code-context-control 2.46.0__tar.gz → 2.49.0__tar.gz

{code_context_control-2.46.0/code_context_control.egg-info → code_context_control-2.49.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.46.0
+Version: 2.49.0
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Gemini, Copilot). Retrieve less, read less, edit safer — and version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP).
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.46.0 → code_context_control-2.49.0}/cli/c3.py

@@ -85,7 +85,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.46.0"
+__version__ = "2.49.0"
 
 
 def _command_deps() -> CommandDeps:
@@ -5632,10 +5632,18 @@ def _bb_cmd_set_default(args, project_path: str) -> None:
 
 
 def cmd_oracle(args):
-    """Oracle Discovery API key + connection management."""
+    """Oracle dashboard server + Discovery API key management."""
     sub = getattr(args, "oracle_cmd", None)
+    if sub in ("serve", "start"):
+        # Lazy import: run_oracle builds all Oracle services (matches
+        # cmd_hub's deferred-import style so bare `c3` stays fast).
+        from oracle.oracle_server import run_oracle
+        run_oracle(port=getattr(args, "port", None),
+                   open_browser=not getattr(args, "no_browser", False))
+        return
     if sub != "api":
-        print("Usage: c3 oracle api {info,key,rotate,clear}")
+        print("Usage: c3 oracle {serve,api} — serve: launch the dashboard; "
+              "api {info,key,rotate,clear}: manage the Discovery key")
         return
 
     from oracle.config import load_config

{code_context_control-2.46.0 → code_context_control-2.49.0}/cli/commands/parser.py

@@ -357,9 +357,18 @@ def build_parser(version: str, parse_cli_ide_arg):
     # ── Oracle Discovery API (v2.32.0) ──────────────────────────────────
     p_oracle = subparsers.add_parser(
         "oracle",
-        help="Oracle Discovery API key + connection management",
+        help="Oracle dashboard server + Discovery API key management",
     )
     or_subs = p_oracle.add_subparsers(dest="oracle_cmd")
+    or_serve = or_subs.add_parser(
+        "serve",
+        aliases=["start"],
+        help="Launch the Oracle dashboard server (REST + MCP discovery endpoints)",
+    )
+    or_serve.add_argument("--port", type=int, default=None,
+                          help="Server port (default: config 'port', 3331)")
+    or_serve.add_argument("--no-browser", action="store_true",
+                          help="Don't open the browser")
     or_api = or_subs.add_parser(
         "api",
         help="Show connection info / manage the Discovery API key",

{code_context_control-2.46.0 → code_context_control-2.49.0}/cli/tools/compress.py

@@ -8,9 +8,8 @@ import sys
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from pathlib import Path
 
-from core import count_tokens
-
 from cli.tools._helpers import finalize_with_tokens, show_token_ratios
+from core import count_tokens
 
 
 def _run_memory_mcp_cli(args: list, cwd: str, timeout: int = 30) -> tuple:

{code_context_control-2.46.0 → code_context_control-2.49.0}/cli/tools/federate.py

@@ -7,7 +7,6 @@ unions child facts. Results stay in per-scope sections — TF-IDF scores are
 not comparable across corpora, so no interleaved ranking.
 """
 
-from pathlib import Path
 
 # Budget split for scope='all': the parent keeps the lion's share.
 _PARENT_BUDGET_SHARE = 0.6

{code_context_control-2.46.0 → code_context_control-2.49.0}/cli/tools/filter.py

@@ -10,9 +10,8 @@ import json
 import re
 from pathlib import Path
 
-from core import count_tokens
-
 from cli.tools._helpers import finalize_with_tokens, show_token_ratios
+from core import count_tokens
 
 
 def handle_filter(file_path: str, text: str, pattern: str, max_lines: int,

{code_context_control-2.46.0 → code_context_control-2.49.0}/cli/tools/read.py

@@ -6,9 +6,8 @@ from concurrent.futures import ThreadPoolExecutor, as_completed
 from pathlib import Path
 from typing import Any
 
-from core import count_tokens
-
 from cli.tools._helpers import finalize_with_tokens
+from core import count_tokens
 
 
 def _coerce_list(val: Any) -> list[str] | None:

{code_context_control-2.46.0 → code_context_control-2.49.0}/cli/tools/search.py

@@ -5,9 +5,8 @@ import time
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from pathlib import Path
 
-from core import count_tokens
-
 from cli.tools._helpers import finalize_with_tokens, show_token_ratios
+from core import count_tokens
 
 # Hard cap: responses above this are truncated to avoid filling context.
 _RESPONSE_TOKEN_CAP = 2400

{code_context_control-2.46.0 → code_context_control-2.49.0/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.46.0
+Version: 2.49.0
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Gemini, Copilot). Retrieve less, read less, edit safer — and version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP).
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.46.0 → code_context_control-2.49.0}/code_context_control.egg-info/SOURCES.txt

@@ -112,6 +112,7 @@ oracle/config.py
 oracle/mcp_oracle.py
 oracle/oracle.html
 oracle/oracle_server.py
+oracle/oracle_ui.html
 oracle/services/__init__.py
 oracle/services/activity_reporter.py
 oracle/services/api_auth.py
@@ -122,6 +123,7 @@ oracle/services/cross_memory.py
 oracle/services/federated_graph.py
 oracle/services/health_checker.py
 oracle/services/insight_engine.py
+oracle/services/local_session.py
 oracle/services/memory_reader.py
 oracle/services/memory_writer.py
 oracle/services/ollama_bridge.py
@@ -129,6 +131,24 @@ oracle/services/project_scanner.py
 oracle/services/review_agent.py
 oracle/services/tool_executor.py
 oracle/services/tool_registry.py
+oracle/ui/activity.js
+oracle/ui/agents.js
+oracle/ui/app.js
+oracle/ui/busy.js
+oracle/ui/core.js
+oracle/ui/crossgraph.js
+oracle/ui/header.js
+oracle/ui/insights.js
+oracle/ui/projects.js
+oracle/ui/settings.js
+oracle/ui/suggestions.js
+oracle/ui/theme_tabs.js
+oracle/ui/chat/conversations.js
+oracle/ui/chat/input.js
+oracle/ui/chat/markdown.js
+oracle/ui/chat/send.js
+oracle/ui/chat/stream_renderer.js
+oracle/ui/chat/toolbar.js
 services/__init__.py
 services/activity_log.py
 services/agent_base.py
@@ -199,6 +219,7 @@ tests/test_bitbucket_client.py
 tests/test_bitbucket_config_fallback.py
 tests/test_bitbucket_credentials.py
 tests/test_bitbucket_tool.py
+tests/test_c3_bridge_project_artifacts.py
 tests/test_c3_shell.py
 tests/test_circuit_breaker.py
 tests/test_claude_md_merge.py
@@ -231,8 +252,15 @@ tests/test_notification_dedup.py
 tests/test_notification_discipline.py
 tests/test_oracle_api_auth.py
 tests/test_oracle_apikey_api.py
+tests/test_oracle_c3_bridge.py
+tests/test_oracle_chat_engine.py
 tests/test_oracle_discovery_api.py
+tests/test_oracle_local_auth.py
+tests/test_oracle_ollama_bridge.py
+tests/test_oracle_scanner_cache.py
 tests/test_oracle_security_fixes.py
+tests/test_oracle_subproject_awareness.py
+tests/test_oracle_ui_bundle.py
 tests/test_output_filter.py
 tests/test_permissions.py
 tests/test_pm_api.py
@@ -242,6 +270,7 @@ tests/test_project_tool.py
 tests/test_read_coercion.py
 tests/test_response_boilerplate.py
 tests/test_retention.py
+tests/test_review_digest.py
 tests/test_service_durability.py
 tests/test_session_benchmark.py
 tests/test_session_budget.py

{code_context_control-2.46.0 → code_context_control-2.49.0}/oracle/config.py

@@ -18,10 +18,18 @@ DEFAULTS = {
     "mcp_port": 3332,               # discovery MCP transport port (loopback)
     "ollama_base_url": "https://ollama.com",
     "ollama_api_key": "",
+    "llm_cache_ttl_sec": 86400,     # disk cache TTL for generate() responses
     "model": "gemma4:31b-cloud",
     "hub_url": "http://localhost:3330",
+    "scanner_ttl_seconds": 20,
     "review_interval_seconds": 1800,
     "review_enabled": True,
+    # ── Scheduled activity digest (runs inside the review loop) ──
+    "digest_enabled": False,          # off = current behavior (on-demand only)
+    "digest_interval_seconds": 86400, # daily cadence once enabled
+    "digest_narrate": False,          # LLM prose costs a cloud call; opt-in
+    "digest_notify_file": "",         # "" = disabled; else JSONL sink path
+    "digest_retention_days": 14,      # prune stored digests
     "auto_open_browser": True,
     "theme": "dark",
     "max_facts_per_analysis": 100,
@@ -39,6 +47,7 @@ DEFAULTS = {
             "description": "Expert in system architecture, design patterns, and cross-project structure. Best for high-level analysis.",
             "system_prompt": "You are the Architect. Focus on structural integrity, design patterns, and the big picture. Provide high-level recommendations before diving into code.",
             "model": "gemma4:31b-cloud",
+            "backend": "ollama",
             "active": True
         },
         {
@@ -47,6 +56,7 @@ DEFAULTS = {
             "description": "Specializes in deep code analysis, bug hunting, and tracing execution paths.",
             "system_prompt": "You are the Code Explorer. Be incredibly precise, cite specific lines of code, and focus on the technical implementation details. Trace logic thoroughly.",
             "model": "gemma4:31b-cloud",
+            "backend": "ollama",
             "active": True
         },
         {
@@ -55,6 +65,7 @@ DEFAULTS = {
             "description": "Focuses on analyzing project memory, facts, and insights.",
             "system_prompt": "You are the Memory Analyst. Rely heavily on memory tools and facts to spot trends. Connect current issues to past context.",
             "model": "gemma4:31b-cloud",
+            "backend": "ollama",
             "active": True
         }
     ],

{code_context_control-2.46.0 → code_context_control-2.49.0}/oracle/oracle.html

@@ -991,6 +991,7 @@
         <button class="btn btn-primary btn-sm" id="btnLoadActivity" onclick="loadActivity()">Refresh</button>
       </div>
     </div>
+    <div id="actScheduled" style="display:none;font-size:11px;color:var(--text2);margin-bottom:10px"></div>
     <div id="actSummary" style="display:flex;gap:10px;flex-wrap:wrap;margin-bottom:14px"></div>
     <div id="actNarrative" class="card" style="display:none;margin-bottom:14px"></div>
     <div id="actProjects"></div>
@@ -1104,6 +1105,16 @@
         <label>Review Interval (minutes)</label>
         <input id="cfgInterval" type="number" min="1" value="30">
       </div>
+      <div class="field">
+        <label style="display:flex;align-items:center;gap:8px">
+          <input type="checkbox" id="cfgDigestEnabled" style="width:auto"> Scheduled activity digest
+        </label>
+        <p style="font-size:11px;color:var(--text2);margin-top:4px">Emit a cross-project digest from the review loop (Activity tab shows the latest).</p>
+      </div>
+      <div class="field">
+        <label>Digest Interval (hours)</label>
+        <input id="cfgDigestInterval" type="number" min="1" value="24">
+      </div>
       <div style="display:flex;gap:8px;margin-top:16px">
         <button class="btn btn-primary" onclick="saveSettings()">Save</button>
         <button class="btn btn-ghost" onclick="testConnection()">Test Connection</button>
@@ -1172,6 +1183,17 @@
         <label>Model</label>
         <input id="agentModel" type="text" placeholder="e.g. gemma4:31b-cloud">
       </div>
+      <div class="field">
+        <label>Backend</label>
+        <select id="agentBackend" style="width:100%;padding:8px;font-size:12px;background:var(--bg3);border:1px solid var(--border);border-radius:6px;color:var(--text)">
+          <option value="ollama">Ollama (chat tool loop)</option>
+          <option value="codex">Codex CLI (read-only, needs project)</option>
+          <option value="gemini">Gemini CLI (read-only, needs project)</option>
+          <option value="claude">Claude CLI (read-only, needs project)</option>
+          <option value="auto">Auto cascade (read-only, needs project)</option>
+        </select>
+        <p style="font-size:11px;color:var(--text2);margin-top:4px">CLI backends run c3_delegate inside a registered project; the model field applies to Ollama only.</p>
+      </div>
       <div class="field" style="display:flex;align-items:center;gap:8px">
         <input id="agentActive" type="checkbox" style="width:auto">
         <label style="margin:0;cursor:pointer" for="agentActive">Active</label>
@@ -1927,7 +1949,23 @@ async function dismissInsight(id) {
 // ═══════════════════════════════════════════════════════════
 // ── Activity Digest ──
 // ═══════════════════════════════════════════════════════════
+async function loadScheduledDigestBanner() {
+  const el = document.getElementById('actScheduled');
+  if (!el) return;
+  try {
+    const latest = await api('/api/activity/digest/latest');
+    if (latest && latest.generated_at) {
+      el.style.display = '';
+      el.textContent = 'Last scheduled digest: ' +
+        latest.generated_at.replace('T', ' ').slice(0, 19) + ' UTC';
+    } else {
+      el.style.display = 'none';
+    }
+  } catch { el.style.display = 'none'; }
+}
+
 async function loadActivity() {
+  loadScheduledDigestBanner();
   const dateEl = document.getElementById('actDate');
   if (dateEl && !dateEl.value) dateEl.value = new Date().toISOString().slice(0, 10);
   const date = dateEl ? dateEl.value : '';
@@ -2076,6 +2114,8 @@ async function loadSettings() {
     keyCheck.parentElement.style.display = hasKey ? '' : 'none';
     document.getElementById('cfgHubUrl').value = cfg.hub_url || '';
     document.getElementById('cfgInterval').value = Math.round((cfg.review_interval_seconds || 1800) / 60);
+    document.getElementById('cfgDigestEnabled').checked = !!cfg.digest_enabled;
+    document.getElementById('cfgDigestInterval').value = Math.round((cfg.digest_interval_seconds || 86400) / 3600);
     applyTheme(cfg.theme || 'dark');
     // Hub link
     const hubUrl = cfg.hub_url || 'http://localhost:3330';
@@ -2122,6 +2162,8 @@ async function saveSettings() {
     ollama_base_url: document.getElementById('cfgOllamaUrl').value,
     hub_url: document.getElementById('cfgHubUrl').value,
     review_interval_seconds: parseInt(document.getElementById('cfgInterval').value) * 60,
+    digest_enabled: document.getElementById('cfgDigestEnabled').checked,
+    digest_interval_seconds: parseInt(document.getElementById('cfgDigestInterval').value) * 3600,
     agents: window.oracleAgents
   };
   if (apiKeyVal) cfg.ollama_api_key = apiKeyVal;
@@ -4040,7 +4082,7 @@ function renderAgents() {
       <div style="flex:1;min-width:0;margin-right:16px">
         <div style="font-weight:600;font-size:14px;margin-bottom:4px;display:flex;align-items:center;gap:8px">
           ${esc(a.name)}
-          <span style="font-size:10px;font-family:monospace;background:var(--bg3);padding:2px 6px;border-radius:4px;color:var(--text2)">${esc(a.model)}</span>
+          <span style="font-size:10px;font-family:monospace;background:var(--bg3);padding:2px 6px;border-radius:4px;color:var(--text2)">${esc(a.backend && a.backend !== 'ollama' ? a.backend : a.model)}</span>
         </div>
         <div style="font-size:12px;color:var(--text2);white-space:nowrap;overflow:hidden;text-overflow:ellipsis" title="${esc(a.description)}">${esc(a.description)}</div>
       </div>
@@ -4071,6 +4113,7 @@ function openAgentModal(id = null) {
     descInput.value = a.description || '';
     promptInput.value = a.system_prompt || '';
     modelInput.value = a.model || '';
+    document.getElementById('agentBackend').value = a.backend || 'ollama';
     activeInput.checked = a.active !== false;
   } else {
     title.textContent = 'Add Custom Agent';
@@ -4079,6 +4122,7 @@ function openAgentModal(id = null) {
     descInput.value = '';
     promptInput.value = '';
     modelInput.value = window.oracleConfig.model || 'gemma4:31b-cloud';
+    document.getElementById('agentBackend').value = 'ollama';
     activeInput.checked = true;
   }
   
@@ -4100,6 +4144,7 @@ function saveAgent() {
     description: document.getElementById('agentDesc').value.trim(),
     system_prompt: document.getElementById('agentPrompt').value.trim(),
     model: document.getElementById('agentModel').value.trim(),
+    backend: document.getElementById('agentBackend').value,
     active: document.getElementById('agentActive').checked
   };
 

{code_context_control-2.46.0 → code_context_control-2.49.0}/oracle/oracle_server.py

@@ -20,7 +20,7 @@ from flask import Flask, Response, jsonify, request, send_from_directory  # noqa
 
 from oracle.config import ORACLE_DIR, load_config, save_config  # noqa: E402
 from oracle.mcp_oracle import mcp_url, start_mcp_thread  # noqa: E402
-from oracle.services import api_auth  # noqa: E402
+from oracle.services import api_auth, local_session  # noqa: E402
 from oracle.services.activity_reporter import ActivityReporter  # noqa: E402
 from oracle.services.api_auth import extract_bearer  # noqa: E402
 from oracle.services.api_auth import verify as verify_api_key  # noqa: E402
@@ -68,6 +68,7 @@ def _init_services():
         base_url=_cfg.get("ollama_base_url", "https://ollama.com"),
         model=_cfg.get("model", "gemma4:31b-cloud"),
         api_key=_cfg.get("ollama_api_key", ""),
+        cache_ttl_sec=int(_cfg.get("llm_cache_ttl_sec", 86400)),
     )
     # Verify model works on startup (background thread to avoid blocking)
     def _verify():
@@ -80,7 +81,10 @@ def _init_services():
             _model_verified = False
             logging.getLogger("oracle").warning("Ollama unreachable — model not verified")
     threading.Thread(target=_verify, daemon=True, name="oracle-model-verify").start()
-    _scanner = ProjectScanner(hub_url=_cfg.get("hub_url", "http://localhost:3330"))
+    _scanner = ProjectScanner(
+        hub_url=_cfg.get("hub_url", "http://localhost:3330"),
+        ttl=float(_cfg.get("scanner_ttl_seconds", 20)),
+    )
     _reader = MemoryReader()
     _checker = HealthChecker(_reader)
     _writer = MemoryWriter()
@@ -89,6 +93,8 @@ def _init_services():
     _chat_store = ChatStore()
     _c3_bridge = C3Bridge(scanner=_scanner)
     _federated = FederatedGraph(reader=_reader, cross_memory=_cross_memory, ollama_bridge=_bridge)
+    # Reporter before ReviewAgent: the review loop emits the scheduled digest.
+    _activity_reporter = ActivityReporter(scanner=_scanner, ollama_bridge=_bridge)
     _agent = ReviewAgent(
         scanner=_scanner,
         reader=_reader,
@@ -98,8 +104,8 @@ def _init_services():
         writer=_writer,
         interval=int(_cfg.get("review_interval_seconds", 1800)),
         federated_graph=_federated,
+        activity_reporter=_activity_reporter,
     )
-    _activity_reporter = ActivityReporter(scanner=_scanner, ollama_bridge=_bridge)
     _chat_engine = ChatEngine(
         bridge=_bridge,
         reader=_reader,
@@ -122,9 +128,10 @@ def _init_services():
 # ── CORS ──────────────────────────────────────────────────
 # Localhost security guard + scoped CORS (replaces the previous wildcard CORS).
 # Host-header allowlist + Origin/Referer CSRF guard. Bearer auth on
-# /api/discovery/* (see _discovery_auth_guard below) still applies on top; this
-# guard also protects the ungated endpoints (config, chat, /api/apikey) from
-# cross-origin reads — notably the raw Discovery token returned by api_apikey_get.
+# /api/discovery/* (see _discovery_auth_guard below) and the local write gate
+# (_local_write_guard: session cookie or Bearer on every other mutating
+# /api/* call) still apply on top; this guard blocks cross-origin browsers,
+# the write gate blocks unauthenticated local processes.
 from core.web_security import (
     allowed_hostnames as _allowed_hostnames,
 )
@@ -155,10 +162,99 @@ def _discovery_auth_guard():
     return None
 
 
+# ── Local write gate ──────────────────────────────────────
+@app.before_request
+def _local_write_guard():
+    """Auth gate for mutating local API calls (everything except Discovery).
+
+    Requires either the per-boot dashboard session cookie (issued on ``GET /``
+    to loopback browsers) or the Discovery Bearer token. Default-deny: any
+    future mutating ``/api/*`` endpoint is covered automatically. Closes the
+    rotate-then-read kill chain — previously any local process could POST
+    /api/apikey/rotate unauthenticated and read the fresh token, defeating
+    the Bearer gates on /api/config and /api/discovery/*.
+    """
+    path = request.path or ""
+    if not path.startswith("/api/") or path.startswith("/api/discovery"):
+        return None
+    if request.method in ("GET", "HEAD", "OPTIONS"):
+        return None
+    if verify_api_key(extract_bearer(request.headers.get("Authorization"))):
+        return None
+    if local_session.verify(request.cookies.get(local_session.COOKIE_NAME)):
+        return None
+    return jsonify({"error": "unauthorized"}), 401
+
+
 # ── Static ────────────────────────────────────────────────
+
+# JS load order for the concatenated Oracle UI build (mirrors cli/hub_server.py).
+# One shared script scope: function declarations hoist across files, and
+# app.js (the init IIFE) must stay LAST.
+_ORACLE_JS_FILES = [
+    "ui/core.js",
+    "ui/busy.js",
+    "ui/theme_tabs.js",
+    "ui/crossgraph.js",
+    "ui/header.js",
+    "ui/projects.js",
+    "ui/insights.js",
+    "ui/activity.js",
+    "ui/suggestions.js",
+    "ui/settings.js",
+    "ui/agents.js",
+    "ui/chat/markdown.js",
+    "ui/chat/conversations.js",
+    "ui/chat/stream_renderer.js",
+    "ui/chat/toolbar.js",
+    "ui/chat/input.js",
+    "ui/chat/send.js",
+    "ui/app.js",
+]
+
+
+def _build_oracle_html() -> str:
+    """Concatenate oracle_ui.html shell + all JS module files into one response."""
+    oracle_dir = Path(__file__).parent
+    shell_path = oracle_dir / "oracle_ui.html"
+    if not shell_path.exists():
+        return "<h1>Oracle UI not found.</h1>"
+
+    shell = shell_path.read_text(encoding="utf-8")
+
+    js_parts = []
+    for rel in _ORACLE_JS_FILES:
+        js_path = oracle_dir / rel
+        if js_path.exists():
+            js_parts.append(f"// ═══ {rel} ═══\n" + js_path.read_text(encoding="utf-8"))
+
+    return shell.replace("/* __C3_ORACLE_SCRIPTS__ */", "\n\n".join(js_parts))
+
+
+# Cache the built HTML (built on first request; cleared on server restart).
+_oracle_html_cache: str | None = None
+
+
 @app.route("/")
 def index():
-    return send_from_directory(os.path.dirname(__file__), "oracle.html")
+    global _oracle_html_cache
+    if _oracle_html_cache is None:
+        _oracle_html_cache = _build_oracle_html()
+    resp = Response(_oracle_html_cache, mimetype="text/html")
+    # Issue the dashboard session cookie only to loopback browsers; remote
+    # viewers (LAN bind) can read GET dashboards but cannot mutate.
+    if local_session.is_loopback(request.remote_addr):
+        local_session.attach_cookie(resp)
+    return resp
+
+
+@app.route("/legacy")
+def index_legacy():
+    """Frozen pre-bundle Oracle UI — escape hatch for one release, then removed."""
+    resp = send_from_directory(os.path.dirname(__file__), "oracle.html")
+    if local_session.is_loopback(request.remote_addr):
+        local_session.attach_cookie(resp)
+    return resp
 
 
 # ── Health ────────────────────────────────────────────────
@@ -206,11 +302,9 @@ _CONFIG_SETTABLE_KEYS = frozenset(_CONFIG_DEFAULTS.keys())
 @app.route("/api/config", methods=["POST"])
 def api_config_set():
     global _cfg
-    # Require the Bearer token: this endpoint can disable Discovery auth or
-    # repoint ollama_base_url, so it must never be reachable unauthenticated.
-    token = extract_bearer(request.headers.get("Authorization"))
-    if not verify_api_key(token):
-        return jsonify({"error": "unauthorized"}), 401
+    # Auth is enforced by _local_write_guard (session cookie or Bearer): this
+    # endpoint can disable Discovery auth or repoint ollama_base_url, so it
+    # must never be reachable unauthenticated.
     body = request.get_json(silent=True) or {}
     if not isinstance(body, dict):
         return jsonify({"error": "body must be a JSON object"}), 400
@@ -258,7 +352,8 @@ def api_projects():
 
 @app.route("/api/projects/scan", methods=["POST"])
 def api_projects_scan():
-    projects = _scanner.discover() if _scanner else []
+    # Explicit Scan action bypasses the scanner's TTL cache.
+    projects = _scanner.discover(force=True) if _scanner else []
     return jsonify({"scanned": len(projects), "projects": projects})
 
 
@@ -635,6 +730,23 @@ def api_chat_conversation_state(conv_id):
 
 
 # ── Activity digest (Oracle UI) ───────────────────────────
+@app.route("/api/activity/digest/latest", methods=["GET"])
+def api_activity_digest_latest():
+    """Most recent SCHEDULED digest (written by the review loop), or null.
+
+    On-demand digests via /api/activity/digest are not persisted here; this
+    serves ~/.c3/oracle/activity_digests/latest.json.
+    """
+    latest = ORACLE_DIR / "activity_digests" / "latest.json"
+    try:
+        if latest.is_file():
+            return Response(latest.read_text(encoding="utf-8"),
+                            mimetype="application/json")
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+    return jsonify({"digest": None, "generated_at": None})
+
+
 @app.route("/api/activity/digest", methods=["GET"])
 def api_activity_digest():
     """Cross-project activity digest for the Oracle UI.
@@ -740,7 +852,7 @@ def api_discovery_mcp_info():
     })
 
 
-# ── Discovery API key management (local dashboard — unauthenticated, loopback) ──
+# ── Discovery API key management (mutations gated by _local_write_guard) ──
 def _apikey_status(reveal: bool = False) -> dict:
     """Status payload for the Discovery API token + connection info.
 
@@ -786,12 +898,14 @@ def _apikey_status(reveal: bool = False) -> dict:
 def api_apikey_get():
     """Return Discovery API token status + connection info.
 
-    The unmasked token is only included when the caller presents a valid Bearer
-    token; otherwise only the masked form is returned (never the raw key over
-    HTTP unauthenticated).
+    The unmasked token is only included when the caller presents a valid
+    Bearer token or the dashboard session cookie; otherwise only the masked
+    form is returned (never the raw key over HTTP unauthenticated).
     """
     try:
-        reveal = verify_api_key(extract_bearer(request.headers.get("Authorization")))
+        reveal = verify_api_key(
+            extract_bearer(request.headers.get("Authorization"))
+        ) or local_session.verify(request.cookies.get(local_session.COOKIE_NAME))
         return jsonify(_apikey_status(reveal=reveal))
     except Exception as e:
         return jsonify({"error": str(e)}), 500