@gotcos/glasses-server 6.21.32 → 6.21.34

package/.env.example

@@ -124,12 +124,15 @@ BIND_HOST=0.0.0.0
 # pipeline to inherit live tasks/calendar/people context. Omit for standalone.
 # COS_SCRIPTS_DIR=/path/to/your/cos/operations/scripts
 #
-# G2 "Review Meetings" reads COS meeting markdown from an operations tree:
-#   {COS_OPERATIONS_DIR}/{quilt|personal|…}/meetings/YYYY-MM/*.md
-# Prefer an explicit ops root (each COS layout can differ). If unset, the
-# server falls back to COS_SCRIPTS_DIR/.. then to local G2 recordings only.
+# G2 "Review Meetings" accepts either layout:
+#   {COS_MEETINGS_ROOT}/YYYY-MM/*.md                      # one read-only library
+#   {COS_OPERATIONS_DIR}/{domain}/meetings/YYYY-MM/*.md  # multi-domain pipeline
+# Keep COS_OPERATIONS_DIR for enrichment and writes. COS_MEETINGS_ROOT is a
+# browse override; legacy values that contain a multi-domain operations tree
+# retain their old alias behavior. If both are unset, the server tries
+# COS_SCRIPTS_DIR/.. and then local G2 recordings.
 # COS_OPERATIONS_DIR=/path/to/your/cos/operations
-# COS_MEETINGS_ROOT=/path/to/your/cos/operations   # alias for COS_OPERATIONS_DIR
+# COS_MEETINGS_ROOT=/path/to/your/existing/meetings
 
 # Telegram session/activity notifications remain OFF even if the COS scripts
 # directory contains .telegram_config.json. Enable export explicitly:

package/CHANGELOG.md

@@ -1,3 +1,34 @@
+## 6.21.34
+
+- **Memory and Threads are now real production surfaces.** Authenticated
+  `/api/memory` and `/api/threads` list/detail routes expose bounded read-only
+  projections from the configured COS pipeline instead of returning 404.
+- **Stable references, not storage internals.** Memory uses its logical
+  `mem_...` ID and Threads use their existing stable ID. Responses never expose
+  embeddings, Qdrant point IDs, raw cache files, secrets, or local paths.
+- **Memory overview is complete.** The store total and type split scan the full
+  collection instead of silently stopping after the first 1,000 records.
+- **Manual threads remain visible immediately.** The bridge merges the computed
+  thread cache with the durable manual-thread store without mutating either.
+- **Standalone installs fail honestly.** Systems without a COS scripts pipeline
+  return empty/unavailable shapes while the rest of the glasses server remains
+  usable.
+
+## 6.21.33
+
+- **Existing meeting libraries can be selected directly.** `COS_MEETINGS_ROOT`
+  now accepts `meetings/YYYY-MM/*.md` as a read-only library, while
+  `COS_OPERATIONS_DIR` continues to own multi-domain enrichment and writes.
+- **Mixed libraries stay coherent.** Review Meetings merges direct, enriched
+  operations, and standalone G2 records, dedupes by session identity, and
+  prefers the writable enriched copy when one exists.
+- **Upgrades remain compatible.** A legacy multi-domain
+  `COS_MEETINGS_ROOT` keeps its prior operations-root meaning. Invalid explicit
+  roots report a degraded state instead of silently switching libraries.
+- **Read-only means read-only.** Direct-library speaker mutations return a
+  typed conflict, paths and symlinks are contained, scans are bounded, and
+  public health never exposes the selected filesystem path.
+
 ## 6.21.32
 
 - **Adaptive meeting-audio cleanup is a default-off, replay-only canary.** When

package/README.md

@@ -292,6 +292,24 @@ optional cleanup process cannot contend with live transcription. Cleanup uses
 one global worker, serves raw while that worker is busy, and preempts within
 100 ms if a meeting starts after a replay request was admitted.
 
+Server 6.21.33 lets Review Meetings browse an existing single-library tree such
+as `meetings/YYYY-MM/*.md`. Set `COS_MEETINGS_ROOT` to the folder that directly
+contains the month folders. It is intentionally read-only. For the full COS
+sync and enrichment pipeline, keep using `COS_OPERATIONS_DIR` with
+`<domain>/meetings/YYYY-MM/*.md`; arbitrary domain names are supported. When a
+direct library and an operations root are both configured, the server merges
+them with standalone G2 recordings and prefers the enriched writable record
+for the same session.
+
+Server 6.21.34 adds authenticated, read-only Memory and Threads browsing for
+full COS installs. With `COS_SCRIPTS_DIR` configured, the companion can show the
+complete Bot Memory count/type split, bounded recent summaries, exact logical
+memory IDs, and existing tracked/manual threads. Exact detail requests are
+resolved by stable ID so a spoken follow-up can carry the selected snapshot as
+context. Embeddings, vector-store point IDs, cache files, secrets, and local
+paths never cross the API boundary. Standalone installs report the feature as
+unavailable without affecting messages, meetings, transcription, or agents.
+
 The first server start downloads the real-time turbo model. True HQ additionally
 requires the full `ggml-large-v3.bin` model (about 3.1 GB):
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.32",
+  "version": "6.21.34",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -39,6 +39,8 @@ import { promptEditRouter } from './routes/prompt-edit.js'
 import { bookmarksRouter } from './routes/bookmarks.js'
 import { welcomeContextRouter } from './routes/welcome-context.js'
 import { liveCuesRouter } from './routes/live-cues.js'
+import { memoryRouter } from './routes/memory.js'
+import { threadsRouter } from './routes/threads.js'
 import { shutdownLiveCues } from './lib/live-cues-engine.js'
 import { prewarmContext } from './lib/context-builder.js'
 import { preWarmCLI } from './lib/claude-bridge.js'
@@ -233,6 +235,8 @@ app.use('/api', displayRouter)
 app.use('/api', transcribeStreamRouter)
 app.use('/api', meetingRouter)
 app.use('/api', meetingsRouter)
+app.use('/api', memoryRouter)
+app.use('/api', threadsRouter)
 app.use('/api', openaiKeyRouter)
 // v6.3.0 — Message History, cross-day 'reference message N', and history
 // recovery for public npx users (previously full-COS-server only).

package/server/lib/cos-context-browser.ts

@@ -0,0 +1,230 @@
+export const MEMORY_ID_PATTERN = /^mem_[A-Za-z0-9_:-]{1,120}$/
+export const THREAD_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
+
+const CONTROL_CHARS = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g
+const ABSOLUTE_PATH = /(^|[\s("'`])(?:~\/|\/(?!\/)(?:[^/\s)"'`]+\/)+[^/\s)"'`]+\/?)/g
+const SECRET_TOKEN = /\b(?:sk-[A-Za-z0-9_-]{12,}|(?:bearer|token|api[_ -]?key)\s*[:=]\s*[A-Za-z0-9._-]{12,})\b/gi
+
+export interface MemoryRefGroups {
+  people?: string[]
+  files?: string[]
+  meetings?: string[]
+  threads?: string[]
+}
+
+export interface MemoryListItem {
+  id: string
+  type: string
+  summary: string
+  content: string
+  created_at: string
+  domain: string
+  refs: MemoryRefGroups
+  reference_available: true
+}
+
+export interface ThreadListItem {
+  id: string
+  name: string
+  domain: string
+  is_manual: boolean
+  topics: string[]
+  meeting_count: number
+  first_seen: string
+  last_seen: string
+  velocity: string
+  age_days: number
+  is_stale: boolean
+  is_resolved: boolean
+  meetings: Array<{ name: string; date: string }>
+  manual_updates: Array<{ content: string; timestamp: string; source: string }>
+  stakeholders: string[]
+  milestones: string[]
+  sources: string[]
+  target_date: string
+  serves_goal: string
+  created_at: string
+  created_by: string
+  access_count: number
+  reference_available: true
+}
+
+export function cleanContextText(value: unknown, limit: number): string {
+  let text = typeof value === 'string' ? value : value == null ? '' : String(value)
+  text = text.replace(CONTROL_CHARS, '')
+  text = text.replace(ABSOLUTE_PATH, (_match, prefix: string) => `${prefix}[local path hidden]`)
+  text = text.replace(SECRET_TOKEN, '[secret hidden]')
+  return text.trim().slice(0, limit)
+}
+
+function finiteInteger(value: unknown, fallback = 0, maximum = Number.MAX_SAFE_INTEGER): number {
+  const number = typeof value === 'number' ? value : Number(value)
+  if (!Number.isFinite(number)) return fallback
+  return Math.max(0, Math.min(maximum, Math.trunc(number)))
+}
+
+function stringList(value: unknown, itemLimit: number, textLimit: number): string[] {
+  if (!Array.isArray(value)) return []
+  return value.slice(0, itemLimit).map(item => {
+    if (item && typeof item === 'object' && !Array.isArray(item)) {
+      const record = item as Record<string, unknown>
+      const label = record.title ?? record.name ?? record.summary ?? record.content ?? record.path ?? record.url
+      return cleanContextText(label ?? '', textLimit)
+    }
+    return cleanContextText(item, textLimit)
+  }).filter(Boolean)
+}
+
+function memoryRefs(value: unknown): MemoryRefGroups {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {}
+  const source = value as Record<string, unknown>
+  const result: MemoryRefGroups = {}
+  for (const key of ['people', 'files', 'meetings', 'threads'] as const) {
+    const items = stringList(source[key], 12, 160)
+    if (items.length) result[key] = items
+  }
+  return result
+}
+
+export function normalizeMemoryList(value: unknown, limit: number): MemoryListItem[] {
+  if (!Array.isArray(value)) return []
+  const result: MemoryListItem[] = []
+  for (const row of value.slice(0, Math.max(0, Math.min(limit, 50)))) {
+    if (!row || typeof row !== 'object' || Array.isArray(row)) continue
+    const source = row as Record<string, unknown>
+    const id = cleanContextText(source.id, 128)
+    if (!MEMORY_ID_PATTERN.test(id)) continue
+    result.push({
+      id,
+      type: cleanContextText(source.type || 'unknown', 48),
+      summary: cleanContextText(source.summary || source.content, 240),
+      content: cleanContextText(source.content, 1200),
+      created_at: cleanContextText(source.created_at, 64),
+      domain: cleanContextText(source.domain, 64),
+      refs: memoryRefs(source.refs),
+      reference_available: true,
+    })
+  }
+  return result
+}
+
+export function normalizeMemoryDetail(value: unknown): (MemoryListItem & {
+  auto_generated: boolean
+  consolidated: boolean
+}) | null {
+  const rows = normalizeMemoryList(value && typeof value === 'object' ? [value] : [], 1)
+  if (!rows[0] || !value || typeof value !== 'object' || Array.isArray(value)) return null
+  const source = value as Record<string, unknown>
+  return {
+    ...rows[0],
+    content: cleanContextText(source.content, 32_000),
+    auto_generated: source.auto_generated === true,
+    consolidated: source.consolidated === true,
+  }
+}
+
+function normalizeThread(value: unknown, detail: boolean): ThreadListItem | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null
+  const source = value as Record<string, unknown>
+  const id = cleanContextText(source.id, 128)
+  if (!THREAD_ID_PATTERN.test(id)) return null
+  const meetings = Array.isArray(source.meetings)
+    ? source.meetings.slice(0, detail ? 50 : 12).flatMap(item => {
+        if (!item || typeof item !== 'object' || Array.isArray(item)) return []
+        const meeting = item as Record<string, unknown>
+        return [{ name: cleanContextText(meeting.name, 240), date: cleanContextText(meeting.date, 32) }]
+      })
+    : []
+  const manualUpdates = Array.isArray(source.manual_updates)
+    ? source.manual_updates.slice(0, detail ? 20 : 8).flatMap(item => {
+        if (!item || typeof item !== 'object' || Array.isArray(item)) return []
+        const update = item as Record<string, unknown>
+        return [{
+          content: cleanContextText(update.content, detail ? 2000 : 500),
+          timestamp: cleanContextText(update.timestamp, 64),
+          source: cleanContextText(update.source, 120),
+        }]
+      })
+    : []
+  return {
+    id,
+    name: cleanContextText(source.name || 'Untitled thread', 160),
+    domain: cleanContextText(source.domain || 'unknown', 64),
+    is_manual: source.is_manual === true,
+    topics: stringList(source.topics, detail ? 40 : 12, 160),
+    meeting_count: finiteInteger(source.meeting_count, meetings.length, 100_000),
+    first_seen: cleanContextText(source.first_seen, 32),
+    last_seen: cleanContextText(source.last_seen, 32),
+    velocity: cleanContextText(source.velocity, 48),
+    age_days: finiteInteger(source.age_days, 0, 1_000_000),
+    is_stale: source.is_stale === true,
+    is_resolved: source.is_resolved === true,
+    meetings,
+    manual_updates: manualUpdates,
+    stakeholders: stringList(source.stakeholders, detail ? 30 : 12, 160),
+    milestones: stringList(source.milestones, detail ? 30 : 8, 500),
+    sources: stringList(source.sources, detail ? 30 : 8, 500),
+    target_date: cleanContextText(source.target_date, 32),
+    serves_goal: cleanContextText(source.serves_goal, 160),
+    created_at: cleanContextText(source.created_at, 64),
+    created_by: cleanContextText(source.created_by, 120),
+    access_count: finiteInteger(source.access_count),
+    reference_available: true,
+  }
+}
+
+export function normalizeThreads(value: unknown, limit: number): {
+  generated_at: string
+  active_count: number
+  stale_count: number
+  resolved_count: number
+  threads: ThreadListItem[]
+} {
+  const source = value && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : {}
+  const rawThreads = Array.isArray(source.threads) ? source.threads : []
+  const threads = rawThreads.slice(0, Math.max(0, Math.min(limit, 50)))
+    .map(item => normalizeThread(item, false))
+    .filter((item): item is ThreadListItem => item !== null)
+  return {
+    generated_at: cleanContextText(source.generated_at, 64),
+    active_count: finiteInteger(source.active_count),
+    stale_count: finiteInteger(source.stale_count),
+    resolved_count: finiteInteger(source.resolved_count),
+    threads,
+  }
+}
+
+export function normalizeThreadDetail(value: unknown): ThreadListItem | null {
+  return normalizeThread(value, true)
+}
+
+export function normalizeMemoryOverview(value: unknown): {
+  available: boolean
+  collection: 'cos_memory'
+  total: number
+  by_type: Record<string, number>
+  reason?: string
+} {
+  const source = value && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : {}
+  const rawTypes = source.by_type && typeof source.by_type === 'object' && !Array.isArray(source.by_type)
+    ? source.by_type as Record<string, unknown>
+    : {}
+  const byType: Record<string, number> = {}
+  for (const [rawKey, rawValue] of Object.entries(rawTypes).slice(0, 24)) {
+    const key = cleanContextText(rawKey, 48)
+    if (key) byType[key] = finiteInteger(rawValue)
+  }
+  const result: ReturnType<typeof normalizeMemoryOverview> = {
+    available: source.available === true,
+    collection: 'cos_memory',
+    total: finiteInteger(source.total),
+    by_type: byType,
+  }
+  const reason = cleanContextText(source.reason, 120)
+  if (reason) result.reason = reason
+  return result
+}

package/server/lib/cos-operations-meetings.ts

@@ -4,17 +4,17 @@
  * When configured, G2 "Review Meetings" reads markdown from a COS-style tree:
  *   {operationsDir}/{domain}/meetings/YYYY-MM/*.md
  *
- * Resolution order:
- *   1. COS_OPERATIONS_DIR  — explicit operations/ root (preferred)
- *   2. COS_MEETINGS_ROOT   — alias for the same path
- *   3. COS_SCRIPTS_DIR/..  — classic Starter Kit layout (operations/scripts → operations)
+ * Read resolution accepts COS_MEETINGS_ROOT as a direct YYYY-MM library.
+ * Write/enrichment resolution remains COS_OPERATIONS_DIR, a legacy
+ * multi-domain COS_MEETINGS_ROOT, then COS_SCRIPTS_DIR/...
  *
  * Standalone installs leave all of these unset and keep using MeetingStore
  * (~/.cos-glasses/data/recordings).
  */
 
-import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, statSync } from 'node:fs'
-import { basename, join, resolve } from 'node:path'
+import { closeSync, existsSync, lstatSync, openSync, readdirSync, readFileSync, readSync, realpathSync, statSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { basename, dirname, join, resolve } from 'node:path'
 import { discoveredDomains, domainAbbreviation as deriveAbbr, isSafeDomainName as safeName } from './domains.js'
 import type { MeetingDetail, MeetingMeta } from './meeting-store.js'
 import { MEETING_SOURCE_MAX_BYTES } from './meeting-store.js'
@@ -41,6 +41,103 @@ const DETAIL_CHUNK_ESTIMATE_CHARS = 1700
 
 export type CosOperationsMeetingMeta = MeetingMeta & { time?: string }
 
+export type MeetingLibraryLayout = 'direct' | 'multi_domain' | 'standalone' | 'invalid_explicit_root'
+
+export interface MeetingLibraryInspection {
+  layout: MeetingLibraryLayout
+  root: string | null
+  rootFingerprint: string | null
+  meetingCount: number
+  warnings: string[]
+  domains: string[]
+}
+
+const MONTH_PATTERN = /^\d{4}-(0[1-9]|1[0-2])$/
+const MAX_LIST_CANDIDATES = 2_000
+const MAX_LIST_FILE_BYTES = 100_000
+const MAX_DETAIL_FILE_BYTES = 10 * 1024 * 1024
+
+function rootFingerprint(root: string): string {
+  return createHash('sha256').update(root).digest('hex').slice(0, 16)
+}
+
+function safeRoot(path: string): string | null {
+  try {
+    const stat = lstatSync(path)
+    if (stat.isSymbolicLink() || !stat.isDirectory()) return null
+    return realpathSync(path)
+  } catch { return null }
+}
+
+function safeChildDirectory(parentReal: string, path: string): string | null {
+  try {
+    const stat = lstatSync(path)
+    if (stat.isSymbolicLink() || !stat.isDirectory()) return null
+    const real = realpathSync(path)
+    return dirname(real) === parentReal ? real : null
+  } catch { return null }
+}
+
+function safeRegularFile(parentReal: string, path: string, maxBytes = MAX_LIST_FILE_BYTES): string | null {
+  try {
+    const stat = lstatSync(path)
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size > maxBytes) return null
+    const real = realpathSync(path)
+    if (dirname(real) !== parentReal) return null
+    return readFileSync(real, 'utf8')
+  } catch { return null }
+}
+
+function safeBoundedRegularFile(parentReal: string, path: string, maxReadBytes: number): { content: string; truncated: boolean } | null {
+  let fd: number | null = null
+  try {
+    const stat = lstatSync(path)
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.size > MAX_DETAIL_FILE_BYTES) return null
+    const real = realpathSync(path)
+    if (dirname(real) !== parentReal) return null
+    fd = openSync(real, 'r')
+    const buffer = Buffer.alloc(Math.min(maxReadBytes, stat.size))
+    const read = readSync(fd, buffer, 0, buffer.length, 0)
+    return { content: buffer.subarray(0, read).toString('utf8'), truncated: stat.size > read }
+  } catch { return null }
+  finally {
+    if (fd !== null) { try { closeSync(fd) } catch { /* already closed */ } }
+  }
+}
+
+export function inspectMeetingLibraryPath(path: string): MeetingLibraryInspection {
+  const requested = resolve(path)
+  const root = safeRoot(requested)
+  if (!root) {
+    return { layout: 'invalid_explicit_root', root: null, rootFingerprint: null, meetingCount: 0, warnings: ['folder is missing, unreadable, or unsafe'], domains: [] }
+  }
+  const entries = (() => { try { return readdirSync(root) } catch { return [] } })()
+  const directMonths = entries.filter(name => MONTH_PATTERN.test(name) && safeChildDirectory(root, join(root, name))).sort()
+  const domains = entries.filter(safeName).filter(name => {
+    const domainReal = safeChildDirectory(root, join(root, name))
+    if (!domainReal) return false
+    return safeChildDirectory(domainReal, join(domainReal, 'meetings')) != null
+  }).sort()
+  const warnings: string[] = []
+  if (directMonths.length > 0 && domains.length > 0) {
+    return { layout: 'invalid_explicit_root', root, rootFingerprint: rootFingerprint(root), meetingCount: 0, warnings: ['folder mixes direct months and domain/meetings trees'], domains }
+  }
+  const layout: MeetingLibraryLayout = directMonths.length > 0 ? 'direct' : domains.length > 0 ? 'multi_domain' : 'invalid_explicit_root'
+  if (layout === 'invalid_explicit_root') {
+    const nearMisses = entries.filter(safeName).filter(name => {
+      const child = safeChildDirectory(root, join(root, name))
+      if (!child) return false
+      try {
+        return readdirSync(child).some(entry => MONTH_PATTERN.test(entry) && safeChildDirectory(child, join(child, entry)))
+      } catch { return false }
+    })
+    warnings.push(nearMisses.length > 0
+      ? `missing meetings/ inside: ${nearMisses.slice(0, 6).join(', ')}`
+      : 'expected YYYY-MM folders or <domain>/meetings/YYYY-MM')
+  }
+  return { layout, root, rootFingerprint: rootFingerprint(root), meetingCount: 0, warnings, domains }
+}
+
 /** Enough to clear the sidecar's leading metadata keys whatever their order. */
 const SIDECAR_HEAD_BYTES = 4096
 
@@ -60,8 +157,11 @@ function sidecarSessionId(monthDir: string, meetingFilename: string): string | u
   const path = join(monthDir, sidecarName)
   let fd: number | null = null
   try {
-    const stat = statSync(path)
-    if (!stat.isFile() || stat.size === 0) return undefined
+    const linkStat = lstatSync(path)
+    if (linkStat.isSymbolicLink() || !linkStat.isFile() || linkStat.size === 0) return undefined
+    const real = realpathSync(path)
+    if (dirname(real) !== realpathSync(monthDir)) return undefined
+    const stat = statSync(real)
     fd = openSync(path, 'r')
     const buffer = Buffer.alloc(Math.min(SIDECAR_HEAD_BYTES, stat.size))
     const read = readSync(fd, buffer, 0, buffer.length, 0)
@@ -84,12 +184,17 @@ function envPath(name: string): string | null {
 /** Resolve the COS operations directory, or null in standalone mode.
  * Reads process.env on each call so tests and Control env updates stay live. */
 export function resolveCosOperationsDir(): string | null {
-  const explicit = envPath('COS_OPERATIONS_DIR') || envPath('COS_MEETINGS_ROOT')
-  if (explicit && existsSync(explicit)) return explicit
+  const operations = envPath('COS_OPERATIONS_DIR')
+  if (operations && inspectMeetingLibraryPath(operations).layout === 'multi_domain') return safeRoot(operations)
+  // Backward compatibility: before 6.21.33 COS_MEETINGS_ROOT was documented as
+  // an alias for COS_OPERATIONS_DIR. Preserve that meaning only for a real
+  // multi-domain tree; a direct library is never a write destination.
+  const legacy = envPath('COS_MEETINGS_ROOT')
+  if (legacy && inspectMeetingLibraryPath(legacy).layout === 'multi_domain') return safeRoot(legacy)
   const scriptsDir = envPath('COS_SCRIPTS_DIR')
   if (scriptsDir) {
     const inferred = resolve(scriptsDir, '..')
-    if (existsSync(inferred)) return inferred
+    if (inspectMeetingLibraryPath(inferred).layout === 'multi_domain') return safeRoot(inferred)
   }
   return null
 }
@@ -98,6 +203,19 @@ export function cosOperationsMeetingsConfigured(): boolean {
   return resolveCosOperationsDir() != null
 }
 
+export function resolveMeetingLibrary(): MeetingLibraryInspection {
+  const explicit = envPath('COS_MEETINGS_ROOT')
+  if (explicit) return inspectMeetingLibraryPath(explicit)
+  const operations = resolveCosOperationsDir()
+  if (operations) return inspectMeetingLibraryPath(operations)
+  return { layout: 'standalone', root: null, rootFingerprint: null, meetingCount: 0, warnings: [], domains: [] }
+}
+
+export function meetingLibraryConfigured(): boolean {
+  const layout = resolveMeetingLibrary().layout
+  return layout === 'direct' || layout === 'multi_domain'
+}
+
 function boundedMeetingSource(content: string): { sourceContent: string; sourceTruncated: boolean } {
   const bytes = Buffer.from(content, 'utf8')
   if (bytes.length <= MEETING_SOURCE_MAX_BYTES) return { sourceContent: content, sourceTruncated: false }
@@ -364,6 +482,41 @@ export function findCosOperationsMeetingBySessionId(sessionId: string): {
   return null
 }
 
+export type MeetingLibraryRecord = NonNullable<ReturnType<typeof findCosOperationsMeetingBySessionId>> & {
+  recordId?: string
+  librarySource?: 'direct_library' | 'cos_operations'
+  mutable?: boolean
+}
+
+/** Read resolver for direct libraries. Mutations must require recordId and
+ * mutable=true; the legacy operations resolver above remains writable. */
+export function findDirectLibraryMeetingBySessionId(sessionId: string): MeetingLibraryRecord | null {
+  const inspection = resolveMeetingLibrary()
+  if (inspection.layout !== 'direct' || !inspection.root) return null
+  const root = inspection.root
+  const months = readdirSync(root).filter(name => MONTH_PATTERN.test(name)).sort().reverse()
+  for (const month of months) {
+    const monthDir = safeChildDirectory(root, join(root, month))
+    if (!monthDir) continue
+    for (const sidecarName of readdirSync(monthDir).filter(name => name.endsWith('.g2-chunks.json')).sort().reverse()) {
+      const filename = sidecarName.replace(/\.g2-chunks\.json$/, '.md')
+      if (sidecarSessionId(monthDir, filename) !== sessionId) continue
+      const meetingPath = join(monthDir, filename)
+      const bounded = safeBoundedRegularFile(monthDir, meetingPath, MEETING_SOURCE_MAX_BYTES)
+      if (bounded == null) continue
+      const title = bounded.content.match(/^#\s+(.+)$/m)?.[1]?.trim() || filename.replace(/\.md$/, '')
+      return {
+        sidecarPath: join(monthDir, sidecarName), meetingPath, filename,
+        domain: 'library', month, title,
+        recordId: `direct:${month}:${filename}`,
+        librarySource: 'direct_library',
+        mutable: false,
+      }
+    }
+  }
+  return null
+}
+
 export function listCosOperationsMeetings(options: {
   limit?: number
   domain?: string
@@ -387,7 +540,6 @@ export function listCosOperationsMeetings(options: {
         .filter(d => /^\d{4}-\d{2}$/.test(d))
         .sort()
         .reverse()
-        .slice(0, 3)
 
       for (const month of months) {
         const monthDir = join(meetingsBase, month)
@@ -403,6 +555,10 @@ export function listCosOperationsMeetings(options: {
               const content = readFileSync(filepath, 'utf-8')
               const meta = withMeetingListInsights(parseMeetingMeta(content.slice(0, 4000), file, domain), content)
               meta.month = month
+              meta.librarySource = 'cos_operations'
+              meta.recordId = `ops:${domain}:${month}:${file}`
+              meta.mutable = true
+              meta.canonicalRecord = `operations/${domain}/meetings/${month}/${file}`
               const sessionId = sidecarSessionId(monthDir, file)
               if (sessionId) meta.sessionId = sessionId
               allMeetings.push(meta)
@@ -417,6 +573,35 @@ export function listCosOperationsMeetings(options: {
   return allMeetings.slice(0, limit)
 }
 
+export function listDirectLibraryMeetings(options: { limit?: number } = {}): CosOperationsMeetingMeta[] {
+  const inspection = resolveMeetingLibrary()
+  if (inspection.layout !== 'direct' || !inspection.root) return []
+  const limit = Math.min(Math.max(options.limit ?? 20, 1), 50)
+  const all: CosOperationsMeetingMeta[] = []
+  let candidates = 0
+  for (const month of readdirSync(inspection.root).filter(name => MONTH_PATTERN.test(name)).sort().reverse()) {
+    const monthDir = safeChildDirectory(inspection.root, join(inspection.root, month))
+    if (!monthDir) continue
+    for (const file of readdirSync(monthDir).filter(name => name.endsWith('.md')).sort().reverse()) {
+      if (++candidates > MAX_LIST_CANDIDATES) break
+      const bounded = safeBoundedRegularFile(monthDir, join(monthDir, file), MAX_LIST_FILE_BYTES)
+      if (bounded == null) continue
+      const content = bounded.content
+      const meta = withMeetingListInsights(parseMeetingMeta(content.slice(0, 4000), file, 'library'), content)
+      meta.month = month
+      meta.librarySource = 'direct_library'
+      meta.recordId = `direct:${month}:${file}`
+      meta.mutable = false
+      const sessionId = sidecarSessionId(monthDir, file)
+      if (sessionId) meta.sessionId = sessionId
+      all.push(meta)
+    }
+    if (candidates > MAX_LIST_CANDIDATES) break
+  }
+  all.sort(compareMeetingsNewestFirst)
+  return all.slice(0, limit)
+}
+
 export function getCosOperationsMeetingDetail(
   domain: string,
   month: string,
@@ -473,3 +658,36 @@ export function getCosOperationsMeetingDetail(
     ...source,
   }
 }
+
+export function getDirectLibraryMeetingDetail(month: string, filename: string): MeetingDetail | null {
+  const inspection = resolveMeetingLibrary()
+  if (inspection.layout !== 'direct' || !inspection.root) return null
+  if (!MONTH_PATTERN.test(month) || basename(filename) !== filename || !filename.endsWith('.md')) return null
+  const monthDir = safeChildDirectory(inspection.root, join(inspection.root, month))
+  if (!monthDir) return null
+  let resolvedFilename = filename
+  let bounded = safeBoundedRegularFile(monthDir, join(monthDir, resolvedFilename), MEETING_SOURCE_MAX_BYTES)
+  if (bounded == null) {
+    const candidates = readdirSync(monthDir).filter(name => name.endsWith('.md')).slice(0, MAX_LIST_CANDIDATES)
+      .map(name => ({ filename: name, content: safeRegularFile(monthDir, join(monthDir, name), 4_000) ?? '' }))
+    const renamed = matchRenamedMeetingFilename(filename, candidates)
+    if (!renamed) return null
+    resolvedFilename = renamed
+    bounded = safeBoundedRegularFile(monthDir, join(monthDir, resolvedFilename), MEETING_SOURCE_MAX_BYTES)
+    if (bounded == null) return null
+  }
+  const content = bounded.content
+  const meta = parseMeetingMeta(content, resolvedFilename, 'library')
+  meta.month = month
+  meta.librarySource = 'direct_library'
+  meta.recordId = `direct:${month}:${resolvedFilename}`
+  meta.mutable = false
+  const sessionId = sidecarSessionId(monthDir, resolvedFilename)
+  if (sessionId) meta.sessionId = sessionId
+  const source = { sourceContent: content, sourceTruncated: bounded.truncated }
+  return {
+    ...meta,
+    summary: extractSummary(content), topics: extractTopics(content), decisions: extractDecisions(content),
+    actionItems: extractActionItems(content), attendees: extractAttendees(content), transcript: content, ...source,
+  }
+}

package/server/lib/meeting-store.ts

@@ -52,6 +52,7 @@ export interface MeetingMeta {
   sessionId?: string
   title: string
   date: string
+  time?: string
   domain: string
   domainAbbr: string
   source: string
@@ -64,6 +65,12 @@ export interface MeetingMeta {
   decisionCount?: number
   actionCount?: number
   attendeeCount?: number
+  /** Additive archive identity. Older companions ignore these fields. */
+  librarySource?: 'direct_library' | 'cos_operations' | 'standalone_recordings'
+  recordId?: string
+  mutable?: boolean
+  /** Present only when the server can state a truthful local record. */
+  canonicalRecord?: string
 }
 
 export interface MeetingActionItem {
@@ -437,7 +444,7 @@ export class MeetingStore {
       // When COS ops is configured, use the private-app pipeline markers so
       // sync_meetings.py --g2-file will enrich (and reclassify domain). Plain
       // "Standalone recording" summaries are treated as already-final and skipped.
-      ...(process.env.COS_SCRIPTS_DIR || process.env.COS_OPERATIONS_DIR || process.env.COS_MEETINGS_ROOT
+      ...(process.env.COS_SCRIPTS_DIR
         ? [
             '<!-- g2-needs-domain-review -->',
             '',

package/server/lib/python-bridge.ts

@@ -31,6 +31,10 @@ const BRIDGE_SCRIPT: string | null = COS_SCRIPTS_DIR ? resolve(COS_SCRIPTS_DIR,
 // have these, so callPython() degrades to a no-op.
 const pythonAvailable = !!(COS_SCRIPTS_DIR && existsSync(PYTHON_BIN!) && existsSync(BRIDGE_SCRIPT!))
 
+export function pythonBridgeAvailable(): boolean {
+  return pythonAvailable
+}
+
 if (pythonAvailable) {
   console.log('[python-bridge] COS pipeline detected — sourcing live context')
 } else if (COS_SCRIPTS_DIR) {
@@ -54,8 +58,17 @@ function standaloneNoop(args: string[]): unknown {
   switch (args[0]) {
     case 'calendar': return { events: [] }
     case 'tasks': return {}
-    case 'threads': return []
+    case 'threads': return { threads: [], active_count: 0, stale_count: 0, resolved_count: 0 }
+    case 'thread-detail': return { error: 'cos_pipeline_not_configured' }
     case 'memory': return []
+    case 'memory-overview': return {
+      available: false,
+      collection: 'cos_memory',
+      total: 0,
+      by_type: {},
+      reason: 'cos_pipeline_not_configured',
+    }
+    case 'memory-detail': return { error: 'cos_pipeline_not_configured' }
     case 'badges': return {}
     default: return {}
   }

package/server/routes/health.ts

@@ -47,6 +47,7 @@ import { getHealthStaticProbes } from '../lib/health-static-probes.js'
 import { getEarlyMeetingSyncSnapshot } from '../lib/g2-ops-handoff.js'
 import { getProgressiveHqSnapshot } from '../lib/meeting-batch-transcribe.js'
 import { getMeetingFinalizationSnapshot } from '../lib/meeting-finalization-jobs.js'
+import { resolveMeetingLibrary } from '../lib/cos-operations-meetings.js'
 
 export const healthRouter = Router()
 
@@ -234,6 +235,7 @@ healthRouter.get('/health', async (_req, res) => {
       recovered: item.recovered,
     })),
   }
+  const meetingLibrary = resolveMeetingLibrary()
   res.json({
     ...checks,
     server_version: managedServerVersion(),
@@ -249,6 +251,11 @@ healthRouter.get('/health', async (_req, res) => {
     codex_models,
     cursor_models,
     meeting_sync,
+    meeting_library: {
+      layout: meetingLibrary.layout,
+      ready: meetingLibrary.layout !== 'invalid_explicit_root',
+      warningCount: meetingLibrary.warnings.length,
+    },
     unsaved_captures,
     chunk_embeddings: chunkEmbeddings,
     speaker_corrections: speakerCorrections,

package/server/routes/meeting.ts

@@ -112,6 +112,7 @@ import {
 import { getServerInstanceId } from '../lib/server-instance-id.js'
 import {
   cosOperationsMeetingsConfigured,
+  findDirectLibraryMeetingBySessionId,
   findCosOperationsMeetingBySessionId,
   resolveCosOperationsDir,
 } from '../lib/cos-operations-meetings.js'
@@ -156,6 +157,10 @@ function cosOpsPipelineConfigured(): boolean {
   return Boolean(process.env.COS_SCRIPTS_DIR?.trim())
 }
 
+function requestedRecordMatches(requested: unknown, expected: string): boolean {
+  return requested == null || requested === '' || requested === expected
+}
+
 interface MeetingSessionSource {
   getTranscript(sessionId: string): string | null
   getStartTime(sessionId: string): number | null
@@ -712,15 +717,16 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     const operations = cosOperationsMeetingsConfigured()
       ? findCosOperationsMeetingBySessionId(sessionId)
       : null
-    const saved = operations ? null : store.findBySessionId(sessionId)
-    if (!operations && !saved) {
+    const direct = operations ? null : findDirectLibraryMeetingBySessionId(sessionId)
+    const saved = operations || direct ? null : store.findBySessionId(sessionId)
+    if (!operations && !direct && !saved) {
       res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
       return
     }
-    const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
-    const title = operations?.title ?? saved!.title
-    const domain = operations?.domain ?? saved!.domain
-    const filename = operations?.filename ?? saved!.filename
+    const sidecarPath = operations?.sidecarPath ?? direct?.sidecarPath ?? saved!.sidecarPath
+    const title = operations?.title ?? direct?.title ?? saved!.title
+    const domain = operations?.domain ?? direct?.domain ?? saved!.domain
+    const filename = operations?.filename ?? direct?.filename ?? saved!.filename
 
     let chunks: unknown
     try {
@@ -770,7 +776,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       title,
       domain,
       filename,
-      source: operations ? 'cos_operations' : 'standalone_recordings',
+      source: operations ? 'cos_operations' : direct ? 'direct_library' : 'standalone_recordings',
+      recordId: operations
+        ? `ops:${operations.domain}:${operations.month}:${operations.filename}`
+        : direct?.recordId ?? `standalone:${sessionId}`,
+      mutable: direct == null,
       ...(saved ? { durationMin: saved.durationMin } : {}),
       ...review,
     })
@@ -812,14 +822,15 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     const operations = cosOperationsMeetingsConfigured()
       ? findCosOperationsMeetingBySessionId(sessionId)
       : null
-    const saved = operations ? null : store.findBySessionId(sessionId)
-    if (!operations && !saved) {
+    const direct = operations ? null : findDirectLibraryMeetingBySessionId(sessionId)
+    const saved = operations || direct ? null : store.findBySessionId(sessionId)
+    if (!operations && !direct && !saved) {
       res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
       return
     }
-    const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
-    const title = operations?.title ?? saved!.title
-    const mdPath = operations?.meetingPath ?? sidecarPath.replace(/\.g2-chunks\.json$/, '.md')
+    const sidecarPath = operations?.sidecarPath ?? direct?.sidecarPath ?? saved!.sidecarPath
+    const title = operations?.title ?? direct?.title ?? saved!.title
+    const mdPath = operations?.meetingPath ?? direct?.meetingPath ?? sidecarPath.replace(/\.g2-chunks\.json$/, '.md')
 
     let sidecar: Record<string, unknown>
     try {
@@ -909,7 +920,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // Which business this is. The sibling /speakers route has always carried
       // this and this one dropped it, so a personal 1:1 about someone's
       // compensation was byte-identical to a marketing sync.
-      domain: operations?.domain ?? saved?.domain ?? '',
+      domain: operations?.domain ?? direct?.domain ?? saved?.domain ?? '',
       // Transcript actually captured, whether or not a write-up exists yet. 140
       // of 399 real sidecars have no .md, and the fallback text claimed there was
       // no transcript while holding one.
@@ -943,6 +954,11 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // no write-up yet.
       capturedChars: clip.capturedChars,
       domain: clip.domain,
+      source: operations ? 'cos_operations' : direct ? 'direct_library' : 'standalone_recordings',
+      recordId: operations
+        ? `ops:${operations.domain}:${operations.month}:${operations.filename}`
+        : direct?.recordId ?? `standalone:${sessionId}`,
+      mutable: direct == null,
       // So the panel can warn above the write-up, not just the clipboard.
       removedNames: clip.removed,
       coverage,
@@ -990,11 +1006,32 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     const operations = cosOperationsMeetingsConfigured()
       ? findCosOperationsMeetingBySessionId(sessionId)
       : null
+    const direct = operations ? null : findDirectLibraryMeetingBySessionId(sessionId)
+    if (direct) {
+      if (!requestedRecordMatches(req.body?.recordId, direct.recordId || '')) {
+        res.status(409).json({ error: 'Meeting source changed; reopen the meeting', reason: 'record_source_mismatch' })
+        return
+      }
+      res.status(409).json({
+        error: 'This meeting comes from a read-only library',
+        reason: 'direct_library_read_only',
+        recordId: direct.recordId,
+        mutable: false,
+      })
+      return
+    }
     const saved = operations ? null : store.findBySessionId(sessionId)
     if (!operations && !saved) {
       res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
       return
     }
+    const selectedRecordId = operations
+      ? `ops:${operations.domain}:${operations.month}:${operations.filename}`
+      : `standalone:${sessionId}`
+    if (!requestedRecordMatches(req.body?.recordId, selectedRecordId)) {
+      res.status(409).json({ error: 'Meeting source changed; reopen the meeting', reason: 'record_source_mismatch' })
+      return
+    }
     const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
     const meetingPath = operations?.meetingPath ?? saved!.filepath
     const title = operations?.title ?? saved!.title
@@ -1164,11 +1201,32 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     const operations = cosOperationsMeetingsConfigured()
       ? findCosOperationsMeetingBySessionId(sessionId)
       : null
+    const direct = operations ? null : findDirectLibraryMeetingBySessionId(sessionId)
+    if (direct) {
+      if (!requestedRecordMatches(req.body?.recordId, direct.recordId || '')) {
+        res.status(409).json({ error: 'Meeting source changed; reopen the meeting', reason: 'record_source_mismatch' })
+        return
+      }
+      res.status(409).json({
+        error: 'This meeting comes from a read-only library',
+        reason: 'direct_library_read_only',
+        recordId: direct.recordId,
+        mutable: false,
+      })
+      return
+    }
     const saved = operations ? null : store.findBySessionId(sessionId)
     if (!operations && !saved) {
       res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
       return
     }
+    const selectedRecordId = operations
+      ? `ops:${operations.domain}:${operations.month}:${operations.filename}`
+      : `standalone:${sessionId}`
+    if (!requestedRecordMatches(req.body?.recordId, selectedRecordId)) {
+      res.status(409).json({ error: 'Meeting source changed; reopen the meeting', reason: 'record_source_mismatch' })
+      return
+    }
     const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
 
     // Refuse to confirm a label the meeting does not actually carry. Otherwise
@@ -1242,11 +1300,32 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
     const operations = cosOperationsMeetingsConfigured()
       ? findCosOperationsMeetingBySessionId(sessionId)
       : null
+    const direct = operations ? null : findDirectLibraryMeetingBySessionId(sessionId)
+    if (direct) {
+      if (!requestedRecordMatches(req.body?.recordId, direct.recordId || '')) {
+        res.status(409).json({ error: 'Meeting source changed; reopen the meeting', reason: 'record_source_mismatch' })
+        return
+      }
+      res.status(409).json({
+        error: 'This meeting comes from a read-only library',
+        reason: 'direct_library_read_only',
+        recordId: direct.recordId,
+        mutable: false,
+      })
+      return
+    }
     const saved = operations ? null : store.findBySessionId(sessionId)
     if (!operations && !saved) {
       res.status(404).json({ error: 'No saved meeting for this session', reason: 'meeting_not_found' })
       return
     }
+    const selectedRecordId = operations
+      ? `ops:${operations.domain}:${operations.month}:${operations.filename}`
+      : `standalone:${sessionId}`
+    if (!requestedRecordMatches(req.body?.recordId, selectedRecordId)) {
+      res.status(409).json({ error: 'Meeting source changed; reopen the meeting', reason: 'record_source_mismatch' })
+      return
+    }
     const sidecarPath = operations?.sidecarPath ?? saved!.sidecarPath
     const meetingPath = operations?.meetingPath ?? saved!.filepath
     const title = operations?.title ?? saved!.title

package/server/routes/meetings.ts

@@ -4,10 +4,44 @@ import { Router } from 'express'
 import { getMeetingStore, MeetingStore, MeetingStoreError } from '../lib/meeting-store.js'
 import {
   cosOperationsMeetingsConfigured,
+  getDirectLibraryMeetingDetail,
   getCosOperationsMeetingDetail,
+  listDirectLibraryMeetings,
   listCosOperationsMeetings,
-  resolveCosOperationsDir,
+  resolveMeetingLibrary,
 } from '../lib/cos-operations-meetings.js'
+import type { MeetingMeta } from '../lib/meeting-store.js'
+
+function withStandaloneIdentity(meeting: MeetingMeta): MeetingMeta {
+  return {
+    ...meeting,
+    librarySource: 'standalone_recordings',
+    recordId: `standalone:${meeting.sessionId || `${meeting.domain}:${meeting.month}:${meeting.filename}`}`,
+    mutable: true,
+  }
+}
+
+function mergeMeetingSources(groups: MeetingMeta[][], limit: number): MeetingMeta[] {
+  const seenSessions = new Set<string>()
+  const seenExact = new Set<string>()
+  const merged: MeetingMeta[] = []
+  for (const group of groups) {
+    for (const meeting of group) {
+      if (meeting.sessionId) {
+        if (seenSessions.has(meeting.sessionId)) continue
+        seenSessions.add(meeting.sessionId)
+      } else {
+        const exact = `${meeting.librarySource || ''}:${meeting.domain}:${meeting.month}:${meeting.filename}`
+        if (seenExact.has(exact)) continue
+        seenExact.add(exact)
+      }
+      merged.push(meeting)
+    }
+  }
+  merged.sort((a, b) => `${b.date}T${b.time || '00:00'}`.localeCompare(`${a.date}T${a.time || '00:00'}`)
+    || b.filename.localeCompare(a.filename))
+  return merged.slice(0, Math.min(Math.max(limit, 1), 50))
+}
 
 export function createMeetingsRouter(store: MeetingStore = getMeetingStore()): Router {
   const router = Router()
@@ -20,17 +54,54 @@ export function createMeetingsRouter(store: MeetingStore = getMeetingStore()): R
       const domain = typeof req.query.domain === 'string' ? req.query.domain : 'all'
       res.set('Cache-Control', 'private, no-store')
 
-      if (cosOperationsMeetingsConfigured()) {
+      const library = resolveMeetingLibrary()
+      if (library.layout === 'invalid_explicit_root') {
+        res.status(409).json({
+          error: 'Configured meetings library is unavailable or malformed',
+          reason: 'invalid_explicit_root',
+          layout: library.layout,
+          warnings: library.warnings,
+        })
+        return
+      }
+
+      if (library.layout === 'direct') {
+        const operations = cosOperationsMeetingsConfigured()
+          ? listCosOperationsMeetings({ limit: 50, domain })
+          : []
+        const direct = domain === 'all' || domain === 'library'
+          ? listDirectLibraryMeetings({ limit: 50 })
+          : []
+        const standalone = store.list({ limit: 50, domain }).map(withStandaloneIdentity)
+        const meetings = mergeMeetingSources([operations, direct, standalone], limit)
+        res.json({
+          meetings,
+          source: operations.length > 0 ? 'mixed_library' : 'direct_library',
+          layout: 'direct',
+          root: library.root,
+          rootFingerprint: library.rootFingerprint,
+          meetingCount: meetings.length,
+          warnings: library.warnings,
+        })
+        return
+      }
+
+      if (library.layout === 'multi_domain') {
         const meetings = listCosOperationsMeetings({ limit, domain })
         res.json({
           meetings,
           source: 'cos_operations',
-          operationsDir: resolveCosOperationsDir(),
+          layout: 'multi_domain',
+          root: library.root,
+          rootFingerprint: library.rootFingerprint,
+          meetingCount: meetings.length,
+          warnings: library.warnings,
         })
         return
       }
 
-      res.json({ meetings: store.list({ limit, domain }), source: 'standalone_recordings' })
+      const meetings = store.list({ limit, domain }).map(withStandaloneIdentity)
+      res.json({ meetings, source: 'standalone_recordings', layout: 'standalone', meetingCount: meetings.length })
     } catch (error) {
       sendMeetingStoreError(res, error)
     }
@@ -49,6 +120,14 @@ export function createMeetingsRouter(store: MeetingStore = getMeetingStore()): R
       }
       res.set('Cache-Control', 'private, no-store')
 
+      if (domain === 'library') {
+        const detail = getDirectLibraryMeetingDetail(month, filename)
+        if (detail) {
+          res.json(detail)
+          return
+        }
+      }
+
       if (cosOperationsMeetingsConfigured()) {
         const detail = getCosOperationsMeetingDetail(domain, month, filename)
         if (detail) {
@@ -71,6 +150,14 @@ export function createMeetingsRouter(store: MeetingStore = getMeetingStore()): R
     try {
       res.set('Cache-Control', 'private, no-store')
 
+      if (req.params.domain === 'library') {
+        const detail = getDirectLibraryMeetingDetail(req.params.month, req.params.filename)
+        if (detail) {
+          res.json(detail)
+          return
+        }
+      }
+
       if (cosOperationsMeetingsConfigured()) {
         const detail = getCosOperationsMeetingDetail(
           req.params.domain,

package/server/routes/memory.ts

@@ -0,0 +1,65 @@
+import { Router } from 'express'
+import { callPython } from '../lib/python-bridge.js'
+import {
+  MEMORY_ID_PATTERN,
+  normalizeMemoryDetail,
+  normalizeMemoryList,
+  normalizeMemoryOverview,
+} from '../lib/cos-context-browser.js'
+
+export const memoryRouter = Router()
+
+function boundedInteger(value: unknown, fallback: number, min: number, max: number): number {
+  const parsed = Number(value)
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.max(min, Math.min(max, Math.trunc(parsed)))
+}
+
+memoryRouter.get('/memory/overview', async (_req, res) => {
+  try {
+    const data = await callPython(['memory-overview'])
+    res.json(normalizeMemoryOverview(data))
+  } catch (error) {
+    res.status(503).json({
+      available: false,
+      collection: 'cos_memory',
+      total: 0,
+      by_type: {},
+      reason: 'memory_bridge_unavailable',
+    })
+  }
+})
+
+memoryRouter.get('/memory/:id', async (req, res) => {
+  if (!MEMORY_ID_PATTERN.test(req.params.id)) {
+    res.status(400).json({ error: 'invalid_memory_id' })
+    return
+  }
+  try {
+    const data = await callPython(['memory-detail', req.params.id])
+    if (data && typeof data === 'object' && 'error' in data) {
+      res.status(404).json({ error: 'memory_not_found' })
+      return
+    }
+    const memory = normalizeMemoryDetail(data)
+    if (!memory) {
+      res.status(404).json({ error: 'memory_not_found' })
+      return
+    }
+    res.json(memory)
+  } catch {
+    res.status(503).json({ error: 'memory_unavailable' })
+  }
+})
+
+memoryRouter.get('/memory', async (req, res) => {
+  const days = boundedInteger(req.query.days, 30, 1, 3650)
+  const limit = boundedInteger(req.query.limit, 20, 1, 50)
+  try {
+    const data = await callPython(['memory', '--days', String(days), '--limit', String(limit)])
+    // Preserve the legacy top-level array used by released companions.
+    res.json(normalizeMemoryList(data, limit))
+  } catch {
+    res.json([])
+  }
+})

package/server/routes/threads.ts

@@ -0,0 +1,38 @@
+import { Router } from 'express'
+import { callPython } from '../lib/python-bridge.js'
+import { THREAD_ID_PATTERN, normalizeThreadDetail, normalizeThreads } from '../lib/cos-context-browser.js'
+
+export const threadsRouter = Router()
+
+threadsRouter.get('/threads/:id', async (req, res) => {
+  if (!THREAD_ID_PATTERN.test(req.params.id)) {
+    res.status(400).json({ error: 'invalid_thread_id' })
+    return
+  }
+  try {
+    const data = await callPython(['thread-detail', req.params.id])
+    if (data && typeof data === 'object' && 'error' in data) {
+      res.status(404).json({ error: 'thread_not_found' })
+      return
+    }
+    const thread = normalizeThreadDetail(data)
+    if (!thread) {
+      res.status(404).json({ error: 'thread_not_found' })
+      return
+    }
+    res.json(thread)
+  } catch {
+    res.status(503).json({ error: 'threads_unavailable' })
+  }
+})
+
+threadsRouter.get('/threads', async (req, res) => {
+  const parsed = Number(req.query.limit)
+  const limit = Number.isFinite(parsed) ? Math.max(1, Math.min(50, Math.trunc(parsed))) : 30
+  try {
+    const data = await callPython(['threads'])
+    res.json(normalizeThreads(data, limit))
+  } catch {
+    res.json(normalizeThreads({}, limit))
+  }
+})