code-context-control 2.89.1__tar.gz → 2.91.0__tar.gz

{code_context_control-2.89.1/code_context_control.egg-info → code_context_control-2.91.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.89.1
+Version: 2.91.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -137,7 +137,7 @@ Full notes: [Upgrading](https://github.com/drknowhow/code-context-control/blob/m
 
 ## The UI
 
-Three local web apps, no Electron — pure Flask + vanilla JS: the **Hub** (`c3 hub`, port 3330), the **per-project UI** (`c3 ui`), and the optional **Oracle** (`c3 oracle serve`).
+Three local web apps, no Electron — pure Flask + vanilla JS: the **Hub** (`c3 hub`, port 3330), the **per-project UI** (`c3 ui`), and the optional **Oracle** (`c3 oracle serve`). Both servers can run as windowless login services — `c3 hub --install`, `c3 oracle serve --install`, or the buttons in Hub → Settings.
 
 ### Project Hub — multi-project mission control
 

{code_context_control-2.89.1 → code_context_control-2.91.0}/README.md

@@ -74,7 +74,7 @@ Full notes: [Upgrading](https://github.com/drknowhow/code-context-control/blob/m
 
 ## The UI
 
-Three local web apps, no Electron — pure Flask + vanilla JS: the **Hub** (`c3 hub`, port 3330), the **per-project UI** (`c3 ui`), and the optional **Oracle** (`c3 oracle serve`).
+Three local web apps, no Electron — pure Flask + vanilla JS: the **Hub** (`c3 hub`, port 3330), the **per-project UI** (`c3 ui`), and the optional **Oracle** (`c3 oracle serve`). Both servers can run as windowless login services — `c3 hub --install`, `c3 oracle serve --install`, or the buttons in Hub → Settings.
 
 ### Project Hub — multi-project mission control
 

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.89.1"
+__version__ = "2.91.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -7426,10 +7426,39 @@ def _oracle_open(args):
         webbrowser.open(url)
 
 
+def _oracle_service_cmd(args):
+    """`c3 oracle serve --install | --uninstall | --status` — mirrors `c3 hub`."""
+    from services.oracle_service import OracleService
+    svc = OracleService()
+    port = getattr(args, "port", None) or svc.default_port()
+
+    if getattr(args, "install", False):
+        res = svc.install(port)
+        print(res.get("output", "Service installed."))
+        if res.get("success"):
+            print(f"Oracle will start at login (no terminal window); log: {svc.LOG_FILE}")
+        return
+    if getattr(args, "uninstall", False):
+        res = svc.uninstall()
+        print(res.get("output", "Service uninstalled."))
+        return
+    res = svc.status()
+    print(f"Oracle Service Status ({res.get('platform', 'unknown')}):")
+    print(f"  Installed: {res.get('installed')}")
+    print(f"  Running  : {res.get('running')}")
+    print(f"  Port     : {res.get('port')}  (bind {res.get('bind_host')}, MCP {res.get('mcp_port')})")
+    print(f"  URL      : {res.get('url')}")
+    print(f"  Method   : {res.get('method')}")
+    print(f"  Log      : {res.get('log_path')}")
+
+
 def cmd_oracle(args):
     """Oracle dashboard server + Discovery API key management."""
     sub = getattr(args, "oracle_cmd", None)
     if sub in ("serve", "start"):
+        if any(getattr(args, f, False) for f in ("install", "uninstall", "status")):
+            _oracle_service_cmd(args)
+            return
         # Lazy import: run_oracle builds all Oracle services (matches
         # cmd_hub's deferred-import style so bare `c3` stays fast).
         from oracle.oracle_server import run_oracle

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/commands/parser.py

@@ -421,9 +421,9 @@ def build_parser(version: str, parse_cli_ide_arg):
     cr_set.add_argument("--stdin", action="store_true", help="Read the value from stdin (piped/multiline values)")
     cr_set.add_argument("--type", dest="ctype",
                         choices=["token", "env", "multiline",
-                                 "address", "identity", "card"],
+                                 "address", "identity", "card", "login"],
                         default="token",
-                        help="Entry type; address/identity/card are structured "
+                        help="Entry type; address/identity/card/login are structured "
                              "(field payload, inject-only, never revealable to the agent)")
     cr_set.add_argument("--desc", default="", help="Human description shown in list/UI")
     cr_set.add_argument("--env-var", default="", help="Env var name used at injection (default: entry name)")
@@ -824,6 +824,13 @@ def build_parser(version: str, parse_cli_ide_arg):
                           help="Server port (default: config 'port', 3331)")
     or_serve.add_argument("--no-browser", action="store_true",
                           help="Don't open the browser")
+    or_serve.add_argument("--install", action="store_true",
+                          help="Register the Oracle as a login/startup service "
+                               "(no terminal window) and start it now")
+    or_serve.add_argument("--uninstall", action="store_true",
+                          help="Remove the Oracle's startup service registration")
+    or_serve.add_argument("--status", action="store_true",
+                          help="Show the Oracle's startup service status")
     or_open = or_subs.add_parser(
         "open",
         help="Sign in to a running dashboard via a single-use URL",

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/guide/credentials.html

@@ -297,12 +297,14 @@ c3_shell(cmd=<span class="str">'terraform apply'</span>, env_creds=<span class="
 
     <!-- ═══════════════════════════════════ STRUCTURED ═══ -->
     <section id="structured" class="tool-section">
-      <h2>Structured kinds — cards, addresses, identity (v2.87.0)</h2>
+      <h2>Structured kinds — cards, addresses, identity, logins (v2.87.0)</h2>
 
-      <p>Three entry types hold <strong>named fields</strong> instead of one opaque value:
+      <p>Four entry types hold <strong>named fields</strong> instead of one opaque value:
       <code>card</code> (cardholder, number, expiry, optional cvc/billing_zip — Luhn-checked),
-      <code>address</code> (street1, city, state, zip, optional recipient/street2/country/phone) and
-      <code>identity</code> (full_name, optional dob/ssn/phone/email). The payload is stored as one
+      <code>address</code> (street1, city, state, zip, optional recipient/street2/country/phone),
+      <code>identity</code> (full_name, optional dob/ssn/phone/email) and
+      <code>login</code> (site_id, canonical_origin, username, password, optional totp_secret —
+      v2.90.0). The payload is stored as one
       canonical JSON object through the same keyring / encrypted-sidecar path as any other value.</p>
 
       <p>They are <strong>inject-only by construction</strong>, which is stricter than a normal secret:</p>
@@ -315,7 +317,10 @@ c3_shell(cmd=<span class="str">'terraform apply'</span>, env_creds=<span class="
         the field list rather than expanding the whole payload.</li>
         <li><strong>The registry shows a projection, not the data.</strong> Lists and the UI display
         <code>visa ••••4242</code> for a card (brand + last4, deliberately <em>not</em> expiry),
-        city/state for an address, the name for an identity. Field <em>names</em> are public;
+        city/state for an address, the name for an identity, and
+        <code>github · https://github.com · 2FA</code> for a login — site, origin and a 2FA
+        boolean, with the <em>username withheld on purpose</em>, because username + origin is
+        half the credential. Field <em>names</em> are public;
         field <em>values</em> never transit any HTTP response — a sweep test enforces this.</li>
         <li><strong>Echoes redact per field</strong> to <code>[cred:NAME.field]</code>. Caveat: the
         redactor only tracks values of 4+ characters, so a 3-digit CVC or 2-letter state that a
@@ -333,6 +338,18 @@ c3_shell(cmd=<span class="str">'terraform apply'</span>, env_creds=<span class="
       <code>c3 creds get NAME --show</code> (all fields) or <code>--show --field number</code> —
       the browser and the mobile gateway never carry the values, and mobile cannot create
       structured entries at all.</p>
+
+      <p><strong><code>login</code> is storage only, and that is a design constraint, not a
+      gap.</strong> C3 has no browser surface and must not grow one: a login runner in which the
+      <em>agent</em> picks the destination URL turns page-content prompt injection into credential
+      exfiltration, and a check written into a script that already holds the plaintext in its own
+      environment is not a boundary — the script can simply not call it. That is what
+      <code>canonical_origin</code> is for: https-only, stored normalized
+      (<code>scheme://host[:port]</code>, no path/query/fragment/userinfo, host lowercased), so a
+      separate <em>out-of-process</em> runner that the agent does not author can pin a credential to
+      exactly one origin and check the live top-level frame before typing. That runner is
+      deliberately not shipped in this package. <code>totp_secret</code> must be base32 — a
+      malformed seed produces wrong codes that look exactly like a wrong password.</p>
     </section>
 
     <hr class="divider">

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/guide/oracle.html

@@ -168,9 +168,10 @@
       <div class="step-grid">
         <div class="step-card">
           <span class="step-num">1</span><h4>Start the Oracle</h4>
-          <pre><code>python oracle/oracle_server.py \
-  --no-browser</code></pre>
-          <p style="font-size: 12px; color: var(--text-dim); margin: 8px 0 0;">Prints the REST + MCP URLs and ensures an API key exists. The MCP server starts in a background thread.</p>
+          <pre><code>c3 oracle serve --no-browser
+<span class="com"># or: run it at login, no terminal window</span>
+c3 oracle serve --install</code></pre>
+          <p style="font-size: 12px; color: var(--text-dim); margin: 8px 0 0;">Prints the REST + MCP URLs and ensures an API key exists. The MCP server starts in a background thread. <code>--install</code> registers a windowless background service (Task Scheduler / launchd / systemd) and starts it now — the same buttons live in <strong>Hub → Settings → Oracle service</strong>.</p>
         </div>
         <div class="step-card">
           <span class="step-num">2</span><h4>Get the token</h4>
@@ -325,8 +326,14 @@ curl -X POST \
           <tr><td><code>c3 oracle api key</code></td>    <td>Print just the token (generating one if needed)</td></tr>
           <tr><td><code>c3 oracle api rotate</code></td> <td>Replace the token with a fresh one</td></tr>
           <tr><td><code>c3 oracle api clear</code></td>  <td>Delete the stored token from the keyring</td></tr>
+          <tr><td><code>c3 oracle serve</code></td>      <td>Run the dashboard + discovery endpoints in this terminal (<code>--no-browser</code>, <code>--port</code>)</td></tr>
+          <tr><td><code>c3 oracle serve --install</code></td>   <td>Register the Oracle as a login/startup service — no terminal window — and start it now. Windows: Task Scheduler (Run-key fallback); macOS: launchd; Linux: systemd user unit</td></tr>
+          <tr><td><code>c3 oracle serve --uninstall</code></td> <td>Remove the startup registration (a running Oracle keeps running)</td></tr>
+          <tr><td><code>c3 oracle serve --status</code></td>    <td>Installed? Running? Port, bind host, URL, and the launcher log path</td></tr>
+          <tr><td><code>c3 oracle open</code></td>       <td>Sign in to a running dashboard via a single-use URL</td></tr>
         </tbody>
       </table>
+      <p style="font-size: 12px; color: var(--text-dim); margin: 8px 0 0;">The Hub exposes the same controls under <strong>Settings → Oracle service</strong> (Install / Uninstall / Start / Stop / Open). Starting the Oracle from there also fills in the Hub's <em>Oracle URL</em> when it is empty, so the Open Oracle button appears in the top bar.</p>
     </section>
 
     <hr class="divider">
@@ -373,6 +380,14 @@ curl -X POST \
             <td><code>The 'keyring' package is required</code></td>
             <td><code>pip install keyring</code> — a C3 dependency that may be missing if you upgraded without re-installing.</td>
           </tr>
+          <tr>
+            <td>Oracle is down after a reboot</td>
+            <td>Nothing restarts a terminal-launched Oracle. Register it once with <code>c3 oracle serve --install</code> (or Hub → Settings → Oracle service → Install); it then starts at login with no window. Startup problems land in <code>~/.c3/oracle/service.log</code> (the launcher) and <code>~/.c3/oracle/oracle.log</code> (the server).</td>
+          </tr>
+          <tr>
+            <td>Installed, but "stopped" right after login</td>
+            <td>If <code>bind_host</code> is a LAN/VPN address, the launcher waits up to 120 s for that address to come up before binding, and Task Scheduler retries a failed start three times a minute apart. Check <code>service.log</code> for <em>waiting for bind host</em>; if the address never appears, the Oracle starts anyway and fails to bind — fix the interface or set <code>bind_host</code> to <code>0.0.0.0</code>.</td>
+          </tr>
         </tbody>
       </table>
     </section>

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/hub_server.py

@@ -3407,6 +3407,63 @@ def api_hub_restart():
     return jsonify({"restarting": True})
 
 
+# ─── Routes: oracle service (background daemon for `c3 oracle serve`) ───────
+#
+# Same shape as the hub's own service routes above. Port and bind host come
+# from ~/.c3/oracle/config.json, not from the hub config. A successful
+# install/start fills an EMPTY hub `oracle_url` with the Oracle's address so
+# the top bar's Open Oracle link appears without a second trip to settings.
+
+def _oracle_service():
+    from services.oracle_service import OracleService
+    return OracleService()
+
+
+def _adopt_oracle_url(svc, result: dict) -> dict:
+    result = dict(result or {})
+    if not result.get("success"):
+        return result
+    cfg = _read_hub_config()
+    if not (cfg.get("oracle_url") or "").strip():
+        cfg["oracle_url"] = svc.url()
+        _write_hub_config(cfg)
+        result["oracle_url_set"] = True
+    result["oracle_url"] = cfg["oracle_url"]
+    return result
+
+
+@app.route("/api/oracle/service", methods=["GET"])
+def api_oracle_service_status():
+    """Whether the Oracle is registered as a startup service / currently up."""
+    return jsonify(_oracle_service().status())
+
+
+@app.route("/api/oracle/service/install", methods=["POST"])
+def api_oracle_service_install():
+    """Register the Oracle to start at login (windowless) and start it now."""
+    svc = _oracle_service()
+    return jsonify(_adopt_oracle_url(svc, svc.install()))
+
+
+@app.route("/api/oracle/service/uninstall", methods=["POST"])
+def api_oracle_service_uninstall():
+    """Remove the Oracle's startup registration (does not stop a running one)."""
+    return jsonify(_oracle_service().uninstall())
+
+
+@app.route("/api/oracle/service/start", methods=["POST"])
+def api_oracle_service_start():
+    """Start the Oracle as a detached background process (no terminal)."""
+    svc = _oracle_service()
+    return jsonify(_adopt_oracle_url(svc, svc.start()))
+
+
+@app.route("/api/oracle/service/stop", methods=["POST"])
+def api_oracle_service_stop():
+    """Kill the Oracle process listening on its configured port."""
+    return jsonify(_oracle_service().stop())
+
+
 # ─── Routes: sessions ────────────────────────────────────────────────────────
 
 @app.route("/api/sessions/start", methods=["POST"])

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/hub_ui/app.js

@@ -142,7 +142,8 @@ function App() {
         onOpenProject={(p, tab) => { setSearchOpen(false); openDrill(p, tab || 'overview'); }} />
       {modal &&
         <HubModals modal={modal} projects={projects}
-          onClose={() => setModal(null)} onChanged={loadProjects} />}
+          onClose={() => setModal(null)}
+          onChanged={() => { loadConfig(); loadProjects(); }} />}
       <ToastHost />
     </div>
   );

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/hub_ui/components/hub_credentials.js

@@ -15,10 +15,14 @@ const HUB_CREDS_EMPTY_FORM = {
   fields: {},
 };
 
-// Structured kinds (v2.87.0): per-type field sets composed into a JSON
-// object client-side. `hidden` fields render as password inputs. These
-// entries are inject-only — the server refuses agent_readable/inject and
+// Structured kinds (v2.87.0; `login` v2.90.0): per-type field sets composed
+// into a JSON object client-side. `hidden` fields render as password inputs.
+// These entries are inject-only — the server refuses agent_readable/inject and
 // there is no reveal path anywhere.
+// This table MUST mirror services/credential_store._SCHEMAS — a kind the store
+// accepts and this table omits is unreachable from the browser and, worse,
+// renders as a plain secret with exposure toggles the server will refuse.
+// tests/test_credential_ui_parity.py asserts the two stay in step.
 const CREDS_STRUCTURED = {
   card:     { required: ['cardholder', 'number', 'expiry'],
               optional: ['cvc', 'billing_zip'], hidden: ['number', 'cvc'] },
@@ -26,11 +30,20 @@ const CREDS_STRUCTURED = {
               optional: ['recipient', 'street2', 'country', 'phone'], hidden: [] },
   identity: { required: ['full_name'],
               optional: ['dob', 'ssn', 'phone', 'email'], hidden: ['ssn', 'dob'] },
+  login:    { required: ['site_id', 'canonical_origin', 'username', 'password'],
+              optional: ['totp_secret'], hidden: ['password', 'totp_secret'] },
 };
 
 const credsDisplayText = (entry) => {
   const d = entry.display || {};
   if (entry.type === 'card') return `${d.brand || 'card'} ••••${d.last4 || '????'}`;
+  // login's projection carries has_totp as a BOOLEAN — the generic join below
+  // would render it as the word "true". Username is absent by design.
+  if (entry.type === 'login') {
+    const bits = [d.site_id, d.origin].filter(Boolean);
+    if (d.has_totp) bits.push('2FA');
+    return bits.join(' · ');
+  }
   const vals = Object.values(d).filter(Boolean);
   return vals.length ? vals.join(', ') : '';
 };
@@ -1168,6 +1181,7 @@ function CredsManager({ path, projectName, onChanged }) {
                 <option value="card">card — credit/debit card (inject-only)</option>
                 <option value="address">address — postal address (inject-only)</option>
                 <option value="identity">identity — personal info (inject-only)</option>
+                <option value="login">login — website login (inject-only, storage only)</option>
               </select>
             </div>
             <div>
@@ -1192,6 +1206,15 @@ function CredsManager({ path, projectName, onChanged }) {
               (<span className="mono">{'{{cred:NAME.field}}'}</span> /{' '}
               <span className="mono">env_creds='NAME.field'</span>) but can never
               reveal them, and they never auto-inject.
+              {form.type === 'login' && (
+                <div style={{ marginTop: 4 }}>
+                  Storage only — C3 has no browser and does not log in to anything.{' '}
+                  <span className="mono">canonical_origin</span> is https-only and
+                  stored normalized so a separate out-of-process runner can pin this
+                  credential to exactly one origin before typing it.{' '}
+                  <span className="mono">totp_secret</span> is base32.
+                </div>
+              )}
             </div>
           ) : (
           <div style={{ display: 'flex', gap: 18, marginTop: 10, fontSize: 12, color: T.text }}>

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/hub_ui/components/settings_modal.js

@@ -1,9 +1,14 @@
 // ─── Hub settings modal ─────────────────────────────────────────
 // Config: GET/POST /api/hub/config {port, auto_open_browser, oracle_url,
-// runtime_cache_size}. Service: GET /api/hub/service + POST
+// runtime_cache_size}. Hub service: GET /api/hub/service + POST
 // /api/hub/service/install|uninstall|start|stop. Restart: POST /api/hub/restart.
+// Oracle service: GET /api/oracle/service + POST
+// /api/oracle/service/install|uninstall|start|stop — runs `c3 oracle serve`
+// windowless in the background; install also registers it to start at login.
 // Theme is handled by the topbar; bind host is CLI/config-file only (read-only here).
 
+let _oraclePollTimer = null;
+
 function SettingsModal({ onClose, onChanged }) {
   const [cfg, setCfg] = useState(null);
   const [port, setPort] = useState('');
@@ -11,14 +16,32 @@ function SettingsModal({ onClose, onChanged }) {
   const [oracleUrl, setOracleUrl] = useState('');
   const [cacheSize, setCacheSize] = useState(8);
   const [saving, setSaving] = useState(false);
-  const [svc, setSvc] = useState(null);            // {installed, running, method, port, log_path} | {error}
+  const [svc, setSvc] = useState(null);            // hub: {installed, running, method, port, log_path} | {error}
   const [svcBusy, setSvcBusy] = useState('');
-  const [confirmAction, setConfirmAction] = useState(null);   // 'stop' | 'uninstall'
+  const [osvc, setOsvc] = useState(null);          // oracle: same shape + {url, bind_host, mcp_port}
+  const [osvcBusy, setOsvcBusy] = useState('');
+  const [confirmAction, setConfirmAction] = useState(null);   // 'stop' | 'uninstall' | 'oracle-stop' | 'oracle-uninstall'
 
   const loadSvc = async () => {
     try { setSvc(await api.get('/api/hub/service')); }
     catch { setSvc({ error: true }); }
   };
+  const loadOsvc = async () => {
+    try { setOsvc(await api.get('/api/oracle/service')); }
+    catch { setOsvc({ error: true }); }
+  };
+
+  // After a start the Oracle needs a few seconds before /api/health answers —
+  // poll until it reports running, give up after ~30 s.
+  const pollOsvc = (attempt = 0) => {
+    clearTimeout(_oraclePollTimer);
+    _oraclePollTimer = setTimeout(async () => {
+      let d = null;
+      try { d = await api.get('/api/oracle/service'); setOsvc(d); }
+      catch { setOsvc({ error: true }); }
+      if (d && !d.running && attempt < 12) pollOsvc(attempt + 1);
+    }, attempt === 0 ? 1500 : 2500);
+  };
 
   useEffect(() => {
     (async () => {
@@ -33,7 +56,9 @@ function SettingsModal({ onClose, onChanged }) {
         notify('Could not load hub config', 'err');
       }
       loadSvc();
+      loadOsvc();
     })();
+    return () => clearTimeout(_oraclePollTimer);
   }, []);
 
   const save = async () => {
@@ -81,6 +106,27 @@ function SettingsModal({ onClose, onChanged }) {
     setTimeout(loadSvc, 800);
   };
 
+  const osvcAction = async (action) => {
+    setConfirmAction(null);
+    setOsvcBusy(action);
+    try {
+      const d = await api.post(`/api/oracle/service/${action}`, {});
+      const ok = d.success !== false;
+      notify(d.output || `Oracle ${action} ${ok ? 'succeeded' : 'failed'}`, ok ? 'ok' : 'err');
+      if (ok && d.oracle_url_set) {
+        // The hub had no oracle_url; the server filled it so the top-bar link appears.
+        setOracleUrl(d.oracle_url || '');
+        notify(`Oracle URL set to ${d.oracle_url} — the Open Oracle button is now in the top bar`);
+        if (onChanged) onChanged();
+      }
+      if (ok && (action === 'start' || action === 'install')) pollOsvc();
+    } catch (e) {
+      notify(`Oracle ${action} failed: ${e.message}`, 'err');
+    }
+    setOsvcBusy('');
+    setTimeout(loadOsvc, 800);
+  };
+
   const restartHub = async () => {
     try { await api.post('/api/hub/restart', {}); } catch { /* server drops mid-response */ }
     notify('Hub restarting…', 'warn');
@@ -109,16 +155,56 @@ function SettingsModal({ onClose, onChanged }) {
     fontSize: 13, outline: 'none', fontFamily: 'inherit',
   });
 
+  // Shared status line for both service blocks.
+  const svcSummary = (s) => {
+    let label, color;
+    if (!s) { label = 'checking…'; color = T.textMuted; }
+    else if (s.error) { label = 'unavailable'; color = T.error; }
+    else if (!s.installed) {
+      label = s.running === true ? 'running (not installed)' : 'not installed';
+      color = s.running === true ? T.accent : T.textMuted;
+    } else {
+      label = s.running === true ? 'running' : s.running === false ? 'stopped' : 'installed';
+      color = s.running !== false ? T.accent : T.textMuted;
+    }
+    return { label, color };
+  };
+
+  const serviceStatus = (s) => {
+    const { label, color } = svcSummary(s);
+    return (
+      <div>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 8 }}>
+          <GlowDot color={color} />
+          <span className="mono" style={{ fontSize: 12, color }}>{label}</span>
+          {s && !s.error && s.method && (
+            <span className="mono" style={{ fontSize: 11, color: T.textDim }}>
+              {s.method}{s.port ? ` (port ${s.port})` : ''}
+            </span>
+          )}
+        </div>
+        {s && !s.error && s.log_path && (
+          <div className="mono" style={{ fontSize: 11, color: T.textDim, marginBottom: 8, wordBreak: 'break-all' }}>
+            log: {s.log_path}
+          </div>
+        )}
+      </div>
+    );
+  };
+
+  const busyLine = (what) => (
+    <div style={{ fontSize: 11, color: T.textMuted, marginTop: 8, animation: 'pulse 1s infinite' }}>
+      {what}…
+    </div>
+  );
+
   const svcInstalled = svc && !svc.error && svc.installed;
-  const svcLabel = !svc ? 'checking…'
-    : svc.error ? 'unavailable'
-      : !svc.installed ? 'not installed'
-        : svc.running === true ? 'running'
-          : svc.running === false ? 'stopped'
-            : 'installed';
-  const svcColor = !svc ? T.textMuted
-    : svc.error ? T.error
-      : (svc.installed && svc.running !== false) ? T.accent : T.textMuted;
+  const osvcInstalled = osvc && !osvc.error && osvc.installed;
+  const osvcRunning = osvc && !osvc.error && osvc.running === true;
+  const openOracle = () => {
+    const url = oracleUrl.trim() || (osvc && osvc.url) || '';
+    if (url) window.open(url, '_blank', 'noopener');
+  };
 
   return (
     <Modal title="Hub Settings" width={520} onClose={onClose}>
@@ -138,27 +224,14 @@ function SettingsModal({ onClose, onChanged }) {
       ), 'Max project runtimes kept warm for drill-in and global search.')}
       {fieldRow('Oracle URL', (
         <input value={oracleUrl} onChange={e => setOracleUrl(e.target.value)}
-          placeholder="http://localhost:3333" className="mono" style={inputStyle(220)} />
-      ), 'Optional — link to a running C3 Oracle instance.')}
+          placeholder="http://localhost:3331" className="mono" style={inputStyle(220)} />
+      ), 'Optional — link to a running C3 Oracle instance. Filled in automatically when you start the Oracle below.')}
       <div style={{ display: 'flex', justifyContent: 'flex-end', marginTop: 10 }}>
         <Btn onClick={save} disabled={saving || !cfg}>{saving ? 'Saving…' : 'Save settings'}</Btn>
       </div>
 
       {sectionLabel('Startup service')}
-      <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginBottom: 8 }}>
-        <GlowDot color={svcColor} />
-        <span className="mono" style={{ fontSize: 12, color: svcColor }}>{svcLabel}</span>
-        {svc && !svc.error && svc.method && (
-          <span className="mono" style={{ fontSize: 11, color: T.textDim }}>
-            {svc.method}{svc.port ? ` (port ${svc.port})` : ''}
-          </span>
-        )}
-      </div>
-      {svc && !svc.error && svc.log_path && (
-        <div className="mono" style={{ fontSize: 11, color: T.textDim, marginBottom: 8, wordBreak: 'break-all' }}>
-          log: {svc.log_path}
-        </div>
-      )}
+      {serviceStatus(svc)}
       <div style={{ display: 'flex', flexWrap: 'wrap', gap: 8 }}>
         <Btn variant="ghost" onClick={() => svcAction('install')} disabled={!!svcBusy}>
           {svcInstalled ? 'Reinstall' : 'Install'}
@@ -174,11 +247,7 @@ function SettingsModal({ onClose, onChanged }) {
           <I name="refresh" size={12} color={T.textMuted} />Restart hub
         </Btn>
       </div>
-      {svcBusy && (
-        <div style={{ fontSize: 11, color: T.textMuted, marginTop: 8, animation: 'pulse 1s infinite' }}>
-          {svcBusy}…
-        </div>
-      )}
+      {svcBusy && busyLine(svcBusy)}
       {cfg && (
         <div style={{ fontSize: 11, color: T.textDim, marginTop: 10 }}>
           {cfg.has_terminal
@@ -187,6 +256,40 @@ function SettingsModal({ onClose, onChanged }) {
         </div>
       )}
 
+      {sectionLabel('Oracle service')}
+      {serviceStatus(osvc)}
+      {osvc && !osvc.error && (
+        <div className="mono" style={{ fontSize: 11, color: T.textDim, marginBottom: 8, wordBreak: 'break-all' }}>
+          bind {osvc.bind_host || '127.0.0.1'} · MCP port {osvc.mcp_port || 3332} · {osvc.url}
+        </div>
+      )}
+      <div style={{ display: 'flex', flexWrap: 'wrap', gap: 8 }}>
+        <Btn variant="ghost" onClick={() => osvcAction('install')} disabled={!!osvcBusy}>
+          {osvcInstalled ? 'Reinstall' : 'Install'}
+        </Btn>
+        {osvcInstalled && (
+          <Btn variant="ghost" onClick={() => setConfirmAction('oracle-uninstall')} disabled={!!osvcBusy}>Uninstall</Btn>
+        )}
+        {!osvcRunning && (
+          <Btn variant="ghost" onClick={() => osvcAction('start')} disabled={!!osvcBusy || !osvc}>
+            <I name="play" size={12} color={T.textMuted} />Start oracle
+          </Btn>
+        )}
+        {osvcRunning && (
+          <Btn variant="ghost" color={T.error} onClick={() => setConfirmAction('oracle-stop')} disabled={!!osvcBusy}>Stop oracle</Btn>
+        )}
+        {osvcRunning && (
+          <Btn variant="ghost" onClick={openOracle}>
+            <I name="external" size={12} color={T.textMuted} />Open
+          </Btn>
+        )}
+      </div>
+      {osvcBusy && busyLine(`oracle ${osvcBusy}`)}
+      <div style={{ fontSize: 11, color: T.textDim, marginTop: 10 }}>
+        Runs <span className="mono">c3 oracle serve</span> in the background — no terminal window.
+        Install also registers it to start at login, so it survives reboots.
+      </div>
+
       {confirmAction === 'stop' && (
         <ConfirmDialog title="Stop Hub"
           message="The page will become unreachable until the hub is restarted (c3 hub)."
@@ -199,6 +302,18 @@ function SettingsModal({ onClose, onChanged }) {
           confirmLabel="Uninstall" danger
           onConfirm={() => svcAction('uninstall')} onCancel={() => setConfirmAction(null)} />
       )}
+      {confirmAction === 'oracle-stop' && (
+        <ConfirmDialog title="Stop Oracle"
+          message="Kills the Oracle process (dashboard, discovery API and MCP endpoint). It will start again at the next login if installed, or via Start oracle."
+          confirmLabel="Stop" danger
+          onConfirm={() => osvcAction('stop')} onCancel={() => setConfirmAction(null)} />
+      )}
+      {confirmAction === 'oracle-uninstall' && (
+        <ConfirmDialog title="Uninstall Oracle Service"
+          message="The Oracle will no longer auto-start on login. A running Oracle keeps running."
+          confirmLabel="Uninstall" danger
+          onConfirm={() => osvcAction('uninstall')} onCancel={() => setConfirmAction(null)} />
+      )}
     </Modal>
   );
 }

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/mcp_server.py

@@ -1039,15 +1039,19 @@ async def c3_credentials(
     often it was used: counts by surface, recent events for THIS project, other
     projects reduced to counts), reveal (name — only entries the user marked
     agent_readable), set (name, value [scope=project|global]
-    [ctype=token|env|multiline|address|identity|card] [description] [env_var] [inject]),
-    delete (name [scope]).
+    [ctype=token|env|multiline|address|identity|card|login] [description] [env_var]
+    [inject]), delete (name [scope]).
     To USE a credential, do NOT reveal it — pass env_creds='NAME1,NAME2' to c3_shell
     (injected as env vars) or write {{cred:NAME}} inside the cmd (expanded server-side);
     the decoded value never enters model context.
-    STRUCTURED kinds (address/identity/card) hold named fields: set takes value as a
-    JSON object (card: cardholder/number/expiry[/cvc/billing_zip]; address:
+    STRUCTURED kinds (address/identity/card/login) hold named fields: set takes value
+    as a JSON object (card: cardholder/number/expiry[/cvc/billing_zip]; address:
     street1/city/state/zip[/recipient/street2/country/phone]; identity:
-    full_name[/dob/ssn/phone/email]). Address a FIELD at the boundary —
+    full_name[/dob/ssn/phone/email]; login: site_id/canonical_origin/username/password
+    [/totp_secret]). `login` is STORAGE ONLY — C3 has no browser and never types a
+    password anywhere. canonical_origin is https-only and stored normalized so an
+    external runner can bind the credential to one origin; do NOT build a browser
+    login runner in this package. Address a FIELD at the boundary —
     env_creds='CARD.number' (env $CARD_NUMBER) or {{cred:CARD.number}} in cmd. Reveal
     is permanently disabled for them and they never auto-inject; have the user enter
     the values via the Credentials UI or `c3 creds set` so they never enter the chat.

{code_context_control-2.89.1 → code_context_control-2.91.0}/cli/tools/credentials.py

@@ -9,9 +9,17 @@ credential is c3_shell: ``env_creds='NAME1,NAME2'`` (env injection) or
 ``{{cred:NAME}}`` in the command (server-side expansion) — the decoded value
 never enters model context.
 
-Structured kinds (address/identity/card) go further: reveal is permanently
+Structured kinds (address/identity/card/login) go further: reveal is permanently
 disabled regardless of flags, and only individual FIELDS are addressable —
 ``env_creds='CARD.number'`` or ``{{cred:CARD.number}}``.
+
+``login`` is storage only. C3 has no browser surface and must not grow one:
+a login runner in which the AGENT chooses the destination URL turns page-content
+prompt injection into credential exfiltration, and a guard written into a script
+that already holds the plaintext is not a boundary. The ``canonical_origin``
+field is stored (https-only, normalized) so that a separate, out-of-process
+runner can pin the credential to one origin and validate the live top-level
+frame before typing. That runner is deliberately somebody else's package.
 """
 from __future__ import annotations