): dispatcher — session_open / session_end rows + session notifications")
         if profile.name == "claude-code":
             print("  Claude MCP prompt settings enabled for this project")
         if perm_tier and profile.name == "claude-code":
@@ -6946,8 +6968,10 @@ def cmd_override(args):
     """
     sub = getattr(args, "override_cmd", None)
     if not sub:
-        print("Usage: c3 override <policy|grant|list|revoke|check|sweep> ...")
+        print("Usage: c3 override <policy|grant|list|revoke|check|sweep|"
+              "requests|approve|deny|costs> ...")
         print("       c3 override policy    # what is escalatable right now")
+        print("       c3 override costs     # which rules keep holding the agent")
         return
 
     from services import override_grants as og
@@ -6976,6 +7000,39 @@ def cmd_override(args):
         _override_requests(args, project_path)
     elif sub in ("approve", "deny"):
         _override_decide(args, sub, project_path)
+    elif sub == "costs":
+        _override_costs(args, project_path)
+
+
+def _override_costs(args, project_path: str) -> None:
+    """`c3 override costs` — which rules keep holding the agent (§11 T5)."""
+    from services import override_costs as ocost
+
+    days = max(1, int(getattr(args, "days", None) or ocost.DEFAULT_DAYS))
+    everywhere = bool(getattr(args, "all_projects", False))
+    rows = ocost.rule_costs(project_path=None if everywhere else project_path,
+                            days=days)
+    print_header(f"Override costs — last {days} day(s)"
+                 + ("" if everywhere else f" · {Path(project_path).name}"))
+    if not rows:
+        print("  (no requests in the window)")
+        return
+    width = max(len(r["rule"]) for r in rows)
+    print(f"  {'held':>4} {'ok':>3} {'no':>3} {'exp':>3} {'wait':>4}  "
+          f"{'rule':<{width}}  suggestion")
+    for r in rows:
+        line = (f"  {r['count']:>4} {r['approved']:>3} {r['denied']:>3} "
+                f"{r['expired']:>3} {r['pending']:>4}  {r['rule']:<{width}}  "
+                f"{r['suggestion']}")
+        if r["count"] >= ocost.NUDGE_THRESHOLD:
+            line += "  <- costing you"
+        print(line)
+        if everywhere:
+            print(f"  {'':22s} {r['project_path']}")
+    print("\n  held = requests filed; ok/no/exp/wait = approved/denied/"
+          "expired/still pending (withdrawn counts in held only).")
+    print("  A rule you keep approving is friction: edit it with `c3 access`. "
+          "A rule you keep denying is working — mute the session instead.")
 
 
 def _override_requests(args, project_path: str) -> None:

{code_context_control-2.125.0 → code_context_control-2.127.0}/cli/commands/parser.py

@@ -779,6 +779,18 @@ def build_parser(version: str, parse_cli_ide_arg):
     ov_deny.add_argument("--path", dest="project_path", default=".",
                          help="Project directory (default: current)")
 
+    # Costs: which rules keep asking (spec §11 Threat 5, v2.127.0). A read
+    # over the request store — it decides nothing and edits no rule.
+    ov_costs = override_subs.add_parser(
+        "costs", help="Which rules held the agent most, and how you answered"
+    )
+    ov_costs.add_argument("--days", type=int, default=7,
+                          help="Trailing window in days (default 7)")
+    ov_costs.add_argument("--all", dest="all_projects", action="store_true",
+                          help="Every project, not just this one")
+    ov_costs.add_argument("--path", dest="project_path", default=".",
+                          help="Project directory (default: current)")
+
     # ── Tool discipline / enforcement mode (v2.66.0) ────────────────────
     # LAYER C: how hard C3 pushes the agent toward c3_* tools. Distinct from
     # `c3 access` (path policy — a security boundary) and from

{code_context_control-2.125.0 → code_context_control-2.127.0}/cli/hook_dispatch.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """Per-event hook dispatcher: ONE process per Claude Code / Gemini hook event.
 
-Usage: python hook_dispatch.py <pretool|posttool|stop|prompt>
+Usage: python hook_dispatch.py <pretool|posttool|stop|prompt|start|compact|end>
 
 Before v2.42 every hook was registered as its own "cmd /c python <hook>.py"
 subprocess, so a single native Read fired up to three interpreter spawns
@@ -167,8 +167,17 @@ def _routes(event: str, raw_tool: str, norm_tool: str, host: str = HOST_CLAUDE):
         yield "hook_terse_advisor"
     elif event == "prompt":
         yield "hook_prompt_recall"
-    elif event in ("start", "compact", "end") and host == HOST_CODEX:
-        yield "hook_codex_lifecycle"
+    elif event in ("start", "compact", "end"):
+        # Codex's thread-bound handoff runs first (it may return context on
+        # SessionStart); the session bookkeeping below is host-agnostic and
+        # returns nothing (v2.126.0: session_open / session_end rows + the
+        # `session` notifications a desktop client wakes on).
+        if host == HOST_CODEX:
+            yield "hook_codex_lifecycle"
+        if event == "start":
+            yield "hook_session_open"
+        elif event == "end":
+            yield "hook_session_end"
 
 
 _RUN_CACHE: dict = {}

code_context_control-2.127.0/cli/hook_session_end.py

@@ -0,0 +1,103 @@
+"""SessionEnd hook: record that a host session ended (D0b, v2.126.0).
+
+Claude Code's ``SessionEnd`` event delivers on stdin::
+
+    {
+      "session_id": "<Claude Code UUID>",
+      "transcript_path": "...",
+      "cwd": "...",
+      "hook_event_name": "SessionEnd",
+      "reason": "clear" | "logout" | "prompt_input_exit" | "other"
+    }
+
+Codex's ``SessionEnd`` carries its thread id in the same ``session_id``
+field; the dispatcher routes both here (``hook_dispatch._routes``, event
+``end``).
+
+Why this exists: this repo's activity log held 525 ``session_start`` rows
+and 14 ``session_save`` rows — ``session_save`` is only written when a human
+ends a session from the hub, so for a client the end of a conversation was
+invisible. Two records fix that:
+
+- ``{type: "session_end", session_id: <C3 id if known>, host_session_id,
+  reason, source}`` appended to ``.c3/activity_log.jsonl``. The C3 id comes
+  from the link file the MCP server wrote at session start
+  (``services.host_sessions``); it is ``""`` when the server never learned
+  the host id.
+- a ``session`` notification (``kind="session"``, ``ref_id=host id``,
+  severity ``info``, title ``Session ended <short id>``) in
+  ``.c3/notifications.jsonl`` — the write that wakes a ``/feed?wait=``
+  client.
+
+Runs in a short-lived subprocess with a few seconds of budget; every step is
+best-effort and nothing here can fail the session that is already ending.
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from cli._hook_utils import detect_host, find_project, log_hook_error  # noqa: E402
+
+SHORT_ID_CHARS = 8
+
+
+def short_id(session_id: str) -> str:
+    return str(session_id or "")[:SHORT_ID_CHARS] or "?"
+
+
+def run(payload: dict, project_path: Path | None = None):
+    """Core logic — importable by the dispatcher and tests. Returns None."""
+    project = find_project(payload, project_path)
+    if project is None:
+        return None
+    host = detect_host(payload)
+    host_sid = str(payload.get("session_id") or "").strip()
+    reason = str(payload.get("reason") or "").strip()
+    c3_sid = ""
+    try:
+        from services.host_sessions import linked_c3_session_id
+        c3_sid = linked_c3_session_id(project, host, host_sid)
+    except Exception:
+        c3_sid = ""
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(str(project)).log("session_end", {
+            "session_id": c3_sid,
+            "host_session_id": host_sid,
+            "reason": reason,
+            "source": host,
+        })
+    except Exception as exc:
+        log_hook_error("hook_session_end", exc)
+    try:
+        from services.notifications import notify
+        notify(project, agent="session", severity="info",
+               title=f"Session ended {short_id(host_sid)}",
+               message=(f"{host} session {host_sid or '?'} ended"
+                        + (f" ({reason})" if reason else "")
+                        + (f"; C3 session {c3_sid}" if c3_sid else "")),
+               kind="session", ref_id=host_sid)
+    except Exception:
+        pass
+    return None
+
+
+def main() -> None:
+    import json
+    try:
+        data = json.load(sys.stdin)
+    except Exception as exc:
+        log_hook_error("hook_session_end", exc)
+        sys.exit(0)
+    try:
+        run(data)
+    except Exception as exc:
+        log_hook_error("hook_session_end", exc)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

code_context_control-2.127.0/cli/hook_session_open.py

@@ -0,0 +1,97 @@
+"""SessionStart hook: record that a host session opened (D0b, v2.126.0).
+
+Claude Code's ``SessionStart`` event delivers on stdin::
+
+    {
+      "session_id": "<Claude Code UUID>",
+      "transcript_path": "...",
+      "cwd": "...",
+      "hook_event_name": "SessionStart",
+      "source": "startup" | "resume" | "clear" | "compact"
+    }
+
+Codex's ``SessionStart`` carries its thread id in the same ``session_id``
+field and no ``source``; the dispatcher routes both here (event ``start``).
+
+Records:
+
+- ``{type: "session_open", host_session_id, source: <host>, start_source}``
+  in ``.c3/activity_log.jsonl``. ``source`` is the HOST (``claude`` /
+  ``codex`` / ``gemini``), matching ``session_end``; the payload's own
+  ``source`` (startup / resume / clear) is kept as ``start_source``.
+- a ``session`` notification (``kind="session"``, ``ref_id=host id``,
+  ``info``, title ``Session started <short id>``).
+
+``source: "compact"`` writes NOTHING: a compaction is the same session and
+the same MCP process, and a "Session started" toast on every compaction
+would teach the user to ignore the real ones.
+
+The MCP server's own ``session_start`` row is untouched — it carries the C3
+id and, when the host put its id in the environment, ``host_session_id``
+too. This hook is what lets a client see the session before the runtime has
+finished starting (~seconds), and it is the row the desktop's "MCP failed to
+connect" sentinel starts its 30 s clock from.
+
+Returns None always: SessionStart hook stdout becomes model context, and
+this hook has nothing to tell the model.
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from cli._hook_utils import detect_host, find_project, log_hook_error  # noqa: E402
+from cli.hook_session_end import short_id  # noqa: E402
+
+_SILENT_SOURCES = {"compact"}
+
+
+def run(payload: dict, project_path: Path | None = None):
+    """Core logic — importable by the dispatcher and tests. Returns None."""
+    start_source = str(payload.get("source") or "").strip().lower()
+    if start_source in _SILENT_SOURCES:
+        return None
+    project = find_project(payload, project_path)
+    if project is None:
+        return None
+    host = detect_host(payload)
+    host_sid = str(payload.get("session_id") or "").strip()
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(str(project)).log("session_open", {
+            "host_session_id": host_sid,
+            "source": host,
+            "start_source": start_source,
+        })
+    except Exception as exc:
+        log_hook_error("hook_session_open", exc)
+    try:
+        from services.notifications import notify
+        notify(project, agent="session", severity="info",
+               title=f"Session started {short_id(host_sid)}",
+               message=(f"{host} session {host_sid or '?'} started"
+                        + (f" ({start_source})" if start_source else "")),
+               kind="session", ref_id=host_sid)
+    except Exception:
+        pass
+    return None
+
+
+def main() -> None:
+    import json
+    try:
+        data = json.load(sys.stdin)
+    except Exception as exc:
+        log_hook_error("hook_session_open", exc)
+        sys.exit(0)
+    try:
+        run(data)
+    except Exception as exc:
+        log_hook_error("hook_session_open", exc)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

{code_context_control-2.125.0 → code_context_control-2.127.0}/cli/hub_server.py

@@ -3215,6 +3215,43 @@ def api_hub_overrides():
                     "limit": limit})
 
 
+@app.route("/api/hub/overrides/costs", methods=["GET"])
+def api_hub_override_costs():
+    """Per-(project, rule) request counts over a trailing window (§11 T5).
+
+    The "this rule is costing you" strip. Query: path (optional — omit for
+    every project in the store; the hub is this machine's own surface and
+    does not filter to a registry), days (1..30, default 7). Response:
+    {days, threshold, rules: [...], count, project} with the row shape of
+    ``services.override_costs.FIELDS``; ``threshold`` is the count at which
+    the UI says something, so the strip and the desktop tray agree on it.
+    Registered before the POST-only ``<request_id>`` route so a GET on
+    ``costs`` can never fall through to a 405 there.
+    """
+    from services import override_costs as ocost
+    project_path = ""
+    raw_project = (request.args.get("path") or "").strip()
+    if raw_project:
+        try:
+            project_path = str(_resolve_project_path(raw_project))
+        except ValueError as e:
+            return jsonify({"error": str(e)}), 404
+    try:
+        days = int(request.args.get("days") or ocost.DEFAULT_DAYS)
+    except (TypeError, ValueError):
+        days = ocost.DEFAULT_DAYS
+    days = max(1, min(ocost.MAX_DAYS, days))
+    try:
+        rules = ocost.rule_costs(project_path=project_path or None, days=days)
+    except Exception as exc:
+        return jsonify({"error": str(exc)}), 500
+    for r in rules:
+        r["project_name"] = Path(str(r.get("project_path") or ".")).name
+    return jsonify({"days": days, "threshold": ocost.NUDGE_THRESHOLD,
+                    "rules": rules, "count": len(rules),
+                    "project": project_path})
+
+
 @app.route("/api/hub/overrides/<request_id>", methods=["POST"])
 def api_hub_override_decide(request_id):
     """Approve (minting a grant) or deny one request. decided_by='desktop'.

{code_context_control-2.125.0 → code_context_control-2.127.0}/cli/hub_ui/components/hub_access.js

@@ -185,11 +185,79 @@ function AccRequestCard({ row, busy, onDecide, onTypedApprove, onRuleApprove })
   );
 }
 
+// ── "Costing you" — the §11 Threat 5 nudge ─────────────────────────────────
+// One row per rule that held at least `threshold` times in the window. The
+// count is the argument: a rule the user keeps approving is friction, and a
+// rule they keep denying is doing its job against an agent that will not
+// stop asking. Either way the fix is the RULE, not the next card — so the
+// only affordance is "open the rule", which jumps to it in the policy matrix
+// below. The strip never approves anything and never edits policy; it says
+// the number out loud, which is the mitigation the spec asks for.
+function accSamePath(a, b) {
+  const norm = (p) => String(p || '').replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+  return norm(a) === norm(b);
+}
+
+function AccCostStrip({ onOpenRule }) {
+  const [data, setData] = useState(null);
+
+  const load = useCallback(async () => {
+    try {
+      setData(await api.get('/api/hub/overrides/costs?days=7'));
+    } catch { /* keep the last good strip */ }
+  }, []);
+
+  useEffect(() => { load(); }, [load]);
+  usePoll(load, 15000);
+
+  if (!data) return null;
+  const threshold = Number(data.threshold) || 3;
+  const rows = (data.rules || []).filter(r => (Number(r.count) || 0) >= threshold);
+  if (rows.length === 0) return null;
+  return (
+    <div style={{
+      background: T.surface, border: `1px solid ${T.warn}`, borderRadius: 10,
+      padding: '10px 14px',
+    }}>
+      <div style={{ display: 'flex', alignItems: 'center', gap: 8, flexWrap: 'wrap', marginBottom: 4 }}>
+        <span style={{ fontSize: 12.5, fontWeight: 700, color: T.warn }}>Costing you</span>
+        <span style={{ fontSize: 11, color: T.textDim }}>
+          rules that held {threshold}+ times in the last {data.days} days — fix the
+          rule, not the next card
+        </span>
+      </div>
+      {rows.map(r => (
+        <div key={`${r.project_path}|${r.rule}`} style={{
+          display: 'flex', alignItems: 'center', gap: 8, flexWrap: 'wrap',
+          padding: '4px 0', fontSize: 11.5, color: T.textMuted,
+        }}>
+          <span className="mono" title={r.project_path} style={{
+            fontSize: 10.5, padding: '2px 7px', borderRadius: 4,
+            background: T.surfaceAlt, color: T.textMuted,
+          }}>{r.project_name || r.project_path}</span>
+          <span>
+            <b className="mono" style={{ color: T.text }}>{r.rule}</b>
+            {' '}held {r.count}× this week ({r.approved} approved) — {r.suggestion}
+          </span>
+          <div style={{ flex: 1 }} />
+          <Btn variant="ghost" onClick={() => onOpenRule(r)}
+            style={{ padding: '4px 10px' }}>Open rule</Btn>
+        </div>
+      ))}
+    </div>
+  );
+}
+
 // ── Read-only per-project policy matrix ────────────────────────────────────
-function AccRulesPanel({ projects }) {
+// `focus` ({path, rule, seq}) comes from the cost strip's "Open rule": the
+// panel switches to that project, scrolls itself into view and outlines the
+// chip whose glob is the rule. A synthetic rule (discipline / shell) has no
+// chip, so the scroll alone is the answer there.
+function AccRulesPanel({ projects, focus }) {
   const [path, setPath] = useState('');
   const [data, setData] = useState(null);
   const [err, setErr] = useState('');
+  const panelRef = useRef(null);
 
   const load = useCallback(async (p) => {
     if (!p) { setData(null); setErr(''); return; }
@@ -199,10 +267,28 @@ function AccRulesPanel({ projects }) {
     } catch (e) { setData(null); setErr(apiErr(e)); }
   }, []);
 
+  // Deliberately keyed on `focus` alone: `projects` is rebuilt by the hub's
+  // own poll, and re-running this on every poll would re-scroll the page
+  // under the user every few seconds.
+  useEffect(() => {
+    if (!focus || !focus.path) return;
+    // Prefer the hub's own spelling of the project so the <select> shows it;
+    // the store's spelling still loads when the project is not registered.
+    const known = (projects || []).find(p => accSamePath(p.path, focus.path));
+    const target = known ? known.path : focus.path;
+    setPath(target);
+    load(target);
+    const el = panelRef.current;
+    if (el && typeof el.scrollIntoView === 'function') {
+      el.scrollIntoView({ behavior: 'smooth', block: 'start' });
+    }
+  }, [focus]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  const hot = focus && focus.rule ? String(focus.rule) : '';
   const scopes = (data && data.rules) || {};
   const layerRows = data && data.policy ? Object.entries(data.policy.layers || {}) : [];
   return (
-    <div style={{
+    <div ref={panelRef} style={{
       background: T.surface, border: `1px solid ${T.border}`, borderRadius: 10,
       padding: '12px 16px',
     }}>
@@ -249,14 +335,21 @@ function AccRulesPanel({ projects }) {
                   <div style={{ fontSize: 11.5, color: T.textDim }}>no rules</div>
                 ) : (
                   <div style={{ display: 'flex', flexWrap: 'wrap', gap: 6 }}>
-                    {rows.map(([kind, glob], i) => (
-                      <span key={i} className="mono" style={{
-                        fontSize: 11, padding: '2px 8px', borderRadius: 4,
-                        color: ACC_KIND_COLOR(kind),
-                        background: `${ACC_KIND_COLOR(kind)}18`,
-                        border: `1px solid ${ACC_KIND_COLOR(kind)}44`,
-                      }} title={kind}>{kind}: {glob}</span>
-                    ))}
+                    {rows.map(([kind, glob], i) => {
+                      const lit = hot && glob === hot;
+                      return (
+                        <span key={i} className="mono" style={{
+                          fontSize: 11, padding: '2px 8px', borderRadius: 4,
+                          color: ACC_KIND_COLOR(kind),
+                          background: `${ACC_KIND_COLOR(kind)}18`,
+                          border: `1px solid ${ACC_KIND_COLOR(kind)}44`,
+                          outline: lit ? `2px solid ${T.warn}` : 'none',
+                          outlineOffset: lit ? 2 : 0,
+                        }} title={lit ? `${kind} — this rule is costing you` : kind}>
+                          {kind}: {glob}
+                        </span>
+                      );
+                    })}
                   </div>
                 )}
                 {scope === 'builtin' && (sec.disabled || []).length > 0 && (
@@ -395,6 +488,11 @@ function HubAccess({ projects }) {
   const [chip, setChip] = useState('pending');
   const [busyId, setBusyId] = useState('');
   const [confirmSpec, setConfirmSpec] = useState(null);
+  // `seq` makes a second click on the same rule re-fire the panel's effect.
+  const [ruleFocus, setRuleFocus] = useState(null);
+  const openRule = (r) => setRuleFocus({
+    path: r.project_path, rule: r.rule, seq: Date.now(),
+  });
 
   const load = useCallback(async () => {
     try {
@@ -459,6 +557,8 @@ function HubAccess({ projects }) {
         ))}
       </div>
 
+      <AccCostStrip onOpenRule={openRule} />
+
       {!loaded ? (
         <div style={{ fontSize: 12, color: T.textDim }}>Loading…</div>
       ) : rows.length === 0 ? (
@@ -479,7 +579,7 @@ function HubAccess({ projects }) {
       )}
 
       <AccGrantsPanel projects={projects} />
-      <AccRulesPanel projects={projects} />
+      <AccRulesPanel projects={projects} focus={ruleFocus} />
       {confirmSpec && (
         <CredConfirm spec={confirmSpec} onClose={() => setConfirmSpec(null)} />
       )}