@gotcos/glasses-server 6.50.4 → 6.52.0

package/server/lib/session-stream-producer.ts

@@ -22,6 +22,7 @@ import {
   type SessionStreamProvider,
 } from './session-stream-events.js'
 import { beginAttachedTurn, publishSessionStream, sessionStreamKey } from './session-stream-bus.js'
+import { releaseAfterTranscriptCatchUp } from './session-transcript-watcher.js'
 
 /**
  * Ceiling on the incomplete trailing line held between chunks.
@@ -68,8 +69,15 @@ export function createLineAssembler(maxCarry: number = MAX_LINE_CARRY_CHARS): Li
 export interface AttachedTurnStream {
   /** Wire this as the adapter's `observeStdout`. Never throws. */
   observeStdout(chunk: string): void
-  /** Call exactly once when the turn settles, whatever its outcome. Never throws. */
-  finish(outcome: 'done' | 'idle'): void
+  /**
+   * Call exactly once when the turn settles, whatever its outcome. Never throws.
+   *
+   * The terminal status is published before this returns. The hold-off lifts once the
+   * session's transcript watcher is at end of file (6.52.0 QA round 2): at once when no
+   * watcher tails the session, within `CATCH_UP_TIMEOUT_MS` otherwise. The promise
+   * settles then and never rejects; callers need not await it.
+   */
+  finish(outcome: 'done' | 'idle'): Promise<void>
 }
 
 export interface AttachedTurnStreamOptions {
@@ -96,6 +104,7 @@ export function createAttachedTurnStream(options: AttachedTurnStreamOptions): At
   const assembler = createLineAssembler()
   const endTurn = beginAttachedTurn(key)
   let finished = false
+  let released: Promise<void> = Promise.resolve()
 
   const emit = (draft: SessionStreamDraft) => {
     try {
@@ -117,8 +126,8 @@ export function createAttachedTurnStream(options: AttachedTurnStreamOptions): At
         /* a malformed chunk costs its own events and nothing else */
       }
     },
-    finish(outcome: 'done' | 'idle'): void {
-      if (finished) return
+    finish(outcome: 'done' | 'idle'): Promise<void> {
+      if (finished) return released
       finished = true
       try {
         for (const line of assembler.flush()) {
@@ -128,11 +137,21 @@ export function createAttachedTurnStream(options: AttachedTurnStreamOptions): At
         /* fall through: the terminal status and the gate release matter more */
       }
       emit({ kind: 'status', state: outcome })
+      // NOT released here. The CLI wrote this turn's records to the transcript as well,
+      // and the watcher reads the hold-off only when it reads: released now, its next
+      // check would show the last lines again and put `working` after this `done`
+      // (6.52.0 QA round 2). The watcher module brings every watcher on this session to
+      // end of file while the hold still applies, then releases, within a bound.
       try {
-        endTurn()
+        released = releaseAfterTranscriptCatchUp(key, endTurn)
       } catch {
-        /* the gate is a Map delete; there is no failure mode to report */
+        try {
+          endTurn()
+        } catch {
+          /* the gate is a Map delete; there is no failure mode to report */
+        }
       }
+      return released
     },
   }
 }

package/server/lib/session-transcript-watcher.ts

@@ -141,6 +141,12 @@ export interface TranscriptTailer {
   state(): 'working' | 'idle' | 'done' | null
   /** True once this tailer has handed off to the poll. Terminal; never clears. */
   degraded(): boolean
+  /**
+   * One HELD pass (6.52.0 QA round 2): move the cursor to end of file and emit nothing.
+   * Only `releaseAfterTranscriptCatchUp` calls it, while a Continue turn still holds the
+   * session. Resolves; never rejects.
+   */
+  skipToEnd(): Promise<void>
 }
 
 /**
@@ -319,6 +325,18 @@ export function createTranscriptTailer(options: TranscriptTailerOptions): Transc
         /* a tick that throws is a tick that produced nothing; the next one retries */
       }
     },
+    async skipToEnd(): Promise<void> {
+      if (degraded) return
+      try {
+        const st = await stat(options.path)
+        if (!st.isFile()) return
+        // The RAW end, not the last newline: see `releaseAfterTranscriptCatchUp`. Moving
+        // backward on a truncated file is what `tick` does too.
+        cursor = { offset: st.size }
+      } catch {
+        /* unreadable right now: the cursor stays, and the caller's bound still releases */
+      }
+    },
   }
 }
 
@@ -330,6 +348,8 @@ interface WatcherEntry {
   refs: number
   timer: ReturnType<typeof setInterval>
   ticking: boolean
+  /** The pass `ticking` guards, so a catch-up can wait for it. Null when none runs. */
+  inflight: Promise<void> | null
   tailer: TranscriptTailer
 }
 
@@ -342,6 +362,8 @@ export interface AcquireWatcherOptions {
   /** Where to start. Production passes the file's current size. */
   offset: number
   intervalMs?: number
+  /** Injected for tests: the tail this entry drives. Production builds it from the fields above. */
+  tailer?: TranscriptTailer
 }
 
 /**
@@ -358,7 +380,7 @@ export function acquireTranscriptWatcher(options: AcquireWatcherOptions): () =>
     return releaseOnce(options.key)
   }
 
-  const tailer = createTranscriptTailer(options)
+  const tailer = options.tailer ?? createTranscriptTailer(options)
   const timer = setInterval(() => {
     const entry = watchers.get(options.key)
     if (!entry) return
@@ -367,12 +389,16 @@ export function acquireTranscriptWatcher(options: AcquireWatcherOptions): () =>
     // next tick sees everything the skipped one would have.
     if (entry.ticking) return
     entry.ticking = true
-    void tailer.tick().finally(() => { entry.ticking = false })
+    // Kept on the entry rather than voided, so a catch-up can wait for it (below).
+    entry.inflight = tailer.tick().catch(() => {}).finally(() => {
+      entry.ticking = false
+      entry.inflight = null
+    })
   }, options.intervalMs ?? POLL_INTERVAL_MS)
   // Never hold the process open. A tail is a view, not work.
   if (typeof (timer as any).unref === 'function') (timer as any).unref()
 
-  watchers.set(options.key, { refs: 1, timer, ticking: false, tailer })
+  watchers.set(options.key, { refs: 1, timer, ticking: false, inflight: null, tailer })
   return releaseOnce(options.key)
 }
 
@@ -410,6 +436,97 @@ export function transcriptWatcherDegraded(key: string): boolean {
   return watchers.get(key)?.tailer.degraded() ?? false
 }
 
+// ---------------------------------------------------------------------------
+// Catch-up before a Continue turn's hold-off lifts (6.52.0 QA round 2)
+// ---------------------------------------------------------------------------
+// The hold-off is read when a tick READS, and a tick runs once a second. The CLI
+// (`claude -p`, `codex exec resume`) writes each record to the transcript tailed here
+// AND prints it on stdout, which the producer maps. Records written after the watcher's
+// last check of the turn were therefore read by its first check AFTER the release, when
+// nothing held them off: the final reply appeared twice on the lens, and the watcher's
+// resume put `working` after `done`. QA reproduced it with the real tailer and producer
+// on the real codex exec sample.
+//
+// So the producer hands its release to `releaseAfterTranscriptCatchUp`, which, while the
+// hold still applies:
+//   1. waits for a tick already in flight, so it reads the hold-off while it holds;
+//   2. runs one held pass that moves the cursor to END OF FILE and emits nothing;
+//   3. only then releases.
+//
+// RAW END OF FILE, not the last newline. On an ordinary exit the child has closed, so
+// every byte there is the turn's. A record cut mid-write left BEHIND the cursor would
+// join the next real record into one unparseable line and lose it; a fragment AHEAD of
+// it is the tail of a record, which never parses (the outer record's closing brace
+// follows it), so the grammar drops it.
+//
+// BOUNDED. The pass is one stat, but a wedged volume or a tick that never settles must
+// not keep the hold-off: that would silence the session for good, which the producer
+// already names as worse than a duplicated line. After `CATCH_UP_TIMEOUT_MS` the release
+// happens anyway and is counted, as is a pass that throws.
+
+/** Ceiling on the catch-up. The pass is one stat; this is for a wedged disk, not an expected wait. */
+export const CATCH_UP_TIMEOUT_MS = 500
+
+const catchUpCounts = { timedOut: 0, failed: 0 }
+
+/** Catch-ups that released on the bound, or on a pass that threw, since this server started. */
+export function transcriptCatchUpCounts(): { timedOut: number; failed: number } {
+  return { ...catchUpCounts }
+}
+
+async function catchUpToEnd(entry: WatcherEntry): Promise<void> {
+  // 1. A check already reading: let it read the hold-off while it still holds.
+  while (entry.ticking && entry.inflight) await entry.inflight
+  // 2. One held pass, guarded like a tick so the timer cannot run another beside it.
+  entry.ticking = true
+  const pass = Promise.resolve().then(() => entry.tailer.skipToEnd())
+  entry.inflight = pass.catch(() => {}).finally(() => {
+    entry.ticking = false
+    entry.inflight = null
+  })
+  await pass
+}
+
+/**
+ * Bring every watcher on this session to end of file, THEN call `release`.
+ *
+ * `release` runs exactly once: at once when nothing tails the session, otherwise after
+ * the catch-up or after `timeoutMs`, whichever is first. The promise settles when it has
+ * run and never rejects.
+ */
+export function releaseAfterTranscriptCatchUp(
+  key: string,
+  release: () => void,
+  timeoutMs: number = CATCH_UP_TIMEOUT_MS,
+): Promise<void> {
+  const releaseSafely = () => {
+    try {
+      release()
+    } catch {
+      /* the release is a Map delete; there is no failure mode to report */
+    }
+  }
+  const entry = watchers.get(key)
+  if (!entry) {
+    // Nothing tails this session, so nothing can read the turn's records late.
+    releaseSafely()
+    return Promise.resolve()
+  }
+
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const bound = new Promise<'timed_out'>(resolve => {
+    timer = setTimeout(() => resolve('timed_out'), Math.max(0, timeoutMs))
+    if (typeof (timer as any).unref === 'function') (timer as any).unref()
+  })
+  const work = catchUpToEnd(entry).then(() => 'caught_up' as const, () => 'failed' as const)
+  return Promise.race([work, bound]).then(outcome => {
+    clearTimeout(timer)
+    if (outcome === 'timed_out') catchUpCounts.timedOut++
+    else if (outcome === 'failed') catchUpCounts.failed++
+    releaseSafely()
+  })
+}
+
 export function __resetTranscriptWatchersForTests(): void {
   for (const entry of watchers.values()) clearInterval(entry.timer)
   watchers.clear()

package/server/lib/thread-occupancy.ts

@@ -156,11 +156,18 @@ export interface OccupancyProbes {
    * sub-agent is open, the session has not ended, AND the registry record says `idle`
    * with `statusUpdatedAt` at or after the Stop (Claude flips it only when every Stop
    * hook has returned, 12-38 s after the Stop on the release Mac, which is when a prompt
-   * queued at the desk would dequeue). Null otherwise, and always null for Codex.
+   * queued at the desk would dequeue). Null otherwise.
    * OPTIONAL, and its absence is the default: attached by `withHookTurnClock` at the
    * composition root only when `COS_SESSION_HOOKS` is on, so the pure gate never reads
    * the environment.
    *
+   * 6.51.0, CODEX: `withCodexTurnClock` answers for Codex threads from the rollout's own
+   * turn markers: the newest is `task_complete`/`turn_complete`, so the engine closed the
+   * turn. Safe to read idle at once for Codex in a way it never was for a Claude Stop,
+   * because every write into a held Codex thread goes through the app's own queue
+   * (`codex-live-queue.ts`), which the engine itself serialises behind any turn it starts
+   * next; nothing is ever written beside the holder.
+   *
    * What it buys: a foreign Desktop holder whose turn the engine has closed reads `idle`
    * at once instead of after the 30 s transcript window. The transcript's mtime is not
    * consulted: the bookkeeping rows Claude writes as the hooks finish are exactly what
@@ -177,6 +184,13 @@ export interface OccupancyProbes {
     cwd: string
     hasConversation: boolean
   } | null
+  /**
+   * 6.51.0: is this Cursor IDE composer mid-turn, by its own hook events (Cursor runs the
+   * COS session hook from `~/.claude/settings.json`)? True only on positive evidence: a
+   * prompt or tool event newer than the last Stop, inside the open-turn ceiling. OPTIONAL;
+   * absent, null, or a throw keeps the 6.50 verdict (`unsupported_provider`).
+   */
+  cursorComposerTurnOpen?: (threadId: string) => boolean | null
 }
 
 /**
@@ -287,11 +301,11 @@ function readHolderActivity(
   }
   const activity = holderActivity(mtime, nowMs)
   if (activity !== 'working') return activity
-  // THE B6 CLAUSE. Only a `working` verdict is revisited, only for Claude, only with a
-  // real clock behind it, and only when the hook probe VOUCHES that the engine closed
-  // the turn (null is strict). `unknown` stays unknown: the clause narrows a refusal,
-  // never a doubt.
-  if (provider !== 'claude' || typeof probes.holderTurnEndedAtMs !== 'function' || typeof mtime !== 'number') return activity
+  // THE B6 CLAUSE. Only a `working` verdict is revisited, only for Claude (6.51.0: and
+  // Codex, from its rollout's turn markers), only with a real clock behind it, and only
+  // when the probe VOUCHES that the engine closed the turn (null is strict). `unknown`
+  // stays unknown: the clause narrows a refusal, never a doubt.
+  if ((provider !== 'claude' && provider !== 'codex') || typeof probes.holderTurnEndedAtMs !== 'function' || typeof mtime !== 'number') return activity
   let stopAt: number | null
   try {
     stopAt = probes.holderTurnEndedAtMs(provider, threadId)
@@ -612,7 +626,16 @@ export function threadOccupancy(
       return { attachable: false, owners: [], reason: 'probe_failed' }
     }
     if (!session || session.hasConversation !== true) {
-      return { attachable: false, owners: [], reason: 'unsupported_provider' }
+      // 6.51.0: still never attachable (Gate 0: an IDE composer is not resumed from
+      // outside), but a composer the hooks show MID-TURN is working, not unsupported, so
+      // a turn spoken at it can wait for its Stop hook. The reason is the only change.
+      let open: boolean | null = null
+      try {
+        open = typeof probes.cursorComposerTurnOpen === 'function' ? probes.cursorComposerTurnOpen(threadId) : null
+      } catch {
+        open = null
+      }
+      return { attachable: false, owners: [], reason: open === true ? 'native_thread_working' : 'unsupported_provider' }
     }
     return { attachable: true, owners: [], reason: null }
   }

package/server/routes/agent-session-bindings.ts

@@ -344,6 +344,16 @@ export interface AgentSessionBindingsDeps {
    */
   deliverLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number; clientTurnId?: string }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; pid?: number | null }>
 
+  /**
+   * 6.51.0: put a Codex turn into the Codex app's OWN queue when the app holds the thread.
+   *
+   * `makeCodexLiveDeliverer` from `server/lib/codex-live-queue-deps.ts`. Separate from
+   * `deliverLiveTurn` on purpose, so the Claude branch is byte-for-byte 6.50. Asked only
+   * when the gate's verdict carries a foreign writer on a Codex thread; absent, that turn
+   * spawns exactly as before.
+   */
+  deliverCodexLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; foreignHolder: boolean }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; queuedId?: string | null }>
+
   /**
    * The self-recursion ledger. Defaults to the real process-wide one.
    *
@@ -498,6 +508,11 @@ export type WriteRefusal =
   // held as retryable and the retry re-reads before doing anything (see
   // `session-peer-inbox.ts`); it is never a fence, because nothing here ran a child.
   | 'live_unverified'
+  // 6.51.0: the Codex app holds this thread and `codex queue` did not take the turn.
+  // Nothing was queued. Never answered by spawning: a resume child against a held
+  // thread dies on "already has an active writer" after the prompt is written, which
+  // is the ambiguous fence this whole branch exists to avoid.
+  | 'codex_live_unavailable'
   // ------------------------------------------------------------------- fork
   //
   // Fork gets its OWN members rather than reusing the ones above, and the reason
@@ -572,6 +587,8 @@ export const WRITE_REASON_COPY: Record<Exclude<WriteRefusal, OccupancyReason>, s
     'COS lost track of this turn after sending it. Open the thread on your Mac and check before sending again.',
   live_unverified:
     'Sent, not yet confirmed. Send again: COS checks before sending twice.',
+  codex_live_unavailable:
+    'The Codex app has this thread open, and COS could not hand it the message. Nothing was sent. Send it from the Codex app, or fork it.',
   turn_failed:
     'COS could not run this turn. Nothing was sent. You can try again.',
 
@@ -1284,6 +1301,8 @@ export const ATTACHED_COPY = 'Attached. COS is driving the original thread.'
 export const TURN_SENT_COPY = 'Sent to the original thread.'
 /** 6.49.0: the turn went into the running session, where the desk will see it. */
 export const TURN_SENT_LIVE_COPY = 'Sent to the open session. It will show where you left it.'
+/** 6.51.0: a Codex turn handed to the Codex app's own queue for the thread it has open. */
+export const TURN_SENT_CODEX_QUEUE_COPY = 'Queued in the Codex app. It runs when the current turn ends, or right away if the thread is idle.'
 /**
  * How long the route waits for the session's transcript to show acceptance.
  *
@@ -1392,18 +1411,18 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
    * one place, so the write routes cannot come to a different conclusion than the
    * probe the user was shown a second earlier.
    */
-  const runOccupancy = (provider: string, threadId: string): AttachabilityBody => {
-    let verdict: Occupancy
+  const detectOccupancy = (provider: string, threadId: string): Occupancy => {
     try {
-      verdict = detect(provider, threadId, deps.probes, deps.dirs)
+      return detect(provider, threadId, deps.probes, deps.dirs)
     } catch (error) {
       // `threadOccupancy` already contains its own probe try/catch, so reaching
       // here means the detector itself threw. Logged without the thread id.
       console.error(`[agent-session-bindings] occupancy threw: ${error instanceof Error ? error.message : error}`)
-      verdict = { attachable: false, owners: [], reason: 'probe_failed' }
+      return { attachable: false, owners: [], reason: 'probe_failed' }
     }
-    return projectAttachability(verdict)
   }
+  const runOccupancy = (provider: string, threadId: string): AttachabilityBody =>
+    projectAttachability(detectOccupancy(provider, threadId))
 
   const refuseAttach = (res: Response, reason: WriteRefusal): void => {
     res.status(refusalStatus(reason)).json({
@@ -2153,9 +2172,16 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // session started in the gap is exactly the residual risk option B leaves
       // open, and it is terminal here rather than a warning because COS has no
       // cross-process lock that could fence a live desktop writer.
-      const verdict = runOccupancy(binding.provider, binding.nativeThreadId)
+      const detected = detectOccupancy(binding.provider, binding.nativeThreadId)
+      const verdict = projectAttachability(detected)
       stage('gate')
       if (!verdict.attachable) return refuseTurn(verdict.reason ?? 'probe_failed')
+      // 6.51.0: the SAME verdict says whether a live process that is not ours holds the
+      // thread. Only the declared idle-holder exemption can carry one on an attachable
+      // verdict (`projectAttachability` refuses anything else), so this is that fact.
+      const foreignHolder = detected.idleHolder === true
+        && Array.isArray(detected.owners)
+        && detected.owners.some(owner => owner?.selfOwned !== true)
 
       const head = await readHead(binding.provider, binding.nativeThreadId)
       stage('head')
@@ -2238,6 +2264,72 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         // suspect_expired: nothing reached a session. Spawn as always.
       }
 
+      // 6.51.0: CODEX, WHEN THE CODEX APP HOLDS THE THREAD. Its app-server keeps the
+      // writer lock for as long as the thread is open, so the resume child below cannot
+      // run (it exits on "already has an active writer" after the prompt is written, and
+      // that fence is what August's two Codex Continues left behind). `codex queue`
+      // hands the turn to that app-server's own queue instead: it runs at the end of the
+      // current turn, or within seconds if the thread is idle (canary in
+      // `codex-live-queue.ts`). A thread nobody holds never gets here.
+      if (binding.provider === 'codex' && foreignHolder && typeof deps.deliverCodexLiveTurn === 'function') {
+        let live: { ok: boolean; reason: string; verifiedBy?: string | null; queuedId?: string | null } | null = null
+        try {
+          live = await deps.deliverCodexLiveTurn({
+            provider: binding.provider,
+            sessionId: binding.nativeThreadId,
+            prompt,
+            foreignHolder: true,
+          })
+        } catch (error) {
+          console.error(`[agent-session-bindings] codex live delivery threw: ${error instanceof Error ? error.message : error}`)
+          live = null
+        }
+        stage(`codex-live(${live?.reason ?? 'threw'})`)
+        if (live?.ok) {
+          console.log(`[agent-session-bindings] turn delivered live provider=codex turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} queuedId=${live.queuedId ?? 'null'}`)
+          respond(200, {
+            turnId,
+            outcome: 'completed',
+            deliveryState: 'delivered',
+            via: 'live',
+            retryable: false,
+            changed: false,
+            revision: null,
+            reason: null,
+            reasonCopy: TURN_SENT_CODEX_QUEUE_COPY,
+          })
+          return
+        }
+        // The operator switched this off: the 6.50 path, unchanged, whatever it does.
+        if (live?.reason !== 'disabled') {
+          // A throw, a timeout, or a confirmation we could not read: a row MAY be in the
+          // app's queue. Unlike the Claude hop, nothing can re-check that before a resend
+          // (QA, 6.51.0), and a retryable answer would have the drainer insert the same
+          // sentence at every turn end until the TTL. So it is what every other unproven
+          // delivery is: ambiguous, ledgered (a replay answers the same), and fenced until
+          // a person looks at the Codex app's queue and releases it.
+          if (live === null || live.reason === 'unverified') {
+            guard.fence(key, 'native_target_fenced', {
+              provider: binding.provider,
+              headBefore: head.digest,
+              turnId,
+              bindingId,
+              now: Date.now(),
+              adapterReason: 'codex_queue_unverified',
+              fenceSite: 'ambiguous',
+              spawns: [],
+            })
+            console.warn(`[agent-session-bindings] fence set site=codex_live provider=codex target=${opaqueRevision(key)} turnId=${turnId} bindingId=${bindingId} headBefore=${head.digest} adapterReason=codex_queue_unverified`)
+            return reportAmbiguous()
+          }
+          // Nothing was queued, and the child cannot run against a held thread. Not
+          // retryable: a missing binary or a CLI that refused does not heal on a 20 s
+          // sweep, and a retryable reason would have the queue drainer re-run it for the
+          // whole TTL (`isRetryableDelivery` trusts the route's own verdict).
+          return refuseTurn('codex_live_unavailable', { retryable: false })
+        }
+      }
+
       // THE QUEUE POINT. Every gate is now behind us — body, replay, queued-prompt,
       // lease, target, epoch, fence, claim, occupancy, head baseline, pin — so a
       // refusal still reaches the user immediately and precisely. Only the spawn is

package/server/routes/agent-sessions.ts

@@ -29,6 +29,8 @@ import {
   emptySessionListDropped,
   loadClaudeDesktopAliases,
   loadCursorComposerNames,
+  loadCodexThreadNames,
+  idFromCodexFilename,
   parseAgentSession,
   type AgentProvider,
   type AgentSessionRoots,
@@ -39,7 +41,7 @@ import {
 import { searchAgentSessions, type AgentSessionSearchHit } from '../lib/agent-session-search.js'
 import { claudeSessionNamesVisible, claudeSessionsDir, claudeSessionsEnabled, readClaudePeerRecords, registryFacts } from './claude-sessions.js'
 import type { ClaudePeerRecord } from '../lib/claude-session-registry.js'
-import { deriveForRow } from '../lib/session-hooks-runtime.js'
+import { deriveForRow, signalFor } from '../lib/session-hooks-runtime.js'
 import { derivedRowFields, type DerivedSessionState } from '../lib/session-state-derive.js'
 import { queuedTurnsFields, queuedWaitingLookup } from '../lib/thread-turn-queue-store.js'
 import { isAttachedTurnActive, sessionStreamKey } from '../lib/session-stream-bus.js'
@@ -387,6 +389,14 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
         attachedTurn: isAttachedTurnActive(sessionStreamKey('claude', row.session_id)),
       }))
     }
+    // 6.51.0: a Cursor composer whose OWN hook events reached the store (Cursor runs the COS
+    // session hook from ~/.claude/settings.json) gets the same one derivation, from the
+    // signal alone. Hook-grounded only: a Cursor row with no events keeps exactly the 6.50
+    // shape, and nothing is inferred from its file times here.
+    for (const row of sessions) {
+      if (row.provider !== 'cursor' || !signalFor(row.session_id)) continue
+      derivedById.set(row.session_id, deriveForRow({ sessionId: row.session_id, now, remember: false }))
+    }
     const queuedOf = queuedWaitingLookup(now)
     res.json({
       sessions: sessions.map((row, index) => withRunning(toEntry(row, activity[index], derivedById.get(row.session_id), queuedOf(row.provider, row.session_id)), running)),
@@ -474,7 +484,16 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
     // `parsed.truncated` says so out loud, and the counts are then counts of what was
     // READ. Presenting a partial count as the session total would be the same
     // dishonesty as a silent cap, so the digest omits the number entirely instead.
-    const parsed = await parseAgentSession(provider, found)
+    // 6.52.0: a Codex thread is titled by its own name, as its list row already is. Keyed
+    // by the rollout's FILENAME id first: a cloned thread's `session_meta` carries its
+    // parent's id (see `listCodexSessions`), and the parent's name would be the wrong one.
+    let codexThreadName: string | undefined
+    if (provider === 'codex') {
+      const names = await loadCodexThreadNames(agentSessionRoots().codexSessions)
+      const fileId = idFromCodexFilename(found.split('/').pop() || '')
+      codexThreadName = (fileId ? names.get(fileId) : undefined) || names.get(sessionId) || undefined
+    }
+    const parsed = await parseAgentSession(provider, found, codexThreadName ? { codexThreadName } : {})
     // 6.50.0 `?turns=N`: the recent conversation, for the lens's scroll-up history. Only
     // when asked, so the detail poll and every older client get the same bytes as before.
     // A failure here costs the history, never the detail page.
@@ -506,6 +525,9 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
         transcript: { inFlight: running.occupied.get(parsed.session_id)?.activeRecently === true, lastActivityAt: activity.lastActivityAt ? Date.parse(activity.lastActivityAt) : null },
         attachedTurn: isAttachedTurnActive(sessionStreamKey('claude', parsed.session_id)),
       })
+    } else if (provider === 'cursor' && signalFor(parsed.session_id)) {
+      // 6.51.0: the detail agrees with its list row (hook-grounded Cursor state).
+      derived = deriveForRow({ sessionId: parsed.session_id, remember: false })
     }
     res.json({
       ...withRunning({ session_id: parsed.session_id }, running),

package/server/routes/cursor-stop-followup.ts

@@ -0,0 +1,74 @@
+// POST /hooks/cursor/stop-followup -- the COS session hook asks, at a Cursor composer's
+// Stop, whether a turn is queued for it (6.51.0). See `lib/cursor-stop-followup.ts`.
+//
+// NOT under /api, on purpose. The hook holds the per-install HOOK token
+// (`~/.cos-glasses/hook-token`, 0600), never the pairing token the /api gate checks, and
+// widening that gate for one caller would be the larger change. This route checks the
+// hook token itself, in constant time, BEFORE its body is read or parsed (6.52.0: it is
+// mounted ahead of the global 10 MB parser, and its own 2 MB parser runs only after the
+// token check). It answers only `{}` or `{"followup_message": ...}` so the hook can print
+// it verbatim, and it never answers with anything a Claude Stop could act on: a body that
+// is not a Cursor Stop is `{}`.
+
+import express, { Router, type NextFunction, type Request, type Response } from 'express'
+import { timingSafeTokenEqual } from '../lib/token-auth.js'
+import { claimNextCursorTurn, cursorStopAcceptsFollowup, cursorStopIsFresh, parseCursorStopEnvelope } from '../lib/cursor-stop-followup.js'
+import { MAX_QUEUED_PER_THREAD, type QueuedThreadTurn } from '../lib/thread-turn-queue.js'
+
+export interface CursorStopFollowupDeps {
+  /** The per-install hook token, or null when none has been minted (then nothing is answered). */
+  hookToken: () => string | null
+  readQueue: (provider: string, threadId: string, now: number) => QueuedThreadTurn[]
+  writeQueue: (provider: string, threadId: string, queue: QueuedThreadTurn[]) => void
+  now: () => number
+}
+
+export const CURSOR_STOP_FOLLOWUP_PATH = '/hooks/cursor/stop-followup'
+
+export function createCursorStopFollowupRouter(deps: CursorStopFollowupDeps): Router {
+  const router = Router()
+  // The token first, then the body: the hook posts its spool envelope, capped at 1 MiB by
+  // the script itself.
+  const requireHookToken = (req: Request, res: Response, next: NextFunction): void => {
+    res.set('Cache-Control', 'private, no-store')
+    let expected: string | null = null
+    try { expected = deps.hookToken() } catch { expected = null }
+    if (!expected || !timingSafeTokenEqual(req.headers['x-cos-hook-token'], expected)) {
+      res.status(401).json({})
+      return
+    }
+    next()
+  }
+  router.post(CURSOR_STOP_FOLLOWUP_PATH, requireHookToken, express.json({ limit: '2mb' }), (req: Request, res: Response) => {
+    const facts = parseCursorStopEnvelope(req.body)
+    if (!facts || !cursorStopAcceptsFollowup(facts, MAX_QUEUED_PER_THREAD)) return res.json({})
+    // The hook waits three seconds and then moves on. A claim made after it stopped
+    // listening marks a turn delivered that Cursor never received (QA, 6.51.0: a Stop that
+    // lands while the event loop is busy). A socket that already reads closed is one sign;
+    // the reliable one is the hook's own start stamp (see cursorStopIsFresh). Everything
+    // from here to the reply is synchronous.
+    if (req.socket?.destroyed === true || res.writableEnded) {
+      console.warn('[cursor-stop-followup] the hook hung up before the claim; nothing claimed')
+      return undefined
+    }
+    let claimed: ReturnType<typeof claimNextCursorTurn> = null
+    try {
+      const now = deps.now()
+      if (!cursorStopIsFresh(facts.hookStartedAtMs, now)) {
+        console.warn(`[cursor-stop-followup] the Stop is ${facts.hookStartedAtMs === null ? 'unstamped' : `${now - facts.hookStartedAtMs} ms old`}; the hook may have stopped listening, so nothing is claimed and the turn waits for the next Stop`)
+        return res.json({})
+      }
+      claimed = claimNextCursorTurn(deps.readQueue('cursor', facts.conversationId, now), now)
+      if (!claimed) return res.json({})
+      // Written BEFORE the text leaves: the row must never read `waiting` after the
+      // composer has been handed it, or a later Stop would hand it over again.
+      deps.writeQueue('cursor', facts.conversationId, claimed.queue)
+    } catch (error) {
+      console.error(`[cursor-stop-followup] claim failed: ${error instanceof Error ? error.message : error}`)
+      return res.json({})
+    }
+    console.log(`[cursor-stop-followup] handed a queued turn to Cursor clientTurnId=${claimed.turn.clientTurnId} chars=${claimed.turn.prompt.length} loop=${facts.loopCount ?? 'null'} cursor=${facts.cursorVersion}`)
+    return res.json({ followup_message: claimed.turn.prompt })
+  })
+  return router
+}