@gotcos/glasses-server 6.52.3 → 6.53.0

package/CHANGELOG.md

@@ -1,3 +1,26 @@
+## 6.53.0
+
+### Cancel a session run from the glasses
+
+Miles, 2026-09-21: "If there's a current run that's going, it essentially clicks the cancel button ... similar to when they're at the desktop." This is the server half; COS Glasses 6.9.529 adds the Cancel run row. Who owns the run decides what a cancel can do, and the server says which in every attachability answer.
+
+- **A COS turn stops at once.** A Continue COS itself spawned (`claude -p --resume`, `codex exec resume`, `cursor-agent`) is registered when its target claim is taken, with its own abort controller, and forgotten in the same `finally` that releases the claim. A cancel aborts it: the adapter sends the child's process group SIGTERM, then SIGKILL after 5 s (a timeout keeps its 2 s; canary C3 saw `claude -p` end cleanly on SIGTERM in about 4 s), and checks the cancel before the spawn and before the prompt is written. The turn ends `turn_cancelled`: ledgered as refused and not retryable, so every app settles it, and NEVER fenced. Until now an aborted child exited on a signal, which read as "may or may not have been delivered" and locked the thread (plan validation B2). A clean exit 0 with our thread id that lands first still counts as delivered. The route re-reads the thread head after a cancel, so the next Continue is not refused as "changed on your Mac".
+- **A Claude run at the desk stops at its next tool call.** A Desktop tab, a terminal, or a Continue delivered into the open window. The server writes a halt marker, `data/session-halt/<session id>`, and the session hook, now synchronous on PreToolUse, answers deny plus `continue: false` before the next tool. Canaries on Claude Code 2.1.278: `continue: false` alone still ran the tool, with the deny it did not (C1b); an interactive session honours it (C5), and so does one opened before the hook was added (C10); the check costs about 11 ms per tool call (C2); a hook that times out or exits 1 lets the tool run (C6, C7), and the script never exits 2. A reply that is pure text finishes first, which is why the lens says "Stops at its next step." A permission prompt the broker is holding for that session is denied at once with `interrupt: true`.
+- **The marker lives only within the run it was written for.** The hook itself removes it on the session's next UserPromptSubmit (a prompt at the desk, a live Continue, a COS turn), so a new prompt is never stopped. The server removes it on that session's SessionEnd and after an hour. Not on Stop: a background subagent reports its parent's session id (C8) and is work a cancel must stop too.
+- **Codex app and Cursor runs cannot be stopped from outside**, and the answer says so: "Runs in Codex on your Mac. Stop it there." (or Cursor).
+- **`POST /api/agent-sessions/:provider/:threadId/cancel`**, body `{"clientCancelId": "..."}`, registered whether or not thread attach is on. `202 {"cancelled": true, "target": "cos_turn", "state": "stopping", "turnId", "queuedHeld", "queuedHoldMs"}` or `202 {"cancelled": true, "target": "desk_run", "effective": "next_tool_call", "queuedHeld", "queuedHoldMs", "settledPermissions"}` (`queuedHoldMs` is the hold below, 120000, so a client does not invent its duration); otherwise `409 {"cancelled": false, "reason", "reasonCopy"}` with `not_running` ("Nothing running now."), `cancel_unsupported`, `hooks_outdated` ("Install hooks in COS Control, then retry.") or `hooks_disabled`. A malformed provider, thread id or `clientCancelId` is `400 invalid_request`; a desk marker that could not be written is `500 cancel_failed` ("Could not cancel. Check the Mac."), never an acceptance. The same `clientCancelId` gets the same answer again while this server process remains up. Every cancel is a line in `data/session-cancel.jsonl`.
+- **Attachability says what a cancel would do.** `GET .../attachability` gains `cancel`: `cos_turn`, `desk_run`, `unsupported`, `hooks_outdated`, `hooks_disabled`, or null when nothing is running. The route and this field are decided by one function (`cancelTargetFor`), so the row the lens shows and the answer to the tap agree. A 6.52 server sends no field, and the app then shows no row.
+- **Parked turns wait two minutes after a cancel while this server process remains up**, then send as normal; the 202 says how many are held. The short hold is deliberately in memory, so a server restart returns persisted queued turns to the ordinary delivery gate. A cancel newer than the session's last transcript row or hook event ends the turn for the queue, so a killed child's unanswered tool call no longer holds parked turns for the 30-minute open-turn ceiling. A queued turn cancelled while it was being admitted is settled cancelled, never sent again.
+- **Health.** `features.sessionCancel`: `{"cosTurn": true, "deskClaude": <hooks on and the 6.53 hook installed>}`.
+- **Rollout: Install hooks in COS Control after updating the server.** The hook script and the PreToolUse subscription both changed (one synchronous block, no matcher; the script still spools only AskUserQuestion and ExitPlanMode). Update Server alone never re-copies the script, so until Install hooks runs the hooks read `drift` or `script_outdated`, a desk cancel answers `hooks_outdated`, and `deskClaude` is false. A COS turn can be cancelled right away.
+- Tests: the hook script executed against fixtures (the deny exactly, nothing printed or spooled for an ordinary tool, the two spooled tools, UserPromptSubmit clearing and still spooling, malformed input, the first session_id winning over one inside `tool_input`, a full spool, exit status never 2, no temp file left); the installer's single PreToolUse block and a 6.52 install reading drift; the adapter's abort before spawn, before the write, mid-run with the 5 s grace, a clean exit racing the cancel, a cancel during a timeout; the route end to end with the real adapter (SIGTERM, `turn_cancelled`, no fence), the head acknowledgement, idempotency, every refusal, the attachability field; the broker's deny with interrupt; the queue hold and its order after expiry; marker cleanup on SessionEnd but not Stop or a child; health. The script's sha pin moves on purpose. The halt cases live in their own file so a mutation of the script is judged by behaviour, not by the pin. Gate: the `halt-*`, `adapter-*cancel*`, `cancel-*`, `desk-running-*`, `broker-cancel-*`, `queue-cancel-*` and `health-desk-claude-needs-install` cases, 48 of 48 killed. Not gated: the script's lower-casing of the session id, whose mutant survives on this Mac's case-insensitive volume (it matters only on a case-sensitive one).
+
+### Grok 4.7
+
+- **Grok 4.7: the Cursor Grok slot now picks the newest Grok, including the new grok-4.7 ids (no cursor- prefix), so Messages on Grok run Grok 4.7 when the CLI advertises it.** Miles, 2026-09-21: "make sure we're running the latest and greatest on the grok front". `cursor-agent models` on CLI 2026.09.18 lists `grok-4.7-high-fast` beside the old `cursor-grok-4.6-high-fast`. The slot matches both schemes, compares versions numerically, and on an exact tie prefers the unprefixed id; low, medium, xhigh and non-fast are still never chosen. The live model list remains authoritative; `grok-4.7-high-fast` is the canonical id, not an unverified fallback.
+- **Display names from the CLI are cleaned**: format characters (the trailing zero-width spaces) are removed and runs of whitespace collapse, so the slot reads "Grok 4.7 High Fast", including from a model cache written before this release.
+- Tests: the 2026-09-18 list picks `grok-4.7-high-fast` with a clean name; low, medium, xhigh and non-fast ignored in the new scheme; an old-scheme-only list still picks its newest; numeric comparison and the tie in both list orders; the new ids resolve to the Grok slot. Gate: `grok-*`, 4 of 4 killed.
+
 ## 6.52.3
 
 ### A quiet ring stays with its owner; a zombie never takes it on waking

package/bin/cli.cjs

@@ -301,7 +301,9 @@ function cursorCliState() {
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: 7000,
     })
-    const grokHighFast = /cursor-grok-\d+(?:\.\d+)*-high-fast/.test(models)
+    // Cursor 2026.09 introduced `grok-4.7-high-fast` without the old
+    // `cursor-` prefix. Accept both exact high-fast families, like runtime does.
+    const grokHighFast = /(?:^|\n)(?:cursor-)?grok-\d+(?:\.\d+)*-high-fast\s+-/m.test(models)
     return {
       binary,
       version,
@@ -358,7 +360,7 @@ if (cursor.binary) {
     console.log('    Run: ' + bold('agent login'))
   } else if (cursor.auth === 'models-unresolved') {
     console.log(yellow('  ⚠') + ` Cursor Agent ${cursor.version} installed — required models unresolved`)
-    console.log('    Verify: ' + bold('agent models') + ' includes Composer 2.5 Fast and a cursor-grok-*-high-fast id')
+    console.log('    Verify: ' + bold('agent models') + ' includes Composer 2.5 Fast and a grok-*-high-fast id')
   } else {
     console.log(yellow('  ⚠') + ` Cursor Agent ${cursor.version} installed — readiness unavailable`)
     console.log('    Verify: ' + bold('agent models'))

package/bin/hooks/cos-session-hook

@@ -1,17 +1,66 @@
 #!/bin/sh
-# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0). Installed into ~/.claude/settings.json by
+# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0). Installed into ~/.claude/settings.json by
 # `--hooks install`; Claude Code runs it with the hook event name as $1 and the event
 # payload on stdin. It spools one JSON file per event into the hook spool and exits 0
 # on every path. Only PermissionRequest ever talks to the server, and only when the
 # desk has been idle. Everything else is a file write, so the server being down or
 # restarting never delays a Claude session.
 #
+# 6.53.0: PreToolUse is SYNCHRONOUS with no matcher, so the first branch below runs before
+# EVERY tool call in every Claude session on this Mac. It is file-only (no curl, no spool
+# write) and prints nothing unless the server left a halt marker for this session, when it
+# prints the one reply that stops the run (canary C1b, 2026-09-21: `continue:false` alone
+# still ran the tool; with the deny it did not). It never exits 2: exit 2 blocks the tool,
+# while a timeout or any other code fails open (C6, C7).
+#
 # The installer bakes COS_GLASSES_HOME and COS_HOOK_SPOOL into the command, so this
 # script and the server can never disagree about where the token or the spool is.
 PATH=/usr/bin:/bin:/usr/sbin; umask 077; trap '' PIPE
 HOME=${HOME:-$(cd ~ 2>/dev/null && pwd)}; [ -n "$HOME" ] || exit 0
 GH=${COS_GLASSES_HOME:-$HOME/.cos-glasses}
 SPOOL=${COS_HOOK_SPOOL:-$GH/data/hook-spool}; EVENT="$1"
+# 6.53.0, the halt check. FIRST, before mkdir, perl and the B8 guard below: a full spool or
+# a stale drain stamp must never stop a cancel, and an ordinary tool call must cost nothing
+# but this. The marker folder sits beside the spool, like the Cursor queue folder; the server
+# writes `<folder>/<session id>` (lib/session-halt.ts). stdin is read ONCE, to a temp file,
+# and handed to the spool path below when the event still needs spooling.
+IN=''
+case "$EVENT" in PreToolUse|UserPromptSubmit)
+  IN=$(mktemp "${TMPDIR:-/tmp}/cos-hook.XXXXXX" 2>/dev/null || mktemp /tmp/cos-hook.XXXXXX 2>/dev/null) || IN=''
+  # No temp file: a tool call goes ahead unchecked (fail open), and a prompt is spooled
+  # below exactly as before, its stdin untouched.
+  [ -n "$IN" ] || [ "$EVENT" = UserPromptSubmit ] || exit 0
+  ;;
+esac
+[ -z "$IN" ] || {
+  HALT="$(dirname "$SPOOL")/session-halt"
+  trap 'rm -f "$IN"; exit 0' HUP INT TERM
+  head -c 1048576 > "$IN" 2>/dev/null
+  # Any marker at all? A glob is a builtin, so the common case (no cancel anywhere on the
+  # Mac) reads no session id and forks nothing for it.
+  SID=''; for F in "$HALT"/*; do [ -e "$F" ] && SID=x; break; done
+  # The FIRST session_id is the payload's own: Claude writes it first, and a tool's input
+  # that happens to carry one comes later.
+  [ -z "$SID" ] || SID=$(grep -Eo '"session_id"[[:space:]]*:[[:space:]]*"[0-9A-Fa-f-]{36}"' "$IN" 2>/dev/null | head -1 | grep -Eo '[0-9A-Fa-f-]{36}' | tr 'A-F' 'a-f')
+  if [ "$EVENT" = UserPromptSubmit ]; then
+    # A new prompt is never stopped: the marker lives only within the run it was written
+    # for. This covers a prompt typed at the desk, a Continue delivered into the open
+    # session, and a COS `-p` turn. Then the prompt is spooled exactly as before.
+    [ -z "$SID" ] || rm -f "$HALT/$SID" 2>/dev/null
+  elif [ -n "$SID" ] && [ -f "$HALT/$SID" ]; then
+    rm -f "$IN"
+    printf '%s' '{"continue":false,"stopReason":"Cancelled from COS","hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Cancelled from COS"}}'
+    exit 0
+  else
+    # Only the two tools the reducer reads were ever spooled (the 6.48 matcher); every
+    # other tool call ends here with nothing written and nothing printed.
+    TOOL=$(grep -Eo '"tool_name"[[:space:]]*:[[:space:]]*"[A-Za-z]+"' "$IN" 2>/dev/null | head -1)
+    case "$TOOL" in *'"AskUserQuestion"'|*'"ExitPlanMode"') ;; *) rm -f "$IN"; exit 0 ;; esac
+  fi
+  # The spool path below reads stdin: hand it the saved bytes. The open descriptor keeps
+  # them readable after the unlink, so no temp file outlives this line.
+  exec < "$IN"; rm -f "$IN"; trap - HUP INT TERM
+}
 mkdir -p "$SPOOL/rejected" 2>/dev/null || exit 0
 TS=$(perl -MTime::HiRes -e 'printf "%.0f", Time::HiRes::time()*1000' 2>/dev/null || date +%s000)
 # B8 guard: a full spool or a stale drain stamp means nobody is reading; keep only permissions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.52.3",
+  "version": "6.53.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -24,7 +24,9 @@ import { agentSessionStreamRouter } from './routes/agent-session-stream.js'
 import { createAttachedTurnStream } from './lib/session-stream-producer.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
 import { createSessionHooksRouter } from './routes/session-hooks.js'
-import { deskIdleSeconds, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
+import { cachedHookStatus, claudeDeskRunning, deskIdleSeconds, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
+import { writeHaltMarker } from './lib/session-halt.js'
+import { appendSessionCancelLedger, cancelEndsTurn, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, threadCancelledAt } from './lib/session-cancel.js'
 import {
   PermissionBroker,
   brokerSignalSink,
@@ -495,6 +497,8 @@ const deliverAttachedTurnForRoute = async (request: {
   nativeThreadId: string
   prompt: string
   onSpawn: (pid: number) => boolean
+  /** 6.53.0: the cancel from the lens, passed straight through to the adapter. */
+  abortSignal?: AbortSignal
 }): Promise<unknown> => {
   // Resolved here, not stored on the binding: the cwd is read from the transcript,
   // which records it verbatim. Decoding the project slug is lossy — this Mac's own
@@ -537,6 +541,7 @@ const deliverAttachedTurnForRoute = async (request: {
       // The only policy this build accepts. The adapter refuses anything else and
       // asserts no bypass/always-approve flag reaches the argv (plan 4.7).
       policy: 'read_only',
+      abortSignal: request.abortSignal,
       deps: {
         ...base,
         // `startMs` is deliberately unused: the adapter already probed it as a GATE
@@ -709,6 +714,14 @@ if (threadAttachEnabled()) {
     turnEnded: (provider: string, threadId: string) => {
       if (provider !== 'claude' && provider !== 'codex') return false
       try {
+        // 6.53.0: a cancel with nothing written since it ENDED the turn. A killed COS child
+        // leaves its last tool_use unanswered, and no Stop or terminal record ever follows.
+        const cancelledAt = threadCancelledAt(provider, threadId)
+        if (cancelledAt !== null) {
+          const readMtime = occupancyProbes.transcriptMtimeMs
+          const lastRow = typeof readMtime === 'function' ? readMtime(provider, threadId) : null
+          if (cancelEndsTurn(cancelledAt, typeof lastRow === 'number' ? lastRow : null)) return true
+        }
         // 6.48.1: the engine's own end of turn: a Stop hook newer than the turn's prompt
         // AND the registry flipped idle after it (the Stop hooks have returned; a prompt
         // typed during them is queued and dequeues only then). The transcript tail
@@ -732,9 +745,14 @@ if (threadAttachEnabled()) {
       if (provider !== 'claude' && provider !== 'codex') return false
       try {
         const now = Date.now()
+        // 6.53.0: evidence older than a cancel on this thread is the cancelled run's, not a
+        // live turn (plan R1: a killed child's dangling tool_use read `tool_pending` for the
+        // whole 30-minute ceiling and held every parked turn behind it).
+        const cancelledAt = threadCancelledAt(provider, threadId)
         if (provider === 'claude') {
           const signal = signalFor(threadId)
-          if (signal && signal.turnOpen && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS) return true
+          if (signal && signal.turnOpen && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS
+            && !cancelEndsTurn(cancelledAt, signal.lastEventAt)) return true
         }
         const path = transcriptPathFor(provider, threadId, nativeHeadDeps)
         const verdict = transcriptTurnVerdict(provider, path)
@@ -742,6 +760,7 @@ if (threadAttachEnabled()) {
         if (verdict.reason !== 'tool_pending' && verdict.reason !== 'prompt_open') return false
         const read = occupancyProbes.transcriptMtimeMs
         const mtime = typeof read === 'function' ? read(provider, threadId) : null
+        if (cancelEndsTurn(cancelledAt, typeof mtime === 'number' ? mtime : null)) return false
         return typeof mtime === 'number' && now - mtime <= OPEN_TURN_CEILING_MS
       } catch {
         return false
@@ -758,6 +777,8 @@ if (threadAttachEnabled()) {
       }
     },
     deliver: (turn: QueuedThreadTurn) => deliverQueuedTurnOverLoopback(turn, PORT, API_TOKEN),
+    // 6.53.0: parked turns hold for two minutes after a cancel on their thread.
+    cancelHoldUntil: (provider: string, threadId: string) => cancelHoldUntilFor(provider, threadId),
     now: () => Date.now(),
   }
   app.use('/api', createThreadTurnQueueRouter(queueDeps))
@@ -852,6 +873,19 @@ app.use('/api', createAgentSessionBindingsRouter({
   // empty list — "nothing is bound" and "the store could not be read" must not
   // look the same.
   bindings: agentSessionBindingRegistry,
+  // 6.53.0: cancel a session run from the lens. The route's own in-flight map answers for
+  // a COS turn; these answer for a run at the desk. Read per request, so Install hooks in
+  // Control flips `hooks_outdated` to `desk_run` within the status cache's five seconds.
+  cancel: {
+    deskRunning: sessionId => claudeDeskRunning(sessionId),
+    hooksEnabled: () => sessionHooksEnabled(),
+    hooksReady: () => cachedHookStatus().installed,
+    writeHalt: (sessionId, marker) => writeHaltMarker(sessionId, marker),
+    settlePermissions: sessionId => permissionBroker.cancelSession(sessionId),
+    queuedWaiting: (provider, threadId) => readQueue(provider, threadId, Date.now()).filter(t => t.status === 'waiting').length,
+    noteCancelled: (provider, threadId, at) => noteThreadCancelled(provider, threadId, at),
+    ledger: row => appendSessionCancelLedger(row),
+  },
 }))
 app.use('/api', displayRouter)
 app.use('/api', transcribeStreamRouter)

package/server/lib/attached-provider-adapter.ts

@@ -59,8 +59,14 @@
 //   aborted        a child existed, we terminated it, no prompt byte was written
 //   ambiguous      we called write(); we cannot prove the provider did not act
 //   delivered      clean exit 0 AND the provider echoed our exact target id
+//   cancelled      (6.53.0) we called write(), then the USER asked us to stop and we
+//                  killed the child. The provider may have acted on part of the turn,
+//                  but that is the user's decision, not an unknown: nothing is lost and
+//                  nothing may be sent again by COS on its own.
 //
-// Only the first two are provably safe to report as a clean failure.
+// Only the first two are provably safe to report as a clean failure. `cancelled` is not
+// a clean failure either, but it is not a fence: a fence exists to stop COS resending a
+// turn nobody knows the fate of, and a cancelled turn is one the user chose to end.
 // `attachedDeliveryAmbiguous` makes that mapping total, and treats any state it
 // does not recognise as ambiguous, so adding a state later cannot silently open
 // the replay path.
@@ -129,9 +135,11 @@ export type AttachedTurnFailure =
   | 'no_native_id_returned'
   | 'native_id_mismatch'
   | 'adapter_internal_error'
+  /** 6.53.0: the caller's abort signal fired (a cancel from the lens). Never ambiguous. */
+  | 'cancelled'
 
 /** See the header. The boundary is the first byte handed to the child's stdin. */
-export type AttachedDeliveryState = 'not_attempted' | 'aborted' | 'ambiguous' | 'delivered'
+export type AttachedDeliveryState = 'not_attempted' | 'aborted' | 'ambiguous' | 'delivered' | 'cancelled'
 
 /**
  * Bounded classification of a provider's stderr.
@@ -202,7 +210,10 @@ export type AttachedTurnResult = AttachedTurnSuccess | AttachedTurnFailureResult
  */
 export function attachedDeliveryAmbiguous(result: AttachedTurnResult): boolean {
   if (result.ok) return false
-  return result.delivery !== 'not_attempted' && result.delivery !== 'aborted'
+  // `cancelled` is listed by name, not inferred: a state added later still defaults to
+  // fenced. It is not ambiguous because the user ended the turn, and a fence would lock
+  // them out of the thread they just stopped (plan validation B2, 2026-09-21).
+  return result.delivery !== 'not_attempted' && result.delivery !== 'aborted' && result.delivery !== 'cancelled'
 }
 
 // ---------------------------------------------------------------------------
@@ -342,6 +353,13 @@ export interface AttachedTurnRequest {
   deps: AttachedTurnDeps
   /** Wall-clock budget for the provider run. Omitted uses the default. */
   timeoutMs?: number
+  /**
+   * 6.53.0: the cancel from the lens. Checked before the spawn and before the prompt is
+   * written (a turn that never started is `cancelled` with delivery `not_attempted` or
+   * `aborted`); after the write it stops the child's process group, SIGTERM then SIGKILL
+   * after CANCEL_KILL_GRACE_MS. A natural exit 0 with our id that lands first still wins.
+   */
+  abortSignal?: AbortSignal
 }
 
 /**
@@ -358,6 +376,14 @@ export const MAX_ATTACHED_TIMEOUT_MS = 30 * 60_000
 /** SIGTERM first; this is how long the child gets before SIGKILL. */
 export const KILL_GRACE_MS = 2_000
 
+/**
+ * The same escalation for a CANCEL, with a longer grace. A timeout is a child that has
+ * stopped answering; a cancel lands on a child that is working and may be mid-write, and
+ * canary C3 (2026-09-21) saw `claude -p --resume` end cleanly on SIGTERM in about 4 s with
+ * a transcript that parses and resumes. Two seconds would SIGKILL it inside that window.
+ */
+export const CANCEL_KILL_GRACE_MS = 5_000
+
 /**
  * Last-resort settle after SIGKILL.
  *
@@ -778,6 +804,11 @@ async function run(
   if (bannedArg !== null) {
     return fail('unsupported_policy', 'not_attempted', { ...base, detail: `banned_arg:${bannedArg}`, durationMs: duration() })
   }
+  // 6.53.0: a cancel that landed before the spawn. No process is created, so nothing can
+  // have been delivered; the turn ends `cancelled`, which the route never fences.
+  if (request.abortSignal?.aborted === true) {
+    return fail('cancelled', 'not_attempted', { ...base, detail: 'before_spawn', durationMs: duration() })
+  }
   let child: AttachedChildProcess
   try {
     child = deps.spawn({ binaryPath, args, cwd, env: buildAttachedEnv() })
@@ -830,7 +861,7 @@ async function run(
   }
 
   try {
-    return await driveChild({ child, pid, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt })
+    return await driveChild({ child, pid, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt, abortSignal: request.abortSignal })
   } finally {
     // Every path: success, mismatch, non-zero exit, timeout, throw. A leaked
     // entry lets a recycled pid inherit our self-ownership claim.
@@ -864,10 +895,11 @@ interface DriveInput {
   prompt: string
   timeoutMs: number
   startedAt: number
+  abortSignal?: AbortSignal
 }
 
 function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
-  const { child, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt } = input
+  const { child, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt, abortSignal } = input
 
   return new Promise<AttachedTurnResult>((resolve) => {
     /** Distinct ids seen. More than one means a fork happened; see the header. */
@@ -879,7 +911,10 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
     let exitCode: number | null = null
     let settled = false
     let timedOut = false
+    /** 6.53.0: the caller's abort fired after the child existed. Read before `timedOut`. */
+    let cancelled = false
     let spawnErrored = false
+    let onAbort: (() => void) | null = null
 
     let deadline: ReturnType<typeof setTimeout> | null = null
     let graceTimer: ReturnType<typeof setTimeout> | null = null
@@ -897,6 +932,10 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
       if (settled) return
       settled = true
       clearTimers()
+      if (onAbort) {
+        try { abortSignal?.removeEventListener('abort', onAbort) } catch { /* nothing to release */ }
+        onAbort = null
+      }
       resolve(result)
     }
 
@@ -963,6 +1002,13 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
         stdoutTail = ''
       }
 
+      // 6.53.0: a cancel outranks every failure below, the timeout included (a cancel in
+      // the timeout's kill grace is still the user's decision). It does NOT outrank a
+      // clean exit 0 that echoed our exact id: that turn finished before the stop landed,
+      // and reporting it cancelled would hide a delivered turn.
+      if (cancelled && !(exitCode === 0 && delivery === 'ambiguous' && observedIds.length === 1 && observedIds[0] === nativeThreadId)) {
+        return settleFailure('cancelled', { delivery: 'cancelled' })
+      }
       if (timedOut) return settleFailure('timeout')
       if (spawnErrored) return settleFailure('spawn_failed', { detail: 'child_error' })
 
@@ -1054,12 +1100,41 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
         forceTimer = setTimeout(() => {
           // A child that survived SIGKILL cannot be reached from here, and
           // blocking forever would wedge the coordinator and any Control drain
-          // behind it.
-          settleFailure('timeout', { detail: 'unreaped', reaped: false })
+          // behind it. A cancel that landed during this escalation still reads
+          // as the user's (6.53.0).
+          if (cancelled) settleFailure('cancelled', { delivery: 'cancelled', detail: 'unreaped', reaped: false })
+          else settleFailure('timeout', { detail: 'unreaped', reaped: false })
         }, FORCE_SETTLE_MS)
       }, KILL_GRACE_MS)
     }, timeoutMs)
 
+    // --- the cancel (6.53.0) ---------------------------------------------------
+    // Registered before the write so an abort from here on is seen. The group SIGTERM then
+    // SIGKILL is the timeout's own sequence with a longer grace; the force settle keeps a
+    // child that survives SIGKILL from wedging the route's claim.
+    if (abortSignal) {
+      onAbort = () => {
+        if (settled || cancelled) return
+        cancelled = true
+        // A timeout already escalating keeps its own timers; the result still reads
+        // cancelled (finishTerminal checks `cancelled` first).
+        if (timedOut) return
+        if (deadline) { clearTimeout(deadline); deadline = null }
+        safeTerminate(deps, child, 'SIGTERM')
+        graceTimer = setTimeout(() => {
+          safeTerminate(deps, child, 'SIGKILL')
+          forceTimer = setTimeout(() => {
+            settleFailure('cancelled', { delivery: 'cancelled', detail: 'unreaped', reaped: false })
+          }, FORCE_SETTLE_MS)
+        }, CANCEL_KILL_GRACE_MS)
+      }
+      try {
+        abortSignal.addEventListener('abort', onAbort, { once: true })
+      } catch {
+        onAbort = null
+      }
+    }
+
     // --- deliver the prompt --------------------------------------------------
     const stdin = child.stdin
     if (!stdin || typeof stdin.write !== 'function' || typeof stdin.end !== 'function' || !child.stdout) {
@@ -1078,6 +1153,15 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
       /* an stdin that cannot take a listener still gets the write attempt below */
     }
 
+    // 6.53.0: a cancel that landed between the spawn check and here (a dependency that
+    // yielded, or one that aborted synchronously). No prompt byte is written: the child is
+    // killed and the turn is provably undelivered.
+    if (abortSignal?.aborted === true) {
+      safeTerminate(deps, child, 'SIGKILL')
+      delivery = 'aborted'
+      return settleFailure('cancelled', { detail: 'before_write', reaped: false })
+    }
+
     try {
       // THE BOUNDARY. From this call on, we cannot prove the provider did not
       // act on the prompt, so every non-success outcome is ambiguous.

package/server/lib/claude-hooks-installer.ts

@@ -46,6 +46,15 @@ export interface HookSubscription {
  * UserPromptSubmit would leave a running turn reading idle). The write is a few
  * milliseconds. PermissionRequest must be synchronous to return a decision; the rest
  * are fire-and-forget.
+ *
+ * 6.53.0: PreToolUse is SYNCHRONOUS with NO matcher, so the script's halt check sees every
+ * tool call and can stop a desk run (cancel from the lens). Canaries, 2026-09-21: the stop
+ * needs `permissionDecision: deny` plus `continue: false` (C1b; `continue: false` alone
+ * still ran the tool), the check costs about 11 ms per call (C2), and a hook that times out
+ * (C6) or exits 1 (C7) lets the tool run, so a broken hook fails open. ONE block per event,
+ * because the merge keeps exactly one of ours per event and status requires it: the script
+ * spools only AskUserQuestion and ExitPlanMode, which is what the old async matcher block
+ * did. Changing this row makes every existing install read `drift` until Install hooks.
  */
 export const HOOK_SUBSCRIPTIONS: readonly HookSubscription[] = [
   { event: 'SessionStart', async: false, timeout: 5 },
@@ -55,7 +64,7 @@ export const HOOK_SUBSCRIPTIONS: readonly HookSubscription[] = [
   { event: 'StopFailure', async: true, timeout: 10 },
   { event: 'PermissionRequest', async: false, timeout: 130 },
   { event: 'PermissionDenied', async: true, timeout: 10 },
-  { event: 'PreToolUse', matcher: 'AskUserQuestion|ExitPlanMode', async: true, timeout: 10 },
+  { event: 'PreToolUse', async: false, timeout: 5 },
   { event: 'PostToolUse', async: true, timeout: 10 },
   { event: 'PostToolUseFailure', async: true, timeout: 10 },
   { event: 'Notification', matcher: 'permission_prompt|idle_prompt|elicitation_dialog|agent_needs_input', async: true, timeout: 10 },

package/server/lib/cursor-model-catalog.ts

@@ -20,12 +20,19 @@ const DEFAULT_REFRESH_TIMEOUT_MS = 7_000
 /**
  * Stable slot → CLI model id mapping.
  * Composer stays pinned (no versioned high-fast family). Grok high-fast is
- * chosen at catalog build: newest `cursor-grok-<ver>-high-fast` in `agent
- * models`. This grok id is only the fallback when the live list has none.
- * `xhigh-fast` is a different SKU and is never selected here.
+ * chosen at catalog build: newest `grok-<ver>-high-fast` or
+ * `cursor-grok-<ver>-high-fast` proven by `agent models`. The constant records
+ * the current canonical id; it is not returned when the live catalog does not
+ * prove that model exists. `xhigh-fast` is a different SKU and is never selected.
+ *
+ * 2026-09-21 (6.53.0): Grok 4.7 shipped under a NEW id scheme with no `cursor-`
+ * prefix (`grok-4.7-high-fast`, per `cursor-agent models` on CLI 2026.09.18,
+ * which still lists the old `cursor-grok-4.6-high-fast` and 4.5 ids). The ask:
+ * "make sure we're running the latest and greatest on the grok front". The
+ * canonical id moves to the new scheme; the live list remains authoritative.
  */
 export const CURSOR_SLOT_MODEL_IDS = {
-  'cursor-grok': 'cursor-grok-4.5-high-fast',
+  'cursor-grok': 'grok-4.7-high-fast',
   'cursor-composer': 'composer-2.5-fast',
 } as const satisfies Record<CursorModelPreference, string>
 
@@ -34,7 +41,12 @@ const SLOT_DISPLAY_FALLBACK = {
   'cursor-composer': 'Composer 2.5 Fast',
 } as const satisfies Record<CursorModelPreference, string>
 
-const GROK_HIGH_FAST_RE = /^cursor-grok-(\d+(?:\.\d+)*)-high-fast$/i
+/**
+ * Both id schemes: `cursor-grok-4.6-high-fast` (through 4.6) and `grok-4.7-high-fast`
+ * (4.7 on). Anchored at both ends, so `-xhigh-fast`, `-medium-fast`, `-low-fast` and the
+ * non-fast `-high` never match.
+ */
+const GROK_HIGH_FAST_RE = /^(?:cursor-)?grok-(\d+(?:\.\d+)*)-high-fast$/i
 
 export function parseCursorGrokHighFastVersion(id: string): number[] | null {
   const match = GROK_HIGH_FAST_RE.exec(id.trim())
@@ -42,6 +54,17 @@ export function parseCursorGrokHighFastVersion(id: string): number[] | null {
   return match[1].split('.').map(part => Number(part))
 }
 
+/**
+ * A display name as the CLI prints it, made printable. CLI 2026.09.18 writes
+ * "Grok 4.7  High Fast" with a double space and trailing zero-width characters; the lens
+ * would draw neither correctly. Format characters (`\p{Cf}`: zero-width space and joiners,
+ * direction marks, BOM) are removed, runs of whitespace become one space, and the ends
+ * are trimmed.
+ */
+export function normalizeCursorDisplayName(name: string): string {
+  return name.replace(/\p{Cf}/gu, '').replace(/\s+/g, ' ').trim()
+}
+
 export function compareVersionTuples(a: number[], b: number[]): number {
   const length = Math.max(a.length, b.length)
   for (let index = 0; index < length; index++) {
@@ -52,16 +75,22 @@ export function compareVersionTuples(a: number[], b: number[]): number {
   return 0
 }
 
-/** Newest `cursor-grok-*-high-fast`. Ignores low/medium/xhigh and non-fast. */
+/**
+ * Newest Grok high-fast, either id scheme, compared numerically. Ignores low/medium/xhigh
+ * and non-fast. On an exact version tie the unprefixed id (the new scheme) wins, whatever
+ * order the CLI lists them in.
+ */
 export function selectNewestCursorGrokHighFast(
   models: CursorCatalogModel[],
 ): CursorCatalogModel | undefined {
-  let best: { model: CursorCatalogModel; version: number[] } | undefined
+  let best: { model: CursorCatalogModel; version: number[]; prefixed: boolean } | undefined
   for (const model of models) {
     const version = parseCursorGrokHighFastVersion(model.id)
     if (!version) continue
-    if (!best || compareVersionTuples(version, best.version) > 0) {
-      best = { model, version }
+    const prefixed = /^cursor-/i.test(model.id.trim())
+    const order = best ? compareVersionTuples(version, best.version) : 1
+    if (!best || order > 0 || (order === 0 && best.prefixed && !prefixed)) {
+      best = { model, version, prefixed }
     }
   }
   return best?.model
@@ -109,7 +138,7 @@ export function parseAgentModelsText(text: string): CursorCatalogModel[] {
     const match = /^([a-z0-9][a-z0-9._\[\]-]*)\s+-\s+(.+)$/i.exec(line)
     if (!match) continue
     const id = match[1]
-    const displayName = match[2].trim()
+    const displayName = normalizeCursorDisplayName(match[2])
     if (!id || !displayName || seen.has(id)) continue
     seen.add(id)
     models.push({ id, displayName })
@@ -126,7 +155,6 @@ export function buildCursorModelCatalog(
 ): CursorModelCatalog {
   const byId = new Map(models.map(model => [model.id, model]))
   const grok = selectNewestCursorGrokHighFast(models)
-    ?? byId.get(CURSOR_SLOT_MODEL_IDS[CURSOR_GROK_MODEL])
   const composer = byId.get(CURSOR_SLOT_MODEL_IDS[CURSOR_COMPOSER_MODEL])
   const options: CursorModelOption[] = [
     {
@@ -168,7 +196,12 @@ function readDiskCatalog(): CursorModelCatalog | null {
       refreshedAt?: string
       agentBinary?: string
     }
-    const models = Array.isArray(parsed.models) ? parsed.models.filter(m => typeof m?.id === 'string' && m.id) : []
+    // A cache written before 6.53.0 kept the CLI's raw display names; normalize on read.
+    const models = Array.isArray(parsed.models)
+      ? parsed.models
+        .filter(m => typeof m?.id === 'string' && m.id)
+        .map(m => ({ ...m, displayName: normalizeCursorDisplayName(typeof m.displayName === 'string' ? m.displayName : '') }))
+      : []
     if (models.length === 0) return null
     return buildCursorModelCatalog(
       models,

package/server/lib/permission-broker.ts

@@ -305,6 +305,18 @@ export function questionHookOutput(toolInput: Record<string, unknown>, answers:
   return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: { behavior: 'allow', updatedInput: { ...toolInput, answers } } } }
 }
 
+/** 6.53.0: the message a held prompt gets when its session's run is cancelled from COS. */
+export const CANCEL_DENY_MESSAGE = 'Cancelled from COS'
+
+/**
+ * 6.53.0: a held prompt whose run was cancelled from the lens. Deny with `interrupt: true`,
+ * so Claude ends the RUN rather than trying something else in place of this tool. The one
+ * case where a broker reply interrupts, and only ever from `cancelSession`.
+ */
+export function cancelHookOutput(): Record<string, unknown> {
+  return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: { behavior: 'deny', message: CANCEL_DENY_MESSAGE, interrupt: true } } }
+}
+
 /** A tool approval: allow once, or deny with the one message. Never a rule. */
 export function approvalHookOutput(decision: 'allow' | 'deny'): Record<string, unknown> {
   const body = decision === 'allow' ? { behavior: 'allow' } : { behavior: 'deny', message: DENY_MESSAGE }
@@ -933,6 +945,42 @@ export class PermissionBroker {
     return { status: 200, body: { ok: true, id: item.id, kind: item.kind, ...chosen } }
   }
 
+  /**
+   * 6.53.0: a desk run of this session was cancelled from COS. Every prompt the broker holds
+   * for it is answered deny with `interrupt: true` (the away-from-desk case: without this the
+   * run waits out the deadline and then shows the Mac's dialog, and a cancel "at the next
+   * tool call" never arrives, because the next tool is the one being asked about). Recorded
+   * as an answer, so a lens answering the same card afterwards reads 409 already_answered.
+   * A hook that already left is `hook_gone`, as for any answer. Returns how many it denied.
+   */
+  cancelSession(sessionId: string): number {
+    const wanted = typeof sessionId === 'string' ? sessionId.toLowerCase() : ''
+    if (!wanted) return 0
+    let denied = 0
+    for (const item of [...this.items.values()]) {
+      if (item.state !== 'pending' || item.sessionId !== wanted) continue
+      if (!item.channel || !item.channel.writable() || !item.channel.reply(cancelHookOutput())) {
+        this.settle(item, 'hook_gone')
+        continue
+      }
+      item.state = 'answered'
+      item.settledAt = this.deps.now()
+      item.answer = { clientAnswerId: 'cos-cancel', chosen: { decision: 'deny' } }
+      item.channel = null
+      item.toolInput = {}
+      item.questions = null
+      item.approval = null
+      if (item.timer) clearTimeout(item.timer)
+      item.timer = null
+      this.counters.answered++
+      try { this.deps.signals?.decided(item.sessionId, item.id, item.fingerprint) } catch { /* rows are advisory */ }
+      this.log(`cancelled ${item.id} kind=${item.kind} pending=${this.pendingCount()}`)
+      denied++
+    }
+    this.prune()
+    return denied
+  }
+
   /**
    * "Leave for the Mac" on a pending item. As for an answer, the hook must still be listening:
    * one that already left is `hook_gone` (the Mac shows its dialog either way).