code-context-control 2.46.1__tar.gz → 2.49.1__tar.gz

{code_context_control-2.46.1/code_context_control.egg-info → code_context_control-2.49.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.46.1
+Version: 2.49.1
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Gemini, Copilot). Retrieve less, read less, edit safer — and version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP).
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.46.1 → code_context_control-2.49.1}/cli/c3.py

@@ -85,7 +85,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.46.1"
+__version__ = "2.49.1"
 
 
 def _command_deps() -> CommandDeps:
@@ -5632,10 +5632,18 @@ def _bb_cmd_set_default(args, project_path: str) -> None:
 
 
 def cmd_oracle(args):
-    """Oracle Discovery API key + connection management."""
+    """Oracle dashboard server + Discovery API key management."""
     sub = getattr(args, "oracle_cmd", None)
+    if sub in ("serve", "start"):
+        # Lazy import: run_oracle builds all Oracle services (matches
+        # cmd_hub's deferred-import style so bare `c3` stays fast).
+        from oracle.oracle_server import run_oracle
+        run_oracle(port=getattr(args, "port", None),
+                   open_browser=not getattr(args, "no_browser", False))
+        return
     if sub != "api":
-        print("Usage: c3 oracle api {info,key,rotate,clear}")
+        print("Usage: c3 oracle {serve,api} — serve: launch the dashboard; "
+              "api {info,key,rotate,clear}: manage the Discovery key")
         return
 
     from oracle.config import load_config

{code_context_control-2.46.1 → code_context_control-2.49.1}/cli/commands/parser.py

@@ -357,9 +357,18 @@ def build_parser(version: str, parse_cli_ide_arg):
     # ── Oracle Discovery API (v2.32.0) ──────────────────────────────────
     p_oracle = subparsers.add_parser(
         "oracle",
-        help="Oracle Discovery API key + connection management",
+        help="Oracle dashboard server + Discovery API key management",
     )
     or_subs = p_oracle.add_subparsers(dest="oracle_cmd")
+    or_serve = or_subs.add_parser(
+        "serve",
+        aliases=["start"],
+        help="Launch the Oracle dashboard server (REST + MCP discovery endpoints)",
+    )
+    or_serve.add_argument("--port", type=int, default=None,
+                          help="Server port (default: config 'port', 3331)")
+    or_serve.add_argument("--no-browser", action="store_true",
+                          help="Don't open the browser")
     or_api = or_subs.add_parser(
         "api",
         help="Show connection info / manage the Discovery API key",

{code_context_control-2.46.1 → code_context_control-2.49.1/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.46.1
+Version: 2.49.1
 Summary: Local code-intelligence layer for AI coding tools (Claude Code, Codex, Gemini, Copilot). Retrieve less, read less, edit safer — and version the configs that shape your agent (CLAUDE.md, skills, hooks, MCP).
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.46.1 → code_context_control-2.49.1}/code_context_control.egg-info/SOURCES.txt

@@ -110,8 +110,8 @@ core/web_security.py
 oracle/__init__.py
 oracle/config.py
 oracle/mcp_oracle.py
-oracle/oracle.html
 oracle/oracle_server.py
+oracle/oracle_ui.html
 oracle/services/__init__.py
 oracle/services/activity_reporter.py
 oracle/services/api_auth.py
@@ -122,6 +122,7 @@ oracle/services/cross_memory.py
 oracle/services/federated_graph.py
 oracle/services/health_checker.py
 oracle/services/insight_engine.py
+oracle/services/local_session.py
 oracle/services/memory_reader.py
 oracle/services/memory_writer.py
 oracle/services/ollama_bridge.py
@@ -129,6 +130,24 @@ oracle/services/project_scanner.py
 oracle/services/review_agent.py
 oracle/services/tool_executor.py
 oracle/services/tool_registry.py
+oracle/ui/activity.js
+oracle/ui/agents.js
+oracle/ui/app.js
+oracle/ui/busy.js
+oracle/ui/core.js
+oracle/ui/crossgraph.js
+oracle/ui/header.js
+oracle/ui/insights.js
+oracle/ui/projects.js
+oracle/ui/settings.js
+oracle/ui/suggestions.js
+oracle/ui/theme_tabs.js
+oracle/ui/chat/conversations.js
+oracle/ui/chat/input.js
+oracle/ui/chat/markdown.js
+oracle/ui/chat/send.js
+oracle/ui/chat/stream_renderer.js
+oracle/ui/chat/toolbar.js
 services/__init__.py
 services/activity_log.py
 services/agent_base.py
@@ -199,6 +218,7 @@ tests/test_bitbucket_client.py
 tests/test_bitbucket_config_fallback.py
 tests/test_bitbucket_credentials.py
 tests/test_bitbucket_tool.py
+tests/test_c3_bridge_project_artifacts.py
 tests/test_c3_shell.py
 tests/test_circuit_breaker.py
 tests/test_claude_md_merge.py
@@ -231,8 +251,15 @@ tests/test_notification_dedup.py
 tests/test_notification_discipline.py
 tests/test_oracle_api_auth.py
 tests/test_oracle_apikey_api.py
+tests/test_oracle_c3_bridge.py
+tests/test_oracle_chat_engine.py
 tests/test_oracle_discovery_api.py
+tests/test_oracle_local_auth.py
+tests/test_oracle_ollama_bridge.py
+tests/test_oracle_scanner_cache.py
 tests/test_oracle_security_fixes.py
+tests/test_oracle_subproject_awareness.py
+tests/test_oracle_ui_bundle.py
 tests/test_output_filter.py
 tests/test_permissions.py
 tests/test_pm_api.py
@@ -242,6 +269,7 @@ tests/test_project_tool.py
 tests/test_read_coercion.py
 tests/test_response_boilerplate.py
 tests/test_retention.py
+tests/test_review_digest.py
 tests/test_service_durability.py
 tests/test_session_benchmark.py
 tests/test_session_budget.py

{code_context_control-2.46.1 → code_context_control-2.49.1}/oracle/config.py

@@ -18,12 +18,21 @@ DEFAULTS = {
     "mcp_port": 3332,               # discovery MCP transport port (loopback)
     "ollama_base_url": "https://ollama.com",
     "ollama_api_key": "",
+    "llm_cache_ttl_sec": 86400,     # disk cache TTL for generate() responses
     "model": "gemma4:31b-cloud",
     "hub_url": "http://localhost:3330",
+    "scanner_ttl_seconds": 20,
     "review_interval_seconds": 1800,
     "review_enabled": True,
+    # ── Scheduled activity digest (runs inside the review loop) ──
+    "digest_enabled": False,          # off = current behavior (on-demand only)
+    "digest_interval_seconds": 86400, # daily cadence once enabled
+    "digest_narrate": False,          # LLM prose costs a cloud call; opt-in
+    "digest_notify_file": "",         # "" = disabled; else JSONL sink path
+    "digest_retention_days": 14,      # prune stored digests
     "auto_open_browser": True,
     "theme": "dark",
+    "ui_last_tab": "chat",          # persisted UI preference (hub parity)
     "max_facts_per_analysis": 100,
     "insight_confidence_threshold": 0.5,
     "log_level": "INFO",
@@ -39,6 +48,7 @@ DEFAULTS = {
             "description": "Expert in system architecture, design patterns, and cross-project structure. Best for high-level analysis.",
             "system_prompt": "You are the Architect. Focus on structural integrity, design patterns, and the big picture. Provide high-level recommendations before diving into code.",
             "model": "gemma4:31b-cloud",
+            "backend": "ollama",
             "active": True
         },
         {
@@ -47,6 +57,7 @@ DEFAULTS = {
             "description": "Specializes in deep code analysis, bug hunting, and tracing execution paths.",
             "system_prompt": "You are the Code Explorer. Be incredibly precise, cite specific lines of code, and focus on the technical implementation details. Trace logic thoroughly.",
             "model": "gemma4:31b-cloud",
+            "backend": "ollama",
             "active": True
         },
         {
@@ -55,6 +66,7 @@ DEFAULTS = {
             "description": "Focuses on analyzing project memory, facts, and insights.",
             "system_prompt": "You are the Memory Analyst. Rely heavily on memory tools and facts to spot trends. Connect current issues to past context.",
             "model": "gemma4:31b-cloud",
+            "backend": "ollama",
             "active": True
         }
     ],

{code_context_control-2.46.1 → code_context_control-2.49.1}/oracle/oracle_server.py

@@ -3,7 +3,6 @@
 import atexit
 import json
 import logging
-import os
 import socket
 import sys
 import threading
@@ -16,11 +15,11 @@ _PROJECT_ROOT = Path(__file__).resolve().parent.parent
 if str(_PROJECT_ROOT) not in sys.path:
     sys.path.insert(0, str(_PROJECT_ROOT))
 
-from flask import Flask, Response, jsonify, request, send_from_directory  # noqa: E402
+from flask import Flask, Response, jsonify, request  # noqa: E402
 
 from oracle.config import ORACLE_DIR, load_config, save_config  # noqa: E402
 from oracle.mcp_oracle import mcp_url, start_mcp_thread  # noqa: E402
-from oracle.services import api_auth  # noqa: E402
+from oracle.services import api_auth, local_session  # noqa: E402
 from oracle.services.activity_reporter import ActivityReporter  # noqa: E402
 from oracle.services.api_auth import extract_bearer  # noqa: E402
 from oracle.services.api_auth import verify as verify_api_key  # noqa: E402
@@ -68,6 +67,7 @@ def _init_services():
         base_url=_cfg.get("ollama_base_url", "https://ollama.com"),
         model=_cfg.get("model", "gemma4:31b-cloud"),
         api_key=_cfg.get("ollama_api_key", ""),
+        cache_ttl_sec=int(_cfg.get("llm_cache_ttl_sec", 86400)),
     )
     # Verify model works on startup (background thread to avoid blocking)
     def _verify():
@@ -80,7 +80,10 @@ def _init_services():
             _model_verified = False
             logging.getLogger("oracle").warning("Ollama unreachable — model not verified")
     threading.Thread(target=_verify, daemon=True, name="oracle-model-verify").start()
-    _scanner = ProjectScanner(hub_url=_cfg.get("hub_url", "http://localhost:3330"))
+    _scanner = ProjectScanner(
+        hub_url=_cfg.get("hub_url", "http://localhost:3330"),
+        ttl=float(_cfg.get("scanner_ttl_seconds", 20)),
+    )
     _reader = MemoryReader()
     _checker = HealthChecker(_reader)
     _writer = MemoryWriter()
@@ -89,6 +92,8 @@ def _init_services():
     _chat_store = ChatStore()
     _c3_bridge = C3Bridge(scanner=_scanner)
     _federated = FederatedGraph(reader=_reader, cross_memory=_cross_memory, ollama_bridge=_bridge)
+    # Reporter before ReviewAgent: the review loop emits the scheduled digest.
+    _activity_reporter = ActivityReporter(scanner=_scanner, ollama_bridge=_bridge)
     _agent = ReviewAgent(
         scanner=_scanner,
         reader=_reader,
@@ -98,8 +103,8 @@ def _init_services():
         writer=_writer,
         interval=int(_cfg.get("review_interval_seconds", 1800)),
         federated_graph=_federated,
+        activity_reporter=_activity_reporter,
     )
-    _activity_reporter = ActivityReporter(scanner=_scanner, ollama_bridge=_bridge)
     _chat_engine = ChatEngine(
         bridge=_bridge,
         reader=_reader,
@@ -122,9 +127,10 @@ def _init_services():
 # ── CORS ──────────────────────────────────────────────────
 # Localhost security guard + scoped CORS (replaces the previous wildcard CORS).
 # Host-header allowlist + Origin/Referer CSRF guard. Bearer auth on
-# /api/discovery/* (see _discovery_auth_guard below) still applies on top; this
-# guard also protects the ungated endpoints (config, chat, /api/apikey) from
-# cross-origin reads — notably the raw Discovery token returned by api_apikey_get.
+# /api/discovery/* (see _discovery_auth_guard below) and the local write gate
+# (_local_write_guard: session cookie or Bearer on every other mutating
+# /api/* call) still apply on top; this guard blocks cross-origin browsers,
+# the write gate blocks unauthenticated local processes.
 from core.web_security import (
     allowed_hostnames as _allowed_hostnames,
 )
@@ -155,10 +161,90 @@ def _discovery_auth_guard():
     return None
 
 
+# ── Local write gate ──────────────────────────────────────
+@app.before_request
+def _local_write_guard():
+    """Auth gate for mutating local API calls (everything except Discovery).
+
+    Requires either the per-boot dashboard session cookie (issued on ``GET /``
+    to loopback browsers) or the Discovery Bearer token. Default-deny: any
+    future mutating ``/api/*`` endpoint is covered automatically. Closes the
+    rotate-then-read kill chain — previously any local process could POST
+    /api/apikey/rotate unauthenticated and read the fresh token, defeating
+    the Bearer gates on /api/config and /api/discovery/*.
+    """
+    path = request.path or ""
+    if not path.startswith("/api/") or path.startswith("/api/discovery"):
+        return None
+    if request.method in ("GET", "HEAD", "OPTIONS"):
+        return None
+    if verify_api_key(extract_bearer(request.headers.get("Authorization"))):
+        return None
+    if local_session.verify(request.cookies.get(local_session.COOKIE_NAME)):
+        return None
+    return jsonify({"error": "unauthorized"}), 401
+
+
 # ── Static ────────────────────────────────────────────────
+
+# JS load order for the concatenated Oracle UI build (mirrors cli/hub_server.py).
+# One shared script scope: function declarations hoist across files, and
+# app.js (the init IIFE) must stay LAST.
+_ORACLE_JS_FILES = [
+    "ui/core.js",
+    "ui/busy.js",
+    "ui/theme_tabs.js",
+    "ui/crossgraph.js",
+    "ui/header.js",
+    "ui/projects.js",
+    "ui/insights.js",
+    "ui/activity.js",
+    "ui/suggestions.js",
+    "ui/settings.js",
+    "ui/agents.js",
+    "ui/chat/markdown.js",
+    "ui/chat/conversations.js",
+    "ui/chat/stream_renderer.js",
+    "ui/chat/toolbar.js",
+    "ui/chat/input.js",
+    "ui/chat/send.js",
+    "ui/app.js",
+]
+
+
+def _build_oracle_html() -> str:
+    """Concatenate oracle_ui.html shell + all JS module files into one response."""
+    oracle_dir = Path(__file__).parent
+    shell_path = oracle_dir / "oracle_ui.html"
+    if not shell_path.exists():
+        return "<h1>Oracle UI not found.</h1>"
+
+    shell = shell_path.read_text(encoding="utf-8")
+
+    js_parts = []
+    for rel in _ORACLE_JS_FILES:
+        js_path = oracle_dir / rel
+        if js_path.exists():
+            js_parts.append(f"// ═══ {rel} ═══\n" + js_path.read_text(encoding="utf-8"))
+
+    return shell.replace("/* __C3_ORACLE_SCRIPTS__ */", "\n\n".join(js_parts))
+
+
+# Cache the built HTML (built on first request; cleared on server restart).
+_oracle_html_cache: str | None = None
+
+
 @app.route("/")
 def index():
-    return send_from_directory(os.path.dirname(__file__), "oracle.html")
+    global _oracle_html_cache
+    if _oracle_html_cache is None:
+        _oracle_html_cache = _build_oracle_html()
+    resp = Response(_oracle_html_cache, mimetype="text/html")
+    # Issue the dashboard session cookie only to loopback browsers; remote
+    # viewers (LAN bind) can read GET dashboards but cannot mutate.
+    if local_session.is_loopback(request.remote_addr):
+        local_session.attach_cookie(resp)
+    return resp
 
 
 # ── Health ────────────────────────────────────────────────
@@ -176,6 +262,7 @@ def api_health():
     return jsonify({
         "status": "ok",
         "service": "c3-oracle",
+        "version": _c3_version(),
         "model": _cfg.get("model", "gemma4:31b-cloud"),
         "ollama_available": ollama_ok,
         "model_verified": _model_verified,
@@ -206,11 +293,9 @@ _CONFIG_SETTABLE_KEYS = frozenset(_CONFIG_DEFAULTS.keys())
 @app.route("/api/config", methods=["POST"])
 def api_config_set():
     global _cfg
-    # Require the Bearer token: this endpoint can disable Discovery auth or
-    # repoint ollama_base_url, so it must never be reachable unauthenticated.
-    token = extract_bearer(request.headers.get("Authorization"))
-    if not verify_api_key(token):
-        return jsonify({"error": "unauthorized"}), 401
+    # Auth is enforced by _local_write_guard (session cookie or Bearer): this
+    # endpoint can disable Discovery auth or repoint ollama_base_url, so it
+    # must never be reachable unauthenticated.
     body = request.get_json(silent=True) or {}
     if not isinstance(body, dict):
         return jsonify({"error": "body must be a JSON object"}), 400
@@ -258,7 +343,8 @@ def api_projects():
 
 @app.route("/api/projects/scan", methods=["POST"])
 def api_projects_scan():
-    projects = _scanner.discover() if _scanner else []
+    # Explicit Scan action bypasses the scanner's TTL cache.
+    projects = _scanner.discover(force=True) if _scanner else []
     return jsonify({"scanned": len(projects), "projects": projects})
 
 
@@ -635,6 +721,23 @@ def api_chat_conversation_state(conv_id):
 
 
 # ── Activity digest (Oracle UI) ───────────────────────────
+@app.route("/api/activity/digest/latest", methods=["GET"])
+def api_activity_digest_latest():
+    """Most recent SCHEDULED digest (written by the review loop), or null.
+
+    On-demand digests via /api/activity/digest are not persisted here; this
+    serves ~/.c3/oracle/activity_digests/latest.json.
+    """
+    latest = ORACLE_DIR / "activity_digests" / "latest.json"
+    try:
+        if latest.is_file():
+            return Response(latest.read_text(encoding="utf-8"),
+                            mimetype="application/json")
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+    return jsonify({"digest": None, "generated_at": None})
+
+
 @app.route("/api/activity/digest", methods=["GET"])
 def api_activity_digest():
     """Cross-project activity digest for the Oracle UI.
@@ -740,7 +843,7 @@ def api_discovery_mcp_info():
     })
 
 
-# ── Discovery API key management (local dashboard — unauthenticated, loopback) ──
+# ── Discovery API key management (mutations gated by _local_write_guard) ──
 def _apikey_status(reveal: bool = False) -> dict:
     """Status payload for the Discovery API token + connection info.
 
@@ -786,12 +889,14 @@ def _apikey_status(reveal: bool = False) -> dict:
 def api_apikey_get():
     """Return Discovery API token status + connection info.
 
-    The unmasked token is only included when the caller presents a valid Bearer
-    token; otherwise only the masked form is returned (never the raw key over
-    HTTP unauthenticated).
+    The unmasked token is only included when the caller presents a valid
+    Bearer token or the dashboard session cookie; otherwise only the masked
+    form is returned (never the raw key over HTTP unauthenticated).
     """
     try:
-        reveal = verify_api_key(extract_bearer(request.headers.get("Authorization")))
+        reveal = verify_api_key(
+            extract_bearer(request.headers.get("Authorization"))
+        ) or local_session.verify(request.cookies.get(local_session.COOKIE_NAME))
         return jsonify(_apikey_status(reveal=reveal))
     except Exception as e:
         return jsonify({"error": str(e)}), 500