@gotcos/glasses-server 6.31.0 → 6.34.0

package/CHANGELOG.md

@@ -2219,6 +2219,96 @@ unsaved capture, and makes batch status stop lying about finished work.
 
 # Changelog
 
+## [6.34.0] - 2026-08-16
+
+### A continued turn now runs with the session's own permissions
+
+- **This widens what Continue can do.** A prompt spoken into the glasses can run
+  tools on the Mac with nobody at the keyboard. Authorized explicitly by Miles
+  after his first real continued turn came back reporting that every tool was
+  disabled, which is not the point of the feature.
+- Claude drops `--permission-mode plan` and the empty `--tools`/`--allowedTools`
+  pair. Codex now uses `getCodexTrustMode()`, the same posture ordinary Codex runs
+  use on the host, rather than a stricter one invented at this call site. Absent
+  `COS_CODEX_SANDBOX=workspace-write` that is still read-only, so this is never
+  more permissive than the rest of the server.
+- **Unchanged, and load-bearing:** `COS_THREAD_ATTACH_ENABLED` still gates the
+  surface and off still leaves the routes unregistered; `findBannedPermissionArg`
+  still rejects every real bypass at the spawn boundary; delivery is still gated
+  on a fresh occupancy probe, the epoch floor, the per-target claim and the head
+  watermark. Dropping a lockdown is not adding a bypass.
+- The old read-only posture had NO test asserting it was present, so it could have
+  been deleted silently. The new posture is pinned, and so is the bypass ban.
+
+## [6.33.0] - 2026-08-16
+
+### One switch turns Continue on
+
+Continue was gated by two environment variables, and the second one was
+invisible. `COS_THREAD_ATTACH_ENABLED=1` registered the write routes;
+`COS_THREAD_ATTACH_IDLE_HOLDER=1` was additionally needed before COS would write
+into a thread whose Mac window is open but idle. COS Control's "Continue agent
+threads" checkbox sets only the first, so health reported the feature ON while
+every single attempt was refused, because a developer's editor windows stay
+open and that is precisely the case the second flag covered.
+
+- **`COS_THREAD_ATTACH_ENABLED=1` is now the whole answer.** It registers the two
+  write routes and wires the transcript clock that tells an idle holder from a
+  working one. Nothing else to set.
+- **`COS_THREAD_ATTACH_IDLE_HOLDER` is REMOVED, not deprecated.** If you set it
+  by hand, it is now ignored and can be deleted from your LaunchAgent plist or
+  shell profile. Leaving it in place changes nothing either way.
+- **COS Control needs no update for this.** Its existing checkbox already writes
+  the surviving key, so the toggle that reported ON while refusing now reports
+  ON and works.
+
+The two switches were never independently useful, and folding them is the honest
+description of the decision rather than a convenience. The relaxation is what
+makes a silent fork possible, so "Continue is on" and "a fork may happen" are one
+choice, and one switch states it.
+
+Every safety behaviour is unchanged. A holder measured WRITING is still refused
+with `native_thread_working`; a holder COS cannot measure is still refused with
+`live_desktop_process`, because only a positive idle observation relaxes the gate
+and an unreadable transcript is not one. Off still means the write routes are not
+registered at all, so a disabled server answers 404 rather than 403 and holds no
+reachable write code.
+
+## [6.32.0] - 2026-08-16
+
+### Continue now blocks on WORKING, not on merely open
+
+Continuing a Claude Code thread from COS used to be refused whenever any foreign
+process held it. That came from `~/.claude/sessions/<pid>.json`, which records an
+OPEN WINDOW, not an agent generating: a session that finished ten minutes ago
+with the window still up looked identical to one mid-turn. Anyone who leaves
+Claude Code windows open was therefore refused on exactly the threads they work
+in, and allowed only on the ones they had abandoned.
+
+- A foreign holder is now terminal only while it is **demonstrably writing**. A
+  holder measured idle (registry record alive, transcript stale past the same
+  30s window `running_active` uses) is continuable.
+- New refusal reason **`native_thread_working`**, distinct from
+  `live_desktop_process`, because the two ask for different things. Working
+  clears itself in seconds and the copy says to wait; `live_desktop_process` now
+  means COS could not measure the thread at all and says so rather than implying
+  the thread is busy.
+- Off by default behind **`COS_THREAD_ATTACH_IDLE_HOLDER=1`**. Unset, no
+  transcript clock is wired, every foreign holder reads unknown, and the gate
+  behaves exactly as it did in 6.31.0. Composes with `COS_THREAD_ATTACH_ENABLED`.
+
+Verified against a real interactive `claude` 2.1.229 held open and idle before
+the gate was touched. Writing into it delivers normally and never corrupts:
+across six injections and six desktop turns, including three writers landing
+within 45ms of each other, every transcript prefix stayed byte-identical, with
+no unparseable lines and no dangling parent references. What it DOES do is fork
+the conversation: the holder's in-memory view is stale, so its next turn branches
+off the pre-injection tail and the two writers stop seeing each other. Nothing is
+lost, and the divergence is caught one layer up by the head watermark, which
+changes on a desktop write and refuses the next COS turn with
+`native_thread_changed`. The full canary, including what it does NOT license, is
+recorded in `server/lib/thread-occupancy.ts` under THE IDLE-HOLDER RELAXATION.
+
 ## [6.31.0] - 2026-08-16
 
 ### "Running" meant an open window, not a working agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.31.0",
+  "version": "6.34.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -20,10 +20,13 @@ import { transcribeRouter } from './routes/transcribe.js'
 import { sessionIndexRouter } from './routes/session-index.js'
 import { agentSessionsRouter } from './routes/agent-sessions.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
-import { createAgentSessionBindingsRouter } from './routes/agent-session-bindings.js'
+import {
+  createAgentSessionBindingsRouter,
+  threadAttachEnabled,
+} from './routes/agent-session-bindings.js'
 import { AgentSessionBindingRegistry } from './lib/agent-session-binding-registry.js'
 import { cosSpawnedPids } from './lib/agent-session-ownership-store.js'
-import { realOccupancyDirs, realOccupancyProbes } from './lib/occupancy-probes.js'
+import { buildOccupancyProbes, realOccupancyDirs } from './lib/occupancy-probes.js'
 import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
 import { deliverAttachedTurn, realAttachedTurnDeps } from './lib/attached-provider-adapter.js'
 import { forkThread, realForkDeps } from './lib/fork-thread.js'
@@ -301,10 +304,33 @@ bindingReapTimer.unref()
 
 // Built once. Each of these reads the disk, so sharing them keeps an attach from
 // re-deriving roots per request.
-const occupancyProbes = realOccupancyProbes(cosSpawnedPids)
 const occupancyDirs = realOccupancyDirs()
 const nativeHeadDeps = realNativeHeadDeps()
 const attachedWorkspaceDeps = realAttachedWorkspaceDeps(nativeHeadDeps)
+/**
+ * THE ONE PLACE the idle-holder relaxation is switched on, on the ONE flag
+ * that also registers the write routes (6.33.0).
+ *
+ * Without the clock, a foreign holder is terminal and Continue is refused for
+ * any thread with a Claude Code window open on it — including the ones Miles
+ * actually works in, because he leaves those windows open. With it, a holder
+ * measured idle is continuable and only a holder measured WRITING is refused.
+ *
+ * `threadAttachEnabled()` is the same call `createAgentSessionBindingsRouter`
+ * makes below to decide whether the two POST routes exist at all. Reading it
+ * here rather than a second env key is what makes "Continue is on" a single
+ * answer: the pair of flags this replaced could disagree, and did, reporting
+ * the feature enabled while every attempt was refused.
+ *
+ * Both gates read this same object — the route's detector via `probes` below,
+ * and the adapter's pre-spawn preflight via `occupancyProbes` at the closure
+ * further down — so they cannot come to different conclusions. That is the whole
+ * reason the clock is a probe rather than a check bolted onto each call site.
+ *
+ * Read the canary evidence in `thread-occupancy.ts` under THE IDLE-HOLDER
+ * RELAXATION before changing this line.
+ */
+const occupancyProbes = buildOccupancyProbes(cosSpawnedPids, nativeHeadDeps, threadAttachEnabled())
 
 /**
  * The shim between the route's request shape and the adapter's.

package/server/lib/attached-provider-adapter.ts

@@ -93,6 +93,7 @@ import { isValidNativeThreadId } from './native-thread-id.js'
 import { isBindableProvider, type BindableProvider } from './agent-session-binding-store.js'
 import { recordCosSpawn, releaseCosSpawn } from './agent-session-ownership-store.js'
 import { processStartMs as realProcessStartMs } from './occupancy-probes.js'
+import { getCodexTrustMode } from './codex-run-ledger.js'
 
 /** Providers with a certified attached path. Cursor is Fork-only (plan 2.5). */
 export type AttachedProvider = BindableProvider
@@ -529,17 +530,35 @@ const STRIPPED_ENV_KEYS: readonly string[] = ['CLAUDECODE', 'COS_API_TOKEN']
 // ---------------------------------------------------------------------------
 
 /**
- * Claude: `claude -p --resume <id>`, read-only, prompt on stdin.
+ * Claude: `claude -p --resume <id>`, prompt on stdin.
  *
  * The prompt is NOT an argv element. argv is world-readable through `ps`, and
  * the prompt is the user's private text; stdin also matches what both ordinary
  * bridges already do.
  *
- * Two independent read-only layers, because either alone is one assumption
- * deep: `--permission-mode plan` means the model cannot mutate regardless of
- * its tool list, and the empty `--tools`/`--allowedTools` pair is the exact
- * text-only posture `claude-permissions.ts` already ships for untrusted mode.
- * If an older CLI rejects `plan`, it exits non-zero and we fail closed.
+ * THE TURN INHERITS THE SESSION'S OWN PERMISSIONS (Miles, 2026-08-16, explicit).
+ *
+ * This used to force two independent read-only layers: `--permission-mode plan`
+ * plus an empty `--tools`/`--allowedTools` pair. The result was a Continue that
+ * could talk into a thread and do nothing in it -- his first real continued turn
+ * came back reporting that every tool was disabled, which is not "like being at
+ * the desk". Both layers are gone; a resumed turn now runs as that session
+ * ordinarily would.
+ *
+ * What that means plainly: a prompt spoken into a pair of glasses can run tools
+ * on this Mac with nobody at the keyboard. That is the intent, not an oversight.
+ * The protections that remain, and that must not be quietly removed with it:
+ *
+ *   1. `COS_THREAD_ATTACH_ENABLED` still gates the whole surface, and off means
+ *      the write routes are never registered.
+ *   2. `findBannedPermissionArg` still runs at the spawn boundary and still
+ *      rejects the actual bypasses -- `--dangerously-skip-permissions`, `--yolo`,
+ *      `danger-full-access` and the rest. Dropping a lockdown is not the same as
+ *      adding a bypass, and the bypass ban is unchanged.
+ *   3. The menu cursor rests on a row that cannot act, so a false-positive ring
+ *      tap cannot reach Continue (`defaultSessionThreadActionIndex`).
+ *   4. Delivery is still gated on a fresh occupancy probe, the epoch floor, the
+ *      per-target claim and the head watermark.
  */
 export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
   return [
@@ -549,9 +568,6 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
     // never observe the session id we are required to verify.
     '--verbose',
     '--resume', nativeThreadId,
-    '--permission-mode', 'plan',
-    '--tools', '',
-    '--allowedTools', '',
   ]
 }
 
@@ -571,7 +587,10 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
 export function buildCodexAttachedArgs(nativeThreadId: string, cwd: string): string[] {
   return [
     'exec',
-    '--sandbox', 'read-only',
+    // The posture ordinary Codex runs use on this host, not a stricter one
+    // invented here. `COS_CODEX_SANDBOX=workspace-write` opts in; absent stays
+    // read-only, so this is never MORE permissive than the rest of the server.
+    '--sandbox', getCodexTrustMode(),
     '--cd', cwd,
     'resume',
     '--json',

package/server/lib/occupancy-probes.ts

@@ -49,6 +49,7 @@ import {
 import { homedir } from 'node:os'
 import { basename, join, resolve } from 'node:path'
 import { NATIVE_THREAD_ID_RE } from './native-thread-id.js'
+import { transcriptPathFor, type NativeHeadDeps } from './native-head.js'
 import { parseProcStartUtcMs, type OccupancyDirs, type OccupancyProbes } from './thread-occupancy.js'
 
 // Re-exported rather than reimplemented. `claudeSessionsDir` already encodes the
@@ -440,5 +441,79 @@ export function realOccupancyProbes(ledger: SpawnLedgerAccessor): OccupancyProbe
     readFile,
     lockHolders,
     cosSpawnedPids: () => sanitizeLedger(ledger()),
+    // transcriptMtimeMs is DELIBERATELY absent here. See `withTranscriptClock`.
+  }
+}
+
+/**
+ * The probe set this install should run, clock and all.
+ *
+ * ONE DECISION, IN ONE PLACE (6.33.0). `attachEnabled` is the SAME answer that
+ * decides whether the two write routes get registered — `threadAttachEnabled()`,
+ * passed in by the composition root rather than re-read here. There is exactly
+ * one reader of `COS_THREAD_ATTACH_ENABLED` in the server, and a second copy is
+ * how a surface comes to advertise a write path the gate will refuse.
+ *
+ * WHY THE CLOCK RIDES THE SAME SWITCH. In 6.32.0 the relaxation had a second
+ * env key of its own (named in the 6.33.0 changelog entry; it is now ignored),
+ * and the two were never independently useful: without the clock, Continue is
+ * refused on every thread with an editor window open, which for a working
+ * developer is all of them. The pair also cost a real testing cycle, because
+ * COS Control's checkbox knew only the first key and reported the feature ON
+ * while the gate still refused every session. And the honest reading is that
+ * they were always ONE decision: the relaxation is what makes a silent fork
+ * possible, so "Continue is on" and "fork is possible" are the same choice, and
+ * one switch says so.
+ *
+ * Attach off is still byte-for-byte the pre-6.28 posture: no clock, so every
+ * foreign holder reads `unknown` and refuses, and the write routes do not exist
+ * to be reached anyway.
+ */
+export function buildOccupancyProbes(
+  ledger: SpawnLedgerAccessor,
+  headDeps: NativeHeadDeps,
+  attachEnabled: boolean,
+): OccupancyProbes {
+  const base = realOccupancyProbes(ledger)
+  // Strictly `=== true`. A caller that hands over a truthy non-boolean has not
+  // answered the question, and the permissive branch is the one that must be
+  // earned by a real yes.
+  return attachEnabled === true ? withTranscriptClock(base, headDeps) : base
+}
+
+/**
+ * Add a transcript clock to a probe set, so an idle foreign holder can be told
+ * apart from a working one.
+ *
+ * WHY THIS IS A SEPARATE WRAPPER rather than a member of `realOccupancyProbes`:
+ * the strict gate has to be what you get by DEFAULT. A probe set built the
+ * ordinary way has no clock, every foreign holder reads `unknown`, and
+ * `threadOccupancy` refuses exactly as it did before 6.32.0. Turning the
+ * relaxation on is then one visible call at one wiring site, and turning it off
+ * is deleting that call — no rollback, no second code path to keep in step.
+ *
+ * Null on every failure: an unresolvable id, a missing file, a stat that threw.
+ * `holderActivity` reads null as `unknown`, which refuses. There is deliberately
+ * no path from "could not read the transcript" to "the holder is idle".
+ *
+ * `statSync` and not `stat`: `OccupancyProbes` is synchronous throughout, and the
+ * adapter's pre-spawn preflight REFUSES a thenable rather than awaiting one —
+ * awaiting there would reopen the very race the check exists to close.
+ */
+export function withTranscriptClock(
+  probes: OccupancyProbes,
+  headDeps: NativeHeadDeps,
+): OccupancyProbes {
+  return {
+    ...probes,
+    transcriptMtimeMs: (provider, threadId) => {
+      try {
+        const path = transcriptPathFor(provider, threadId, headDeps)
+        if (path === null) return null
+        return statSync(path).mtimeMs
+      } catch {
+        return null
+      }
+    },
   }
 }

package/server/lib/occupied-threads.ts

@@ -32,6 +32,7 @@ import {
   claudeOwners,
   codexLockPath,
   codexOwners,
+  isActiveRecently,
   type OccupancyDirs,
   type OccupancyProbes,
   type ThreadOwner,
@@ -210,49 +211,19 @@ export function noOccupancyKnown(): OccupiedScan {
 }
 
 /**
- * How recently the transcript must have been written for a held thread to read
- * as WORKING rather than merely OPEN.
+ * The freshness window and the raw reading now live in `thread-occupancy.ts`.
  *
- * WHY A SECOND SIGNAL EXISTS AT ALL. `owners` answers "a process holds this
- * thread", which is not the question the user is asking when he looks at the
- * lens. He watched a session finish on his Mac while the glasses still showed it
- * active, because the window was still open and the registry record therefore
- * still existed. Occupancy has no clock in it; the transcript does.
+ * MOVED, not duplicated (6.32.0). The write gate needs the same window this
+ * hint uses, and it is the lower module, so keeping a second copy here would be
+ * two definitions of "recently" that could drift. Re-exported so every existing
+ * importer of these two names is unaffected.
  *
- * MEASURED, not assumed: while a session generates, its jsonl mtime tracks the
- * wall clock to within a second, and when generation stops the mtime goes stale
- * while the registry record stays exactly where it was. That divergence is the
- * whole signal.
- *
- * 30 seconds is deliberately far wider than the observed sub-second write
- * cadence. The gap this has to survive is a long tool call or a slow first token
- * between writes, and a window sized to the cadence would flap a working session
- * to OPEN and back every time the model paused to think. The cost of the wide
- * window is bounded and known: a session that stops is reported working for up
- * to 30 more seconds, which is a late correction rather than a permanent lie.
+ * Note the polarity difference before reusing `isActiveRecently` anywhere new:
+ * for a HINT, its `false` safely means "render OPEN". For a GATE, that same
+ * `false` would mean "allow the write", and unmeasurable must not mean allowed.
+ * `holderActivity` in `thread-occupancy.ts` is the gate-side reading.
  */
-export const ACTIVE_RECENTLY_WINDOW_MS = 30_000
-
-/**
- * Was this transcript written inside the window?
- *
- * NULL IS NOT "RECENT". An unresolvable path, an unreadable file, a stat that
- * threw — every one of them arrives here as null and answers false, so the row
- * falls back to OPEN. That is not a fail-open: OPEN is still a true statement
- * about a thread with a live owner. It is the STRONGER claim, "an agent is
- * working in here", that has to be earned by an actual observation.
- *
- * A timestamp far in the FUTURE is refused for the same reason rather than
- * treated as maximally fresh. Skew of a few seconds is normal and lands inside
- * the window; a file dated next week is a clock this server cannot reason about,
- * and letting it manufacture a permanent "working" badge would rebuild the bug
- * from the other direction.
- */
-export function isActiveRecently(mtimeMs: number | null | undefined, nowMs: number): boolean {
-  if (typeof mtimeMs !== 'number' || !Number.isFinite(mtimeMs)) return false
-  if (!Number.isFinite(nowMs)) return false
-  return Math.abs(nowMs - mtimeMs) <= ACTIVE_RECENTLY_WINDOW_MS
-}
+export { ACTIVE_RECENTLY_WINDOW_MS, isActiveRecently } from './thread-occupancy.js'
 
 /**
  * Fill in `activeRecently` for a scan, from transcript write times.

package/server/lib/thread-occupancy.ts

@@ -56,6 +56,12 @@ export interface ThreadOwner {
 
 export type OccupancyReason =
   | 'live_desktop_process'
+  // A foreign holder that is DEMONSTRABLY generating right now, as opposed to
+  // merely holding the thread open. Separate from `live_desktop_process` because
+  // the two ask the user for different things: this one clears by itself in
+  // seconds and is worth waiting out, the other needs a window closed. Only
+  // reachable when a transcript clock is wired — see THE IDLE-HOLDER RELAXATION below.
+  | 'native_thread_working'
   | 'unsupported_provider'
   | 'invalid_thread_id'
   | 'detector_unavailable'
@@ -73,13 +79,30 @@ export interface Occupancy {
   owners: ThreadOwner[]
   /** Null only when attachable. Drives the Control/lens footer copy. */
   reason: OccupancyReason | null
+  /**
+   * This verdict is attachable DESPITE a foreign owner, because that owner was
+   * measured idle. See THE IDLE-HOLDER RELAXATION below.
+   *
+   * It exists so the permissive outcome has to be DECLARED rather than inferred
+   * from `attachable` alone. `projectAttachability` treats a foreign owner on an
+   * attachable verdict as a contradiction and forces it back to refused; without
+   * a positive marker, relaxing the gate would mean deleting that check, and the
+   * check is what catches a future detector that flips `attachable` by accident.
+   * With the marker, the only way to reach the permissive path is to say so.
+   *
+   * Absent (not false) on every other verdict, so `=== true` is the only test.
+   */
+  idleHolder?: true
 }
 
 /**
  * What a scan could not establish. Any non-null value forbids attaching, even
  * with zero owners — that is the whole point of the type.
  */
-type Doubt = Exclude<OccupancyReason, 'live_desktop_process' | 'unsupported_provider' | 'invalid_thread_id'> | null
+type Doubt = Exclude<
+  OccupancyReason,
+  'live_desktop_process' | 'native_thread_working' | 'unsupported_provider' | 'invalid_thread_id'
+> | null
 
 interface ScanResult {
   owners: ThreadOwner[]
@@ -111,6 +134,128 @@ export interface OccupancyProbes {
    * membership — the start time is what makes the claim checkable.
    */
   cosSpawnedPids: () => ReadonlyMap<number, number>
+  /**
+   * Transcript write time for this thread, epoch ms, or null when it cannot be
+   * read. OPTIONAL, and its ABSENCE is the default.
+   *
+   * Absent means this install has no clock on the thread, which means every
+   * foreign holder stays `live_desktop_process` — byte-for-byte the behaviour
+   * that shipped before the idle-holder relaxation existed. That is why it is
+   * optional rather than required: the strict gate is what you get by doing
+   * nothing, and the relaxation is wired on purpose by `buildOccupancyProbes`
+   * in `occupancy-probes.ts`, which attaches the clock only when thread attach
+   * itself is on.
+   *
+   * Null is NOT idle. See `holderActivity` for why that distinction is the whole
+   * safety property here.
+   */
+  transcriptMtimeMs?: (provider: OccupancyProvider, threadId: string) => number | null
+}
+
+/**
+ * How recently the transcript must have been written for a held thread to read
+ * as WORKING rather than merely OPEN.
+ *
+ * WHY A SECOND SIGNAL EXISTS AT ALL. `owners` answers "a process holds this
+ * thread", which is not the question the user is asking. He watched a session
+ * finish on his Mac while the glasses still showed it active, because the window
+ * was still open and the registry record therefore still existed. Occupancy has
+ * no clock in it; the transcript does.
+ *
+ * MEASURED, not assumed: while a session generates, its jsonl mtime tracks the
+ * wall clock to within a second, and when generation stops the mtime goes stale
+ * while the registry record stays exactly where it was. That divergence is the
+ * whole signal.
+ *
+ * 30 seconds is deliberately far wider than the observed sub-second write
+ * cadence. The gap this has to survive is a long tool call or a slow first token
+ * between writes, and a window sized to the cadence would flap a working session
+ * to OPEN and back every time the model paused to think. The cost of the wide
+ * window is bounded and known: a session that stops is reported working for up
+ * to 30 more seconds, which is a late correction rather than a permanent lie.
+ *
+ * LIVES HERE, not in `occupied-threads.ts`, since 6.32.0. The display hint and
+ * the write gate must agree on what "recently" means, and the gate is the lower
+ * module of the two. `occupied-threads.ts` re-exports it, so every existing
+ * importer is unaffected.
+ */
+export const ACTIVE_RECENTLY_WINDOW_MS = 30_000
+
+/**
+ * Was this transcript written inside the window?
+ *
+ * NULL IS NOT "RECENT". An unresolvable path, an unreadable file, a stat that
+ * threw — every one of them arrives here as null and answers false, so the row
+ * falls back to OPEN. That is not a fail-open FOR A DISPLAY HINT: OPEN is still
+ * a true statement about a thread with a live owner. It is the STRONGER claim,
+ * "an agent is working in here", that has to be earned by an actual observation.
+ *
+ * A timestamp far in the FUTURE is refused for the same reason rather than
+ * treated as maximally fresh. Skew of a few seconds is normal and lands inside
+ * the window; a file dated next week is a clock this server cannot reason about,
+ * and letting it manufacture a permanent "working" badge would rebuild the bug
+ * from the other direction.
+ *
+ * DO NOT CALL THIS FROM A WRITE GATE. Its false has two meanings — "measured,
+ * and stale" and "could not measure" — and a gate that treats the second as the
+ * first is fail-open. `holderActivity` is the gate-side reading.
+ */
+export function isActiveRecently(mtimeMs: number | null | undefined, nowMs: number): boolean {
+  if (typeof mtimeMs !== 'number' || !Number.isFinite(mtimeMs)) return false
+  if (!Number.isFinite(nowMs)) return false
+  return Math.abs(nowMs - mtimeMs) <= ACTIVE_RECENTLY_WINDOW_MS
+}
+
+/**
+ * What a foreign holder is doing, for a caller that must DECIDE rather than
+ * render.
+ *
+ * THREE VALUES, AND THE THIRD IS THE POINT. `isActiveRecently` collapses "I
+ * measured a stale file" and "I could not measure anything" into the same
+ * `false`, which is correct for a badge — the weaker claim, OPEN, is true either
+ * way — and catastrophic for a gate, where that same `false` would mean ALLOW
+ * THE WRITE. Same reading, opposite polarity, so the gate gets its own function
+ * instead of reusing the hint's boolean.
+ *
+ * Only `idle` is a positive observation of an idle holder: a real number, not in
+ * the future, measured outside the window. Everything else is `unknown` and
+ * refuses. This is the same "no owner found is not no owner" rule the rest of
+ * this module runs on, applied to the clock instead of the registry.
+ *
+ * The window itself is NOT redefined here — `isActiveRecently` decides what
+ * recent means, so the badge and the gate can never drift apart on it.
+ */
+export type HolderActivity = 'working' | 'idle' | 'unknown'
+
+export function holderActivity(mtimeMs: number | null | undefined, nowMs: number): HolderActivity {
+  if (typeof mtimeMs !== 'number' || !Number.isFinite(mtimeMs)) return 'unknown'
+  if (!Number.isFinite(nowMs)) return 'unknown'
+  // A future-dated transcript is a clock this server cannot reason about. The
+  // hint may treat a few seconds of skew as freshness; the gate may not treat
+  // ANY amount of it as idleness, because "stale" is the permissive answer here
+  // and a wrong clock would hand it out forever.
+  if (mtimeMs > nowMs + ACTIVE_RECENTLY_WINDOW_MS) return 'unknown'
+  return isActiveRecently(mtimeMs, nowMs) ? 'working' : 'idle'
+}
+
+/**
+ * Read the transcript clock for a thread, refusing to guess.
+ *
+ * A probe that is absent, throws, or answers null all land on `unknown`, which
+ * refuses. There is no path from a failed reading to a permissive verdict.
+ */
+function readHolderActivity(
+  provider: OccupancyProvider,
+  threadId: string,
+  probes: OccupancyProbes,
+  nowMs: number,
+): HolderActivity {
+  if (typeof probes.transcriptMtimeMs !== 'function') return 'unknown'
+  try {
+    return holderActivity(probes.transcriptMtimeMs(provider, threadId), nowMs)
+  } catch {
+    return 'unknown'
+  }
 }
 
 /** A Claude registry filename is exactly `<pid>.json`. Not `*.json`. */
@@ -321,14 +466,84 @@ export interface OccupancyDirs {
   codexLocksDir: string
 }
 
+// ===========================================================================
+// THE IDLE-HOLDER RELAXATION (6.32.0)
+// ===========================================================================
+//
+// This loosens a guard that was deliberate. Read this before touching it, and
+// do not widen it further without repeating the experiment.
+//
+// WHAT CHANGED. A foreign owner used to be terminal on its own. It is now
+// terminal only while that owner is DEMONSTRABLY WRITING. A holder measured
+// idle — registry record alive, transcript stale — is continuable.
+//
+// WHY THE OLD RULE WAS WRONG. The registry records an OPEN WINDOW, not active
+// generation. `~/.claude/sessions/<pid>.json` for a session that finished ten
+// minutes ago is byte-identical to one mid-turn. Miles keeps Claude Code
+// windows open, so Continue was refused for exactly the threads he cares about
+// and allowed only for the ones he had abandoned. The gate was measuring the
+// wrong thing, not measuring it too strictly.
+//
+// THE CANARY, run 2026-08-16 against a real interactive `claude` 2.1.229 held
+// open in tmux (pid 48446, `kind: interactive`, `entrypoint: claude-desktop`,
+// indistinguishable from a desktop window) in a scratch workspace. Turns were
+// injected with the EXACT argv this server spawns. Raw findings:
+//
+//   1. DELIVERY WORKS. `claude -p --resume <id>` into an idle-held thread
+//      exits 0 in ~5s and returns its result. Same session id, same file.
+//   2. NO CORRUPTION. Across 6 injections and 6 desktop turns, including
+//      three SDK writers landing within 45ms of each other on the same node,
+//      the transcript stayed append-only: every prefix byte-identical before
+//      and after (`cmp`), zero unparseable lines, zero dangling parentUuid.
+//      Claude Code appends whole rows, so byte interleaving does not occur.
+//   3. THE HOLDER IGNORES THE INJECTED TURN — this is the real finding. Its
+//      in-memory view is stale and stays stale. Asked afterwards to list every
+//      word it had been told to reply with, it answered "ALPHA": the injected
+//      "BRAVO" was invisible to it.
+//   4. NOTHING IS CLOBBERED, BUT THE THREAD FORKS. The holder's next turn
+//      parented to the PRE-INJECTION tail, making the transcript a tree. Both
+//      turns survive in full; they are on different branches, and from then on
+//      each writer sees only its own. A later `--resume` read back
+//      "ALPHA, BRAVO" and never saw the desktop's "CHARLIE".
+//   5. THE WORKING CASE IS DIFFERENT AND STAYS BLOCKED. With the holder
+//      generating, the transcript mtime was 6.2s old and `holderActivity`
+//      returned `working`, so this relaxation does not fire there at all.
+//
+// SO THE ANSWER IS: no clobbering, no corruption, no data loss — but the two
+// views diverge silently after the write, and neither side is told by THIS
+// module. What makes that acceptable is the guard one layer up: `nativeHead`
+// digests the transcript tail, and a desktop write CHANGES it (measured:
+// nh1:faba1b35... -> nh1:ace93a1f...), so the next COS turn on that binding is
+// refused with `native_thread_changed` and the user is offered refresh, continue
+// anyway, or fork. Divergence is caught by the CONTENT watermark, which is the
+// signal that can actually see it. Occupancy never could.
+//
+// WHAT THIS IS NOT A LICENCE FOR. Do not extend the same reasoning to the
+// `doubt` reasons below: those mean the scan could not SEE, and an unreadable
+// registry is not an idle holder. Do not relax the `working` branch on the
+// grounds that "nothing got corrupted in the canary either" — case 5 was never
+// run to completion precisely because it stays blocked. And do not reach for
+// `isActiveRecently` here; its `false` means "stale OR unmeasurable", and only
+// `holderActivity` separates those.
+//
+// TURNING IT OFF. Unwire `probes.transcriptMtimeMs`. Since 6.33.0 that happens
+// by unsetting `COS_THREAD_ATTACH_ENABLED`, the one switch that also unregisters
+// the write routes: the relaxation is what makes a silent fork possible, so it
+// is the same decision as Continue itself and no longer has a flag of its own.
+// Every foreign holder then reads `unknown` and refuses, which is the pre-6.32.0
+// gate exactly, and with attach off there is no write route to reach anyway.
+
 /**
  * The Phase 0 attach precondition.
  *
  * Returns attachable ONLY when a supported provider proved its detector exists,
- * read every candidate record, and found no foreign owner. Every other outcome
- * names why. The whole function is wrapped: a throwing probe — including the
- * spawn ledger, which is the most safety-critical of them — is `probe_failed`,
+ * read every candidate record, and found no owner it must respect. Every other
+ * outcome names why. The whole function is wrapped: a throwing probe — including
+ * the spawn ledger, which is the most safety-critical of them — is `probe_failed`,
  * never an exception escaping into a route.
+ *
+ * A foreign owner measured IDLE is the one exception, and it is marked
+ * `idleHolder` on the way out. See THE IDLE-HOLDER RELAXATION above.
  */
 export function threadOccupancy(
   provider: string,
@@ -358,10 +573,23 @@ export function threadOccupancy(
 
   const foreign = result.owners.filter(o => !o.selfOwned)
   if (foreign.length > 0) {
-    return { attachable: false, owners: result.owners, reason: 'live_desktop_process' }
+    const activity = readHolderActivity(provider, threadId, probes, Date.now())
+    if (activity !== 'idle') {
+      return {
+        attachable: false,
+        owners: result.owners,
+        reason: activity === 'working' ? 'native_thread_working' : 'live_desktop_process',
+      }
+    }
+    // FALL THROUGH, deliberately. See THE IDLE-HOLDER RELAXATION below for why this is
+    // safe and what it is NOT. Everything after this point still applies: a scan
+    // that could not establish something still refuses on the next line.
   }
   if (result.doubt !== null) {
     return { attachable: false, owners: result.owners, reason: result.doubt }
   }
+  if (foreign.length > 0) {
+    return { attachable: true, owners: result.owners, reason: null, idleHolder: true }
+  }
   return { attachable: true, owners: result.owners, reason: null }
 }

package/server/routes/agent-session-bindings.ts

@@ -391,8 +391,17 @@ export const REASON_COPY: Record<OccupancyReason, string> = {
   // supported permanent configuration, not a degraded one (plan 4.9).
   attach_disabled:
     'Continuing a thread on your Mac is turned off. COS is read-only here. Fork it instead.',
+  // Held open by another app AND COS has no clock on the thread, so it cannot
+  // tell working from idle. Since 6.32.0 an idle holder is continuable, which
+  // makes this the "could not measure" case rather than the "someone else is
+  // here" case, and the copy says which.
   live_desktop_process:
-    'Open on your Mac. COS will not write into a thread another app is holding. Fork it instead.',
+    'Open on your Mac, and COS cannot tell whether it is still working. It will not write into it. Fork it instead.',
+  // Measured, and the answer was yes. Deliberately a different instruction from
+  // the line above: this clears on its own within seconds, so the useful advice
+  // is to wait, with fork as the fallback rather than the recommendation.
+  native_thread_working:
+    'Your Mac is writing to this thread right now. Wait a few seconds and try again, or fork it.',
   unsupported_provider:
     'This assistant cannot be continued from COS yet. Fork it instead.',
   invalid_thread_id:
@@ -672,14 +681,26 @@ export interface AttachabilityBody {
  * permissive way if simply forwarded: attachable with a reason, attachable with an
  * owner that is not provably ours, and a non-array owners field. Any of them is a
  * defect upstream, and a defect must not resolve to permissive.
+ *
+ * THE ONE EXEMPTION, added with the idle-holder relaxation in 6.32.0: a foreign
+ * owner is allowed on an attachable verdict when the verdict itself carries
+ * `idleHolder === true`. The check is not weakened by this, it is made explicit —
+ * before, "attachable" and "no foreign owner" were the same claim, so a detector
+ * that flipped `attachable` by mistake was caught here. It still is. What can no
+ * longer be caught here is a detector that ALSO sets `idleHolder`, which takes a
+ * deliberate edit in `thread-occupancy.ts` rather than an accident, and which the
+ * mutation tests over that file cover.
  */
 export function projectAttachability(verdict: Occupancy): AttachabilityBody {
   const owners = Array.isArray(verdict?.owners) ? verdict.owners : null
+  // Strictly `=== true`. An idleHolder of 1, 'yes', or {} is a malformed verdict,
+  // and a malformed verdict must not buy an exemption.
+  const foreignOwnerDeclared = verdict?.idleHolder === true
   const sound =
     verdict?.attachable === true &&
     verdict.reason === null &&
     owners !== null &&
-    owners.every(owner => owner?.selfOwned === true)
+    owners.every(owner => owner?.selfOwned === true || foreignOwnerDeclared)
   const reason: OccupancyReason | null = sound ? null : ((verdict?.reason ?? 'probe_failed') as OccupancyReason)
   return {
     attachable: sound,