@gotcos/glasses-server 6.56.0 → 6.57.0

package/CHANGELOG.md

@@ -1,3 +1,42 @@
+## 6.57.0
+
+### Jev in the server: session suggestions and a key you can set from COS Control
+
+- New `POST /api/work-board/session-recommendation` answers Continue, Fork or New for a Work task. The client sends only the sessions it can target (at most 80); the task and its meetings come from the board. Jev answers two questions in one request: which session shares this work's context (same deliverable, page, module, codebase or client thread), and which, if any, is already doing this exact task. Continue at 0.5 or above on the second, Fork when a session covers the context at 0.6 or above, otherwise New. Answers are cached for 30 minutes per task and session set. On Miles's live sessions a 1:1 task went New, a server bug continued its server session at 0.91, and a hardware-page task forked the hardware session; about 10K input tokens per task.
+- Advice only: nothing is selected, sent or started. Without a key, over the cap, or while paused, the route answers `provider: none` and the client keeps its local word match.
+- New `POST /api/jev-key/set`, `GET /api/jev-key/status` and `DELETE /api/jev-key`, like `/api/openai-key`: the key is validated live against TypeSafe's free model listing, saved to `data/jev-key.json` (0600), and never returned. A key saved this way wins over `TYPESAFE_API_KEY` in the environment or either `.env` file (both held one on Miles's Mac, which made a Settings key do nothing); the COS meeting producer resolves in the same order. Status says which source is active. A saved key works without a restart, and saving one clears a breaker left open by the old key.
+- Cost controls: a daily input-token cap (`COS_JEV_DAILY_TOKENS`, default 1,000,000, about $0.04), a ledger in the data directory so a restart does not reset it, a 20-second timeout, and a breaker that pauses Jev for an hour after three consecutive failures. The model is pinned to `jev-1.13.0`.
+
+### Work intake: meeting work that is not on the board yet
+
+- New authenticated routes `GET /api/work-intake`, `POST /api/work-intake/items` and `POST /api/work-intake/:id/resolve` hold what the COS meeting producer (`work_intake.py`) found but did not write to Work: meeting links it was less sure of (0.60 to 0.85, or higher for a task that already links several meetings), other people's asks, and Miles's own items that need a look (from an older meeting, not clear enough to be a task, or owner unclear). Nothing here calls a model or starts an agent.
+- Producer batches are validated per item. A bad item comes back in `rejected` with its code and never blocks the rest of the batch; only a malformed batch as a whole is refused. Unknown fields, unknown review reasons and a malformed session pull are dropped, not stored, and the item itself still arrives.
+- A decision is sticky while it is retained (60 days). Once Miles accepts or dismisses an item, or the producer records a card it already made, a later producer upsert never reopens it. Resolution is serialized per item, so a double click answers "already being saved" instead of writing twice.
+- Accepting a suggested link checks that the board can write, re-reads the task by its Work identity (it survives a rename), confirms the meeting is still the same saved record, uses the library's title, and retries up to twice on a revision race.
+- Accepting an ask creates one Mentioned card linked to its meeting through one locked write in `task_write.capture_work_item`. Someone else's item is written with "(from Name)". If the same words are already an open task, that task is linked instead of adding a second card; the same words on closed, archived or delegated work are refused.
+- Card creation needs a COS bridge that reports `captureWork`. Older bridges and the bundled task runtime report it off, and accepting an ask is refused with the code `card_creation_unavailable`. A bridge that fails or times out is reported as `bridgeUnavailable` (accept answers `task_bridge_unavailable`), never as an older server. Earlier servers read only `version === 1`, so the new capability is additive.
+- The journal lives in the server data directory under `work-intake/` with one writer. A bad record is quarantined on its own and logged, and an unreadable journal leaves the rest of the API running. Unexpected failures are logged with the route. See `docs/work-intake.md`.
+- The local Work candidate (`server/scripts/work-review-candidate.ts`) mounts Intake with its own journal in the candidate home, accepts producer-sized batches, and stays up if that journal is unreadable. It also mounts the Jev routes against the same board.
+- Tests: `node server/scripts/work-intake-mutation-gate.mjs` runs 29 mutations over intake, the Jev client and session recommendation in a private copy, after a green baseline.
+
+### Fixed
+
+- Session advice only suggests a Fork on a Claude or Codex session, the sessions a Work handoff can fork. A Cursor session that shares the context no longer produces a Fork that Send then refuses. A Fork's confidence is now the named session's own probability, not the chance that some session shares the context (a 0.5 and 0.48 split used to read 98%). A Jev answer without its "none" option is treated as a bad answer instead of a certain Fork. The board lookup tries a task's Work identity before its row id.
+- The local Work candidate reads the installed Jev key but can no longer set or remove it, counts its own Jev spend in the candidate home, and accepts session-advice requests up to 128 KB (66 real sessions measured 20 KB, over the old 16 KB limit).
+- The Control 2 sandbox probe's loopback listener accepted connections with no error handler. The bash probes close right after writing, so the accepted socket could see a reset. Vitest reported it as an unhandled error in 2 of 3 runs on 6.56.1, and in a running server it would have been uncaught.
+
+## 6.56.1
+
+### Codex runs again after the ChatGPT app update
+
+- On 2026-09-27 a ChatGPT.app update (26.924, codex-cli 0.158.0-alpha.2.1) moved its bundled Codex CLI from `Contents/Resources/codex` to `Contents/Resources/codex-cli/bin/codex`, and `/Applications/Codex.app` is gone. Every Codex run (GPT models from the glasses, Codex engines) then failed with `codex binary unresolved (not_found)`. The server now looks in the new place first and still in the old one for older ChatGPT builds. The new location is a launcher that follows its own links, so nothing else changes.
+- A test pins the order, and fails without the new location; the resolver finds it with no PATH and no `~/.codex/bin` link.
+
+### Linking a saved meeting to Work
+
+- Linking a saved COS meeting to a Work card no longer fails with "The selected meeting changed; refresh before linking". Opening a single operations meeting now returns the same record identity the meeting list shows, so the exact-meeting check in Work passes for an unchanged meeting and still refuses a different or renamed one.
+- The earlier tests replaced the meeting resolver with a stub that always agreed. A new test links a real operations meeting, picked from the meeting list, through the production resolver.
+
 ## 6.56.0
 
 ### Connected Work across COS Control and glasses

package/docs/work-intake.md

@@ -0,0 +1,32 @@
+# Work intake
+
+Work intake holds meeting-derived Work that is not on the board yet. A producer outside the server (COS `operations/scripts/work_intake.py`, which uses Jev to judge saved meetings) pushes items; the user resolves them in COS Control → Work → Intake. The server never calls a model or starts an agent for intake.
+
+## Items
+
+| Kind | Status | Meaning | Accept does |
+| --- | --- | --- | --- |
+| `link` | `suggested` | An existing task was probably worked on in a meeting (0.60 to 0.85, or higher for a task that already links several meetings) | Links the task to the meeting |
+| `ask` | `ask` | Someone else's action item. `pull` names one of the user's sessions that may already cover it | Creates a Mentioned card linked to the meeting, written with "(from Name)" |
+| `ask` | `review` | The user's own item that needs a look. `reason`: `outside_window`, `unclear_task` or `owner_uncertain` | Creates a Mentioned card linked to the meeting |
+| any | `accepted` / `dismissed` | Decided. A producer may record cards it made itself (`resolution.by: "producer"`) and may retract its own open items (a producer dismissal) | — |
+
+## API (authenticated like every `/api` route)
+
+- `GET /api/work-intake` returns `{ schemaVersion: 1, capabilities: { linkWrites, cardCreation, bridgeUnavailable? }, counts, items, quarantined }` with open items only.
+- `POST /api/work-intake/items` takes `{ items: [...] }`, at most 200 per batch. Each item is validated on its own; refusals come back in `rejected: [{ id, code }]`.
+- `POST /api/work-intake/:id/resolve` takes `{ action: "accept" | "dismiss" }`. Refusals are 409 with a code (`intake_task_changed`, `meeting_links_full`, `meeting_identity_changed`, `meeting_unavailable`, `intake_text_collision`, `work_board_read_only`, `card_creation_unavailable`, `intake_busy`), 503 `task_bridge_unavailable` when the task bridge did not answer, 404 `intake_not_found`. A refused item stays open.
+
+Card creation needs a COS task bridge that reports `captureWork: 1`. The bundled task runtime does not, so on installs without COS the Intake list stays empty and accepting an ask is refused.
+
+## Storage and recovery
+
+The journal is `work-intake/intake.json` in the server data directory, owned by one server process (`writer.lock`). User decisions are kept for 60 days and are sticky against producer upserts; open items are capped at 5,000. An unreadable record is quarantined on its own and logged at start. An unreadable or unsafe journal disables intake (503) without stopping the rest of the server: preserve the file for diagnosis, then move it aside to start empty. The producer's own ledger (`.work_intake_state.json`) never re-sends a decided item.
+
+## Verification
+
+`npx vitest run server/lib/work-intake-store.test.ts server/routes/work-intake.test.ts server/lib/task-store-intake.test.ts` covers the store, routes and bridge powers. `node server/scripts/work-intake-mutation-gate.mjs` runs its mutations in a private copy and refuses to start on a red baseline. The local Work candidate (`server/scripts/work-review-candidate.ts`) mounts intake with a journal in the candidate home.
+
+## Jev key and session suggestions
+
+`POST /api/jev-key/set` `{ key }` validates the key against TypeSafe and saves it to `data/jev-key.json`; `GET /api/jev-key/status` returns `{ configured, source, usedToday, dailyCap, breakerOpenUntil, lastError }` and never the key; `DELETE /api/jev-key` removes the saved key. `POST /api/work-board/session-recommendation` `{ domain, id, sessions: [{ id, provider, title, summary? }] }` returns `{ provider: "jev", action: "continue" | "fork" | "new", sessionId, confidence, reason, alternatives }` or `{ provider: "none", reason }`. The COS meeting producer reads the same saved key when its own `.env` has none.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.56.0",
+  "version": "6.57.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -43,6 +43,7 @@
     "!server/scripts/engine-canary.ts",
     "!server/scripts/work-review-candidate.ts",
     "!server/scripts/work-review-mutation-gate.mjs",
+    "!server/scripts/work-intake-mutation-gate.mjs",
     "!server/scripts/mutation-gate.mjs",
     "!server/lib/meeting-engine/__fixtures__/**",
     "!server/lib/__fixtures__/**",
@@ -62,6 +63,7 @@
     "docs/control2-sandbox.md",
     "docs/control2-task-runtime.md",
     "docs/work-reviews.md",
+    "docs/work-intake.md",
     "work-task-runtime",
     "docs/work-task-runtime.md",
     "!server/scripts/build-work-task-runtime.py"

package/server/index.ts

@@ -124,6 +124,10 @@ import { getTranscriptionProfileStatus } from './lib/profile.js'
 import { createQueryJobsRouter } from './routes/query-jobs.js'
 import { createWorkReviewsRouter } from './routes/work-reviews.js'
 import { createWorkBoardRouter } from './routes/work-board.js'
+import { createWorkIntakeRouter } from './routes/work-intake.js'
+import { createJevRouter } from './routes/jev.js'
+import { dataPath } from './lib/data-dir.js'
+import { WorkIntakeStore, createOptionalWorkIntakeStore } from './lib/work-intake-store.js'
 import { createDefaultWorkReviewRuntime } from './lib/work-review-backend.js'
 import { createMorningBriefRouter } from './routes/morning-brief.js'
 import { getMorningBriefScheduler, startMorningBriefScheduler, stopMorningBriefScheduler } from './lib/morning-brief-runtime.js'
@@ -622,6 +626,11 @@ app.use('/api', createQueryJobsRouter(queryJobCoordinator, {
 const workReviewRuntime = createDefaultWorkReviewRuntime()
 app.use('/api', createWorkReviewsRouter(workReviewRuntime))
 app.use('/api', createWorkBoardRouter())
+// Work intake (6.57.0): meeting-derived suggestions, asks and review items. Optional: a bad journal never blocks boot.
+const workIntakeStore = createOptionalWorkIntakeStore(() => new WorkIntakeStore(dataPath('work-intake')))
+app.use('/api', createWorkIntakeRouter({ store: workIntakeStore }))
+// Jev key (Control Settings) and Continue/Fork/New session recommendations for Work tasks (6.57.0).
+app.use('/api', createJevRouter())
 app.use('/api', queryRouter)
 // The scheduled start-of-day brief: settings, status, run-now. Same auth as
 // every other settings route; the brief itself is an ordinary durable job.
@@ -937,6 +946,7 @@ async function gracefulShutdown(): Promise<void> {
   forceExit.unref?.()
   stopMorningBriefScheduler()
   await workReviewRuntime?.close()
+  workIntakeStore?.close()
   stopMeetingImportScheduler()
   stopMeetingMergeScheduler()
   sessionHooksRuntime.stop()

package/server/lib/control2-sandbox.ts

@@ -139,7 +139,9 @@ export async function probeControl2Sandbox(): Promise<Control2SandboxCapability>
   const protectedRoot = mkdtempSync(join(tmpdir(), 'cos-control2-protected-'))
   const sentinel = join(realpathSync(protectedRoot), 'sentinel.txt')
   writeFileSync(sentinel, 'protected-canary-only', { mode: 0o600 })
-  const listener = createServer(socket => socket.end('reachable'))
+  // 6.57.0: the bash probes close right after writing, so the accepted socket can see ECONNRESET.
+  // Without a listener that 'error' was unhandled (vitest reported it in 2 of 3 runs on 6.56.1).
+  const listener = createServer(socket => { socket.on('error', () => {}); socket.end('reachable') })
   let hits = 0
   listener.on('connection', () => { hits++ })
   try {

package/server/lib/cos-operations-meetings.ts

@@ -828,6 +828,13 @@ export function getCosOperationsMeetingDetail(
   const content = readFileSync(filepath, 'utf-8')
   const meta = parseMeetingMeta(content, resolvedFilename, domain)
   meta.month = month
+  // Same identity the list row advertises (listCosOperationsMeetings). Work's
+  // meeting link and review checks compare the list's recordId against this
+  // detail; without it every real COS meeting refused as "meeting changed".
+  meta.librarySource = 'cos_operations'
+  meta.recordId = `ops:${domain}:${month}:${resolvedFilename}`
+  meta.mutable = true
+  meta.canonicalRecord = `operations/${domain}/meetings/${month}/${resolvedFilename}`
   const source = boundedMeetingSource(content)
 
   return {

package/server/lib/jev.ts

@@ -0,0 +1,156 @@
+/**
+ * Jev (TypeSafe System One): a classifier that answers typed questions with calibrated probabilities. It never
+ * writes text. Used for Work session matching (6.57.0); the COS meeting producer uses the same key.
+ *
+ * Key resolution: data/jev-key.json (saved from COS Control Settings, validated live, never echoed back) wins, then
+ * TYPESAFE_API_KEY in the environment (which includes ~/.cos-glasses/.env, loaded at boot), then the COS scripts
+ * .env. Unlike the OpenAI key the saved key comes FIRST: Miles's Mac has TYPESAFE_API_KEY in both .env files, so an
+ * environment-first order made the Settings key inert (QA 2026-09-28). The COS producer (work_intake.py) resolves
+ * in the same order: saved, its environment, then the other .env.
+ *
+ * Cost controls: a daily input-token cap (COS_JEV_DAILY_TOKENS, default 1,000,000, about $0.04 at $42 per billion),
+ * a breaker that opens for an hour after three consecutive failures, and a 20-second request timeout. Every call
+ * counts against a ledger in the data directory, so a restart does not reset the cap.
+ */
+import { existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { COS_SCRIPTS_DIR } from './python-bridge.js'
+import { dataPath } from './data-dir.js'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { secureExistingPrivateFile } from './secure-user-config.js'
+
+export const JEV_ENDPOINT = 'https://api.typesafe.ai/v1'
+export const JEV_MODEL = 'jev-1.13.0'
+export const JEV_KEY_FILE = dataPath('jev-key.json')
+export const JEV_USAGE_FILE = dataPath('jev-usage.json')
+export const JEV_LIMITS = { defaultDailyTokens: 1_000_000, timeoutMs: 20_000, breakerFailures: 3, breakerMs: 3_600_000 } as const
+
+export type JevKeySource = 'env' | 'config' | 'scripts-env' | 'none'
+export class JevError extends Error {
+  constructor(readonly code: 'jev_not_configured' | 'jev_cap_reached' | 'jev_breaker_open' | 'jev_key_rejected'
+    | 'jev_request_rejected' | 'jev_unavailable' | 'jev_bad_answer', message: string = code) { super(message) }
+}
+
+interface KeyFile { key: string; savedAt: string; validatedAt?: string }
+function readKeyFile(): KeyFile | null {
+  if (!existsSync(JEV_KEY_FILE)) return null
+  try {
+    secureExistingPrivateFile(JEV_KEY_FILE)
+    const parsed = JSON.parse(readFileSync(JEV_KEY_FILE, 'utf8')) as Partial<KeyFile>
+    return typeof parsed.key === 'string' && parsed.key.trim()
+      ? { key: parsed.key.trim(), savedAt: String(parsed.savedAt ?? ''), validatedAt: parsed.validatedAt } : null
+  } catch { return null }
+}
+
+/** Resolved fresh on every call (a small file read), so a key saved from Control works without a restart. */
+export function resolveJevKey(): { key: string; source: Exclude<JevKeySource, 'none'>; savedAt?: string; validatedAt?: string } | null {
+  const file = readKeyFile()
+  if (file) return { key: file.key, source: 'config', savedAt: file.savedAt, validatedAt: file.validatedAt }
+  const env = process.env.TYPESAFE_API_KEY?.trim().replace(/^["']|["']$/g, '')
+  if (env) return { key: env, source: 'env' }
+  if (COS_SCRIPTS_DIR) {
+    for (const path of [resolve(COS_SCRIPTS_DIR, '.env'), resolve(COS_SCRIPTS_DIR, '../../.env')]) {
+      try {
+        const match = readFileSync(path, 'utf8').match(/^TYPESAFE_API_KEY=(.+)$/m)
+        if (match?.[1].trim()) return { key: match[1].trim().replace(/^["']|["']$/g, ''), source: 'scripts-env' }
+      } catch { /* next */ }
+    }
+  }
+  return null
+}
+
+export function saveJevKey(key: string, now = new Date()): void {
+  mkdirSync(dirname(JEV_KEY_FILE), { recursive: true, mode: 0o700 })
+  const at = now.toISOString()
+  durableAtomicWriteFileSync(JEV_KEY_FILE, JSON.stringify({ key, savedAt: at, validatedAt: at }, null, 2) + '\n', { mode: 0o600 })
+}
+
+type Fetch = typeof fetch
+/** A 200 from the free model listing proves the key works without spending tokens. */
+export async function validateJevKey(key: string, fetchImpl: Fetch = fetch): Promise<{ ok: true } | { ok: false; status: number; reason: string }> {
+  try {
+    const res = await fetchImpl(`${JEV_ENDPOINT}/models`, { headers: { Authorization: `Bearer ${key}` }, signal: AbortSignal.timeout(8_000) })
+    if (res.ok) return { ok: true }
+    return { ok: false, status: res.status, reason: res.status === 401 || res.status === 403 ? 'TypeSafe did not accept this key.' : `TypeSafe returned ${res.status}.` }
+  } catch { return { ok: false, status: 0, reason: 'TypeSafe could not be reached. Check the network and try again.' } }
+}
+
+function today(now: Date): string { return now.toISOString().slice(0, 10) }
+function dailyCap(): number {
+  const raw = Number(process.env.COS_JEV_DAILY_TOKENS)
+  return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : JEV_LIMITS.defaultDailyTokens
+}
+
+export interface JevAnswers { answers: Record<string, { choice?: string; probabilities?: Record<string, number>; noul?: number }>; model?: string; inputTokens: number }
+
+/** One Jev client per process: it owns the breaker and the usage ledger. */
+export class JevClient {
+  private failures = 0
+  private breakerUntil = 0
+  private lastError: string | null = null
+  constructor(private readonly fetchImpl: Fetch = fetch, private readonly now: () => Date = () => new Date(),
+              private readonly usageFile = JEV_USAGE_FILE) {}
+
+  usedToday(): number {
+    try {
+      const ledger = JSON.parse(readFileSync(this.usageFile, 'utf8')) as Record<string, number>
+      return Number(ledger[today(this.now())]) || 0
+    } catch { return 0 }
+  }
+  private record(tokens: number): void {
+    let ledger: Record<string, number> = {}
+    try { ledger = JSON.parse(readFileSync(this.usageFile, 'utf8')) } catch { /* fresh */ }
+    const day = today(this.now())
+    const kept = Object.fromEntries(Object.entries(ledger).filter(([d]) => d >= today(new Date(this.now().getTime() - 31 * 86_400_000))))
+    kept[day] = (Number(kept[day]) || 0) + tokens
+    mkdirSync(dirname(this.usageFile), { recursive: true, mode: 0o700 })
+    durableAtomicWriteFileSync(this.usageFile, JSON.stringify(kept) + '\n', { mode: 0o600 })
+  }
+  private fail(code: JevError['code'], countsTowardBreaker: boolean): never {
+    this.lastError = code
+    if (countsTowardBreaker && ++this.failures >= JEV_LIMITS.breakerFailures) {
+      this.breakerUntil = this.now().getTime() + JEV_LIMITS.breakerMs
+      this.failures = 0
+    }
+    throw new JevError(code)
+  }
+
+  /** A newly validated key starts clean: failures under the old key must not pause the new one for an hour. */
+  resetForNewKey(): void { this.failures = 0; this.breakerUntil = 0; this.lastError = null }
+
+  status(): { configured: boolean; source: JevKeySource; savedAt?: string; validatedAt?: string; usedToday: number; dailyCap: number; breakerOpenUntil: string | null; lastError: string | null } {
+    const key = resolveJevKey()
+    return { configured: !!key, source: key?.source ?? 'none', savedAt: key?.savedAt, validatedAt: key?.validatedAt,
+      usedToday: this.usedToday(), dailyCap: dailyCap(),
+      breakerOpenUntil: this.breakerUntil > this.now().getTime() ? new Date(this.breakerUntil).toISOString() : null, lastError: this.lastError }
+  }
+
+  /** Ask one request. `estimate` is the caller's input-token estimate, checked against the cap BEFORE sending. */
+  async ask(state: unknown, questions: Record<string, unknown>, estimate: number): Promise<JevAnswers> {
+    const key = resolveJevKey()
+    if (!key) throw new JevError('jev_not_configured')
+    if (this.breakerUntil > this.now().getTime()) throw new JevError('jev_breaker_open')
+    if (this.usedToday() + estimate > dailyCap()) this.fail('jev_cap_reached', false)
+    let res: Response
+    try {
+      res = await this.fetchImpl(`${JEV_ENDPOINT}/systemone`, { method: 'POST', signal: AbortSignal.timeout(JEV_LIMITS.timeoutMs),
+        headers: { Authorization: `Bearer ${key.key}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ state, model: JEV_MODEL, questions }) })
+    } catch { return this.fail('jev_unavailable', true) }
+    if (res.status === 401 || res.status === 403 || res.status === 402) return this.fail('jev_key_rejected', true)
+    if (res.status === 400 || res.status === 413 || res.status === 422) return this.fail('jev_request_rejected', false)
+    if (!res.ok) return this.fail('jev_unavailable', true)
+    let body: { answers?: JevAnswers['answers']; model?: string; usage?: { input_tokens?: number } }
+    try { body = await res.json() } catch { return this.fail('jev_bad_answer', true) }
+    const used = Number(body.usage?.input_tokens) || estimate  // count something even if usage is missing
+    this.record(used)
+    if (!body.answers || typeof body.answers !== 'object') return this.fail('jev_bad_answer', true)
+    this.failures = 0; this.lastError = null
+    return { answers: body.answers, model: body.model, inputTokens: used }
+  }
+}
+
+let shared: JevClient | null = null
+export function sharedJevClient(): JevClient { return shared ??= new JevClient() }
+/** Jev bills by input size; about 2.6 characters per token, measured on COS meeting and task text. */
+export function estimateJevTokens(value: unknown): number { return Math.ceil(JSON.stringify(value).length / 2.6) + 1 }

package/server/lib/provider-binary.ts

@@ -118,8 +118,12 @@ export function providerBinarySpec(provider: string): BinarySpec | null {
       name: 'codex',
       envKeys: ['COS_ATTACHED_CODEX_BIN', 'COS_CODEX_BIN'],
       absolutes: [
-        // Verified 2026-08-15: codex-cli 0.148.0-alpha.9 lives here, and there is
-        // no `codex` on PATH at all on this machine.
+        // 6.56.1: ChatGPT.app 26.924 (2026-09-27, codex-cli 0.158.0-alpha.2.1) moved the bundled CLI
+        // here, a sh launcher that follows symlinks to CodexCLI.app. Every Codex run on an updated
+        // Mac failed with `codex binary unresolved (not_found)` until this path was listed.
+        '/Applications/ChatGPT.app/Contents/Resources/codex-cli/bin/codex',
+        // Verified 2026-08-15: codex-cli 0.148.0-alpha.9 lived here (older ChatGPT builds), and
+        // there is no `codex` on PATH at all on this machine.
         '/Applications/ChatGPT.app/Contents/Resources/codex',
         home ? join(home, '.codex', 'bin', 'codex') : '',
         '/opt/homebrew/bin/codex',

package/server/lib/session-recommendation.ts

@@ -0,0 +1,107 @@
+/**
+ * Which of the user's agent sessions should take a Work task: Continue one already doing it, Fork one that shares
+ * its context (same deliverable, page, module, codebase or client thread) but is doing different work, or start a
+ * New session. Jev answers two choice questions over the sessions in one request; the thresholds below were
+ * checked on Miles's live sessions on 2026-09-28 (a 1:1 task went New, a server bug Continued its server session at
+ * 0.91, a hardware-page task Forked the hardware session). A recommendation is advice: nothing is selected or sent.
+ */
+import { createHash } from 'node:crypto'
+import { estimateJevTokens, JevError, type JevClient } from './jev.js'
+
+export const CONTINUE_AT = 0.5  // P(a session is already doing this exact task)
+export const FORK_AT = 0.6      // P(some session shares the context) = 1 - P(none)
+export const RECOMMENDATION_LIMITS = { sessions: 80, title: 120, summary: 240, cacheMs: 30 * 60_000, cacheEntries: 200 } as const
+
+export interface CandidateSession { id: string; provider: string; title: string; summary?: string; updated?: string }
+export interface RecommendationInput { task: { text: string; domain: string; meetings: string[] }; sessions: CandidateSession[] }
+export type Recommendation =
+  | { provider: 'jev'; model: string; action: 'continue' | 'fork' | 'new'; sessionId: string | null; confidence: number; reason: string;
+      alternatives: Array<{ sessionId: string; p: number }>; cached: boolean }
+  | { provider: 'none'; reason: string }
+
+const BEST = "Which one of the user's agent sessions is the natural place to do the work in `task`: the session already working on the "
+  + 'same deliverable, page, module, codebase or client thread, so continuing or forking it saves re-explaining context? '
+  + 'Choose none if no session works on the same deliverable, page, module, codebase or client thread.'
+const EXACT = "Which one of the user's agent sessions is already doing this exact task, so the work should simply continue there? "
+  + 'A session on the same project doing different work does not count. Choose none if no session is doing this task.'
+
+/** Providers the Work handoff can fork (Control's destinationSupported). */
+export const FORKABLE = new Set(['claude', 'codex'])
+const clip = (text: string | undefined, max: number) => (text ?? '').replace(/\s+/g, ' ').trim().slice(0, max)
+const round = (n: number) => Math.round(n * 100) / 100
+
+function ranked(probabilities: Record<string, number> | undefined, offered: Set<string>): Array<[string, number]> {
+  const rows = Object.entries(probabilities ?? {}).filter(([k]) => k !== 'none')
+  if (rows.some(([k]) => !offered.has(k))) throw new JevError('jev_bad_answer', 'Jev chose a session that was not offered')
+  return rows.map(([k, v]) => [k, Number(v) || 0] as [string, number]).sort((a, b) => b[1] - a[1])
+}
+
+/** Pure policy over Jev's two answers. Exported for tests. */
+export function decide(best: Record<string, number>, exact: Record<string, number>, sessions: CandidateSession[]):
+    Omit<Extract<Recommendation, { provider: 'jev' }>, 'provider' | 'model' | 'cached'> {
+  const offered = new Set(sessions.map((_, i) => `s${i}`))
+  const bestRank = ranked(best, offered), exactRank = ranked(exact, offered)
+  const idOf = (key: string) => sessions[Number(key.slice(1))].id
+  const alternatives = bestRank.slice(0, 3).filter(([, p]) => p > 0).map(([k, p]) => ({ sessionId: idOf(k), p: round(p) }))
+  const [exactKey, exactP] = exactRank[0] ?? ['', 0]
+  if (exactKey && exactP >= CONTINUE_AT) {
+    return { action: 'continue', sessionId: idOf(exactKey), confidence: round(exactP), reason: 'Already doing this task.', alternatives }
+  }
+  // A choice answer always carries `none`; without it "covered" would read 1 and advise a Fork at 100%.
+  if (typeof best.none !== 'number' || !Number.isFinite(best.none)) throw new JevError('jev_bad_answer', 'Jev left out none')
+  const covered = 1 - best.none
+  // Fork only where the workspace can fork (Claude and Codex); a Cursor session sharing context cannot take a Fork.
+  const [forkKey, forkP] = bestRank.find(([k, p]) => p > 0 && FORKABLE.has(sessions[Number(k.slice(1))].provider)) ?? ['', 0]
+  if (forkKey && covered >= FORK_AT) {
+    // The confidence shown is the named session's own probability, not the chance that SOME session shares context.
+    return { action: 'fork', sessionId: idOf(forkKey), confidence: round(forkP),
+      reason: 'Shares this work’s context (same deliverable, page, module or thread) but is doing different work.', alternatives }
+  }
+  return { action: 'new', sessionId: null, confidence: round(1 - covered), reason: 'No existing session shares this work’s context.', alternatives }
+}
+
+/** Validate what the client sends. Sessions are candidates only: the task text always comes from the board. */
+export function parseCandidates(raw: unknown): CandidateSession[] | null {
+  if (!Array.isArray(raw) || raw.length > RECOMMENDATION_LIMITS.sessions) return null
+  const seen = new Set<string>(), out: CandidateSession[] = []
+  for (const r of raw as Array<Record<string, unknown>>) {
+    if (!r || typeof r !== 'object' || typeof r.id !== 'string' || !r.id || r.id.length > 200 || seen.has(r.id)) return null
+    if (typeof r.title !== 'string' || !clip(r.title, RECOMMENDATION_LIMITS.title)) return null
+    seen.add(r.id)
+    out.push({ id: r.id, provider: clip(typeof r.provider === 'string' ? r.provider : 'agent', 20), title: clip(r.title, RECOMMENDATION_LIMITS.title),
+      summary: clip(typeof r.summary === 'string' ? r.summary : '', RECOMMENDATION_LIMITS.summary), updated: clip(typeof r.updated === 'string' ? r.updated : '', 10) })
+  }
+  return out
+}
+
+export class SessionRecommender {
+  private cache = new Map<string, { at: number; value: Extract<Recommendation, { provider: 'jev' }> }>()
+  constructor(private readonly jev: JevClient, private readonly now: () => number = () => Date.now()) {}
+
+  async recommend(input: RecommendationInput): Promise<Recommendation> {
+    const sessions = input.sessions
+    if (!sessions.length) return { provider: 'none', reason: 'no_sessions' }
+    const key = createHash('sha256').update(JSON.stringify(input)).digest('hex')
+    const hit = this.cache.get(key)
+    if (hit && this.now() - hit.at < RECOMMENDATION_LIMITS.cacheMs) return { ...hit.value, cached: true }
+    const state = { task: { text: clip(input.task.text, 1200), domain: input.task.domain, meetings: input.task.meetings.map(t => clip(t, 160)).slice(0, 8) },
+      sessions: sessions.map((s, i) => ({ i, provider: s.provider, title: s.title, summary: s.summary, updated: s.updated })) }
+    const options = Object.fromEntries(sessions.map((s, i) => [`s${i}`, `sessions[${i}]: ${clip(s.title, 100)}`]))
+    const questions = {
+      best: { type: 'choice', criteria: { ...options, none: 'No listed session shares this work’s context.' }, instructions: BEST },
+      exact: { type: 'choice', criteria: { ...options, none: 'No listed session is doing this task.' }, instructions: EXACT },
+    }
+    try {
+      const reply = await this.jev.ask(state, questions, estimateJevTokens({ state, questions }))
+      const best = reply.answers.best?.probabilities, exact = reply.answers.exact?.probabilities
+      if (!best || !exact) throw new JevError('jev_bad_answer')
+      const value = { provider: 'jev' as const, model: reply.model ?? 'jev', cached: false, ...decide(best, exact, sessions) }
+      if (this.cache.size >= RECOMMENDATION_LIMITS.cacheEntries) this.cache.delete(this.cache.keys().next().value!)
+      this.cache.set(key, { at: this.now(), value })
+      return value
+    } catch (e) {
+      if (e instanceof JevError) return { provider: 'none', reason: e.code }
+      throw e
+    }
+  }
+}

package/server/lib/task-store.ts

@@ -560,6 +560,30 @@ export async function setTaskWorkStage(domain: string, id: string, workStage: Wo
   if (!WORK_STAGES.includes(workStage)) throw new TaskRunError(422, 'invalid_work_stage', 'Unknown Work stage')
   await withLockRetry(() => bridge(['task-set-work-stage', domain, id, workStage], JSON.stringify({ expectedText, expectedRevision })))
 }
+/**
+ * Work intake needs two bridge powers: exact meeting links (version 1) and one-write card capture. A bridge that
+ * failed or timed out is reported as `bridgeUnavailable`, so a hiccup never reads as "this server is too old".
+ */
+export async function workIntakeCapabilities(): Promise<{ linkWrites: boolean; cardCreation: boolean; bridgeUnavailable?: true }> {
+  if (!taskBridgeAvailable()) return { linkWrites: false, cardCreation: false }
+  try {
+    const value = await bridge(['task-work-capabilities']) as { version?: unknown; captureWork?: unknown }
+    // `captureWork` is additive on purpose: servers through 6.56.x read only `version === 1`.
+    return { linkWrites: value?.version === 1, cardCreation: value?.version === 1 && value?.captureWork === 1 }
+  } catch { return { linkWrites: false, cardCreation: false, bridgeUnavailable: true } }
+}
+export interface CapturedWorkItem { created: boolean; id: string; linked: boolean; checked: boolean; archived: boolean; delegated: boolean }
+/** One locked write: a Mentioned card already linked to its meeting (COS `task_write.capture_work_item`). */
+export async function captureWorkItem(domain: string, text: string, meeting: WorkMeetingRef): Promise<CapturedWorkItem> {
+  if (!isSafeDomainName(domain) || !taskDomains().includes(domain)) throw new TaskRunError(400, 'invalid_domain', 'Unknown task domain')
+  if (!text || text.length > 2000) throw new TaskRunError(422, 'invalid_task_text', 'Card text must be 1 to 2,000 characters')
+  rejectReservedWorkText(text)
+  const out = await withLockRetry(() => bridge(['task-capture-work', domain], JSON.stringify({ text, meeting }))) as Partial<CapturedWorkItem> & { ok?: unknown }
+  if (out?.ok !== true || typeof out.id !== 'string' || !/^[a-f0-9]{12}$/.test(out.id) || typeof out.created !== 'boolean' || typeof out.linked !== 'boolean') {
+    throw new TaskRunError(502, 'capture_unverified', 'The card could not be confirmed. Refresh Work before trying again.')
+  }
+  return { created: out.created, id: out.id, linked: out.linked, checked: out.checked === true, archived: out.archived === true, delegated: out.delegated === true }
+}
 export async function linkTaskMeeting(domain: string, id: string, expectedText: string, expectedRevision: string, meeting: WorkMeetingRef): Promise<void> {
   validateWorkTarget(domain, id, expectedText, expectedRevision)
   await withLockRetry(() => bridge(['task-link-meeting', domain, id], JSON.stringify({ expectedText, expectedRevision, meeting })))

package/server/lib/work-intake-store.ts

@@ -0,0 +1,221 @@
+/**
+ * Work intake: meeting-derived Work that is not yet on the board, and cards a producer already made.
+ *
+ * A producer (COS `work_intake.py`, Jev-scored) upserts items; the user resolves them in Control.
+ * Suggested meeting links (0.60 to 0.85, or higher for a task already linked to several meetings), other people's
+ * asks, and review items (his own, from an older meeting or not clear enough to card)
+ * live here, never in tasks.md: task metadata accepts only workflowPhase/workIdentity/meetingRefs, and an
+ * older validator would mark a whole task line invalid if a suggestion were stored on it.
+ *
+ * One process owns the journal (instance lock). A bad record is quarantined on its own instead of taking
+ * the store down. A user's decision is sticky while it is retained (60 days): a later producer upsert never reopens
+ * it, and the producer's own ledger never re-sends a decided item.
+ */
+import { existsSync, lstatSync, mkdirSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { isSafeDomainName } from './domains.js'
+import { acquireServerInstanceLock, type ServerInstanceLock } from './server-instance-lock.js'
+
+export class WorkIntakeError extends Error {
+  constructor(readonly code: string, readonly status = 409) { super(code) }
+}
+export type IntakeKind = 'link' | 'ask'
+export type IntakeStatus = 'suggested' | 'review' | 'ask' | 'accepted' | 'dismissed'
+export interface IntakeMeeting { domain: string; month: string; filename: string; recordId: string; title: string }
+export interface IntakeTask { domain: string; id: string; workIdentity: string; text: string }
+export interface IntakePull { kind: 'session'; id: string; title: string; p: number }
+export interface IntakeResolution { action: 'accept' | 'dismiss'; by: 'producer' | 'user'; at: string; taskId?: string }
+/** Why an item of Miles's landed in Review instead of becoming a card. */
+export type IntakeReason = 'unclear_task' | 'owner_uncertain' | 'outside_window'
+const REASONS: ReadonlySet<string> = new Set<IntakeReason>(['unclear_task', 'owner_uncertain', 'outside_window'])
+export interface WorkIntakeItem {
+  id: string; kind: IntakeKind; status: IntakeStatus; meeting: IntakeMeeting; confidence: number; model: string
+  producedAt: string; updatedAt: string
+  task?: IntakeTask; relation?: 'originated' | 'advanced'
+  text?: string; owner?: string | null; ownerIsMiles?: boolean; pull?: IntakePull | null; reason?: IntakeReason
+  resolution?: IntakeResolution
+}
+
+export const INTAKE_LIMITS = { items: 5_000, batch: 200, text: 600, title: 300, owner: 80, model: 64, retainResolvedDays: 60 } as const
+const OPEN: ReadonlySet<IntakeStatus> = new Set(['suggested', 'review', 'ask'])
+const ID = /^wi_[a-f0-9]{32}$/
+const TASK_ID = /^[a-f0-9]{12}$/
+const MONTH = /^\d{4}-(0[1-9]|1[0-2])$/
+const clean = (v: unknown, max: number): string | null =>
+  typeof v === 'string' && v.trim() && v.length <= max && !/[\x00-\x08\x0b-\x1f\x7f]/.test(v) ? v.replace(/\s+/g, ' ').trim() : null
+const iso = (v: unknown): string | null => typeof v === 'string' && v.length <= 40 && !Number.isNaN(Date.parse(v)) ? v : null
+
+function meetingOf(raw: unknown): IntakeMeeting {
+  const m = raw as Partial<IntakeMeeting> | null
+  const domain = clean(m?.domain, 64), month = clean(m?.month, 7), filename = clean(m?.filename, 255)
+  const recordId = clean(m?.recordId, 512), title = clean(m?.title, INTAKE_LIMITS.title)
+  if (!domain || !isSafeDomainName(domain) || !month || !MONTH.test(month) || !filename || !/^[^/\\]+\.md$/.test(filename) || !recordId || !title) {
+    throw new WorkIntakeError('invalid_intake_meeting', 400)
+  }
+  return { domain, month, filename, recordId, title }
+}
+
+/** Validate one producer or journal record. Unknown fields are dropped, never trusted. */
+export function parseIntakeItem(raw: unknown, now = new Date().toISOString()): WorkIntakeItem {
+  const r = raw as Record<string, unknown> | null
+  if (!r || typeof r !== 'object' || Array.isArray(r)) throw new WorkIntakeError('invalid_intake_item', 400)
+  const id = typeof r.id === 'string' && ID.test(r.id) ? r.id : null
+  const kind = r.kind === 'link' || r.kind === 'ask' ? r.kind : null
+  const status = typeof r.status === 'string' && ['suggested', 'review', 'ask', 'accepted', 'dismissed'].includes(r.status) ? r.status as IntakeStatus : null
+  const confidence = typeof r.confidence === 'number' && r.confidence >= 0 && r.confidence <= 1 ? r.confidence : null
+  const model = clean(r.model, INTAKE_LIMITS.model)
+  if (!id || !kind || !status || confidence === null || !model) throw new WorkIntakeError('invalid_intake_item', 400)
+  const allowed: readonly IntakeStatus[] = kind === 'link' ? ['suggested', 'accepted', 'dismissed'] : ['review', 'ask', 'accepted', 'dismissed']
+  if (!allowed.includes(status)) throw new WorkIntakeError('invalid_intake_status', 400)
+  const item: WorkIntakeItem = { id, kind, status, meeting: meetingOf(r.meeting), confidence, model,
+    producedAt: iso(r.producedAt) ?? now, updatedAt: iso(r.updatedAt) ?? now }
+  if (kind === 'link') {
+    const t = r.task as Partial<IntakeTask> | null
+    const domain = clean(t?.domain, 64), tid = clean(t?.id, 12), identity = clean(t?.workIdentity, 12), text = clean(t?.text, INTAKE_LIMITS.text)
+    if (!domain || !isSafeDomainName(domain) || !tid || !TASK_ID.test(tid) || !identity || !TASK_ID.test(identity) || !text) {
+      throw new WorkIntakeError('invalid_intake_task', 400)
+    }
+    item.task = { domain, id: tid, workIdentity: identity, text }
+    item.relation = r.relation === 'originated' ? 'originated' : 'advanced'
+  } else {
+    const text = clean(r.text, INTAKE_LIMITS.text)
+    if (!text) throw new WorkIntakeError('invalid_intake_text', 400)
+    item.text = text
+    item.owner = r.owner === null || r.owner === undefined ? null : clean(r.owner, INTAKE_LIMITS.owner)
+    item.ownerIsMiles = r.ownerIsMiles === true
+    // Advisory, like `reason`: a malformed pull is dropped and the ask itself still arrives.
+    const p = r.pull as Partial<IntakePull> | null | undefined
+    const pid = clean(p?.id, 200), title = clean(p?.title, 120)
+    item.pull = p && p.kind === 'session' && pid && title && typeof p.p === 'number' && p.p >= 0 && p.p <= 1 ? { kind: 'session', id: pid, title, p: p.p } : null
+    // Optional and advisory: an unknown reason from a newer producer is dropped, never a reason to refuse the item.
+    if (typeof r.reason === 'string' && REASONS.has(r.reason)) item.reason = r.reason as IntakeReason
+  }
+  const res = r.resolution as Partial<IntakeResolution> | undefined
+  if (res !== undefined) {
+    if ((res.action !== 'accept' && res.action !== 'dismiss') || (res.by !== 'producer' && res.by !== 'user')) throw new WorkIntakeError('invalid_intake_resolution', 400)
+    const taskId = res.taskId === undefined ? undefined : clean(res.taskId, 12)
+    if (taskId !== undefined && (!taskId || !TASK_ID.test(taskId))) throw new WorkIntakeError('invalid_intake_resolution', 400)
+    item.resolution = { action: res.action, by: res.by, at: iso(res.at) ?? now, ...(taskId ? { taskId } : {}) }
+  }
+  if ((item.status === 'accepted' || item.status === 'dismissed') !== (item.resolution !== undefined)) throw new WorkIntakeError('invalid_intake_resolution', 400)
+  return item
+}
+
+export interface IntakeRejection { id: string | null; code: string }
+export interface UpsertResult { inserted: number; updated: number; sticky: number; rejected: IntakeRejection[] }
+
+export class WorkIntakeStore {
+  private rows: WorkIntakeItem[] = []
+  private quarantined: unknown[] = []
+  private readonly path: string
+  private readonly lock: ServerInstanceLock
+  private closed = false
+  private readonly busy = new Set<string>()
+  constructor(root: string, private readonly now: () => Date = () => new Date()) {
+    const dir = resolve(root)
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    const stat = lstatSync(dir)
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077)) throw new WorkIntakeError('intake_store_unsafe', 503)
+    this.path = join(dir, 'intake.json')
+    try { this.lock = acquireServerInstanceLock({ lockDir: join(dir, 'writer.lock') }) }
+    catch { throw new WorkIntakeError('intake_store_locked', 503) }
+    if (!existsSync(this.path)) return
+    try {
+      const file = lstatSync(this.path)
+      if (!file.isFile() || file.isSymbolicLink() || file.uid !== process.getuid?.() || (file.mode & 0o077) || file.size > 32_000_000) throw new Error('unsafe')
+      const journal = JSON.parse(readFileSync(this.path, 'utf8'))
+      if (journal?.version !== 1 || !Array.isArray(journal.items)) throw new Error('version')
+      const seen = new Set<string>()
+      for (const raw of journal.items) {
+        try {
+          const item = parseIntakeItem(raw)
+          if (seen.has(item.id)) throw new Error('duplicate')
+          seen.add(item.id); this.rows.push(item)
+        } catch { this.quarantined.push(raw) }  // one bad record never takes the store down
+      }
+      if (Array.isArray(journal.quarantined)) this.quarantined.push(...journal.quarantined.slice(0, 500))
+      if (this.quarantined.length) console.warn(`[work-intake] ${this.quarantined.length} unreadable journal record(s) set aside in ${this.path}`)
+    } catch { this.close(); throw new WorkIntakeError('intake_store_recovery_required', 503) }
+  }
+  list(): WorkIntakeItem[] { return structuredClone(this.rows) }
+  open(): WorkIntakeItem[] { return this.list().filter(r => OPEN.has(r.status)) }
+  get(id: string): WorkIntakeItem | undefined { return this.list().find(r => r.id === id) }
+  quarantineCount(): number { return this.quarantined.length }
+
+  /**
+   * Validate per item: one bad item is answered in `rejected` and never blocks the rest of the batch, so a
+   * producer queue cannot wedge on a single record. Only a malformed batch as a whole is refused outright.
+   */
+  upsert(raws: unknown[]): UpsertResult {
+    if (!Array.isArray(raws) || raws.length > INTAKE_LIMITS.batch) throw new WorkIntakeError('invalid_intake_batch', 400)
+    const at = this.now().toISOString()
+    const items: WorkIntakeItem[] = [], result: UpsertResult = { inserted: 0, updated: 0, sticky: 0, rejected: [] }
+    for (const raw of raws) {
+      const rawId = (raw as { id?: unknown } | null)?.id
+      const id = typeof rawId === 'string' && ID.test(rawId) ? rawId : null
+      try {
+        const item = parseIntakeItem(raw, at)
+        if (item.resolution?.by === 'user') throw new WorkIntakeError('producer_cannot_record_user_decisions', 400)
+        items.push(item)
+      } catch (e) {
+        result.rejected.push({ id, code: e instanceof WorkIntakeError ? e.code : 'invalid_intake_item' })
+      }
+    }
+    if (!items.length) return result
+    const next = this.list()
+    for (const item of items) {
+      const index = next.findIndex(r => r.id === item.id)
+      if (index < 0) { next.unshift({ ...item, updatedAt: at }); result.inserted++; continue }
+      const prior = next[index]
+      if (prior.resolution?.by === 'user' || (prior.status === 'accepted' && item.status !== 'accepted')) { result.sticky++; continue }
+      next[index] = { ...item, producedAt: prior.producedAt, updatedAt: at }
+      result.updated++
+    }
+    this.write(next)
+    return result
+  }
+
+  /** Serialize resolution per item: a double click gets 409 instead of a second link or card. */
+  async resolve(id: string, fn: (item: WorkIntakeItem) => Promise<{ taskId?: string; action: 'accept' | 'dismiss' }>): Promise<WorkIntakeItem> {
+    if (!ID.test(id)) throw new WorkIntakeError('invalid_intake_id', 400)
+    if (this.busy.has(id)) throw new WorkIntakeError('intake_busy', 409)
+    const current = this.get(id)
+    if (!current) throw new WorkIntakeError('intake_not_found', 404)
+    if (!OPEN.has(current.status)) return current  // repeat accept or dismiss: already decided, idempotent
+    this.busy.add(id)
+    try {
+      const outcome = await fn(current)
+      const at = this.now().toISOString()
+      const next = this.list(), index = next.findIndex(r => r.id === id)
+      if (index < 0) throw new WorkIntakeError('intake_not_found', 404)
+      next[index] = { ...next[index], status: outcome.action === 'accept' ? 'accepted' : 'dismissed', updatedAt: at,
+        resolution: { action: outcome.action, by: 'user', at, ...(outcome.taskId ? { taskId: outcome.taskId } : {}) } }
+      this.write(next)
+      return structuredClone(next[index])
+    } finally { this.busy.delete(id) }
+  }
+
+  private write(rows: WorkIntakeItem[]): void {
+    if (this.closed) throw new WorkIntakeError('intake_store_closed', 503)
+    const cutoff = this.now().getTime() - INTAKE_LIMITS.retainResolvedDays * 86_400_000
+    const kept = rows.filter(r => OPEN.has(r.status) || Date.parse(r.updatedAt) >= cutoff)
+    if (kept.length > INTAKE_LIMITS.items) throw new WorkIntakeError('intake_store_full', 503)
+    durableAtomicWriteFileSync(this.path, JSON.stringify({ version: 1, items: kept, quarantined: this.quarantined }) + '\n')
+    this.rows = kept
+  }
+  close(): void {
+    if (this.closed) return
+    this.closed = true
+    this.lock.release()
+  }
+}
+
+/** Optional: a locked or unreadable journal must never keep the base API from starting. */
+export function createOptionalWorkIntakeStore(create: () => WorkIntakeStore): WorkIntakeStore | null {
+  try { return create() }
+  catch (error) {
+    console.error('[work-intake] store unavailable; base API remains available:', error instanceof WorkIntakeError ? error.code : error)
+    return null
+  }
+}

package/server/routes/jev.ts

@@ -0,0 +1,77 @@
+/**
+ * Jev key management (COS Control Settings) and Work session recommendations. Auth comes from the parent /api mount.
+ *
+ * The key is push-only, like /api/openai-key: validated live against TypeSafe's free model listing, saved to
+ * data/jev-key.json (0600), and never returned to any client. The saved key wins over TYPESAFE_API_KEY in the
+ * environment (see resolveJevKey); /status says which source is active so Control can show it honestly.
+ */
+import { Router } from 'express'
+import { existsSync, unlinkSync } from 'node:fs'
+import { JEV_KEY_FILE, saveJevKey, sharedJevClient, validateJevKey, type JevClient } from '../lib/jev.js'
+import { SessionRecommender, parseCandidates } from '../lib/session-recommendation.js'
+import { listBoard } from '../lib/task-store.js'
+import { isSafeDomainName } from '../lib/domains.js'
+
+export interface JevRouteDependencies {
+  jev: JevClient
+  recommender: Pick<SessionRecommender, 'recommend'>
+  list: typeof listBoard
+  validate: typeof validateJevKey
+  save: typeof saveJevKey
+}
+
+export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}): Router {
+  const jev = overrides.jev ?? sharedJevClient()
+  const deps: JevRouteDependencies = { jev, recommender: new SessionRecommender(jev), list: listBoard, validate: validateJevKey, save: saveJevKey, ...overrides }
+  const router = Router()
+  router.use(['/jev-key', '/work-board/session-recommendation'], (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
+
+  router.get('/jev-key/status', (_req, res) => res.json(deps.jev.status()))
+
+  router.post('/jev-key/set', async (req, res) => {
+    const raw = req.body?.key
+    if (!req.body || typeof req.body !== 'object' || Object.keys(req.body).some(k => k !== 'key') || typeof raw !== 'string') {
+      return res.status(400).json({ error: { code: 'invalid_jev_key', message: 'Paste a TypeSafe API key.' } })
+    }
+    const key = raw.trim()
+    if (key.length < 16 || key.length > 512 || /[\s\x00-\x1f\x7f]/.test(key)) {
+      return res.status(400).json({ error: { code: 'invalid_jev_key', message: 'That does not look like a TypeSafe API key.' } })
+    }
+    const check = await deps.validate(key)
+    if (!check.ok) return res.status(400).json({ error: { code: 'jev_key_not_accepted', message: check.reason, upstreamStatus: check.status } })
+    try { deps.save(key) } catch {
+      return res.status(500).json({ error: { code: 'jev_key_not_saved', message: 'The key was valid but could not be saved. Check the server data folder.' } })
+    }
+    deps.jev.resetForNewKey()
+    return res.json({ ok: true, ...deps.jev.status() })
+  })
+
+  router.delete('/jev-key', (_req, res) => {
+    try { if (existsSync(JEV_KEY_FILE)) unlinkSync(JEV_KEY_FILE) } catch {
+      return res.status(500).json({ error: { code: 'jev_key_not_removed', message: 'The saved key could not be removed.' } })
+    }
+    return res.json({ ok: true, ...deps.jev.status() })
+  })
+
+  /** Continue / Fork / New for one task. The task comes from the board; the client sends only candidate sessions. */
+  router.post('/work-board/session-recommendation', async (req, res) => {
+    const body = req.body
+    const sessions = parseCandidates(body?.sessions)
+    if (!body || typeof body !== 'object' || Object.keys(body).some(k => !['domain', 'id', 'sessions'].includes(k))
+      || typeof body.domain !== 'string' || !isSafeDomainName(body.domain) || typeof body.id !== 'string' || !/^[a-f0-9]{12}$/.test(body.id) || !sessions) {
+      return res.status(400).json({ error: { code: 'invalid_recommendation_request', message: 'Select an exact task and send at most 80 sessions.' } })
+    }
+    try {
+      // Work identity first: it survives a rename, while a new card's id could equal an old identity's text hash.
+      const rows = (await deps.list()).filter(r => r.domain === body.domain)
+      const row = rows.find(r => r.workIdentity === body.id) ?? rows.find(r => r.id === body.id)
+      if (!row) return res.status(404).json({ error: { code: 'task_not_found', message: 'That task changed or was removed. Refresh Work.' } })
+      const meetings = (row.meetingRefs ?? []).map(ref => ref.title ?? '').filter(Boolean)
+      return res.json(await deps.recommender.recommend({ task: { text: row.text || row.title || '', domain: row.domain, meetings }, sessions }))
+    } catch (e) {
+      console.error('[jev] session recommendation failed:', e instanceof Error ? e.message : e)
+      return res.json({ provider: 'none', reason: 'recommendation_unavailable' })  // advice only: never block the workspace
+    }
+  })
+  return router
+}

package/server/routes/work-intake.ts

@@ -0,0 +1,136 @@
+import { Router } from 'express'
+import { WorkIntakeError, WorkIntakeStore, type IntakeMeeting, type WorkIntakeItem } from '../lib/work-intake-store.js'
+import { captureWorkItem, linkTaskMeeting, listBoard, workIntakeCapabilities, TaskBridgeError, TaskRunError,
+  type WorkMeetingRef } from '../lib/task-store.js'
+import { resolveSavedMeetingDetail } from './meetings.js'
+import type { MeetingDescriptor } from '../lib/work-review-store.js'
+import type { MeetingDetail } from '../lib/meeting-store.js'
+
+export interface WorkIntakeDependencies {
+  store: WorkIntakeStore | null
+  list: typeof listBoard
+  capabilities: typeof workIntakeCapabilities
+  link: typeof linkTaskMeeting
+  capture: typeof captureWorkItem
+  resolveMeeting: (descriptor: MeetingDescriptor) => MeetingDetail | Promise<MeetingDetail>
+}
+const MAX_MEETING_REFS = 8 // task_work_metadata.MAX_REFS
+export const LINK_RACE_RETRIES = 2
+const DUE_TAIL = /\s*[—–-]+\s*Due:[^()]*$/
+
+/**
+ * The words an accepted item becomes on the board. An ask records whose item it was: the producer moves the
+ * owner's trailing tag out of the words, so it is written back here as "(from Name)", ahead of any due date.
+ */
+export function intakeCardText(item: Pick<WorkIntakeItem, 'text' | 'owner' | 'ownerIsMiles'>): string {
+  const text = item.text ?? '', owner = item.owner?.trim()
+  if (item.ownerIsMiles || !owner) return text
+  const due = DUE_TAIL.exec(text)
+  return due ? `${text.slice(0, due.index)} (from ${owner})${due[0]}` : `${text} (from ${owner})`
+}
+
+/** Auth is supplied by the parent /api mount. Nothing here calls a model or starts an agent. */
+export function createWorkIntakeRouter(overrides: Partial<WorkIntakeDependencies> & Pick<WorkIntakeDependencies, 'store'>): Router {
+  const deps: WorkIntakeDependencies = { list: listBoard, capabilities: workIntakeCapabilities, link: linkTaskMeeting,
+    capture: captureWorkItem, resolveMeeting: resolveSavedMeetingDetail, ...overrides }
+  const router = Router()
+  router.use('/work-intake', (_req, res, next) => {
+    res.set('Cache-Control', 'private, no-store')
+    if (!deps.store) return res.status(503).json({ error: { code: 'work_intake_unavailable', message: 'Work intake is unavailable on this server.' } })
+    next()
+  })
+  /** Refusals are answers; anything unexpected is also logged, since Control only shows the code. */
+  const fail = (res: import('express').Response, e: unknown, where: string) => {
+    if (e instanceof WorkIntakeError) {
+      if (e.status >= 500) console.error(`[work-intake] ${where}: ${e.code}`)
+      return res.status(e.status).json({ error: { code: e.code } })
+    }
+    if (e instanceof TaskRunError) {
+      if (e.status >= 500) console.error(`[work-intake] ${where}: ${e.code}: ${e.message}`)
+      return res.status(e.status).json({ error: { code: e.code, message: e.message } })
+    }
+    if (e instanceof TaskBridgeError) return res.status(e.code === 'task_not_found' ? 404 : 409).json({ error: { code: e.code, message: e.message } })
+    console.error(`[work-intake] ${where} failed:`, e instanceof Error ? e.message : e)
+    return res.status(503).json({ error: { code: 'work_intake_unavailable', message: 'Work intake is unavailable. Refresh before trying again.' } })
+  }
+
+  router.get('/work-intake', async (_req, res) => {
+    try {
+      const items = deps.store!.open()
+      const counts = { suggested: 0, ask: 0, review: 0 }
+      for (const item of items) counts[item.status as keyof typeof counts]++
+      res.json({ schemaVersion: 1, capabilities: await deps.capabilities(), counts, items, quarantined: deps.store!.quarantineCount() })
+    } catch (e) { fail(res, e, 'list') }
+  })
+
+  router.post('/work-intake/items', (req, res) => {
+    try {
+      const body = req.body
+      if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(k => k !== 'items') || !Array.isArray(body.items)) {
+        throw new WorkIntakeError('invalid_intake_batch', 400)
+      }
+      res.json({ ok: true, ...deps.store!.upsert(body.items) })
+    } catch (e) { fail(res, e, 'upsert') }
+  })
+
+  router.post('/work-intake/:id/resolve', async (req, res) => {
+    try {
+      const action = req.body?.action
+      if (!req.body || typeof req.body !== 'object' || Object.keys(req.body).some(k => k !== 'action') || (action !== 'accept' && action !== 'dismiss')) {
+        throw new WorkIntakeError('invalid_intake_action', 400)
+      }
+      const item = await deps.store!.resolve(String(req.params.id), async current =>
+        action === 'dismiss' ? { action: 'dismiss' } : { action: 'accept', taskId: await accept(current) })
+      res.json({ ok: true, item })
+    } catch (e) { fail(res, e, 'resolve') }
+  })
+
+  /** The meeting must still be the one that was judged; its canonical title comes from the library, not the producer. */
+  async function verifiedMeeting(m: IntakeMeeting): Promise<WorkMeetingRef> {
+    const descriptor: MeetingDescriptor = { domain: m.domain, month: m.month, filename: m.filename, recordId: m.recordId }
+    let resolved: MeetingDetail
+    try { resolved = await deps.resolveMeeting(descriptor) }
+    catch { throw new WorkIntakeError('meeting_unavailable', 409) }
+    if (resolved.recordId !== m.recordId) throw new WorkIntakeError('meeting_identity_changed', 409)
+    return { ...descriptor, recordId: m.recordId, title: (resolved.title || m.title).replace(/\s+/g, ' ').trim().slice(0, 300) }
+  }
+
+  async function accept(item: WorkIntakeItem): Promise<string> {
+    // The write power first: a read-only board must say so, not report its meeting as unreadable.
+    const capabilities = await deps.capabilities()
+    if (capabilities.bridgeUnavailable) throw new WorkIntakeError('task_bridge_unavailable', 503)
+    if (item.kind === 'link' && !capabilities.linkWrites) throw new WorkIntakeError('work_board_read_only', 409)
+    if (item.kind === 'ask' && !capabilities.cardCreation) throw new WorkIntakeError('card_creation_unavailable', 409)
+    const meeting = await verifiedMeeting(item.meeting)
+    if (item.kind === 'link') {
+      const task = item.task!
+      // Work identity survives a rename; the task id does not.
+      return linkRow(task.domain, r => r.workIdentity === task.workIdentity || r.id === task.id, meeting)
+    }
+    const out = await deps.capture(meeting.domain, intakeCardText(item), meeting)
+    if (out.created || out.linked) return out.id
+    // The same words are already an OPEN task: that task is this work, so link it (as the producer does).
+    // On closed, archived or delegated work, adding a second card with the same words is refused.
+    if (!out.checked && !out.archived && !out.delegated) return linkRow(meeting.domain, r => r.id === out.id, meeting)
+    throw new WorkIntakeError('intake_text_collision', 409)
+  }
+
+  /** Link one task to the meeting. Re-reads the row on every attempt; up to two retries on a revision race. */
+  async function linkRow(domain: string, match: (row: Awaited<ReturnType<typeof listBoard>>[number]) => boolean, meeting: WorkMeetingRef): Promise<string> {
+    for (let attempt = 0; ; attempt++) {
+      const row = (await deps.list()).find(r => r.domain === domain && match(r))
+      if (!row || !row.workRevision) throw new WorkIntakeError('intake_task_changed', 409)
+      const refs = row.meetingRefs ?? []
+      if (refs.some(ref => ref.recordId === meeting.recordId)) return row.id
+      if (refs.length >= MAX_MEETING_REFS) throw new WorkIntakeError('meeting_links_full', 409)
+      try {
+        await deps.link(row.domain, row.id, row.text, row.workRevision, meeting)
+        return row.id
+      } catch (e) {
+        if (attempt < LINK_RACE_RETRIES && e instanceof TaskBridgeError && e.code === 'task_revision_changed') continue
+        throw e
+      }
+    }
+  }
+  return router
+}