@gotcos/glasses-server 6.57.0 → 6.57.1

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 6.57.1
+
+### Session suggestions for meeting reviews
+
+- Miles, 2026-09-28: the meeting review "Retail Liquor Summit Campaign Launch" got no session suggestion, although a session named "Retail Liquor Summit campaign launch" existed. Suggestions only took a board task. `POST /api/work-board/session-recommendation` now also takes exactly `{reviewId, sessions}`. The server reads the review's meeting title and reviewed follow-up from its own review store; the client never supplies the work text, the same rule as for tasks. An unknown review answers 404 `review_not_found`, a server with reviews off answers 404 `reviews_unavailable`, a review request with a bad id or session list answers 400 `invalid_review_request` (its own code, so Control can tell it from a 6.57.0 server), and a mixed or unknown body answers 400. Task requests are unchanged. Needs COS Control 0.5.243 to ask for reviews.
+- The review is read with a new `peek`, straight from the review store. The existing `get` reconciled every review row on each call, and suggestions ask on each Work visit. A lookup that throws answers 503 `review_store_unavailable` rather than "not found" (defensive: the stock lookup reads memory). `WorkReviewStore.get` now clones only the matched row.
+- The local Work candidate passes its own review runtime the same way.
+- Tests: the route test covers the review body, the missing review, reviews off, the exact-shape refusals and the failure fallback; the runtime test covers `peek` (no reconcile, no meeting resolution). The mutation gate adds seven mutants for the new branches (including `peek` and the review 400 code) and now runs the review runtime tests. docs/work-intake.md documents the review request.
+
 ## 6.57.0
 
 ### Jev in the server: session suggestions and a key you can set from COS Control

package/docs/work-intake.md

@@ -30,3 +30,5 @@ The journal is `work-intake/intake.json` in the server data directory, owned by
 ## Jev key and session suggestions
 
 `POST /api/jev-key/set` `{ key }` validates the key against TypeSafe and saves it to `data/jev-key.json`; `GET /api/jev-key/status` returns `{ configured, source, usedToday, dailyCap, breakerOpenUntil, lastError }` and never the key; `DELETE /api/jev-key` removes the saved key. `POST /api/work-board/session-recommendation` `{ domain, id, sessions: [{ id, provider, title, summary? }] }` returns `{ provider: "jev", action: "continue" | "fork" | "new", sessionId, confidence, reason, alternatives }` or `{ provider: "none", reason }`. The COS meeting producer reads the same saved key when its own `.env` has none.
+
+Since 6.57.1 `POST /api/work-board/session-recommendation` also takes exactly `{ reviewId, sessions }` for a meeting review (`reviewId` = `wr_` + 32 hex). The server reads the review's meeting title and reviewed follow-up from its own store; the client never sends work text. Errors: 400 `invalid_review_request` (bad id or session list), 404 `review_not_found`, 404 `reviews_unavailable` (reviews off), 503 `review_store_unavailable` (defensive; the stock lookup reads memory).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.57.0",
+  "version": "6.57.1",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -629,8 +629,8 @@ app.use('/api', createWorkBoardRouter())
 // Work intake (6.57.0): meeting-derived suggestions, asks and review items. Optional: a bad journal never blocks boot.
 const workIntakeStore = createOptionalWorkIntakeStore(() => new WorkIntakeStore(dataPath('work-intake')))
 app.use('/api', createWorkIntakeRouter({ store: workIntakeStore }))
-// Jev key (Control Settings) and Continue/Fork/New session recommendations for Work tasks (6.57.0).
-app.use('/api', createJevRouter())
+// Jev key (Control Settings) and Continue/Fork/New session recommendations for Work tasks (6.57.0) and meeting reviews (6.57.1).
+app.use('/api', createJevRouter(workReviewRuntime ? { review: async id => workReviewRuntime.peek(id) } : {}))
 app.use('/api', queryRouter)
 // The scheduled start-of-day brief: settings, status, run-now. Same auth as
 // every other settings route; the brief itself is an ordinary durable job.

package/server/lib/session-recommendation.ts

@@ -7,6 +7,7 @@
  */
 import { createHash } from 'node:crypto'
 import { estimateJevTokens, JevError, type JevClient } from './jev.js'
+import { FORKABLE_PROVIDERS } from './agent-session-binding-store.js'
 
 export const CONTINUE_AT = 0.5  // P(a session is already doing this exact task)
 export const FORK_AT = 0.6      // P(some session shares the context) = 1 - P(none)
@@ -25,8 +26,9 @@ const BEST = "Which one of the user's agent sessions is the natural place to do
 const EXACT = "Which one of the user's agent sessions is already doing this exact task, so the work should simply continue there? "
   + 'A session on the same project doing different work does not count. Choose none if no session is doing this task.'
 
-/** Providers the Work handoff can fork (Control's destinationSupported). */
-export const FORKABLE = new Set(['claude', 'codex'])
+/** Providers a Work handoff can fork natively (Control 0.5.243 applies a Fork suggestion as a same-platform fork).
+ *  One list with the fork route (agent-session-binding-store FORKABLE_PROVIDERS). */
+export const FORKABLE = new Set<string>(FORKABLE_PROVIDERS)
 const clip = (text: string | undefined, max: number) => (text ?? '').replace(/\s+/g, ' ').trim().slice(0, max)
 const round = (n: number) => Math.round(n * 100) / 100
 

package/server/lib/work-review-runtime.ts

@@ -174,6 +174,12 @@ export class WorkReviewRuntime {
     await this.serial(async () => { if (this.stopping) return; for (const row of this.deps.store.list()) await this.reconcileRow(row, allowAdmission) })
   }
   async list(): Promise<WorkReview[]> { await this.reconcile(false); return this.deps.store.list().map(publicReview) }
+  /** 6.57.1: one review as stored, without reconciling every row. Session advice reads it on each Work visit.
+   *  Exact id lookup only (the route validates the `wr_` pattern first). */
+  peek(id: string): WorkReview | null {
+    const row = this.deps.store.get(id)
+    return row ? publicReview(row) : null
+  }
   async get(id: string): Promise<WorkReview> {
     if (!/^wr_[a-f0-9]{32}$/.test(id)) throw new WorkReviewError('invalid_review_id',400)
     await this.reconcile(false); const row = this.deps.store.get(id)

package/server/lib/work-review-store.ts

@@ -84,7 +84,8 @@ export class WorkReviewStore {
     } catch { this.close(); throw new WorkReviewError('review_store_recovery_required', 503) }
   }
   list(): StoredWorkReview[] { return structuredClone(this.rows) }
-  get(id: string): StoredWorkReview | undefined { return this.list().find(r => r.id === id) }
+  // 6.57.1: clone the one row, not the whole journal (session advice reads a review on each Work visit).
+  get(id: string): StoredWorkReview | undefined { const row = this.rows.find(r => r.id === id); return row ? structuredClone(row) : undefined }
   put(row: StoredWorkReview): void {
     if (this.closed) throw new WorkReviewError('review_store_closed', 503)
     const next = this.list(); const index = next.findIndex(r => r.id === row.id)

package/server/routes/jev.ts

@@ -12,12 +12,17 @@ import { SessionRecommender, parseCandidates } from '../lib/session-recommendati
 import { listBoard } from '../lib/task-store.js'
 import { isSafeDomainName } from '../lib/domains.js'
 
+/** What the route reads from a meeting review (6.57.1): the server's own record, never client text. */
+export interface ReviewForAdvice { source: { title: string; domain: string }; markdown?: string }
+
 export interface JevRouteDependencies {
   jev: JevClient
   recommender: Pick<SessionRecommender, 'recommend'>
   list: typeof listBoard
   validate: typeof validateJevKey
   save: typeof saveJevKey
+  /** Looks a meeting review up by its `wr_` id; throws or returns null when it does not exist. Absent when reviews are off. */
+  review?: (id: string) => Promise<ReviewForAdvice | null>
 }
 
 export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}): Router {
@@ -53,10 +58,34 @@ export function createJevRouter(overrides: Partial<JevRouteDependencies> = {}):
     return res.json({ ok: true, ...deps.jev.status() })
   })
 
-  /** Continue / Fork / New for one task. The task comes from the board; the client sends only candidate sessions. */
+  /** Continue / Fork / New for one task or meeting review. The work comes from the board or the review store; the
+   *  client sends only candidate sessions. */
   router.post('/work-board/session-recommendation', async (req, res) => {
     const body = req.body
     const sessions = parseCandidates(body?.sessions)
+    const keys = body && typeof body === 'object' ? Object.keys(body).sort().join(',') : ''
+    // 6.57.1: a meeting review is named by its id alone (`{reviewId, sessions}`), exactly.
+    if (keys === 'reviewId,sessions') {
+      if (typeof body.reviewId !== 'string' || !/^wr_[a-f0-9]{32}$/.test(body.reviewId) || !sessions) {
+        // Its own code: 6.57.0 answers a review body with invalid_recommendation_request, and Control reads THAT as an old server.
+        return res.status(400).json({ error: { code: 'invalid_review_request', message: 'Select an exact meeting review and send at most 80 sessions.' } })
+      }
+      if (!deps.review) return res.status(404).json({ error: { code: 'reviews_unavailable', message: 'Meeting reviews are not available on this server.' } })
+      let review: ReviewForAdvice | null
+      try { review = await deps.review(body.reviewId) } catch (e) {  // defensive: the stock lookup reads memory and does not throw
+        console.error('[jev] review lookup failed:', e instanceof Error ? e.message : e)
+        return res.status(503).json({ error: { code: 'review_store_unavailable', message: 'Meeting reviews could not be read. Try again shortly.' } })
+      }
+      if (!review) return res.status(404).json({ error: { code: 'review_not_found', message: 'That meeting review changed or was removed. Refresh Work.' } })
+      try {
+        const title = review.source.title || 'Meeting follow-up'
+        return res.json(await deps.recommender.recommend({
+          task: { text: [title, review.markdown ?? ''].filter(Boolean).join('\n\n'), domain: review.source.domain, meetings: [title] }, sessions }))
+      } catch (e) {
+        console.error('[jev] session recommendation failed:', e instanceof Error ? e.message : e)
+        return res.json({ provider: 'none', reason: 'recommendation_unavailable' })
+      }
+    }
     if (!body || typeof body !== 'object' || Object.keys(body).some(k => !['domain', 'id', 'sessions'].includes(k))
       || typeof body.domain !== 'string' || !isSafeDomainName(body.domain) || typeof body.id !== 'string' || !/^[a-f0-9]{12}$/.test(body.id) || !sessions) {
       return res.status(400).json({ error: { code: 'invalid_recommendation_request', message: 'Select an exact task and send at most 80 sessions.' } })