@gotcos/glasses-server 6.32.0 → 6.35.0

package/CHANGELOG.md

@@ -2219,6 +2219,130 @@ unsaved capture, and makes batch status stop lying about finished work.
 
 # Changelog
 
+## [6.35.0] - 2026-08-16
+
+### The newest assistant reply arrives whole instead of at 160 characters
+
+- **The defect.** Miles opened a session on the glasses and the newest reply was cut
+  off mid-sentence. The session detail payload had NO full-text field: it carried
+  `discussion_summary` (180 chars) and `discussion_digest` (2000), and the newest
+  reply appeared only as the `Latest:` line inside the digest, produced by
+  `proseSnippet` at **160 characters** with a bare `slice` that stops mid-word and
+  prints nothing to say it stopped. An 1821-character reply reached the wire as 160
+  characters. The other 1661 never left the Mac. Polling was never the suspect: no
+  poll can deliver bytes the server did not send.
+- **New field `latest_reply` on `GET /api/agent-sessions/:provider/:sessionId`,
+  bounded at 4000 characters.** The number is measured, not guessed. Across 8,387
+  assistant replies in the 60 most recent transcripts on this Mac: p50 153, p75 291,
+  p90 1,627, p95 2,412, p99 3,405, max 21,757. The old 160-char cap delivered only
+  **52.7%** of replies whole. 4000 delivers **99.58%** (35 of 8,387 cut). 6000 would
+  buy 0.26 of a point for 50% more bytes on every fetch, and the reader paginates at
+  roughly 200 chars, so 4000 is at most 20 swipes of deliberate reading.
+- **A dedicated field, not a bigger slice of the digest.** Three caps sit in series
+  here (`proseSnippet` 160, `DIGEST_TURN_MAX` 220, `DISCUSSION_DIGEST_MAX` 2000) and
+  the digest reserves its `Latest:` block FIRST, so a longer reply inside that budget
+  starves the user turns it is supposed to sit beside. Two fields, two jobs.
+- **Truncation is now visible.** `latest_reply` ends in an ellipsis when it does have
+  to cut. `proseSnippet` keeps its old bare 160-char slice, pinned by a test.
+- **ADDITIVE. An older app keeps working.** Nothing was removed or renamed:
+  `discussion_summary` and `discussion_digest` still carry exactly what they carried,
+  the digest still holds its own 160-char `Latest:` line, and a client that never
+  learns the new key renders what it rendered before. Proven over real HTTP rather
+  than by reading the route source.
+
+### Two latent hazards in the same path, both closed
+
+- **"Latest" can no longer be a line from the session's opening.** An oversized
+  transcript is read head-then-tail into one loop, and the newest reply was plain
+  last-write-wins across both windows. A session whose tail window happened to hold
+  no assistant prose, which is ordinary when the last 768 KiB are giant tool results,
+  kept whichever assistant row the HEAD saw and published it labelled `Latest:`. A
+  line from the start of the session, presented as its current state. Silently wrong,
+  and worse than truncation because truncation is at least visible. Lines are now
+  tagged with the window they came from and only the window ending at EOF can claim
+  to be latest; with nothing there the honest answer is nothing, and the digest drops
+  its `Latest:` block rather than filling it with the wrong turn. A whole-file read
+  is all tail, so small sessions are unchanged.
+- **A record larger than the tail window no longer empties the tail.** The tail opens
+  at `size - 768 KiB`, mid-record, and the leading fragment is discarded by design.
+  When the FINAL record is bigger than the window, that fragment is the only thing in
+  it: nothing parses, and the tail contributes no recent turns and no reply at all.
+  Not hypothetical: 14 records over 768 KiB exist in a 60-transcript sample on this
+  Mac, the largest 1,239,045 bytes, 1.58x the window. The tail now reaches back up to
+  one further MiB to open at a real record boundary, and stops reaching past that so
+  a pathological record cannot pull an unbounded read into memory.
+- **Measured, not asserted:** both hazards are LATENT today. Every transcript
+  currently over the 32 MiB read ceiling has 8 to 19 assistant rows in its tail, so
+  neither is firing right now. They are mechanisms, closed before they fire.
+
+### Notes
+
+- One behaviour change beyond the additive field, and it is the point of the fix: on
+  a truncated read whose tail holds no assistant prose, `discussion_summary` and the
+  digest's `Latest:` block are now EMPTY where they used to carry a line from the
+  session's opening. That removes wrong content, not content.
+- A mutation that survived is recorded rather than buried. An early draft clamped the
+  tail start at `headBytes` to avoid double counting, and no test reached it. It was
+  both untested and wrong: `lastRecordStart` returns the LAST record's start and that
+  record always runs to EOF, so the head can only ever see a prefix it discards, and
+  the clamp only threw away the record the reach exists to recover. The clamp is
+  gone, a test now covers the case, and re-adding it fails.
+
+## [6.34.0] - 2026-08-16
+
+### A continued turn now runs with the session's own permissions
+
+- **This widens what Continue can do.** A prompt spoken into the glasses can run
+  tools on the Mac with nobody at the keyboard. Authorized explicitly by Miles
+  after his first real continued turn came back reporting that every tool was
+  disabled, which is not the point of the feature.
+- Claude drops `--permission-mode plan` and the empty `--tools`/`--allowedTools`
+  pair. Codex now uses `getCodexTrustMode()`, the same posture ordinary Codex runs
+  use on the host, rather than a stricter one invented at this call site. Absent
+  `COS_CODEX_SANDBOX=workspace-write` that is still read-only, so this is never
+  more permissive than the rest of the server.
+- **Unchanged, and load-bearing:** `COS_THREAD_ATTACH_ENABLED` still gates the
+  surface and off still leaves the routes unregistered; `findBannedPermissionArg`
+  still rejects every real bypass at the spawn boundary; delivery is still gated
+  on a fresh occupancy probe, the epoch floor, the per-target claim and the head
+  watermark. Dropping a lockdown is not adding a bypass.
+- The old read-only posture had NO test asserting it was present, so it could have
+  been deleted silently. The new posture is pinned, and so is the bypass ban.
+
+## [6.33.0] - 2026-08-16
+
+### One switch turns Continue on
+
+Continue was gated by two environment variables, and the second one was
+invisible. `COS_THREAD_ATTACH_ENABLED=1` registered the write routes;
+`COS_THREAD_ATTACH_IDLE_HOLDER=1` was additionally needed before COS would write
+into a thread whose Mac window is open but idle. COS Control's "Continue agent
+threads" checkbox sets only the first, so health reported the feature ON while
+every single attempt was refused, because a developer's editor windows stay
+open and that is precisely the case the second flag covered.
+
+- **`COS_THREAD_ATTACH_ENABLED=1` is now the whole answer.** It registers the two
+  write routes and wires the transcript clock that tells an idle holder from a
+  working one. Nothing else to set.
+- **`COS_THREAD_ATTACH_IDLE_HOLDER` is REMOVED, not deprecated.** If you set it
+  by hand, it is now ignored and can be deleted from your LaunchAgent plist or
+  shell profile. Leaving it in place changes nothing either way.
+- **COS Control needs no update for this.** Its existing checkbox already writes
+  the surviving key, so the toggle that reported ON while refusing now reports
+  ON and works.
+
+The two switches were never independently useful, and folding them is the honest
+description of the decision rather than a convenience. The relaxation is what
+makes a silent fork possible, so "Continue is on" and "a fork may happen" are one
+choice, and one switch states it.
+
+Every safety behaviour is unchanged. A holder measured WRITING is still refused
+with `native_thread_working`; a holder COS cannot measure is still refused with
+`live_desktop_process`, because only a positive idle observation relaxes the gate
+and an unreadable transcript is not one. Off still means the write routes are not
+registered at all, so a disabled server answers 404 rather than 403 and holds no
+reachable write code.
+
 ## [6.32.0] - 2026-08-16
 
 ### Continue now blocks on WORKING, not on merely open

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.32.0",
+  "version": "6.35.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -20,15 +20,13 @@ import { transcribeRouter } from './routes/transcribe.js'
 import { sessionIndexRouter } from './routes/session-index.js'
 import { agentSessionsRouter } from './routes/agent-sessions.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
-import { createAgentSessionBindingsRouter } from './routes/agent-session-bindings.js'
+import {
+  createAgentSessionBindingsRouter,
+  threadAttachEnabled,
+} from './routes/agent-session-bindings.js'
 import { AgentSessionBindingRegistry } from './lib/agent-session-binding-registry.js'
 import { cosSpawnedPids } from './lib/agent-session-ownership-store.js'
-import {
-  idleHolderContinueEnabled,
-  realOccupancyDirs,
-  realOccupancyProbes,
-  withTranscriptClock,
-} from './lib/occupancy-probes.js'
+import { buildOccupancyProbes, realOccupancyDirs } from './lib/occupancy-probes.js'
 import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
 import { deliverAttachedTurn, realAttachedTurnDeps } from './lib/attached-provider-adapter.js'
 import { forkThread, realForkDeps } from './lib/fork-thread.js'
@@ -310,13 +308,20 @@ const occupancyDirs = realOccupancyDirs()
 const nativeHeadDeps = realNativeHeadDeps()
 const attachedWorkspaceDeps = realAttachedWorkspaceDeps(nativeHeadDeps)
 /**
- * THE ONE PLACE the idle-holder relaxation is switched on (6.32.0).
+ * THE ONE PLACE the idle-holder relaxation is switched on, on the ONE flag
+ * that also registers the write routes (6.33.0).
  *
  * Without the clock, a foreign holder is terminal and Continue is refused for
  * any thread with a Claude Code window open on it — including the ones Miles
  * actually works in, because he leaves those windows open. With it, a holder
  * measured idle is continuable and only a holder measured WRITING is refused.
  *
+ * `threadAttachEnabled()` is the same call `createAgentSessionBindingsRouter`
+ * makes below to decide whether the two POST routes exist at all. Reading it
+ * here rather than a second env key is what makes "Continue is on" a single
+ * answer: the pair of flags this replaced could disagree, and did, reporting
+ * the feature enabled while every attempt was refused.
+ *
  * Both gates read this same object — the route's detector via `probes` below,
  * and the adapter's pre-spawn preflight via `occupancyProbes` at the closure
  * further down — so they cannot come to different conclusions. That is the whole
@@ -325,9 +330,7 @@ const attachedWorkspaceDeps = realAttachedWorkspaceDeps(nativeHeadDeps)
  * Read the canary evidence in `thread-occupancy.ts` under THE IDLE-HOLDER
  * RELAXATION before changing this line.
  */
-const occupancyProbes = idleHolderContinueEnabled()
-  ? withTranscriptClock(realOccupancyProbes(cosSpawnedPids), nativeHeadDeps)
-  : realOccupancyProbes(cosSpawnedPids)
+const occupancyProbes = buildOccupancyProbes(cosSpawnedPids, nativeHeadDeps, threadAttachEnabled())
 
 /**
  * The shim between the route's request shape and the adapter's.

package/server/lib/agent-session-store.ts

@@ -122,13 +122,55 @@ export function firstLineTitle(text: string): string {
   return line.slice(0, 80)
 }
 
+/** Fenced code, tags and runs of whitespace out; one line of prose left. Shared so
+ *  `proseSnippet` and `latestAssistantReply` can never disagree about what the prose
+ *  of a record IS — only about how much of it they keep. */
+function proseBody(text: string): string {
+  const body = text.replace(/```[\s\S]*?```/g, ' ')
+  return body.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim()
+}
+
 export function proseSnippet(text: string, max = 160): string {
-  let body = text.replace(/```[\s\S]*?```/g, ' ')
-  body = body.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim()
+  const body = proseBody(text)
   if (!body || isWrapperPrompt(body)) return ''
   return body.slice(0, max)
 }
 
+/**
+ * How much of the newest assistant reply crosses the wire, whole.
+ *
+ * MEASURED, not guessed. Across 8,387 assistant replies in the 60 most recent
+ * transcripts on this Mac: p50 153, p75 291, p90 1,627, p95 2,412, p99 3,405,
+ * max 21,757. The 160-char snippet that used to be the ONLY assistant text on the
+ * detail payload delivered 52.7% of replies whole — it cut nearly half of them, and
+ * cut them mid-word with no ellipsis. 4,000 delivers 99.58% whole (35 of 8,387 cut).
+ *
+ * WHY NOT HIGHER. 6,000 buys 0.26 of a percentage point for 50% more bytes on every
+ * detail fetch, and the ceiling is what a pathological reply costs, not what a
+ * typical one costs. The reader paginates at ~200 chars, so 4,000 is at most 20
+ * swipes of deliberate reading; 21,757 would be 109. Bounded on purpose: this
+ * crosses a phone radio and renders on a 576x288 HUD.
+ *
+ * WHY NOT LOWER. 2,000 would still cut 7.5% of replies, and Miles's 1,821-char reply
+ * — the one that started this — sits inside the band that a 2,000 cap leaves with no
+ * headroom at all.
+ */
+export const LATEST_REPLY_MAX = 4000
+
+/**
+ * The newest assistant reply, whole.
+ *
+ * Same cleaning as `proseSnippet`, a far larger budget, and — when it does have to
+ * cut — an ellipsis, so a truncated reply is VISIBLY truncated. `proseSnippet` ends
+ * in a bare `slice`, which is how 1,821 characters became 160 with nothing on screen
+ * to say so.
+ */
+export function latestAssistantReply(text: string, max = LATEST_REPLY_MAX): string {
+  const body = proseBody(text)
+  if (!body || isWrapperPrompt(body)) return ''
+  return body.length <= max ? body : `${body.slice(0, max - 1)}…`
+}
+
 export function composeDiscussionSummary(input: {
   title?: string
   firstPrompt?: string
@@ -1034,6 +1076,92 @@ export const PARTIAL_HEAD_BYTES = 256 * 1024
  *  follow-up continues from. */
 export const PARTIAL_TAIL_BYTES = 768 * 1024
 
+/**
+ * Extra bytes the tail window may reach BACKWARDS to open at a record boundary.
+ *
+ * A single JSONL record can be larger than the whole tail window. Measured on this
+ * Mac: 14 records over 768 KiB in a 60-transcript sample, the largest 1,239,045
+ * bytes — 1.58x the window. When the record that straddles the window start is the
+ * FINAL record, the window holds no complete record at all: `parseJsonLine` rejects
+ * the one fragment it gets and the tail contributes NOTHING. No recent turns, and no
+ * latest reply, at exactly the moment the user opened the session to see what just
+ * happened. Reaching back one more MiB recovers the record instead.
+ *
+ * BOUNDED, because the point is to survive a big record and not to be dragged into an
+ * unbounded read by a pathological one. Past this the tail keeps its ordinary start
+ * and the loss stays honest rather than becoming a wrong "Latest".
+ */
+export const PARTIAL_TAIL_MAX_EXTRA_BYTES = 1024 * 1024
+
+async function readRange(path: string, start: number, end: number): Promise<Buffer> {
+  if (end < start) return Buffer.alloc(0)
+  const chunks: Buffer[] = []
+  for await (const chunk of createReadStream(path, { start, end })) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
+  }
+  return Buffer.concat(chunks)
+}
+
+/**
+ * Where the LAST record in the file begins, found by walking back from EOF to the
+ * newline that closed the record before it.
+ *
+ * Cheap in the ordinary case: the last record is small, so the first 64 KiB chunk
+ * contains the boundary and the walk stops immediately. Returns -1 when no boundary
+ * turns up within `limit` bytes, which is the signal to stop reaching.
+ */
+export async function lastRecordStart(path: string, size: number, limit: number): Promise<number> {
+  if (size <= 0) return -1
+  const CHUNK = 64 * 1024
+  // A terminating newline CLOSES the last record; it does not open one. Counting it
+  // would report the last record as starting at EOF and find every window empty.
+  const tailByte = await readRange(path, size - 1, size - 1)
+  const searchEnd = tailByte.length === 1 && tailByte[0] === 0x0a ? size - 1 : size
+  if (searchEnd <= 0) return -1
+  const floor = Math.max(0, size - limit)
+  let pos = searchEnd
+  while (pos > floor) {
+    const start = Math.max(floor, pos - CHUNK)
+    const buf = await readRange(path, start, pos - 1)
+    const idx = buf.lastIndexOf(0x0a)
+    if (idx >= 0) return start + idx + 1
+    pos = start
+  }
+  // Reached the front of the file without a newline: the whole file is one record.
+  return floor === 0 ? 0 : -1
+}
+
+/**
+ * The byte offset the tail window opens at.
+ *
+ * Normally `size - tailBytes`, mid-record, and the leading fragment is discarded by
+ * design. The exception this exists for is a final record BIGGER than the window,
+ * where discarding the fragment discards the entire tail.
+ */
+export async function tailWindowStart(
+  path: string,
+  size: number,
+  headBytes: number,
+  tailBytes: number,
+  extraBytes: number,
+): Promise<number> {
+  const preferred = Math.max(headBytes, size - tailBytes)
+  const boundary = await lastRecordStart(path, size, tailBytes + extraBytes)
+  // A boundary at or after the ordinary start means at least one complete record
+  // already falls inside the window. Nothing to recover; keep the cheaper read.
+  if (boundary < 0 || boundary >= preferred) return preferred
+  // Reaching back BEHIND `headBytes` is allowed, and the instinct to clamp it here is
+  // wrong — an earlier draft did clamp, which silently threw away the very record
+  // this function exists to recover whenever the final record began inside the head
+  // window. It cannot double-count: `boundary` is the start of the LAST record, and
+  // the last record always runs to EOF, which is past `maxBytes` and therefore past
+  // `headBytes`. The head pass can only ever see a prefix of it, arriving as a
+  // trailing partial line that `parseJsonLine` rejects. Every record the head reads
+  // WHOLE ends before `boundary`, so the tail never re-yields one. The read stays
+  // bounded because `lastRecordStart` only looks back `tailBytes + extraBytes`.
+  return boundary
+}
+
 /**
  * Lines of a transcript, reading the WHOLE file when it fits and head+tail when it
  * does not.
@@ -1049,6 +1177,19 @@ export const PARTIAL_TAIL_BYTES = 768 * 1024
  * `parseJsonLine` returns null for it and the caller's loop skips it, which is why
  * this can slice at an arbitrary byte offset and stay correct.
  */
+/**
+ * One transcript line, tagged with the window it came from.
+ *
+ * `tail` means "this line is in the window that ends at EOF". A whole-file read is
+ * all tail, which is what makes the consumer's rule uniform: anything claiming to be
+ * the LATEST state of a session must come from a tail line, no `truncated` special
+ * case at the call site.
+ */
+export interface AgentSessionLine {
+  text: string
+  tail: boolean
+}
+
 export async function* agentSessionLines(
   path: string,
   size: number,
@@ -1060,19 +1201,27 @@ export async function* agentSessionLines(
   // windowing removed. It did exactly that until a mutation caught it.
   headBytes = PARTIAL_HEAD_BYTES,
   tailBytes = PARTIAL_TAIL_BYTES,
-): AsyncGenerator<string> {
+  extraBytes = PARTIAL_TAIL_MAX_EXTRA_BYTES,
+): AsyncGenerator<AgentSessionLine> {
   if (size <= maxBytes) {
-    yield* createInterface({ input: createReadStream(path), crlfDelay: Infinity })
+    for await (const text of createInterface({ input: createReadStream(path), crlfDelay: Infinity })) {
+      yield { text, tail: true }
+    }
     return
   }
-  yield* createInterface({
+  for await (const text of createInterface({
     input: createReadStream(path, { start: 0, end: headBytes - 1 }),
     crlfDelay: Infinity,
-  })
-  yield* createInterface({
-    input: createReadStream(path, { start: Math.max(headBytes, size - tailBytes) }),
+  })) {
+    yield { text, tail: false }
+  }
+  const start = await tailWindowStart(path, size, headBytes, tailBytes, extraBytes)
+  for await (const text of createInterface({
+    input: createReadStream(path, { start }),
     crlfDelay: Infinity,
-  })
+  })) {
+    yield { text, tail: true }
+  }
 }
 
 export interface AgentSessionDetail {
@@ -1086,6 +1235,12 @@ export interface AgentSessionDetail {
   /** Deep, paginated body text for the detail page — up to 2000 chars. The list row
    *  keeps `discussion_summary` at 180. Older clients ignore this field. */
   discussion_digest: string
+  /** The newest assistant reply, whole, up to `LATEST_REPLY_MAX`. Its own field
+   *  rather than a bigger slice of the digest: the digest's job is to summarize a
+   *  whole session inside 2000 chars, and a long reply competing for that budget
+   *  starves the user turns — `composeDiscussionDigest` reserves the Latest block
+   *  FIRST. Two fields, two jobs. Older clients ignore this one. */
+  latest_reply: string
   user_message_count: number
   assistant_message_count: number
   omitted_tools: number
@@ -1110,6 +1265,7 @@ export async function parseAgentSession(
   let sessionId = path.split('/').pop()?.replace(/\.jsonl$/, '') || ''
   let firstPrompt = ''
   let latestAssistant = ''
+  let latestReply = ''
   let userCount = 0
   // Bounded sample for the deep digest: the opening turns plus a recent window.
   // The composer only ever renders head + as many recent as fit 2000 chars, so
@@ -1142,7 +1298,33 @@ export async function parseAgentSession(
   let assistantCount = 0
   let omittedTools = 0
 
-  for await (const line of agentSessionLines(path, st.size, maxBytes, opts.headBytes, opts.tailBytes)) {
+  /**
+   * Where the assistant left off — taken ONLY from the window that ends at EOF.
+   *
+   * An oversized transcript is read head-then-tail into one loop, and this used to be
+   * plain last-write-wins across both. So a session whose tail window happens to hold
+   * no assistant prose — entirely possible when the last 768 KiB are giant tool
+   * results — kept whichever assistant row the HEAD saw and published it under the
+   * label "Latest:". A line from the session's opening, presented as its current
+   * state. Silently wrong, and worse than truncation: truncation is visible.
+   *
+   * With nothing in the tail the honest answer is nothing, and the digest drops its
+   * Latest block rather than filling it with the wrong turn.
+   *
+   * The two fields move together, gated on the same snippet, so the summary line and
+   * the full reply can never come from different records.
+   */
+  const rememberAssistant = (text: string, fromTail: boolean): void => {
+    if (!fromTail) return
+    const snippet = proseSnippet(text)
+    if (!snippet) return
+    latestAssistant = snippet
+    latestReply = latestAssistantReply(text)
+  }
+
+  for await (const { text: line, tail } of agentSessionLines(
+    path, st.size, maxBytes, opts.headBytes, opts.tailBytes,
+  )) {
     const obj = parseJsonLine(line)
     if (!obj) continue
     if (provider === 'claude') {
@@ -1169,8 +1351,7 @@ export async function parseAgentSession(
         if (!title) title = firstLineTitle(text)
       } else {
         assistantCount += 1
-        const snippet = proseSnippet(text)
-        if (snippet) latestAssistant = snippet
+        rememberAssistant(text, tail)
       }
     } else if (provider === 'codex') {
       if (obj.type === 'session_meta' && obj.payload && typeof obj.payload === 'object') {
@@ -1193,8 +1374,7 @@ export async function parseAgentSession(
       if (!text || isWrapperPrompt(text)) continue
       if (payload.role === 'assistant') {
         assistantCount += 1
-        const snippet = proseSnippet(text)
-        if (snippet) latestAssistant = snippet
+        rememberAssistant(text, tail)
       } else {
         userCount += 1
         collectTurn(text)
@@ -1219,8 +1399,7 @@ export async function parseAgentSession(
         }
       } else {
         assistantCount += 1
-        const snippet = proseSnippet(text)
-        if (snippet) latestAssistant = snippet
+        rememberAssistant(text, tail)
       }
     }
   }
@@ -1253,6 +1432,7 @@ export async function parseAgentSession(
       totalTurns: truncated ? undefined : userCount,
       truncated,
     }),
+    latest_reply: latestReply,
     user_message_count: userCount,
     assistant_message_count: assistantCount,
     omitted_tools: omittedTools,

package/server/lib/attached-provider-adapter.ts

@@ -93,6 +93,7 @@ import { isValidNativeThreadId } from './native-thread-id.js'
 import { isBindableProvider, type BindableProvider } from './agent-session-binding-store.js'
 import { recordCosSpawn, releaseCosSpawn } from './agent-session-ownership-store.js'
 import { processStartMs as realProcessStartMs } from './occupancy-probes.js'
+import { getCodexTrustMode } from './codex-run-ledger.js'
 
 /** Providers with a certified attached path. Cursor is Fork-only (plan 2.5). */
 export type AttachedProvider = BindableProvider
@@ -529,17 +530,35 @@ const STRIPPED_ENV_KEYS: readonly string[] = ['CLAUDECODE', 'COS_API_TOKEN']
 // ---------------------------------------------------------------------------
 
 /**
- * Claude: `claude -p --resume <id>`, read-only, prompt on stdin.
+ * Claude: `claude -p --resume <id>`, prompt on stdin.
  *
  * The prompt is NOT an argv element. argv is world-readable through `ps`, and
  * the prompt is the user's private text; stdin also matches what both ordinary
  * bridges already do.
  *
- * Two independent read-only layers, because either alone is one assumption
- * deep: `--permission-mode plan` means the model cannot mutate regardless of
- * its tool list, and the empty `--tools`/`--allowedTools` pair is the exact
- * text-only posture `claude-permissions.ts` already ships for untrusted mode.
- * If an older CLI rejects `plan`, it exits non-zero and we fail closed.
+ * THE TURN INHERITS THE SESSION'S OWN PERMISSIONS (Miles, 2026-08-16, explicit).
+ *
+ * This used to force two independent read-only layers: `--permission-mode plan`
+ * plus an empty `--tools`/`--allowedTools` pair. The result was a Continue that
+ * could talk into a thread and do nothing in it -- his first real continued turn
+ * came back reporting that every tool was disabled, which is not "like being at
+ * the desk". Both layers are gone; a resumed turn now runs as that session
+ * ordinarily would.
+ *
+ * What that means plainly: a prompt spoken into a pair of glasses can run tools
+ * on this Mac with nobody at the keyboard. That is the intent, not an oversight.
+ * The protections that remain, and that must not be quietly removed with it:
+ *
+ *   1. `COS_THREAD_ATTACH_ENABLED` still gates the whole surface, and off means
+ *      the write routes are never registered.
+ *   2. `findBannedPermissionArg` still runs at the spawn boundary and still
+ *      rejects the actual bypasses -- `--dangerously-skip-permissions`, `--yolo`,
+ *      `danger-full-access` and the rest. Dropping a lockdown is not the same as
+ *      adding a bypass, and the bypass ban is unchanged.
+ *   3. The menu cursor rests on a row that cannot act, so a false-positive ring
+ *      tap cannot reach Continue (`defaultSessionThreadActionIndex`).
+ *   4. Delivery is still gated on a fresh occupancy probe, the epoch floor, the
+ *      per-target claim and the head watermark.
  */
 export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
   return [
@@ -549,9 +568,6 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
     // never observe the session id we are required to verify.
     '--verbose',
     '--resume', nativeThreadId,
-    '--permission-mode', 'plan',
-    '--tools', '',
-    '--allowedTools', '',
   ]
 }
 
@@ -571,7 +587,10 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
 export function buildCodexAttachedArgs(nativeThreadId: string, cwd: string): string[] {
   return [
     'exec',
-    '--sandbox', 'read-only',
+    // The posture ordinary Codex runs use on this host, not a stricter one
+    // invented here. `COS_CODEX_SANDBOX=workspace-write` opts in; absent stays
+    // read-only, so this is never MORE permissive than the rest of the server.
+    '--sandbox', getCodexTrustMode(),
     '--cd', cwd,
     'resume',
     '--json',

package/server/lib/occupancy-probes.ts

@@ -446,21 +446,39 @@ export function realOccupancyProbes(ledger: SpawnLedgerAccessor): OccupancyProbe
 }
 
 /**
- * Is the idle-holder relaxation switched on for this install?
+ * The probe set this install should run, clock and all.
  *
- * ONE READER, exported so every other module imports it rather than re-reading
- * `process.env` — the same anti-drift rule `threadAttachEnabled` follows, and for
- * the same reason: a second copy is how a surface comes to advertise a write path
- * the gate will refuse.
+ * ONE DECISION, IN ONE PLACE (6.33.0). `attachEnabled` is the SAME answer that
+ * decides whether the two write routes get registered — `threadAttachEnabled()`,
+ * passed in by the composition root rather than re-read here. There is exactly
+ * one reader of `COS_THREAD_ATTACH_ENABLED` in the server, and a second copy is
+ * how a surface comes to advertise a write path the gate will refuse.
  *
- * `=== '1'` opt-IN, not `!== '0'` opt-out. This decides whether COS may write
- * into a conversation a human still has open, so anything ambiguous — unset,
- * empty, 'true', 'yes' — reads as OFF. It composes with
- * `COS_THREAD_ATTACH_ENABLED`: with attach itself off, this flag does nothing at
- * all, because there is no write path to relax.
+ * WHY THE CLOCK RIDES THE SAME SWITCH. In 6.32.0 the relaxation had a second
+ * env key of its own (named in the 6.33.0 changelog entry; it is now ignored),
+ * and the two were never independently useful: without the clock, Continue is
+ * refused on every thread with an editor window open, which for a working
+ * developer is all of them. The pair also cost a real testing cycle, because
+ * COS Control's checkbox knew only the first key and reported the feature ON
+ * while the gate still refused every session. And the honest reading is that
+ * they were always ONE decision: the relaxation is what makes a silent fork
+ * possible, so "Continue is on" and "fork is possible" are the same choice, and
+ * one switch says so.
+ *
+ * Attach off is still byte-for-byte the pre-6.28 posture: no clock, so every
+ * foreign holder reads `unknown` and refuses, and the write routes do not exist
+ * to be reached anyway.
  */
-export function idleHolderContinueEnabled(): boolean {
-  return process.env.COS_THREAD_ATTACH_IDLE_HOLDER === '1'
+export function buildOccupancyProbes(
+  ledger: SpawnLedgerAccessor,
+  headDeps: NativeHeadDeps,
+  attachEnabled: boolean,
+): OccupancyProbes {
+  const base = realOccupancyProbes(ledger)
+  // Strictly `=== true`. A caller that hands over a truthy non-boolean has not
+  // answered the question, and the permissive branch is the one that must be
+  // earned by a real yes.
+  return attachEnabled === true ? withTranscriptClock(base, headDeps) : base
 }
 
 /**

package/server/lib/thread-occupancy.ts

@@ -142,8 +142,9 @@ export interface OccupancyProbes {
    * foreign holder stays `live_desktop_process` — byte-for-byte the behaviour
    * that shipped before the idle-holder relaxation existed. That is why it is
    * optional rather than required: the strict gate is what you get by doing
-   * nothing, and the relaxation has to be wired on purpose (see `server/index.ts`,
-   * where the wiring is itself behind `COS_THREAD_ATTACH_IDLE_HOLDER`).
+   * nothing, and the relaxation is wired on purpose by `buildOccupancyProbes`
+   * in `occupancy-probes.ts`, which attaches the clock only when thread attach
+   * itself is on.
    *
    * Null is NOT idle. See `holderActivity` for why that distinction is the whole
    * safety property here.
@@ -525,9 +526,12 @@ export interface OccupancyDirs {
 // `isActiveRecently` here; its `false` means "stale OR unmeasurable", and only
 // `holderActivity` separates those.
 //
-// TURNING IT OFF. Unwire `probes.transcriptMtimeMs` (in practice: unset
-// `COS_THREAD_ATTACH_IDLE_HOLDER`). Every foreign holder then reads `unknown`
-// and refuses, which is the pre-6.32.0 gate exactly. No rollback needed.
+// TURNING IT OFF. Unwire `probes.transcriptMtimeMs`. Since 6.33.0 that happens
+// by unsetting `COS_THREAD_ATTACH_ENABLED`, the one switch that also unregisters
+// the write routes: the relaxation is what makes a silent fork possible, so it
+// is the same decision as Continue itself and no longer has a flag of its own.
+// Every foreign holder then reads `unknown` and refuses, which is the pre-6.32.0
+// gate exactly, and with attach off there is no write route to reach anyway.
 
 /**
  * The Phase 0 attach precondition.

package/server/routes/agent-sessions.ts

@@ -366,6 +366,12 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
       // summary — Miles: "it should be in the body not the title, the row should
       // be no more than the 180 characters."
       discussion_digest: parsed.discussion_digest || '',
+      // The newest assistant reply, whole. ADDITIVE: the digest above still carries
+      // its own 160-char `Latest:` line, so a client that never learns this field
+      // renders exactly what it rendered before. Measured at 4000 chars — see
+      // LATEST_REPLY_MAX. Before this existed the detail payload had NO full-text
+      // field at all, and an 1821-char reply left the Mac as 160 characters.
+      latest_reply: parsed.latest_reply || '',
       truncated: parsed.truncated,
       project: parsed.project,
       created: modified,