code-context-control 2.91.0__tar.gz → 2.92.0__tar.gz

{code_context_control-2.91.0/code_context_control.egg-info → code_context_control-2.92.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.91.0
+Version: 2.92.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.91.0 → code_context_control-2.92.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.91.0"
+__version__ = "2.92.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -845,7 +845,8 @@ def _prompt_memory_llm(project_path: str) -> None:
           + ("cloud + local fallback." if section["cloud_enabled"] else "local only (private)."))
 
 
-def _prompt_init_steps(project_path: str, ide_name: str, default_mode: str = "direct") -> tuple[str, bool]:
+def _prompt_init_steps(project_path: str, ide_name: str, default_mode: str = "direct",
+                       shape=None) -> tuple[str, bool]:
     """Run guided post-init setup steps for Git and MCP."""
     chosen_ide = _select_init_ide(ide_name or "auto")
     save_config({"ide": chosen_ide}, project_path)
@@ -916,7 +917,7 @@ def _prompt_init_steps(project_path: str, ide_name: str, default_mode: str = "di
                 )
                 include_wildcard = bool(wildcard_choice and wildcard_choice.startswith("Yes"))
 
-    chosen_enforcement = _prompt_enforcement(chosen_tier)
+    chosen_enforcement = _prompt_enforcement(chosen_tier, shape=shape)
 
     _run_install_mcp(project_path, chosen_ide, mcp_mode=mcp_mode,
                      permissions=chosen_tier, include_mcp_wildcard=include_wildcard,
@@ -924,9 +925,70 @@ def _prompt_init_steps(project_path: str, ide_name: str, default_mode: str = "di
     return chosen_ide, True
 
 
-def _prompt_enforcement(chosen_tier: str | None) -> str | None:
+def _assess_repo_shape(project_path: str):
+    """Measure the project (services.repo_shape). None when it cannot be measured."""
+    try:
+        from services import repo_shape
+        return repo_shape.assess(project_path)
+    except Exception:
+        _log.debug("repo shape assessment failed", exc_info=True)
+        return None
+
+
+def _apply_repo_shape_default(project_path: str, explicit_enforcement: str | None = None,
+                              shape=None) -> None:
+    """Say what kind of project this is, and default a prose one to ``advisory``.
+
+    Field report 2026-08-22: a 636-file project, ~95% Markdown and .docx,
+    where every symbol-aware C3 tool had nothing to act on and strict
+    discipline was paid on every turn until C3 was uninstalled. The shape
+    is printed for every project; the default is written only for the prose
+    kind, only over a tier-derived or unset mode (never over ``c3 enforce``
+    or ``--enforcement``), with provenance ``set_by: repo-shape`` so
+    ``c3 enforce`` shows where it came from, and with the way back printed.
+    """
+    try:
+        from services import enforcement_policy as ep
+        from services import repo_shape
+    except Exception:
+        return
+    if shape is None:
+        shape = _assess_repo_shape(project_path)
+    if shape is None or shape.kind == repo_shape.KIND_EMPTY:
+        return
+    print(f"\n  Repo shape: {shape.describe()}")
+    mode = repo_shape.recommended_mode(shape)
+    if not mode:
+        return
+    if explicit_enforcement:
+        print(f"      Prose-heavy, but --enforcement {explicit_enforcement} was given — leaving it as set.")
+        return
+    current = ep.resolve(project_path)
+    if current.set_by == ep.SET_BY_USER:
+        print(f"      Prose-heavy; tool discipline stays '{current.mode}' (your choice).")
+        return
+    if current.mode == mode:
+        print(f"      Prose-heavy; tool discipline is already '{mode}'.")
+        return
+    try:
+        result = ep.set_mode(mode, project_path, set_by=ep.SET_BY_SHAPE, scope="project")
+    except ValueError:
+        return
+    if result.get("deferred"):
+        return
+    print("  [!] This is a documentation project: C3's symbol-aware tools (compress/read/impact/")
+    print(f"      validate/CI) have little to act on here, so tool discipline is set to '{mode}' —")
+    print("      native Edit/Write are allowed with a nudge and the edit ledger still records them.")
+    print("      `c3 enforce strict` restores the hard block; `c3 enforce` shows the setting.")
+
+
+def _prompt_enforcement(chosen_tier: str | None, shape=None) -> str | None:
     """Step 5/5 — tool discipline. Returns an explicit mode, or None to derive.
 
+    ``shape`` (services.repo_shape.RepoShape) moves the suggested default to
+    ``advisory`` for a documentation project and says why, so the user is
+    not asked to guess what C3's symbol tools will do with 600 Markdown files.
+
     Asked separately from the permission tier because it answers a genuinely
     different question: the tier controls what the IDE will let the agent call,
     this controls how hard C3's own hook pushes it toward c3_* tools. Users hit
@@ -938,8 +1000,18 @@ def _prompt_enforcement(chosen_tier: str | None) -> str | None:
         return None
 
     default_mode = ep.derive_from_tier(chosen_tier) if chosen_tier else ep.MODE_ADVISORY
+    suggested_by = "Your permission tier suggests"
+    try:
+        from services import repo_shape
+        shape_mode = repo_shape.recommended_mode(shape) if shape is not None else None
+    except Exception:
+        shape_mode = None
+    if shape_mode:
+        default_mode = shape_mode
+        suggested_by = ("This is a documentation project — C3's symbol tools have "
+                        "little to act on here. Suggested")
     print()
-    print(f"  (Your permission tier suggests: {default_mode})")
+    print(f"  ({suggested_by}: {default_mode})")
     choice = _prompt_choice(
         "Step 5/5 — Tool discipline: how hard should C3 push toward c3_* tools?",
         [
@@ -1085,6 +1157,7 @@ def cmd_init(args):
     if not c3_dir.exists() or not (c3_dir / "config.json").exists():
         print_header(f"Initializing C3 for: {project_path}")
         _do_init(project_path, ide_name=requested_ide, no_embed=no_embed)
+        shape = _assess_repo_shape(project_path)
         try:
             from services.project_manager import ProjectManager
             ProjectManager().add_project(project_path)
@@ -1101,7 +1174,11 @@ def cmd_init(args):
                 enforcement=getattr(args, "enforcement", None),
             )
         else:
-            _prompt_init_steps(project_path, requested_ide, default_mode=getattr(args, "mcp_mode", "direct"))
+            _prompt_init_steps(project_path, requested_ide,
+                               default_mode=getattr(args, "mcp_mode", "direct"), shape=shape)
+        _apply_repo_shape_default(project_path,
+                                  explicit_enforcement=getattr(args, "enforcement", None),
+                                  shape=shape)
         # Detect Codex CLI availability
         try:
             from cli.tools.delegate import check_codex
@@ -1285,11 +1362,7 @@ def cmd_init(args):
         if c3_dir.exists():
             shutil.rmtree(c3_dir)
             print("  Deleted .c3/")
-        for filename, _ in _instruction_documents_for_project():
-            p = Path(project_path) / filename
-            if p.exists():
-                p.unlink()
-                print(f"  Deleted {filename}")
+        _remove_c3_instruction_docs(project_path)
         print("\n[OK] C3 project files removed.")
         return
 
@@ -1361,9 +1434,10 @@ def cmd_init(args):
 
     elif selected.startswith("Wipe"):
         confirm = input(
-            "\n  WARNING: This will permanently delete .c3/ and all project\n"
-            "  instruction files (CLAUDE.md, GEMINI.md, AGENTS.md), and remove\n"
-            "  C3 MCP configurations from your IDE. Type 'yes' to confirm: "
+            "\n  WARNING: This will permanently delete .c3/, remove C3's managed\n"
+            "  block from CLAUDE.md / AGENTS.md / GEMINI.md (a file is deleted only\n"
+            "  when nothing else is in it), and remove C3 MCP configurations from\n"
+            "  your IDE. Type 'yes' to confirm: "
         ).strip().lower()
         if confirm != "yes":
             print("  Wipe cancelled.")
@@ -1375,11 +1449,7 @@ def cmd_init(args):
             shutil.rmtree(c3_dir)
             print("  Deleted .c3/")
 
-        for filename, _ in _instruction_documents_for_project():
-            p = Path(project_path) / filename
-            if p.exists():
-                p.unlink()
-                print(f"  Deleted {filename}")
+        _remove_c3_instruction_docs(project_path)
 
         print("\n[OK] C3 project files removed.")
 
@@ -4555,6 +4625,115 @@ def _ensure_global_session_fallbacks(server_script: str, c3_mcp_exe: str | None
             print(f"Warning: Could not update {antigravity_path} (global fallback skipped)")
 
 
+# Every hook script C3 has ever registered in a settings file — the v2.42+
+# dispatcher plus the pre-v2.42 per-hook scripts — so uninstall recognises an
+# entry written by any C3 version. A user hook is anything not naming one.
+_C3_HOOK_SCRIPTS = (
+    "hook_dispatch.py",
+    "hook_access_guard.py", "hook_artifact.py", "hook_auto_snapshot.py",
+    "hook_c3_signal.py", "hook_c3read.py", "hook_edit_ledger.py",
+    "hook_edit_unlock.py", "hook_filter.py", "hook_ghost_files.py",
+    "hook_pretool_enforce.py", "hook_prompt_recall.py", "hook_read.py",
+    "hook_session_stats.py", "hook_terse_advisor.py",
+)
+
+
+def _is_c3_hook_command(command) -> bool:
+    return any(script in str(command or "") for script in _C3_HOOK_SCRIPTS)
+
+
+def _is_c3_permission(rule) -> bool:
+    """``mcp__c3__<tool>``, ``mcp__c3__*``, or the bare ``mcp__c3`` server grant."""
+    r = str(rule or "").strip()
+    return r == "mcp__c3" or r.startswith("mcp__c3__")
+
+
+def _c3_references_in_settings(settings: dict) -> list:
+    """Every C3-owned entry present in a settings dict: hook commands (named
+    by event) and permission rules. Used to decide whether there is anything
+    to remove and, after writing, to check that it was actually removed."""
+    refs: list = []
+    hooks = settings.get("hooks")
+    if isinstance(hooks, dict):
+        for event, groups in hooks.items():
+            for group in groups or []:
+                if not isinstance(group, dict):
+                    continue
+                for hk in group.get("hooks") or []:
+                    if isinstance(hk, dict) and _is_c3_hook_command(hk.get("command")):
+                        refs.append(f"hooks.{event}")
+    perms = settings.get("permissions")
+    if isinstance(perms, dict):
+        for key in ("allow", "deny", "ask"):
+            for rule in perms.get(key) or []:
+                if _is_c3_permission(rule):
+                    refs.append(f"permissions.{key}:{rule}")
+    if "c3" in (settings.get("enabledMcpjsonServers") or []):
+        refs.append("enabledMcpjsonServers:c3")
+    return refs
+
+
+def _strip_c3_from_settings(settings: dict) -> dict:
+    """Remove every C3-owned entry from a Claude Code settings dict (in place,
+    and returned). Touches ONLY what C3 wrote: hook entries whose command runs
+    a C3 hook script — any event, any matcher; the previous cleanup looked at
+    three PostToolUse matchers from the pre-v2.42 layout and nothing else, so
+    PreToolUse/Stop/UserPromptSubmit and the whole ``permissions.allow`` list
+    survived an "uninstall" — plus ``mcp__c3__*`` permission rules and the
+    ``c3`` MCP-server enablement. User hooks, user permission rules and every
+    other key are left exactly as found; containers emptied by the removal
+    are dropped so a file C3 created alone ends up empty (and the caller
+    deletes it) rather than as ``{"hooks": {}}``.
+    """
+    hooks = settings.get("hooks")
+    if isinstance(hooks, dict):
+        for event in list(hooks.keys()):
+            kept_groups = []
+            for group in hooks.get(event) or []:
+                if not isinstance(group, dict):
+                    kept_groups.append(group)
+                    continue
+                entries = group.get("hooks") or []
+                if not any(isinstance(hk, dict) and _is_c3_hook_command(hk.get("command"))
+                           for hk in entries):
+                    kept_groups.append(group)  # not ours — untouched
+                    continue
+                kept = [hk for hk in entries
+                        if not (isinstance(hk, dict) and _is_c3_hook_command(hk.get("command")))]
+                if kept:
+                    group = dict(group)
+                    group["hooks"] = kept
+                    kept_groups.append(group)
+            if kept_groups:
+                hooks[event] = kept_groups
+            else:
+                del hooks[event]
+        if not hooks:
+            del settings["hooks"]
+
+    perms = settings.get("permissions")
+    if isinstance(perms, dict):
+        for key in ("allow", "deny", "ask"):
+            rules = perms.get(key)
+            if isinstance(rules, list) and any(_is_c3_permission(r) for r in rules):
+                kept_rules = [r for r in rules if not _is_c3_permission(r)]
+                if kept_rules:
+                    perms[key] = kept_rules
+                else:
+                    del perms[key]
+        if not perms:
+            del settings["permissions"]
+
+    enabled = settings.get("enabledMcpjsonServers")
+    if isinstance(enabled, list) and "c3" in enabled:
+        enabled = [s for s in enabled if s != "c3"]
+        if enabled:
+            settings["enabledMcpjsonServers"] = enabled
+        else:
+            del settings["enabledMcpjsonServers"]
+    return settings
+
+
 def _uninstall_mcp_all(project_path: str, include_global: bool = True):
     """Remove C3 MCP server configurations from all supported IDEs.
 
@@ -4658,37 +4837,28 @@ def _uninstall_mcp_all(project_path: str, include_global: bool = True):
                     with open(settings_path, 'r', encoding="utf-8") as f:
                         settings = json.load(f)
 
-                    # Remove hooks
-                    hooks = settings.get("hooks", {}).get("PostToolUse", [])
-                    new_hooks = []
-                    c3_hook_files = {"hook_filter.py", "hook_read.py", "hook_c3read.py", "hook_dispatch.py"}
-                    for h in hooks:
-                        if h.get("matcher") in ("Bash", "Read", "mcp__c3__c3_read"):
-                            h["hooks"] = [hook for hook in h.get("hooks", [])
-                                          if not any(f in hook.get("command", "") for f in c3_hook_files)]
-                            if h["hooks"]:
-                                new_hooks.append(h)
-                        else:
-                            new_hooks.append(h)
-
-                    if new_hooks:
-                        settings["hooks"]["PostToolUse"] = new_hooks
-                    elif "hooks" in settings and "PostToolUse" in settings["hooks"]:
-                        del settings["hooks"]["PostToolUse"]
-                        if not settings["hooks"]:
-                            del settings["hooks"]
-
-                    # Remove enabled server
-                    if "enabledMcpjsonServers" in settings and "c3" in settings["enabledMcpjsonServers"]:
-                        settings["enabledMcpjsonServers"].remove("c3")
-
-                    if not settings:
-                        settings_path.unlink()
-                        print(f"  Deleted empty {settings_path}")
+                    before = _c3_references_in_settings(settings)
+                    if not before:
+                        print(f"  No C3 entries in {settings_path}")
                     else:
-                        with open(settings_path, 'w', encoding="utf-8") as f:
-                            json.dump(settings, f, indent=2)
-                        print(f"  Removed C3 hooks/settings from {settings_path}")
+                        settings = _strip_c3_from_settings(settings)
+                        if not settings:
+                            settings_path.unlink()
+                            print(f"  Deleted empty {settings_path}")
+                        else:
+                            with open(settings_path, 'w', encoding="utf-8") as f:
+                                json.dump(settings, f, indent=2)
+                            # Postcondition: re-read what is on disk and report
+                            # what is true, not what was attempted.
+                            with open(settings_path, 'r', encoding="utf-8") as f:
+                                remaining = _c3_references_in_settings(json.load(f))
+                            if remaining:
+                                shown = ", ".join(remaining[:5]) + (" ..." if len(remaining) > 5 else "")
+                                print(f"  [!] C3 entries remain in {settings_path} "
+                                      f"({len(remaining)}): {shown}")
+                            else:
+                                print(f"  Removed C3 hooks/settings from {settings_path} "
+                                      f"({len(before)} entries)")
                 except Exception as e:
                     print(f"  Warning: Could not update {settings_path}: {e}")
 
@@ -4872,6 +5042,44 @@ def _instruction_documents_for_project() -> list[tuple[str, str]]:
     ]
 
 
+def _remove_c3_instruction_docs(project_path: str) -> None:
+    """Take C3's managed block OUT of every instruction doc it ever wrote.
+
+    Uninstall counterpart of ``_sync_project_instruction_docs``. Before
+    v2.92 this was a bare ``unlink()`` of CLAUDE.md / AGENTS.md / GEMINI.md —
+    which, in a project whose CLAUDE.md also carried another tool's managed
+    block (``<!-- YEP:BEGIN -->``) or the user's own notes, destroyed content
+    C3 never owned, with no warning and no way back unless git had it.
+    Same rule every regeneration path already follows: C3 owns its slice,
+    everything outside the markers is preserved. A file is deleted only when
+    the block was all there was.
+    """
+    from services.claude_md import strip_c3_block
+
+    for filename, _ in _instruction_documents_for_project():
+        p = Path(project_path) / filename
+        if not p.exists():
+            continue
+        try:
+            existing = p.read_text(encoding="utf-8", errors="replace")
+        except OSError as exc:
+            print(f"  Warning: Could not read {filename}: {exc}")
+            continue
+        remainder = strip_c3_block(existing)
+        if remainder is None:
+            print(f"  Kept {filename} (no C3 block in it — not ours to delete)")
+        elif remainder.strip():
+            try:
+                p.write_text(remainder, encoding="utf-8")
+            except OSError as exc:
+                print(f"  Warning: Could not update {filename}: {exc}")
+                continue
+            print(f"  Removed C3 block from {filename} (kept the rest of the file)")
+        else:
+            p.unlink()
+            print(f"  Deleted {filename}")
+
+
 _LEGACY_INSTRUCTION_DOCS = ("GEMINI.md",)  # Gemini CLI profile removed in v2.52
 
 

{code_context_control-2.91.0 → code_context_control-2.92.0}/cli/guide/oracle.html

@@ -330,10 +330,10 @@ curl -X POST \
           <tr><td><code>c3 oracle serve --install</code></td>   <td>Register the Oracle as a login/startup service — no terminal window — and start it now. Windows: Task Scheduler (Run-key fallback); macOS: launchd; Linux: systemd user unit</td></tr>
           <tr><td><code>c3 oracle serve --uninstall</code></td> <td>Remove the startup registration (a running Oracle keeps running)</td></tr>
           <tr><td><code>c3 oracle serve --status</code></td>    <td>Installed? Running? Port, bind host, URL, and the launcher log path</td></tr>
-          <tr><td><code>c3 oracle open</code></td>       <td>Sign in to a running dashboard via a single-use URL</td></tr>
+          <tr><td><code>c3 oracle open</code></td>       <td>Sign in to a running dashboard via a single-use URL (the hub's <strong>Open Oracle</strong> button does the same thing)</td></tr>
         </tbody>
       </table>
-      <p style="font-size: 12px; color: var(--text-dim); margin: 8px 0 0;">The Hub exposes the same controls under <strong>Settings → Oracle service</strong> (Install / Uninstall / Start / Stop / Open). Starting the Oracle from there also fills in the Hub's <em>Oracle URL</em> when it is empty, so the Open Oracle button appears in the top bar.</p>
+      <p style="font-size: 12px; color: var(--text-dim); margin: 8px 0 0;">The Hub exposes the same controls under <strong>Settings → Oracle service</strong> (Install / Uninstall / Start / Stop / Open). Starting the Oracle from there also fills in the Hub's <em>Oracle URL</em> when it is empty, so the Open Oracle button appears in the top bar. That button opens a <strong>signed-in</strong> dashboard: it redeems the Oracle's owner-only bootstrap key for you. Reaching the dashboard by pasting its URL instead leaves it read-only — the page renders and the header looks healthy, but chat, Save and Test Ollama answer <code>401 unauthorized</code>.</p>
     </section>
 
     <hr class="divider">

{code_context_control-2.91.0 → code_context_control-2.92.0}/cli/hook_pretool_enforce.py

@@ -35,6 +35,7 @@ advisory path instead of granting stale unlocks.
 Supports both Claude Code and Gemini CLI via _hook_utils.
 """
 import json
+import re
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -361,6 +362,131 @@ def _vault_denial(tool_name: str, tool_input: dict) -> dict | None:
     return None
 
 
+def _outside_project(base: Path, tool_input: dict) -> bool:
+    """True when the call targets a path outside the project root.
+
+    Tool discipline exists to keep THIS project's edit ledger complete and
+    its index warm. A scratch file in /tmp or a file in some other checkout
+    has no ledger here, so a block buys nothing and costs a workaround, and
+    a hint is noise (ISSUE-2 of the 2026-08 field report). Relative paths
+    resolve against the project root, which is also the hook's cwd. A path
+    that cannot be resolved counts as inside — the existing behaviour.
+    """
+    raw = str(tool_input.get("file_path") or tool_input.get("notebook_path")
+              or tool_input.get("path") or "")
+    if not raw:
+        return False
+    try:
+        target = Path(raw)
+        if not target.is_absolute():
+            target = base / target
+        # canonical_key: resolved, forward-slash, casefolded — the one path
+        # identity the unlock map and Access Guard already agree on.
+        target_key = canonical_key(target)
+        root_key = canonical_key(base).rstrip("/")
+    except (OSError, RuntimeError, ValueError):
+        return False
+    return not (target_key == root_key or target_key.startswith(root_key + "/"))
+
+
+# ── Sub-agent tool grants ──────────────────────────────────────────────────
+# Claude Code sends `agent_type` (plus `agent_id` inside a sub-agent) with
+# every hook payload. A sub-agent whose definition lists `tools:` gets ONLY
+# those tools; if none of them reaches the c3 MCP server, the agent has no
+# c3_edit to be redirected to, and a strict deny just pushes the write onto
+# a shell heredoc that the ledger never sees (field report 2026-08-22,
+# ISSUE-1: four self-reports in one session). For that agent only, the
+# block degrades to the advisory nudge. An agent with no `tools:` line
+# inherits every tool and stays strict; an agent we cannot find stays strict
+# but the deny names the fix.
+
+_C3_GRANT_PREFIXES = ("mcp__c3__", "c3_")
+_C3_GRANT_EXACT = frozenset({"*", "mcp__*", "mcp__c3"})
+
+
+def _agent_definition(base: Path, agent_type: str) -> Path | None:
+    """The agent file for ``agent_type``: project ``.claude/agents`` first,
+    then the user's. Plugin-scoped or path-like names are not looked up."""
+    name = str(agent_type or "").strip()
+    if not name or any(ch in name for ch in r"/\:") or name.startswith("."):
+        return None
+    roots = [base / ".claude" / "agents"]
+    try:
+        roots.append(Path.home() / ".claude" / "agents")
+    except Exception:
+        pass
+    for root in roots:
+        if not root.is_dir():
+            continue
+        direct = root / f"{name}.md"
+        if direct.is_file():
+            return direct
+        nested = next((p for p in root.rglob(f"{name}.md") if p.is_file()), None)
+        if nested is not None:
+            return nested
+    return None
+
+
+def _frontmatter_tools(text: str) -> list | None:
+    """The ``tools:`` grant from an agent file's YAML frontmatter.
+
+    ``None`` when there is no frontmatter or no ``tools:`` key — the agent
+    inherits every tool. Handles the inline form (``tools: Read, Write`` or
+    ``tools: [Read, Write]``) and the list form (``- Read`` lines).
+    """
+    lines = text.splitlines()
+    if not lines or lines[0].strip() != "---":
+        return None
+    body = []
+    for line in lines[1:]:
+        if line.strip() == "---":
+            break
+        body.append(line)
+    for i, line in enumerate(body):
+        m = re.match(r"^tools\s*:\s*(.*)$", line)
+        if not m:
+            continue
+        rest = m.group(1).strip()
+        if rest and rest not in ("|", ">"):
+            rest = rest.strip("[]")
+            return [t.strip().strip("'\"") for t in rest.split(",") if t.strip()]
+        tools = []
+        for nxt in body[i + 1:]:
+            lm = re.match(r"^\s+-\s*(.*)$", nxt)
+            if not lm:
+                break
+            tools.append(lm.group(1).strip().strip("'\""))
+        return tools
+    return None
+
+
+def _grant_reaches_c3(tools: list) -> bool:
+    for t in tools:
+        t = str(t).strip()
+        if t in _C3_GRANT_EXACT or t.startswith(_C3_GRANT_PREFIXES):
+            return True
+    return False
+
+
+def _agent_cannot_comply(payload: dict, base: Path) -> str | None:
+    """A one-line reason when the calling agent provably has no c3 tool to
+    use instead, else None (keep strict). Any failure → None."""
+    agent_type = str(payload.get("agent_type") or "").strip()
+    if not agent_type:
+        return None
+    try:
+        definition = _agent_definition(base, agent_type)
+        if definition is None:
+            return None
+        tools = _frontmatter_tools(definition.read_text(encoding="utf-8", errors="replace"))
+    except Exception:
+        return None
+    if tools is None or _grant_reaches_c3(tools):
+        return None
+    return (f"agent '{agent_type}' ({definition.name}) lists tools: with no "
+            f"mcp__c3__* entry, so it has no c3_edit to use")
+
+
 def _override_allows(base: Path, tool_name: str, tool_input: dict,
                      session_id: str) -> str | None:
     """A live discipline grant for this exact write, or None (spec §5).
@@ -401,6 +527,11 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     if vault:
         return vault
 
+    # Scope: this hook governs the project's own files. Anything outside the
+    # root passes through in every mode — nothing here to keep a ledger of.
+    if _outside_project(base, tool_input):
+        return None
+
     policy = _resolve_policy(base)
     mode = getattr(policy, "mode", None) or "strict"
     ttl_s = getattr(policy, "signal_ttl_s", _SIGNAL_MAX_AGE_SECS)
@@ -444,6 +575,16 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
         granted = _override_allows(base, tool_name, tool_input, session_id)
         if granted:
             return _with_warnings({"additionalContext": granted}, policy)
+        cannot = _agent_cannot_comply(payload, base)
+        if cannot:
+            return _with_warnings({
+                "additionalContext": (
+                    f"[c3:hint] Native `{tool_name}` allowed: {cannot}. The edit "
+                    f"ledger still records this write. To keep strict discipline "
+                    f"for this agent, add `mcp__c3__c3_edit` (or `mcp__c3`) to its "
+                    f"tools: list, or drop the tools: line so it inherits every tool."
+                )
+            }, policy)
         _record_block(tool_name, tool_input, session_id, base)
         reason = (
             f"[c3:enforce] Native `{tool_name}` is blocked to preserve the edit "
@@ -451,6 +592,13 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
             f"If this is getting in your way, the user can run "
             f"`c3 enforce advisory`."
         )
+        agent_type = str(payload.get("agent_type") or "").strip()
+        if agent_type:
+            reason += (
+                f" Running as agent '{agent_type}': if its tools: grant has no "
+                f"mcp__c3__* entry it cannot follow this — add `mcp__c3__c3_edit` "
+                f"to the grant, or drop the tools: line so it inherits every tool."
+            )
         return {
             "hookSpecificOutput": {
                 "hookEventName": "PreToolUse",

{code_context_control-2.91.0 → code_context_control-2.92.0}/cli/hub_server.py

@@ -25,7 +25,7 @@ import urllib.request
 import webbrowser
 from pathlib import Path
 
-from flask import Flask, jsonify, request, send_from_directory
+from flask import Flask, jsonify, redirect, request, send_from_directory
 
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
@@ -3464,6 +3464,48 @@ def api_oracle_service_stop():
     return jsonify(_oracle_service().stop())
 
 
+@app.route("/api/oracle/open")
+def api_oracle_open():
+    """Redirect the browser to a *signed-in* Oracle dashboard.
+
+    Plain ``GET /`` on the Oracle is read-only by design (#31): the session
+    cookie is only issued in exchange for a single-use bootstrap code, and the
+    owner-only ``bootstrap.key`` is what proves the caller is the same OS user
+    as the server. Since the Oracle became a login service nothing redeems
+    that key for the browser, so the top-bar link landed on a dashboard where
+    every read looked healthy and every write — chat, Save settings, Test
+    Ollama — answered ``401 unauthorized``.
+
+    The hub runs as the owning user, so it can redeem the key on the browser's
+    behalf. It reaches no further than ``c3 oracle open`` already does. Any
+    failure falls back to the plain URL, i.e. the previous behavior.
+    """
+    base = (_read_hub_config().get("oracle_url") or "").strip().rstrip("/")
+    if not base:
+        base = _oracle_service().url()
+    try:
+        from oracle.config import ORACLE_DIR
+        from oracle.services import local_session
+        key = local_session.read_bootstrap_key(ORACLE_DIR)
+    except Exception:
+        key = ""
+    if not key:
+        return redirect(base)  # Oracle not running, or key not published yet
+    try:
+        req = urllib.request.Request(
+            f"{base}/api/session/bootstrap",
+            data=json.dumps({"key": key}).encode("utf-8"),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(req, timeout=10) as r:
+            payload = json.loads(r.read().decode("utf-8"))
+        return redirect(payload.get("url") or base)
+    except Exception as e:
+        logging.getLogger("c3.hub").warning("oracle sign-in mint failed: %s", e)
+        return redirect(base)
+
+
 # ─── Routes: sessions ────────────────────────────────────────────────────────
 
 @app.route("/api/sessions/start", methods=["POST"])