@gotcos/glasses-server 6.43.4 → 6.44.0

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 6.44.0
+
+Task store: one COS `tasks.md` contract with a durable lock, columns, and a run ledger.
+
+- Bridge subcommands `task-rows`, `task-capture`, `task-set-run-at`, `task-set-marker`, `task-move`, and `task-check` are first-class. Standalone installs without a COS pipeline return `cos_pipeline_not_configured` instead of an empty object.
+- `GET /api/tasks` and `/api/tasks/runs` project the board and the ledger. Capture, check, move, and schedule go through the same writer lock the Python side uses.
+- Morning-brief config gains `taskCatchUpMinutes` (default 180). Task due/missed math uses `taskInstant`, which steps a spring-forward gap by 60 minutes instead of pretending `zonedInstant` already did that.
+- Health advertises `capabilities.tasks.gate` so a new client can tell an old server from a new one.
+- `POST /api/tasks/:id/run` is Run now: a restricted Claude job (`Read` / `Grep` / `Glob`) on the same durable path as the morning brief. The same task already live → 409 `task_running`. A second different task while the slot is reserved → 503 `dispatch_slots_busy`.
+- `GET /api/tasks` returns `{ tasks, workBadge, gate }`. A client that still expects a domain map must adapt.
+
 ## 6.43.4
 
 Every message now says who started it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.43.4",
+  "version": "6.44.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -59,6 +59,7 @@ import { promptEditRouter } from './routes/prompt-edit.js'
 import { bookmarksRouter } from './routes/bookmarks.js'
 import { welcomeContextRouter } from './routes/welcome-context.js'
 import { liveCuesRouter } from './routes/live-cues.js'
+import { tasksRouter } from './routes/tasks.js'
 import { memoryRouter } from './routes/memory.js'
 import { threadsRouter } from './routes/threads.js'
 import { shutdownLiveCues } from './lib/live-cues-engine.js'
@@ -689,6 +690,7 @@ app.use('/api', promptEditRouter)
 app.use('/api', bookmarksRouter)
 app.use('/api', welcomeContextRouter)
 app.use('/api', liveCuesRouter)
+app.use('/api', tasksRouter)
 
 // OpenAI-compatible endpoint for the G2 Agent (ER "Add Agent")
 // Mounted at root — routes are /v1/chat/completions and /v1/models

package/server/lib/claude-bridge.ts

@@ -54,6 +54,7 @@ import {
   buildClaudeToolList,
   claudeMcpConfigArgs,
   claudeToolCapabilityPrompt,
+  readOnlyCapabilityPrompt,
 } from './claude-tool-access.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
 import { claudePermissionArgs, getClaudeTrustMode } from './claude-permissions.js'
@@ -388,6 +389,8 @@ export interface CallOptions {
   cursorExecutionMode?: import('../../shared/model-preference.js').CursorExecutionMode
   /** Durable coordinator already owns the per-session provider lease. */
   sessionLockHeld?: boolean
+  /** Read-only scheduled-task dispatch. Same shape as QueryJobRequest.dispatch. */
+  dispatch?: { restricted: true; tools: readonly string[] }
 }
 
 export async function callClaudeStreaming(
@@ -418,7 +421,7 @@ export async function callClaudeStreaming(
   // Notify client immediately — model is known before any async work
   // Pass existing CLI session ID if resuming (new sessions get it after first result)
   const resolvedCliKey = cliSessionKey(sid, resolvedModel)
-  let existingCliSession = cliSessionMap.get(resolvedCliKey)
+  let existingCliSession = options?.dispatch ? undefined : cliSessionMap.get(resolvedCliKey)
   callbacks.onStart?.(resolvedModel, sid, existingCliSession, {
     clientJobId: options?.clientJobId,
     generation: options?.generation,
@@ -461,14 +464,18 @@ export async function callClaudeStreaming(
   const allowedToolList = buildClaudeToolList({
     publisherTool: outputImagePublisher?.claudeAllowedTool,
   })
-  let mcpConfigArgs: string[]
-  try {
-    mcpConfigArgs = claudeMcpConfigArgs()
-  } catch (err) {
-    outputImagePublisher?.cleanup()
-    throw err
+  let mcpConfigArgs: string[] = []
+  if (!options?.dispatch) {
+    try {
+      mcpConfigArgs = claudeMcpConfigArgs()
+    } catch (err) {
+      outputImagePublisher?.cleanup()
+      throw err
+    }
   }
-  systemPrompt = `${systemPrompt}\n\n${claudeToolCapabilityPrompt(allowedToolList)}`
+  systemPrompt = options?.dispatch
+    ? `${systemPrompt}\n\n${readOnlyCapabilityPrompt('scheduled task dispatch', 'Read, Grep and Glob only; no writes, no shell, no web', 'the task owner on the Mac')}`
+    : `${systemPrompt}\n\n${claudeToolCapabilityPrompt(allowedToolList)}`
   if (outputImagePublisher) systemPrompt = `${systemPrompt}\n\n${outputImagePublisher.promptInstructions}`
 
   // Phase: thinking (waiting for Claude to start)
@@ -519,7 +526,8 @@ export async function callClaudeStreaming(
 
   // Check if we have a prior CLI session for this COS session.
   // If not, use the pre-warmed session (eliminates 2-15s cold start on first query).
-  if (!existingCliSession && preWarmedCliSessionId && resolvedModel === DEFAULT_MODEL) {
+  // Restricted dispatch never steals the pre-warmed unrestricted session.
+  if (!options?.dispatch && !existingCliSession && preWarmedCliSessionId && resolvedModel === DEFAULT_MODEL) {
     // Only the default model consumes the pre-warmed session.
     // Hey Even (Haiku) cold-starts its own session to avoid model contamination.
     existingCliSession = preWarmedCliSessionId
@@ -540,11 +548,21 @@ export async function callClaudeStreaming(
     '--output-format', 'stream-json',
     '--verbose',  // Required: stream-json requires --verbose
     '--system-prompt', systemPrompt,
-    ...mcpConfigArgs,
+    ...(options?.dispatch ? [] : mcpConfigArgs),
   ]
 
   // Full and lightweight paths share the same explicit MCP selector contract.
-  if (options?.lightweight) {
+  if (options?.dispatch) {
+    args.push(
+      '--restricted',
+      '--tools', options.dispatch.tools.join(','),
+      '--permission-mode', 'dontAsk',
+      '--strict-mcp-config',
+      '--mcp-config', '{"mcpServers":{}}',
+      '--no-session-persistence',
+      '--include-partial-messages',
+    )
+  } else if (options?.lightweight) {
     args.push(...claudePermissionArgs(getClaudeTrustMode(), tools))
   } else {
     args.push(...claudePermissionArgs(getClaudeTrustMode(), tools), '--include-partial-messages')
@@ -929,7 +947,7 @@ export async function callClaudeStreaming(
             continue
           }
           // Capture CLI session ID for future --resume (avoids cold start on next query)
-          if (event.session_id) {
+          if (event.session_id && !options?.dispatch) {
             cliSessionMap.set(resolvedCliKey, event.session_id)
             scheduleCliSessionSave()
             updateClaudeRun(run.runId, { cliSessionId: event.session_id })

package/server/lib/maintenance-lifecycle.ts

@@ -54,6 +54,12 @@ export type MaintenanceWorkKind =
   // budget must stay under COS Control's 90s drain timeout (main.swift:1853)
   // or every drain that catches a cue in flight hard-fails to Repair.
   | 'live_cue_pipeline'
+  // Scheduled-task dispatch and reconcile (6.44.0). Held for
+  // TASK_LEASE_CEILING_MS so an Update Server drain cannot unload the
+  // server while a restricted Claude submit or marker write is live.
+  // Two `task_dispatch` leases (dispatch + reconcile) are expected —
+  // acquire() is a concurrent Map, not a per-kind mutex.
+  | 'task_dispatch'
   // Miles-triggered recovery of a quarantined unsaved capture (6.19.0):
   // batch-transcribes retained WAVs into a durable scribe. Held for the whole
   // background run so an Update Server drain waits for it like any batch.

package/server/lib/model-router.ts

@@ -105,6 +105,10 @@ export async function callModelStreaming(
   }
 
   try {
+    if (options?.dispatch && !isClaudeModel(resolvedModel)) {
+      await lockedCallbacks.onError('dispatch_requires_claude')
+      return sid
+    }
     // Cursor slots fail closed — never fall through to Claude/Codex.
     if (isCursorModel(resolvedModel)) {
       await getCursorModelCatalog()

package/server/lib/morning-brief-config.ts

@@ -29,6 +29,12 @@ import {
 export const MORNING_BRIEF_PROTOCOL_VERSION = 1 as const
 export const MORNING_BRIEF_CONFIG_VERSION = 1 as const
 
+export const TASK_CATCH_UP_LIMITS = Object.freeze({
+  defaultMinutes: 180,
+  minMinutes: 30,
+  maxMinutes: 720,
+})
+
 export const MORNING_BRIEF_LIMITS = Object.freeze({
   /** How late after the slot a missed fire may still happen (Mac was asleep). */
   maxCatchUpMinutes: 12 * 60,
@@ -91,6 +97,8 @@ export interface MorningBriefConfig {
   /** 0 = Sunday … 6 = Saturday. */
   days: number[]
   catchUpMinutes: number
+  /** How late a task runAt may still count as due (not missed). */
+  taskCatchUpMinutes: number
   model?: ModelPreference
   effort?: EffortPreference
   /** Ordered: section order in the brief. */
@@ -271,6 +279,7 @@ export function defaultMorningBriefConfig(now = new Date()): MorningBriefConfig
     timezone: serverTimezone(),
     days: [1, 2, 3, 4, 5],
     catchUpMinutes: MORNING_BRIEF_LIMITS.defaultCatchUpMinutes,
+    taskCatchUpMinutes: TASK_CATCH_UP_LIMITS.defaultMinutes,
     sources: defaultSources(),
     closingInstruction: '',
     updatedAt: now.toISOString(),
@@ -389,6 +398,13 @@ export function applyMorningBriefPatch(current: MorningBriefConfig, raw: unknown
     }
     next.catchUpMinutes = minutes
   }
+  if ('taskCatchUpMinutes' in patch) {
+    const minutes = Number(patch.taskCatchUpMinutes)
+    if (!Number.isSafeInteger(minutes) || minutes < TASK_CATCH_UP_LIMITS.minMinutes || minutes > TASK_CATCH_UP_LIMITS.maxMinutes) {
+      throw new MorningBriefConfigError('invalid_task_catch_up', `taskCatchUpMinutes must be ${TASK_CATCH_UP_LIMITS.minMinutes} to ${TASK_CATCH_UP_LIMITS.maxMinutes}.`)
+    }
+    next.taskCatchUpMinutes = minutes
+  }
   if ('model' in patch) {
     if (patch.model == null || patch.model === '') {
       delete next.model
@@ -429,6 +445,7 @@ export function coerceMorningBriefConfig(raw: unknown, now = new Date()): Mornin
   const input = raw as Record<string, unknown>
   const time = typeof input.time === 'string' && TIME_RE.test(input.time.trim()) ? input.time.trim() : base.time
   const catchUp = Number(input.catchUpMinutes)
+  const taskCatchUp = Number(input.taskCatchUpMinutes)
   const model = normalizeModelPreference(input.model)
   const effort = normalizeEffortPreference(input.effort)
   let sources: MorningBriefSource[]
@@ -441,6 +458,10 @@ export function coerceMorningBriefConfig(raw: unknown, now = new Date()): Mornin
     days: normalizeDays(input.days, base.days),
     catchUpMinutes: Number.isSafeInteger(catchUp) && catchUp >= 0 && catchUp <= MORNING_BRIEF_LIMITS.maxCatchUpMinutes
       ? catchUp : base.catchUpMinutes,
+    taskCatchUpMinutes: Number.isSafeInteger(taskCatchUp)
+      && taskCatchUp >= TASK_CATCH_UP_LIMITS.minMinutes
+      && taskCatchUp <= TASK_CATCH_UP_LIMITS.maxMinutes
+      ? taskCatchUp : base.taskCatchUpMinutes,
     ...(model ? { model } : {}),
     ...(effort ? { effort } : {}),
     sources,
@@ -463,7 +484,7 @@ export function morningBriefPaths(root?: string): MorningBriefStorePaths {
   return { config: `${base}/config.json`, runs: `${base}/runs.json` }
 }
 
-function ensurePrivateDir(file: string): void {
+export function ensurePrivateDir(file: string): void {
   const dir = dirname(file)
   mkdirSync(dir, { recursive: true, mode: 0o700 })
   try { chmodSync(dir, 0o700) } catch { /* best effort */ }

package/server/lib/morning-brief-prompt.ts

@@ -30,6 +30,8 @@ export interface MorningBriefPromptInput {
   day: string
   ownerName: string
   trigger: 'scheduled' | 'manual'
+  /** Optional TASKS digest. Kept only when the full prompt still fits. */
+  taskDigest?: string
 }
 
 const WEEKDAY_NAMES = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday']
@@ -200,7 +202,7 @@ const KNOWN_IDS = new Set<MorningBriefSourceId>(MORNING_BRIEF_SOURCES.map(spec =
 
 /** Compose the brief prompt. Enabled sources become numbered sections in the
  * user's order; a section whose source has nothing to say is skipped. */
-export function composeMorningBriefPrompt(input: MorningBriefPromptInput): string {
+function assembleMorningBriefPrompt(input: MorningBriefPromptInput, includeDigest: boolean): string {
   const { config, day, ownerName, trigger } = input
   const slotMinutes = parseTime(config.time)
   const slot = `${String(Math.floor(slotMinutes / 60)).padStart(2, '0')}:${String(slotMinutes % 60).padStart(2, '0')}`
@@ -244,6 +246,11 @@ export function composeMorningBriefPrompt(input: MorningBriefPromptInput): strin
     lines.push('')
   }
 
+  if (includeDigest && input.taskDigest) {
+    lines.push(input.taskDigest)
+    lines.push('')
+  }
+
   lines.push(
     'Format for the glasses: plain text only. No markdown headings, tables, or bullet symbols; a section is its label on one line followed by short lines. ' +
     'Keep every line under 60 characters where you can, because the lens is 576 pixels wide and wraps silently. Keep the whole brief under about 60 lines; ' +
@@ -256,7 +263,14 @@ export function composeMorningBriefPrompt(input: MorningBriefPromptInput): strin
   )
   lines.push('Do not say "here is" or "I found". Do not add a preamble or a sign-off.')
 
-  const prompt = lines.join('\n')
+  return lines.join('\n')
+}
+
+export function composeMorningBriefPrompt(input: MorningBriefPromptInput): string {
+  const withDigest = assembleMorningBriefPrompt(input, true)
+  const prompt = input.taskDigest && withDigest.length <= MORNING_BRIEF_PROMPT_MAX_CHARS
+    ? withDigest
+    : assembleMorningBriefPrompt(input, false)
   return prompt.length > MORNING_BRIEF_PROMPT_MAX_CHARS
     ? `${prompt.slice(0, MORNING_BRIEF_PROMPT_MAX_CHARS - 1)}…`
     : prompt

package/server/lib/morning-brief-runtime.ts

@@ -13,9 +13,16 @@ import { maxGlobalMsgNumInDir } from '../routes/message-ref.js'
 import { dataPath } from './data-dir.js'
 import { getOwnerName } from './profile.js'
 import { durableQueryJobsEnabled } from './query-job-feature.js'
-import { queryJobCoordinator } from './query-job-runtime.js'
+import { projectPublicConversationTerminal, queryJobCoordinator } from './query-job-runtime.js'
 import { maintenanceAdmissionsOpen } from './maintenance-lifecycle.js'
 import { maxReservedGlobalMsgNum, registerMessageReservationSource } from './message-reservations.js'
+import {
+  bindTaskDispatcher,
+  dispatchDueTasks,
+  reconcileDispatch,
+  reservationsForEra,
+} from './task-dispatcher.js'
+import { composeTaskDigest, listBoard } from './task-store.js'
 import { morningBriefPaths } from './morning-brief-config.js'
 import { MorningBriefScheduler } from './morning-brief-scheduler.js'
 import {
@@ -162,9 +169,25 @@ export function probeSkill(rawName: string, workDir = resolveProviderWorkDir({ s
 
 let scheduler: MorningBriefScheduler | null = null
 let unregisterReservations: (() => void) | null = null
+let unregisterTaskReservations: (() => void) | null = null
 
 export function getMorningBriefScheduler(): MorningBriefScheduler {
   if (!scheduler) {
+    bindTaskDispatcher({
+      submit: raw => queryJobCoordinator.submit(raw),
+      findByClientGeneration: (clientJobId, generation) => queryJobCoordinator.getByClientGeneration(clientJobId, generation),
+      getSnapshot: jobId => queryJobCoordinator.getSnapshot(jobId),
+      getExecution: jobId => queryJobCoordinator.store.getExecution(jobId),
+      cancel: (jobId, generation) => queryJobCoordinator.cancel(jobId, generation),
+      complete: (jobId, input) => queryJobCoordinator.store.complete(jobId, input),
+      createSession,
+      currentMessageEra,
+      currentMessageMax,
+      durableJobsEnabled: durableQueryJobsEnabled,
+      admissionsOpen: maintenanceAdmissionsOpen,
+      projectTerminal: projectPublicConversationTerminal,
+      finishIfActive: jobId => queryJobCoordinator.finishIfActive(jobId),
+    })
     const instance = new MorningBriefScheduler({
       paths: morningBriefPaths(),
       submit: raw => queryJobCoordinator.submit(raw),
@@ -184,9 +207,15 @@ export function getMorningBriefScheduler(): MorningBriefScheduler {
         reflection: probeReflection,
         skill: name => probeSkill(name),
       }),
+      dispatchDueTasks,
+      reconcileDispatch,
+      taskDigest: async () => {
+        try { return composeTaskDigest(await listBoard()) } catch { return '' }
+      },
     })
     // The ledger row exists before the job does; its number must count.
     unregisterReservations = registerMessageReservationSource(() => instance.liveReservations(currentMessageEra()))
+    unregisterTaskReservations = registerMessageReservationSource(() => reservationsForEra(currentMessageEra()))
     scheduler = instance
   }
   return scheduler
@@ -200,4 +229,6 @@ export function stopMorningBriefScheduler(): void {
   scheduler?.stop()
   unregisterReservations?.()
   unregisterReservations = null
+  unregisterTaskReservations?.()
+  unregisterTaskReservations = null
 }

package/server/lib/morning-brief-schedule.ts

@@ -74,8 +74,10 @@ export function shiftDay(day: string, delta: number): string {
  * The instant at which `day` reaches `minutes` past midnight in `timezone`.
  * Two-pass offset correction: read the zone's wall clock at a UTC guess, apply
  * the difference, and re-check once so a DST transition between the guess and
- * the target lands on the right side. On a non-existent local time (spring
- * forward) this returns the first instant after the gap.
+ * the target lands on the right side. A non-existent local time local-clocks
+ * ~60 min early on the old offset (02:30 CDT gap → 01:30; 02:00 → 01:00);
+ * 03:00 lands on 03:00 CDT. `taskInstant` adds 60 min when earlier:
+ * 02:00→03:00, 02:30→03:30.
  */
 export function zonedInstant(day: string, minutes: number, timezone: string): number {
   const [y, m, d] = day.split('-').map(Number)
@@ -90,6 +92,21 @@ export function zonedInstant(day: string, minutes: number, timezone: string): nu
   return guess
 }
 
+/** Instant for a task runAt. If the rendered local (day, minutes) is earlier
+ * than requested (spring-forward gap), add 60 minutes up to three times.
+ * Fall back to the first zonedInstant. */
+export function taskInstant(day: string, minutes: number, timezone: string): number {
+  const first = zonedInstant(day, minutes, timezone)
+  let instant = first
+  for (let pass = 0; pass < 3; pass++) {
+    const clock = localClock(instant, timezone)
+    const earlier = clock.day < day || (clock.day === day && clock.minutes < minutes)
+    if (!earlier) return instant
+    instant += 60 * 60_000
+  }
+  return first
+}
+
 function daysBetween(fromDay: string, toDay: string): number {
   const [fy, fm, fd] = fromDay.split('-').map(Number)
   const [ty, tm, td] = toDay.split('-').map(Number)

package/server/lib/morning-brief-scheduler.ts

@@ -70,6 +70,10 @@ export interface MorningBriefSchedulerDeps {
   now?: () => number
   tickMs?: number
   log?: (line: string) => void
+  dispatchDueTasks?: () => Promise<{ fired: number; reason?: string }>
+  reconcileDispatch?: () => Promise<{ fired: number; reason?: string }>
+  onDispatch?: (result: { fired: number; reason?: string }) => void
+  taskDigest?: (day: string) => string | Promise<string>
 }
 
 export class MorningBriefRunError extends Error {
@@ -134,6 +138,10 @@ export class MorningBriefScheduler {
   /** One chain for tick() AND runNow(): the in-progress read in runNow and the
    * ledger write in fire() must never interleave with a scheduled fire. */
   private serial: Promise<unknown> = Promise.resolve()
+  private serialTasks: Promise<unknown> = Promise.resolve()
+  private serialTasksDepth = 0
+  private dispatchInFlight: Promise<unknown> | null = null
+  private reconcileInFlight: Promise<unknown> | null = null
   private readonly now: () => number
   private readonly log: (line: string) => void
   readonly quarantinedConfig?: string
@@ -190,6 +198,23 @@ export class MorningBriefScheduler {
 
   /** One scheduler pass. Serialised: a slow submission never overlaps the next tick. */
   tick(): Promise<TickResult> {
+    if (this.deps.dispatchDueTasks && !this.dispatchInFlight) {
+      const mine = this.serializeTaskWork(() => this.deps.dispatchDueTasks!())
+      this.dispatchInFlight = mine
+      void mine.then(
+        result => this.deps.onDispatch?.(result),
+        () => undefined,
+      ).finally(() => {
+        if (this.dispatchInFlight === mine) this.dispatchInFlight = null
+      })
+    }
+    if (this.deps.reconcileDispatch && !this.reconcileInFlight) {
+      const mine = this.serializeTaskWork(() => this.deps.reconcileDispatch!())
+      this.reconcileInFlight = mine
+      void mine.finally(() => {
+        if (this.reconcileInFlight === mine) this.reconcileInFlight = null
+      })
+    }
     if (this.tickInFlight) return this.tickInFlight
     this.tickInFlight = this.serialize(() => this.runTick()).finally(() => { this.tickInFlight = null })
     return this.tickInFlight
@@ -201,6 +226,22 @@ export class MorningBriefScheduler {
     return next
   }
 
+  private serializeTaskWork<T>(fn: () => Promise<T> | T): Promise<T> {
+    if (this.serialTasksDepth > 0) {
+      return Promise.reject(new Error('nested serializeTaskWork'))
+    }
+    const run = this.serialTasks.then(async () => {
+      this.serialTasksDepth += 1
+      try {
+        return await fn()
+      } finally {
+        this.serialTasksDepth -= 1
+      }
+    })
+    this.serialTasks = run.then(() => undefined, () => undefined)
+    return run
+  }
+
   private async runTick(): Promise<TickResult> {
     if (!this.deps.durableJobsEnabled()) return { fired: false, reason: 'durable_jobs_off' }
     if (!this.deps.admissionsOpen()) return { fired: false, reason: 'admissions_closed' }
@@ -309,7 +350,14 @@ export class MorningBriefScheduler {
     // Ledger first. A crash after this line is a resume, not a second brief.
     this.replaceRun(run)
 
-    const prompt = composeMorningBriefPrompt({ config: this.config, day, ownerName: this.deps.ownerName(), trigger })
+    const digest = this.deps.taskDigest ? await this.deps.taskDigest(day) : undefined
+    const prompt = composeMorningBriefPrompt({
+      config: this.config,
+      day,
+      ownerName: this.deps.ownerName(),
+      trigger,
+      ...(digest ? { taskDigest: digest } : {}),
+    })
     try {
       const admission = await this.deps.submit({
         clientJobId,

package/server/lib/python-bridge.ts

@@ -78,9 +78,9 @@ if (pythonAvailable) {
  * pipeline is configured; otherwise resolves to an empty/no-op result so the
  * context builder degrades gracefully on a standalone install.
  */
-export function callPython(args: string[], timeoutMs = 30_000): Promise<unknown> {
+export function callPython(args: string[], timeoutMs = 30_000, input?: string): Promise<unknown> {
   if (pythonAvailable) {
-    return callPythonDirect(args, timeoutMs)
+    return callPythonDirect(args, timeoutMs, input)
   }
   return Promise.resolve(standaloneNoop(args))
 }
@@ -186,6 +186,13 @@ function standaloneNoop(args: string[]): unknown {
       return { error: 'cos_pipeline_not_configured' }
     }
     case 'badges': return {}
+    case 'task-rows':
+    case 'task-capture':
+    case 'task-set-run-at':
+    case 'task-set-marker':
+    case 'task-move':
+    case 'task-check':
+      return { error: { code: 'cos_pipeline_not_configured' } }
     default: return {}
   }
 }
@@ -199,15 +206,18 @@ function argLimit(args: string[], fallback: number): number {
 }
 
 /** Full Python bridge — requires the user's venv + cos_api_bridge.py. */
-function callPythonDirect(args: string[], timeoutMs: number): Promise<unknown> {
+function callPythonDirect(args: string[], timeoutMs: number, input?: string): Promise<unknown> {
   return new Promise((resolvePromise, reject) => {
-    execFile(
+    const child = execFile(
       PYTHON_BIN!,
       [BRIDGE_SCRIPT!, ...args],
       { cwd: COS_SCRIPTS_DIR!, timeout: timeoutMs, maxBuffer: 1024 * 1024 },
       (err, stdout, stderr) => {
         if (err) {
           const msg = stderr?.trim() || err.message
+          if (typeof msg === 'string' && msg.includes('unknown command')) {
+            return resolvePromise({ error: { code: 'cos_pipeline_not_configured', message: msg } })
+          }
           return reject(new Error(`python-bridge: ${msg}`))
         }
         try {
@@ -217,5 +227,9 @@ function callPythonDirect(args: string[], timeoutMs: number): Promise<unknown> {
         }
       }
     )
+    if (input != null) {
+      child.stdin?.write(input)
+      child.stdin?.end()
+    }
   })
 }

package/server/lib/query-job-coordinator.ts

@@ -3,6 +3,7 @@ import {
   QueryJobStore,
   QueryJobStoreError,
   type QueryJobAdmissionResult,
+  type QueryJobMutationResult,
   type QueryJobSubscription,
 } from './query-job-store.js'
 import {
@@ -502,7 +503,7 @@ export class QueryJobCoordinator {
     }
   }
 
-  async cancel(jobId: string, generation: number): Promise<QueryJobSnapshot> {
+  async cancel(jobId: string, generation: number): Promise<QueryJobMutationResult> {
     const result = await this.store.cancel(jobId, generation)
     if (result.applied) {
       const active = this.active.get(jobId)
@@ -514,7 +515,12 @@ export class QueryJobCoordinator {
         this.finishActive(active)
       }
     }
-    return result.job
+    return result
+  }
+
+  finishIfActive(jobId: string): void {
+    const active = this.active.get(jobId)
+    if (active) this.finishActive(active)
   }
 
   getSnapshot(jobId: string, generation?: number): Promise<QueryJobSnapshot> {

package/server/lib/query-job-runtime.ts

@@ -92,8 +92,14 @@ export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<
   }
   try {
     const resolved = await resolveQueryAttachments(input)
+    const { dispatch: _strippedDispatch, origin: rawOrigin, ...rest } = input
+    const origin = (rawOrigin && typeof rawOrigin === 'object' && (rawOrigin as { kind?: string }).kind === 'task')
+      ? undefined
+      : rawOrigin
+    if (_strippedDispatch !== undefined || origin !== rawOrigin) queryJobStore.noteOriginStripped()
     return {
-      ...input,
+      ...rest,
+      ...(origin !== undefined ? { origin } : {}),
       messageEra: activeEra,
       attachmentIds: resolved.ids,
       attachmentRefs: resolved.refs,
@@ -124,7 +130,7 @@ function originStamp(request: QueryJobRequest): { origin?: NonNullable<QueryJobR
  * cache. Journaled request/response text always wins over bridge-written
  * partial rows; validated media refs may be merged because output media can
  * finish immediately before a crash. Exact provenance collapses duplicates. */
-async function projectPublicConversationTerminal(
+export async function projectPublicConversationTerminal(
   job: QueryJobSnapshot,
   request: QueryJobRequest,
 ): Promise<void> {
@@ -334,6 +340,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
       requestAttachments: resolvedAttachments.refs,
       attachmentPromptBlock: resolvedAttachments.promptBlock,
       sessionLockHeld: true,
+      ...(request.dispatch ? { dispatch: request.dispatch } : {}),
     },
   )
 }

package/server/lib/query-job-store.ts

@@ -319,6 +319,7 @@ export class QueryJobStore {
       interruptedOnBoot: 0,
       evictedHydratedJobs: 0,
       originDropped: 0,
+      originStripped: 0,
       fingerprintMismatches: 0,
       lastErrorCode: null,
       lastSuccessfulWriteAt: null,
@@ -1162,6 +1163,10 @@ export class QueryJobStore {
     this.health.counts = counts
   }
 
+  noteOriginStripped(): void {
+    this.health.originStripped++
+  }
+
   getHealth(): QueryJobStoreHealth {
     this.refreshHealth()
     return clone(this.health)