code-context-control 2.77.0__tar.gz → 2.79.0__tar.gz

{code_context_control-2.77.0/code_context_control.egg-info → code_context_control-2.79.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.77.0
+Version: 2.79.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -202,6 +202,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_session` | Snapshot, restore, log decisions, compact history |
 | `c3_impact` | Blast-radius analysis before editing shared symbols |
 | `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
+| `c3_ci` | Run this repo's real `.github/workflows` locally, with structured failures, before pushing (v2.79.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
 | `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter, `verify` (did a failed `c3_edit` still land?) |
@@ -212,7 +213,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_jira` | Jira Cloud + Data Center — JQL, issues, transitions (v2.56.0) |
 | `c3_project` | Cross-project discovery & operations; guarded writes (v2.31.0) |
 
-Every tool is **read-only safe in plan mode** except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, `c3_delegate` with write delegation enabled, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task` / `c3_locks`.
+Every tool is **read-only safe in plan mode** except `c3_edit`, `c3_shell`, `c3_ci(action='run'|'rerun')`, `c3_artifacts(action='restore')`, `c3_delegate` with write delegation enabled, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task` / `c3_locks`.
 
 On Windows `c3_shell` uses Git Bash when available. Git Bash bundles no `jq`; use `python -m json.tool` for portable JSON formatting.
 

{code_context_control-2.77.0 → code_context_control-2.79.0}/README.md

@@ -139,6 +139,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_session` | Snapshot, restore, log decisions, compact history |
 | `c3_impact` | Blast-radius analysis before editing shared symbols |
 | `c3_locks` | Agent leases — who is working on which file, so two agents don't collide (v2.65.0) |
+| `c3_ci` | Run this repo's real `.github/workflows` locally, with structured failures, before pushing (v2.79.0) |
 | `c3_delegate` | Offload heavy work to local Ollama / Codex / Gemini |
 | `c3_agent` | Workflows: `review_changes`, `investigate`, `preflight`, `prepare_context`, `validate_compress` |
 | `c3_edits` | Edit-ledger queries, version diffs, restore points, per-branch filter, `verify` (did a failed `c3_edit` still land?) |
@@ -149,7 +150,7 @@ C3 exposes **21 tools** as a native MCP server. Your IDE calls them directly:
 | `c3_jira` | Jira Cloud + Data Center — JQL, issues, transitions (v2.56.0) |
 | `c3_project` | Cross-project discovery & operations; guarded writes (v2.31.0) |
 
-Every tool is **read-only safe in plan mode** except `c3_edit`, `c3_shell`, `c3_artifacts(action='restore')`, `c3_delegate` with write delegation enabled, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task` / `c3_locks`.
+Every tool is **read-only safe in plan mode** except `c3_edit`, `c3_shell`, `c3_ci(action='run'|'rerun')`, `c3_artifacts(action='restore')`, `c3_delegate` with write delegation enabled, and write actions on `c3_bitbucket` / `c3_jira` / `c3_credentials` / `c3_project` / `c3_task` / `c3_locks`.
 
 On Windows `c3_shell` uses Git Bash when available. Git Bash bundles no `jq`; use `python -m json.tool` for portable JSON formatting.
 

{code_context_control-2.77.0 → code_context_control-2.79.0}/cli/_hook_utils.py

@@ -359,6 +359,48 @@ def record_unlocked_files(
         save_enforcement_state(state, project_path)
 
 
+# ── Host (IDE runtime) detection ─────────────────────────────────────────────
+# Three hosts drive C3 hooks, and their OUTPUT contracts differ enough that one
+# shared payload shape cannot satisfy all of them:
+#
+#   claude — top-level "tool_result" / "additionalContext" accepted.
+#   gemini — no tool_result; context nests under hookSpecificOutput.
+#   codex  — every hook output schema is additionalProperties:false and
+#            hookSpecificOutput.hookEventName is REQUIRED. Unknown keys are a
+#            hard deserialization error, not a warning, so emitting the Claude
+#            shape makes Codex discard the whole hook response.
+HOST_CLAUDE = "claude"
+HOST_GEMINI = "gemini"
+HOST_CODEX = "codex"
+
+
+def detect_host(data: dict) -> str:
+    """Identify which agent runtime sent this hook payload.
+
+    Codex is detected by `turn_id`, which its wire schema marks required on
+    every turn-scoped event C3 hooks (pre/post tool use, user prompt submit,
+    stop) and documents as "Codex extension". Claude Code never sends it.
+
+    Codex MUST be checked before Gemini: Codex declares `tool_response` as
+    free-form, so an MCP tool that returns an object would otherwise trip the
+    isinstance-dict test and be mistaken for Gemini.
+
+    The CODEX_* env fallback covers a future Codex that drops `turn_id`. A
+    false positive there degrades gracefully — Claude Code also accepts
+    hookSpecificOutput.additionalContext — so guessing "codex" is the safe
+    direction to be wrong in.
+    """
+    if not isinstance(data, dict):
+        return HOST_CLAUDE
+    if data.get("turn_id"):
+        return HOST_CODEX
+    if isinstance(data.get("tool_response"), dict):
+        return HOST_GEMINI
+    if os.environ.get("CODEX_THREAD_ID") or os.environ.get("CODEX_MANAGED_BY_NPM"):
+        return HOST_CODEX
+    return HOST_CLAUDE
+
+
 # Map Gemini CLI built-in tool names → canonical Claude Code equivalents
 GEMINI_TOOL_MAP = {
     "run_shell_command": "Bash",

{code_context_control-2.77.0 → code_context_control-2.79.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.77.0"
+__version__ = "2.79.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -261,7 +261,7 @@ _C3_MCP_ALLOW = [
     "mcp__c3__c3_bitbucket",
     "mcp__c3__c3_jira", "mcp__c3__c3_credentials",
     "mcp__c3__c3_project", "mcp__c3__c3_task", "mcp__c3__c3_artifacts",
-    "mcp__c3__c3_override",
+    "mcp__c3__c3_override", "mcp__c3__c3_ci",
 ]
 
 # Obsolete MCP tool names from earlier C3 versions. `c3 permissions clean`
@@ -4772,6 +4772,7 @@ back to native tools as the task progresses.
 - **Shell**: `c3_shell(cmd, timeout=60)` — structured shell exec (tests/git/build). Auto-filters output, logs git mutations to the ledger. Native Bash for interactive/TTY only
 - **Memory**: `c3_memory(action='recall')` — full recall. `index` + `fetch` for token-efficient two-step retrieval
 - **Delegate**: `c3_delegate(task, backend='ollama|codex|gemini|claude|auto')` — offload to other models
+- **Local CI** (v2.79.0+): `c3_ci(action='inspect|run|rerun|failures')` — run THIS repo's real `.github/workflows` here instead of pushing for feedback. `run` executes in `needs` order; `failures` gives {file,line,message}; `rerun` retries only what failed. Only `FULL_CI_PASS` means safe to push — `PARTIAL_PASS` means something did not run (other OS, unsupported action, or your selection).
 - **Bitbucket** (v2.30.0+, when `c3 bitbucket login` has run): `c3_bitbucket(action='list_prs|get_pr|merge_pr|...')` — self-hosted Bitbucket Data Center / Server. Token in OS keyring; mutating actions auto-log to the edit ledger.
 - **Cross-project** (v2.31.0+): `c3_project(action='list|scan|search|read|edit|...', project='<name|path>')` — discover and operate on OTHER c3-installed projects. Reads run freely; writes (edit/shell/memory) need `allow_write=true`.
 - **Masked paths** (v2.63.0+): content prefixed `[c3-mask:transformed]` is a policy-transformed VIEW, not the file. Values may be synthetic, rows withheld, bodies stripped — don't copy literals out of it or infer completeness from it. Masked paths are read-only and refuse shell/git/validate/impact/filter/delegate (`[c3-mask:unsupported]`). That's policy, not a transient error — report the block instead of routing around it.
@@ -6030,6 +6031,80 @@ def _creds_cmd_import(args, project_path: str) -> None:
               "(use --overwrite to replace)")
 
 
+def cmd_ci(args):
+    """AgentCI entry point — exits with the finding.
+
+    The shared dispatcher below discards every command's return value, so
+    `ci` exits for itself rather than changing exit-code behaviour for the
+    other twenty commands. A pre-push hook or a script has to be able to read
+    "not a full pass" from `$?`, which is the whole point of the verdict.
+    """
+    sys.exit(_ci_main(args))
+
+
+def _ci_main(args) -> int:
+    """AgentCI — run this repo's real CI locally (docs/agent-ci.md).
+
+    The human mirror of the c3_ci tool. It deliberately reuses the same
+    handler, so the CLI and the agent surface can never drift into disagreeing
+    about what a verdict means. Returns the process exit code.
+    """
+    import json as _json
+    from types import SimpleNamespace
+
+    from cli.tools.ci import handle_ci
+
+    sub = getattr(args, "ci_cmd", None) or "inspect"
+    project_path = getattr(args, "project_path", ".") or "."
+    as_json = bool(getattr(args, "json", False))
+
+    if as_json:
+        # Structured mode answers from the services directly — the text
+        # handler formats for reading, and reformatting prose into JSON would
+        # be a second, lossier schema.
+        from services import ci_runner as cr
+        from services.ci_workflow import inspect_project
+        if sub == "inspect":
+            payload = inspect_project(project_path)
+        elif sub in ("run", "rerun"):
+            only = None
+            if sub == "rerun":
+                prior = cr.load_run(project_path, getattr(args, "run_id", ""))
+                only = (prior or {}).get("failed") or []
+                if not only:
+                    print(_json.dumps({"error": "no failed jobs to rerun"}))
+                    return 1
+            payload = cr.run_ci(
+                project_path, selector=getattr(args, "job", ""),
+                allow_foreign=bool(getattr(args, "allow_foreign", False)),
+                only=only, timeout=getattr(args, "timeout", 0) or cr.DEFAULT_STEP_TIMEOUT,
+                workflow=getattr(args, "workflow", "")).to_dict()
+        elif sub == "runs":
+            payload = {"runs": cr.list_runs(project_path)}
+        else:
+            payload = cr.load_run(project_path, getattr(args, "run_id", ""))
+        print(_json.dumps(payload, indent=2))
+        verdict = payload.get("verdict") if isinstance(payload, dict) else ""
+        return 0 if verdict in (cr.FULL_PASS, None, "") else 1
+
+    svc = SimpleNamespace(project_path=project_path)
+
+    def finalize(_name, _args, resp, _summ, **_kw):
+        return resp
+
+    out = handle_ci(
+        sub, getattr(args, "job", "") or "", getattr(args, "run_id", "") or "",
+        bool(getattr(args, "allow_foreign", False)),
+        getattr(args, "workflow", "") or "", getattr(args, "tail", 200) or 200,
+        getattr(args, "timeout", 0) or 0, svc, finalize)
+    print(out)
+    # Exit code is the finding: a non-full verdict must not read as success to
+    # a shell script or a pre-push hook.
+    if sub in ("run", "rerun") and "FULL_CI_PASS" not in out:
+        return 1
+    return 0
+
+
 def cmd_locks(args):
     """Agent Locks — human surface. force-release lives here, never in c3_locks."""
     from services import agent_locks as al
@@ -8290,6 +8365,7 @@ def main():
         "enforce": cmd_enforce,
         "override": cmd_override,
         "locks": cmd_locks,
+        "ci": cmd_ci,
         "oracle": cmd_oracle,
         "upgrade": cmd_upgrade,
     }

{code_context_control-2.77.0 → code_context_control-2.79.0}/cli/commands/parser.py

@@ -472,6 +472,52 @@ def build_parser(version: str, parse_cli_ide_arg):
     lk_sweep = locks_subs.add_parser("sweep", help="Drop expired leases now")
     lk_sweep.add_argument("--path", dest="project_path", default=".")
 
+    # ── AgentCI — local CI execution (docs/agent-ci.md) ─────────────────
+    # Reads .github/workflows/*.yml as the source of truth. The CLI mirrors
+    # the c3_ci tool so a human can drive the same loop an agent does.
+    p_ci = subparsers.add_parser(
+        "ci", help="Run this repo's real CI locally instead of pushing for feedback")
+    ci_subs = p_ci.add_subparsers(dest="ci_cmd")
+
+    def _ci_common(sub):
+        sub.add_argument("--path", dest="project_path", default=".",
+                         help="Project directory (default: current)")
+        sub.add_argument("--json", action="store_true", help="Machine-readable output")
+        return sub
+
+    _ci_common(ci_subs.add_parser(
+        "inspect", help="Show workflows, the job DAG, and what runs on this host"))
+
+    ci_run = _ci_common(ci_subs.add_parser("run", help="Execute jobs locally"))
+    ci_run.add_argument("--job", default="",
+                        help="Job id, matrix cell, or workflow::job (default: all)")
+    ci_run.add_argument("--workflow", default="", help="Limit to one workflow by name")
+    ci_run.add_argument("--allow-foreign", action="store_true",
+                        help="Also run jobs targeting another OS (labelled cross-OS; "
+                             "can never yield FULL_CI_PASS)")
+    ci_run.add_argument("--timeout", type=int, default=0,
+                        help="Per-step timeout in seconds (default 900)")
+
+    ci_rerun = _ci_common(ci_subs.add_parser(
+        "rerun", help="Re-run only the jobs that failed in the last run"))
+    ci_rerun.add_argument("--run", dest="run_id", default="", help="Run id (default: latest)")
+    ci_rerun.add_argument("--allow-foreign", action="store_true")
+    ci_rerun.add_argument("--timeout", type=int, default=0)
+
+    ci_status = _ci_common(ci_subs.add_parser("status", help="Last run's verdict and jobs"))
+    ci_status.add_argument("--run", dest="run_id", default="")
+
+    ci_fail = _ci_common(ci_subs.add_parser(
+        "failures", help="Structured failures from the last run"))
+    ci_fail.add_argument("--run", dest="run_id", default="")
+
+    ci_logs = _ci_common(ci_subs.add_parser("logs", help="Tail one job's log"))
+    ci_logs.add_argument("job", nargs="?", default="", help="Job key")
+    ci_logs.add_argument("--run", dest="run_id", default="")
+    ci_logs.add_argument("--tail", type=int, default=200)
+
+    _ci_common(ci_subs.add_parser("runs", help="Recent local CI runs"))
+
     # ── Override Requests (v2.69.0, docs/override-requests.md) ──────────
     # Human-only approval surface. A grant is single-use, session-bound,
     # path-exact and TTL-capped, and it never edits policy: the rule that

{code_context_control-2.77.0 → code_context_control-2.79.0}/cli/docs.html

@@ -1747,11 +1747,17 @@ Background agent system with periodic check loop and AI enhancement.
   ...</code></pre>
 
       <!-- ─── Hooks ──────────────────────── -->
-      <h3 id="hooks">PostToolUse Hooks <span class="badge badge-blue" style="font-size:10px">Claude Code only</span>
+      <h3 id="hooks">PostToolUse Hooks <span class="badge badge-blue" style="font-size:10px">installed for Claude Code</span>
       </h3>
-      <p>C3 registers two PostToolUse hooks in <code>.claude/settings.local.json</code> that run after Claude executes
-        certain tools. These hooks are only installed for Claude Code &mdash; other IDEs rely on the workflow
+      <p>C3 registers its PostToolUse hooks in <code>.claude/settings.local.json</code> that run after Claude executes
+        certain tools. C3 only <em>installs</em> them for Claude Code &mdash; other IDEs rely on the workflow
         instructions in their instructions file instead.</p>
+      <p>The dispatcher itself is not Claude-only. Since v2.78.0 it branches by host and speaks three wire formats:
+        Claude Code, Gemini CLI, and Codex CLI &mdash; so a Codex session with a hand-authored
+        <code>.codex/hooks.json</code> pointing at <code>cli/hook_dispatch.py</code> gets full enforcement and
+        bookkeeping. Codex validates hook output strictly (<code>additionalProperties: false</code>), which is why it
+        needs its own serializer rather than the Claude shape. Output filtering is skipped on Codex: its schema has no
+        <code>tool_result</code> to replace, so tokenizing the payload would be wasted work.</p>
 
       <table>
         <tr>

{code_context_control-2.77.0 → code_context_control-2.79.0}/cli/hook_dispatch.py

@@ -14,12 +14,20 @@ Matcher granularity that previously lived in .claude/settings.local.json
 routing tables below — install-mcp registers the dispatcher once per matcher,
 and the dispatcher decides which sub-hook logic applies.
 
-Output composition follows Claude Code hook semantics:
+Output composition merges sub-hook results the same way for every host:
   - a permissionDecision "deny" from any sub-hook wins over allows;
   - additionalContext strings from all sub-hooks are concatenated;
-  - a tool_result replacement (hook_filter) is preserved;
-  - plain-text (user-visible) messages are printed only when no structured
-    JSON output exists, matching the old per-hook stdout behavior.
+  - a tool_result replacement (hook_filter) is captured.
+
+Serialization then branches by host, because the three runtimes do NOT share
+a wire contract (see _hook_utils.detect_host):
+  - Claude Code — top-level tool_result / additionalContext; plain-text
+    messages print raw when no structured JSON output exists;
+  - Gemini CLI — no tool_result; context nests under hookSpecificOutput;
+  - Codex CLI — every hook output schema is additionalProperties:false with a
+    required hookEventName, so output is built from a per-event whitelist and
+    Codex never sees a tool_result. Codex also skips hook_filter entirely:
+    it is the only sub-hook that tokenizes the full tool payload.
 
 Failure visibility: a sub-hook crash is logged to .c3/hook_errors.log and
 never kills the remaining sub-hooks. CRITICAL failures — a sub-hook module
@@ -44,10 +52,40 @@ from cli import _hook_utils  # noqa: E402
 # spellings share ONE module instance (state warnings must not split).
 sys.modules.setdefault("_hook_utils", _hook_utils)
 
-from cli._hook_utils import log_hook_error, normalize_tool_name  # noqa: E402
+from cli._hook_utils import (  # noqa: E402
+    HOST_CLAUDE,
+    HOST_CODEX,
+    HOST_GEMINI,
+    detect_host,
+    log_hook_error,
+    normalize_tool_name,
+)
 
 VALID_EVENTS = ("pretool", "posttool", "stop", "prompt")
 
+# ── Codex wire contract ─────────────────────────────────────────────────────
+# Codex validates hook output against additionalProperties:false schemas, so
+# the Codex branch emits by WHITELIST rather than by "drop the keys we know
+# about". A sub-hook that invents a new output key can then never break Codex
+# — the key is simply not forwarded.
+_CODEX_EVENT_NAMES = {
+    "pretool": "PreToolUse",
+    "posttool": "PostToolUse",
+    "prompt": "UserPromptSubmit",
+    "stop": "Stop",
+}
+
+# Keys each event's hookSpecificOutput accepts. "stop" is absent deliberately:
+# stop.command.output has no hookSpecificOutput member at all.
+_CODEX_HSO_KEYS = {
+    "pretool": {
+        "hookEventName", "additionalContext",
+        "permissionDecision", "permissionDecisionReason", "updatedInput",
+    },
+    "posttool": {"hookEventName", "additionalContext", "updatedMCPToolOutput"},
+    "prompt": {"hookEventName", "additionalContext"},
+}
+
 # ── Routing tables (parity with the pre-v2.42 per-matcher registration) ─────
 
 # c3 tools whose completion refreshes the enforcement signal — exactly the
@@ -77,9 +115,15 @@ _GHOST_TOOLS = {
 }
 
 
-def _routes(event: str, raw_tool: str, norm_tool: str):
+def _routes(event: str, raw_tool: str, norm_tool: str, host: str = HOST_CLAUDE):
     """Yield sub-hook module names applicable to this event + tool, in the
-    same relative order the separate hook commands used to run."""
+    same relative order the separate hook commands used to run.
+
+    `host` gates hooks that cannot pay their way on a given runtime — see the
+    hook_filter carve-out below. Every other sub-hook is host-agnostic: they
+    do bookkeeping (ledger, artifact, signal, unlock, ghost sweep) without
+    parsing or tokenizing the tool payload, so they stay on for all hosts.
+    """
     if event == "pretool":
         # Access Guard runs FIRST: merge_outputs keeps the first deny, so a
         # policy denial here cannot be readmitted by sticky-unlock allows.
@@ -87,7 +131,13 @@ def _routes(event: str, raw_tool: str, norm_tool: str):
         # hook_pretool_enforce self-filters via its _PREREQS table.
         yield "hook_pretool_enforce"
     elif event == "posttool":
-        if norm_tool == "Bash":
+        # hook_filter is the ONE sub-hook that reads the whole tool payload:
+        # it tiktoken-encodes the entire Bash output to measure savings, a
+        # Rust-side allocation proportional to output size. On Codex that work
+        # is also pointless — its schema has no tool_result, so the filtered
+        # text could never replace the output anyway. Skip it entirely rather
+        # than risk an allocation failure for a result we must discard.
+        if norm_tool == "Bash" and host != HOST_CODEX:
             yield "hook_filter"
         if norm_tool == "Read":
             yield "hook_read"
@@ -155,18 +205,66 @@ def _load_run(module_name: str):
     return result
 
 
+def _codex_output(event: str, deny_hso, contexts: list, tool_result,
+                  texts: list) -> dict | None:
+    """Serialize merged sub-hook results into Codex's wire contract.
+
+    Codex accepts neither a top-level `tool_result` nor a top-level
+    `additionalContext`, and requires `hookEventName` inside
+    hookSpecificOutput. Anything that has no Codex-legal home is folded into a
+    channel that does exist rather than dropped:
+
+    - a tool_result replacement becomes leading context (it cannot replace the
+      output on Codex, but the filtered text is still worth reading);
+    - "_text" becomes `systemMessage`, the only user-visible string field
+      present on every Codex hook output schema — including Stop, which has no
+      hookSpecificOutput at all, so its context lands there too.
+    """
+    if tool_result is not None:
+        contexts.insert(0, str(tool_result))
+
+    result: dict = {}
+    hso_keys = _CODEX_HSO_KEYS.get(event)
+    joined = "\n".join(c for c in contexts if c)
+
+    if hso_keys is not None:
+        hso = {k: v for k, v in (deny_hso or {}).items() if k in hso_keys}
+        if joined:
+            # A deny's own reason travels in permissionDecisionReason; `joined`
+            # is the non-deny context, so the two never collide.
+            hso["additionalContext"] = joined
+        if hso:
+            hso["hookEventName"] = _CODEX_EVENT_NAMES[event]
+            result["hookSpecificOutput"] = hso
+    elif joined:
+        texts.insert(0, joined)
+
+    if texts:
+        result["systemMessage"] = "\n".join(texts)
+    return result or None
+
+
 def merge_outputs(outputs: list, warnings: list, is_gemini: bool = False,
-                  event: str = "") -> dict | None:
-    """Compose sub-hook outputs per Claude Code hook semantics.
+                  event: str = "", host: str | None = None) -> dict | None:
+    """Compose sub-hook outputs into ONE host-appropriate hook response.
 
+    Collection is host-agnostic:
     - deny beats allow: the first hookSpecificOutput carrying a
-      permissionDecision "deny" is kept verbatim;
+      permissionDecision "deny" is kept;
     - additionalContext strings are concatenated with newlines
       (critical warnings appended last);
-    - tool_result replacement (hook_filter) is preserved;
-    - "_text" plain messages ride along under "_text" — main() prints them
-      raw only when no structured output exists.
+    - a tool_result replacement (hook_filter) is captured.
+
+    Emission is not. Each host gets the shape its parser accepts — Claude
+    takes top-level keys, Gemini nests context and has no tool_result, Codex
+    validates against additionalProperties:false schemas (see _codex_output).
+
+    `is_gemini` is retained for callers that predate `host`; `host` wins when
+    both are given.
     """
+    if host is None:
+        host = HOST_GEMINI if is_gemini else HOST_CLAUDE
+
     deny_hso = None
     contexts: list = []
     texts: list = []
@@ -192,6 +290,10 @@ def merge_outputs(outputs: list, warnings: list, is_gemini: bool = False,
 
     contexts.extend(warnings)
 
+    if host == HOST_CODEX:
+        return _codex_output(event, deny_hso, contexts, tool_result, texts)
+
+    is_gemini = host == HOST_GEMINI
     result: dict = {}
     if deny_hso is not None:
         result["hookSpecificOutput"] = deny_hso
@@ -229,14 +331,14 @@ def dispatch(event: str, payload: dict, project_path: Path | None = None) -> dic
     """Run all applicable sub-hooks in-process and merge their outputs."""
     raw_tool = str(payload.get("tool_name", ""))
     norm_tool = normalize_tool_name(raw_tool)
-    is_gemini = isinstance(payload.get("tool_response", ""), dict)
+    host = detect_host(payload)
 
     outputs: list = []
     warnings: list = []
     # Drain any stale warnings from a previous dispatch in this process.
     _hook_utils.drain_state_warnings()
 
-    for module_name in _routes(event, raw_tool, norm_tool):
+    for module_name in _routes(event, raw_tool, norm_tool, host):
         run_fn, err = _load_run(module_name)
         if run_fn is None:
             warnings.append(
@@ -263,7 +365,7 @@ def dispatch(event: str, payload: dict, project_path: Path | None = None) -> dic
         # become visible instead of silently disabling enforcement.
         warnings.extend(_hook_utils.drain_state_warnings())
 
-    return merge_outputs(outputs, warnings, is_gemini=is_gemini, event=event)
+    return merge_outputs(outputs, warnings, event=event, host=host)
 
 
 def main() -> None:
@@ -288,14 +390,24 @@ def main() -> None:
     try:
         output = dispatch(event, payload)
     except Exception as exc:
-        # The dispatcher itself failing is critical — say so.
+        # The dispatcher itself failing is critical — say so. Route the notice
+        # through merge_outputs so even the panic path speaks the host's
+        # dialect: a raw {"additionalContext": ...} is itself invalid on Codex,
+        # which would turn one crash into two error reports.
         log_hook_error("hook_dispatch", exc)
-        print(json.dumps({
+        notice = {
             "additionalContext": (
                 f"[c3:hook-error] hook_dispatch: {type(exc).__name__}: {exc}; "
                 "see .c3/hook_errors.log"
             )
-        }))
+        }
+        try:
+            output = merge_outputs([notice], [], event=event,
+                                   host=detect_host(payload))
+        except Exception:
+            output = notice
+        if output:
+            print(json.dumps(output))
         return
 
     if not output:

{code_context_control-2.77.0 → code_context_control-2.79.0}/cli/hub_server.py

@@ -337,6 +337,7 @@ _HUB_JS_FILES = [
     "hub_ui/components/hub_credentials.js",
     "hub_ui/components/hub_locks.js",
     "hub_ui/components/hub_enforcement.js",
+    "hub_ui/components/hub_ci.js",
     "hub_ui/components/drill_subprojects.js",
     "hub_ui/components/drill_health.js",
     "hub_ui/components/drill_tasks.js",
@@ -1282,6 +1283,134 @@ def api_batch_cancel():
         return jsonify({"cancelled": True})
 
 
+# ── AgentCI: local CI execution (docs/agent-ci.md) ────────────────────────
+# A CI run is minutes long, so the POST starts a worker and returns; the UI
+# polls. One run per project at a time — two concurrent runs would interleave
+# their writes into the same .c3/ci run index and neither result would be
+# trustworthy.
+
+_ci_runs: dict = {}          # project path -> in-flight state
+_ci_lock = threading.Lock()
+
+
+def _ci_worker(project: str, job: str, allow_foreign: bool, workflow: str) -> None:
+    from services import ci_runner as cr
+    try:
+        result = cr.run_ci(project, selector=job, allow_foreign=allow_foreign,
+                           workflow=workflow)
+        payload = {"running": False, "done": True, "error": None,
+                   "run_id": result.run_id, "verdict": result.verdict,
+                   "note": result.note}
+    except Exception as exc:            # a crashed worker must not look idle
+        payload = {"running": False, "done": True, "run_id": "",
+                   "error": f"{type(exc).__name__}: {exc}"}
+    with _ci_lock:
+        _ci_runs[project] = payload
+
+
+@app.route("/api/ci/inspect", methods=["GET"])
+def api_ci_inspect():
+    """Workflows, the normalized job DAG, and what is runnable on this host."""
+    from services.ci_workflow import inspect_project
+    path = (request.args.get("path") or "").strip()
+    if not path:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    try:
+        return jsonify(inspect_project(resolved))
+    except Exception as e:
+        return jsonify({"error": f"{type(e).__name__}: {e}"}), 500
+
+
+@app.route("/api/ci/runs", methods=["GET"])
+def api_ci_runs():
+    from services import ci_runner as cr
+    path = (request.args.get("path") or "").strip()
+    if not path:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    limit = max(1, min(100, int(request.args.get("limit") or 20)))
+    return jsonify({"runs": cr.list_runs(resolved, limit=limit)})
+
+
+@app.route("/api/ci/run", methods=["GET"])
+def api_ci_run_detail():
+    from services import ci_runner as cr
+    path = (request.args.get("path") or "").strip()
+    if not path:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    return jsonify(cr.load_run(resolved, (request.args.get("run_id") or "").strip())
+                   or {})
+
+
+@app.route("/api/ci/logs", methods=["GET"])
+def api_ci_logs():
+    from services import ci_runner as cr
+    path = (request.args.get("path") or "").strip()
+    run_id = (request.args.get("run_id") or "").strip()
+    job = (request.args.get("job") or "").strip()
+    if not (path and run_id and job):
+        return jsonify({"error": "path, run_id and job are required"}), 400
+    try:
+        resolved = _resolve_project_path(path)
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    tail = max(1, min(2000, int(request.args.get("tail") or 300)))
+    return jsonify({"log": cr.read_log(resolved, run_id, job, tail=tail)})
+
+
+@app.route("/api/ci/run", methods=["POST"])
+def api_ci_run_start():
+    """Start a local CI run in the background. Poll /api/ci/status."""
+    data = request.get_json(force=True) or {}
+    path = str(data.get("path") or "").strip()
+    if not path:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = str(_resolve_project_path(path))
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+
+    with _ci_lock:
+        state = _ci_runs.get(resolved) or {}
+        if state.get("running"):
+            return jsonify({"error": "a CI run is already in progress here"}), 409
+        _ci_runs[resolved] = {"running": True, "done": False, "error": None,
+                              "run_id": "", "verdict": "", "note": ""}
+
+    threading.Thread(
+        target=_ci_worker,
+        args=(resolved, str(data.get("job") or ""),
+              bool(data.get("allow_foreign")), str(data.get("workflow") or "")),
+        daemon=True,
+    ).start()
+    return jsonify({"started": True})
+
+
+@app.route("/api/ci/status", methods=["GET"])
+def api_ci_status():
+    path = (request.args.get("path") or "").strip()
+    if not path:
+        return jsonify({"error": "path is required"}), 400
+    try:
+        resolved = str(_resolve_project_path(path))
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 404
+    with _ci_lock:
+        return jsonify(dict(_ci_runs.get(resolved)
+                            or {"running": False, "done": False}))
+
+
 # ── Sub-projects: linked child .c3 branches (v2.44.0) ─────────────────────
 
 def _sub_manager(parent: str):