@gotcos/glasses-server 6.61.6 → 6.62.1

package/.env.example

@@ -334,3 +334,9 @@ BIND_HOST=0.0.0.0
 #   time <scripts>/venv/bin/python3 <scripts>/lightrag_search.py --explore "Some Entity"
 # Consistently under ~30s, turn it on. Otherwise leave it off — cues still get
 # memory grounding from Qdrant, which returns in ~1.5s.
+
+# Sessions Continue: 0 restores the 6.61 posture (Codex configured sandbox,
+# Cursor Ask). Default 1 preserves session settings; Cursor Run Everything
+# additionally requires a client that acknowledges displaying continue_note.
+# Keep this in ~/.cos-glasses/.env; Control does not yet persist it on update.
+COS_CONTINUE_FULL_PERMISSIONS=1

package/CHANGELOG.md

@@ -1,3 +1,44 @@
+## 6.62.1 — 2026-10-05 — Combined provider parity and handoff hardening
+
+- Includes the 6.62.0 provider parity, cancellation, hook readiness, and safe Cursor continuation updates.
+- A failed fork names its copy when available and distinguishes usage limits, authentication, and context overflow.
+- Claude, Codex, and Cursor prompt hooks receive a private, short-lived binding to the current user request.
+- Compatible with existing glasses; build 6.10.600 displays the server continuation note and opts into the matching Cursor behavior.
+
+### Included 6.62.0 candidate work — Provider parity: Claude, Codex and Cursor session visibility and continuation
+
+Originally prepared for a candidate release; these changes are included in 6.62.1. The standalone 6.62.0 npm release was skipped. Pairs with glasses 6.10.600 (copy only); older glasses keep working.
+
+**Permission change on Continue (read this).** A Continue now carries the session's OWN permissions:
+- Codex: the session's model, effort and sandbox from its latest `turn_context`. A Desktop thread recorded as `danger-full-access` resumes with it, but only when its folder is already trusted in `~/.codex/config.toml`; otherwise `workspace-write` (network as the session had it). Unreadable settings fall back to the 6.61 posture with a note. 6.61 resumed every Codex Continue read-only.
+- Cursor: Run Everything (`--force`) on the session's own model only for clients sending `X-COS-Continue-Note: 1`; older clients retain Ask mode (6.61: Ask mode on Composer 2.5 Fast). Forks stay read-only for every provider; Cursor's Fork is a new read-only chat seeded with the session's context.
+- Claude: unchanged.
+- Kill switch: `COS_CONTINUE_FULL_PERMISSIONS=0` in `~/.cos-glasses/.env` restores the 6.61 argv byte for byte. Detail and the attach verdict carry a `continue_note` (≤60 chars) saying what will run.
+
+**Seeing the work.**
+- One working hint for every provider: an open hook turn reads active for up to 5 minutes after its last event (Esc without Stop decays), on top of the 6.61 reading; Cursor rows are decided by their hooks (they were always quiet before). Codex reads its rollout turn markers until its hooks are trusted.
+- Codex hooks: `--hooks install` (and Control's Install hooks) also writes the COS hook into `~/.codex/hooks.json`. Codex runs untrusted hooks silently never, so run `codex` in Terminal and trust them once ("Trust all and continue"). Trust is read through Codex's own `hooks/list`; COS never writes hook trust. Continue never adds project trust; Codex itself may write project trust when starting a new session. Claude's hooks state, banner and desk cancel stay Claude-only.
+- Cursor observer: its spool files were rejected since 6.61.7 (filename nonce); now accepted, recent rejects re-ingested once, `afterAgentThought` gives Cursor a reasoning line (spooled on disk until drained, then memory and stream only; never the ledger). The observer stops adding thoughts when the drain is stale.
+- `reported_model` on detail for all three; list polling avoids model lookups. Cursor titles use the composer name or the first query. Codex rollout completion can close an observed compaction phase; compaction start still needs hook evidence.
+- `/api/health` and `/api/models`: `providers.{claude,codex,cursor}.{observe,act}` with a reason for every "no"; `threadForkProviders`; `features.sessionCancel.deskCodex` / `deskCursor`.
+
+**Acting the same.**
+- Cancel run stops desk Codex (trusted hooks) and desk Cursor runs at their next command, like Claude, after provider-stamped hooks have been observed for that thread and the current hook is ready. Codex gets a deny-only halt reply (it fails open on Claude's); Claude's reply bytes are unchanged and the 6.61.7 script stays halt-ready.
+- Live Continue into an open Claude session is on by default (`COS_CONTINUE_LIVE=0` turns it off). A busy Codex Desktop thread takes a Continue straight into its own queue when COS has nothing queued for it. That hop accepts the moving native head and enters the app queue, which is not shown in the COS Queue. An Interrupt kicks the queue like a Stop. Cursor CLI queued turns auto-run after the chat is free; the stored client acknowledgement determines Ask versus Run Everything.
+- Every Cursor CLI spawn runs on its own config dir (copy of the user's config, chats/hooks/MCP/agents/plans linked), and Continue/Fork refuse if isolation fails, so COS no longer overwrites the user's Cursor default model.
+- Codex and Cursor Messages jobs link to their native session at the first event.
+
+Engine limits kept, with honest copy: an idle Cursor IDE composer cannot take an outside message; Cursor approvals cannot be answered remotely in `-p`; a ChatGPT.app thread cannot be steered mid-turn; pure `js` Codex steps are not caught by a cancel.
+
+Codex hook trust is refreshed through a bounded `codex app-server` call every five minutes. Cursor hook-open turns quiet beyond five minutes stay OPEN (not actively writing) up to the 30-minute ceiling. Claude/Codex end-state visibility may lag by 30 seconds. Control does not yet persist the full-permissions kill switch through updates; set it in `.env`.
+
+## 6.61.7 — 2026-10-04 — Agent activity and compaction visibility
+
+- Add display-only child activity to native Sessions list/detail. Codex uses read-only spawn relationships plus each child's lifecycle, with bounded reads, freshness, deduplication and explicit incomplete/unknown counts.
+- Observe Claude subagent identities and compaction hooks. Refresh hooks after upgrading. Native Cursor observers cover subagent start/stop, context compaction and resumed output; installation preserves other hooks. Observers retain no prompts and never trigger queue drains or permission decisions.
+- Stream past oversized top-level Codex context replacement records in bounded chunks instead of declaring completion and disconnecting. Other oversized records keep their existing fallback.
+- Paired with glasses 6.10.590. No model routing or Cursor model-catalog changes. Automated fixture canaries pass; physical device and live-provider acceptance are recorded separately.
+
 ## 6.61.6 — 2026-10-03
 
 - Keep Codex-owned waiting messages visible in Sessions queue counts and queue reads after the COS handoff. Unavailable native reads report unknown, not empty.

package/README.md

@@ -206,7 +206,7 @@ state drafts; the `cursor`, `epoch` and `id:` line stay.
 Since 6.49.0 a Continue can land in the running session itself, so the Desktop tab or
 the `claude` in a terminal that you left open shows the turn and answers it with its own
 context, instead of a resume child writing to the transcript behind that window. It is
-off until `COS_CONTINUE_LIVE=1`. The server writes the turn to the session's own inbox
+on by default since 6.62.0; set `COS_CONTINUE_LIVE=0` to disable it. The server writes the turn to the session's own inbox
 (the socket Claude Code publishes in `~/.claude/sessions/<pid>.json`, in the line format
 its help text documents), pinned to the full session id, and calls it delivered only
 when the session's transcript shows the message accepted; every other outcome takes the
@@ -913,3 +913,7 @@ The package includes a checksummed public Python runtime. It uses a unique owner
 Run `glasses-memory-setup --runtime-dir /absolute/path/to/cos-memory-runtime --data-root /absolute/path/to/private-memory` with Python 3.11+ installed. Set `COS_SCRIPTS_DIR` to the runtime directory in your server configuration, then restart the server. Add an explicitly granted Markdown/text source using `venv/bin/python3 manage.py grant /path/to/notes.md --title "Project"` from that runtime directory. The bundled README documents captures, reviews, document links, source refresh, upgrade and staged restore. Keep the latest independent deletion checkpoint separately from restorable snapshots.
 
 This is a local owner instance, separate from app.gotcos.com tenants and hosted Sessions. Installing the package does not upload your corpus or enable household sharing. A source build or local setup test is not proof of a published registry version; use the release ledger for actual availability.
+
+## Provider parity in 6.62.0
+
+See [provider capabilities and limits](docs/provider-parity.md) for Continue permissions, client compatibility, hook trust, observation limits and rollback. Glasses 6.10.600 shows the server's Continue note. Older clients retain Cursor Ask behavior; forks remain read-only.

package/bin/cli.cjs

@@ -146,12 +146,13 @@ function setupSpeakerModel() {
   return 0
 }
 
-// --hooks install|status|uninstall: the Claude Code session hook (6.48.0). Runs before the
+// --hooks install|status|uninstall: the Claude Code session hook (6.48.0), and the same hook in
+// Codex when Codex is on the Mac (6.62.0; `--codex` for Codex only). Runs before the
 // banner and the runtime checks, resolving tsx itself; the managed runtime never comes
 // through here (Control uses POST /api/session-hooks/install on the running server).
 if (process.argv.includes('--hooks')) {
   if (!['install', 'status', 'uninstall'].includes(HOOKS_ACTION)) {
-    console.error('Usage: --hooks install|status|uninstall [--dry-run] [--port N]')
+    console.error('Usage: --hooks install|status|uninstall [--dry-run] [--port N] [--codex]')
     process.exit(64)
   }
   let hooksTsx
@@ -183,7 +184,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log('    npx --yes @gotcos/glasses-server@latest --setup-transcription --transcription-tier balanced|max')
   console.log('    npx --yes @gotcos/glasses-server@latest --setup-speaker-model')
   console.log('    npx --yes @gotcos/glasses-server@latest --prepare-only')
-  console.log('    npx --yes @gotcos/glasses-server@latest --hooks install|status|uninstall [--dry-run] [--port N]')
+  console.log('    npx --yes @gotcos/glasses-server@latest --hooks install|status|uninstall [--dry-run] [--port N] [--codex]')
   console.log('')
   console.log('  Requirements:')
   console.log('    - Node.js 20.11+')
@@ -280,9 +281,53 @@ function resolveCursorAgentBinary() {
   const homeLocal = resolve(homedir(), '.local', 'bin', 'agent')
   return existsSync(homeLocal) ? homeLocal : null
 }
+// 6.62.0 (plan 3.4): the launcher's two `agent` probes run on a config dir of their own,
+// like every server spawn (server/lib/cursor-spawn-env.ts, which this mirrors: CommonJS
+// cannot import it). Same link list; the census test pins that the two lists agree.
+const CURSOR_SPAWN_LINKS = ['chats', 'hooks.json', 'mcp.json', 'plugins', 'skills-cursor', 'agents', 'plans']
+function cursorSpawnEnvSync() {
+  const { mkdtempSync, symlinkSync, rmSync } = require('fs')
+  const sourceDir = process.env.CURSOR_CONFIG_DIR?.trim() || join(homedir(), '.cursor')
+  const root = join(CONFIG_DIR, 'cursor-cli')
+  let dir = null
+  const release = () => {
+    if (!dir) return
+    for (const name of CURSOR_SPAWN_LINKS) {
+      try { if (lstatSync(join(dir, name)).isSymbolicLink()) unlinkSync(join(dir, name)) } catch { /* absent */ }
+    }
+    try { rmSync(dir, { recursive: true, force: true }) } catch { /* best effort */ }
+    dir = null
+  }
+  try {
+    mkdirSync(root, { recursive: true, mode: 0o700 })
+    dir = mkdtempSync(join(root, 'spawn-'))
+    chmodSync(dir, 0o700)
+    if (existsSync(join(sourceDir, 'cli-config.json'))) {
+      copyFileSync(join(sourceDir, 'cli-config.json'), join(dir, 'cli-config.json'))
+      chmodSync(join(dir, 'cli-config.json'), 0o600)
+    }
+    for (const name of CURSOR_SPAWN_LINKS) {
+      if (existsSync(join(sourceDir, name))) symlinkSync(join(sourceDir, name), join(dir, name))
+    }
+    return { env: { ...process.env, CURSOR_CONFIG_DIR: dir }, release }
+  } catch (error) {
+    release()
+    // 6.62.0 /qa (W6): fail open for these two read-only probes, but never silently.
+    console.warn(`[cursor-spawn-env] isolation unavailable for the launcher's agent probe, using the shared config: ${error && error.code ? error.code : error}`)
+    return { env: { ...process.env }, release: () => {} }
+  }
+}
 function cursorCliState() {
   const binary = resolveCursorAgentBinary()
   if (!binary) return { binary: null, version: null, auth: null }
+  const isolation = cursorSpawnEnvSync()
+  try {
+    return cursorCliStateWith(binary, isolation.env)
+  } finally {
+    isolation.release()
+  }
+}
+function cursorCliStateWith(binary, env) {
 
   let version = 'available'
   try {
@@ -290,6 +335,7 @@ function cursorCliState() {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: 5000,
+      env,
     }).trim()
     const versionLine = about.split('\n').map((line) => line.trim()).find((line) => /CLI Version|cursor|agent/i.test(line))
     if (versionLine) version = versionLine
@@ -300,6 +346,7 @@ function cursorCliState() {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: 7000,
+      env,
     })
     // Cursor 2026.09 introduced `grok-4.7-high-fast` without the old
     // `cursor-` prefix. Accept both exact high-fast families, like runtime does.

package/bin/hooks/cos-cursor-observer.cjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// Read-only native Cursor lifecycle observer. No network, credentials, commands or prompts. An agent
+// thought (6.62.0) is capped at 280 characters and display only: it sits in a 0600 spool file until
+// the server drains it, then lives in memory and on the live feed, and is never written to the ledger.
+const fs=require('node:fs'),path=require('node:path'),crypto=require('node:crypto');
+const event=process.argv[2],spool=process.argv[3];
+const names={subagentStart:'SubagentStart',subagentStop:'SubagentStop',preCompact:'PreCompact',postToolUse:'PostToolUse',afterAgentResponse:'PostCompact',stop:'PostCompact',sessionEnd:'PostCompact',afterAgentThought:'AgentThought'};
+let input='',oversize=false;
+process.stdin.setEncoding('utf8');
+process.stdin.on('data',chunk=>{if(input.length+chunk.length>1048576){oversize=true;input=''}else if(!oversize)input+=chunk});
+process.stdin.on('error',()=>{});
+process.stdin.on('end',()=>{
+ try {
+  if(!oversize && names[event] && spool){
+   const p=JSON.parse(input),id=p.parent_conversation_id||p.conversation_id||p.session_id;
+   if(typeof id==='string'&&/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)){
+    fs.mkdirSync(spool,{recursive:true,mode:0o700});
+    // 6.62.0 (QA W16): the hook script's guard. A drain stamp older than a day means nobody is
+    // reading the spool, so nothing more is written into it (thoughts least of all).
+    let stale=false;try{stale=Date.now()-fs.statSync(path.join(spool,'.last-drain')).mtimeMs>86400000}catch{}
+    if(!stale&&fs.readdirSync(spool).length<2000){
+     const ts=Date.now(),payload={session_id:id.toLowerCase(),display_only:true};
+     const agent=p.subagent_id||p.agent_id;
+     if(typeof agent==='string'&&/^[a-zA-Z0-9_-]{1,160}$/.test(agent))payload.agent_id=agent;
+     // 6.62.0: the thought itself, at most 280 characters. The server keeps it in memory only.
+     if(names[event]==='AgentThought'){if(typeof p.text!=='string'||!p.text.trim())throw 0;payload.text=p.text.slice(0,280)}
+     const name=ts+'-'+process.pid+'-'+crypto.randomBytes(6).toString('hex')+'-'+names[event]+'.json';
+     const temp=path.join(spool,'.'+name);
+     fs.writeFileSync(temp,JSON.stringify({ts,ppid:null,event:names[event],provider:'cursor',payload}),{mode:0o600,flag:'wx'});
+     fs.renameSync(temp,path.join(spool,name));
+    }
+   }
+  }
+ } catch {} // An observational failure never blocks a user action.
+ process.stdout.write(event==='subagentStart'?'{"permission":"allow"}\n':'{}\n');
+});

package/bin/hooks/cos-session-hook

@@ -1,5 +1,5 @@
 #!/bin/sh
-# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0; single entry 6.53.3; away hold wait 6.60.0). Installed into ~/.claude/settings.json by
+# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0; single entry 6.53.3; away hold wait 6.60.0; Codex and Cursor parity 6.62.0). Installed into ~/.claude/settings.json by
 # `--hooks install`; Claude Code runs it with the hook event name as $1 and the event
 # payload on stdin. It spools one JSON file per event into the hook spool and exits 0
 # on every path. Only PermissionRequest ever talks to the server, and only when the
@@ -19,10 +19,19 @@
 #
 # The installer bakes COS_GLASSES_HOME and COS_HOOK_SPOOL into the command, so this
 # script and the server can never disagree about where the token or the spool is.
+#
+# 6.62.0: the same bytes also run from ~/.codex/hooks.json (as their own copy,
+# cos-session-hook-codex), whose command adds COS_HOOK_PROVIDER=codex; a Codex payload
+# reaching the Claude command is recognised too (codex_of, below). Codex changes three things
+# only: the halt reply is deny-only (Codex rejects `continue:false` in a PreToolUse reply and
+# then RUNS the tool, canary C10; the deny alone blocks it, C12), the spooled envelope says
+# `"provider":"codex"`, and the Cursor Stop follow-up below never runs. Claude and Cursor
+# share the Claude command and keep today's bytes; the server tells them apart by the payload.
 PATH=/usr/bin:/bin:/usr/sbin; umask 077; trap '' PIPE
 HOME=${HOME:-$(cd ~ 2>/dev/null && pwd)}; [ -n "$HOME" ] || exit 0
 GH=${COS_GLASSES_HOME:-$HOME/.cos-glasses}
 SPOOL=${COS_HOOK_SPOOL:-$GH/data/hook-spool}; EVENT="$1"
+PROV=${COS_HOOK_PROVIDER:-}; case "$PROV" in claude|codex|cursor) ;; *) PROV='' ;; esac
 # 6.53.0, the halt check; 6.53.3, one entry for both synchronous events (review A, option a).
 # FIRST, before mkdir, perl and the B8 guard below: a full spool or a stale drain stamp must
 # never stop a cancel. The marker folder sits beside the spool, like the Cursor queue
@@ -38,13 +47,17 @@ case "$EVENT" in PreToolUse|UserPromptSubmit)
   HALT="${SPOOL%/*}/session-halt"
   # Any marker at all? A glob is a builtin, and it runs before stdin is touched.
   ANY=''; for F in "$HALT"/*; do [ -e "$F" ] && ANY=1; break; done
-  # The FIRST session_id is the payload's own: Claude writes it first, and a tool's input
-  # that happens to carry one comes later. Any JSON spacing; 36 hex-and-dash characters
-  # inside a closed string, or nothing.
+  # The FIRST session_id is the payload's own: Claude and Codex write it first, and a tool's
+  # input that happens to carry one comes later. 6.62.0 (W7): Cursor writes
+  # "conversation_id" FIRST (byte 1, the same id) and its session_id ~600 bytes in, behind
+  # tool_input, so a large edit pushed it out of this read and an input naming another
+  # session matched first. Whichever of the two keys comes first is the payload's own. Any
+  # JSON spacing; 36 hex-and-dash characters inside a closed string, or nothing.
   sid_of() {
-    SID=''
-    case "$HEAD" in *'"session_id"'*)
-      SID=${HEAD#*'"session_id"'}; SID=${SID#"${SID%%[!:[:space:]]*}"}
+    SID=''; KEY='"session_id"'; PRE=${HEAD%%'"session_id"'*}
+    case "$PRE" in *'"conversation_id"'*) KEY='"conversation_id"' ;; esac
+    case "$HEAD" in *"$KEY"*)
+      SID=${HEAD#*"$KEY"}; SID=${SID#"${SID%%[!:[:space:]]*}"}
       case "$SID" in '"'*'"'*) SID=${SID#?}; SID=${SID%%'"'*} ;; *) SID='' ;; esac ;;
     esac
     case "$SID" in *[!0-9A-Fa-f-]*) SID='' ;; esac
@@ -73,6 +86,20 @@ case "$EVENT" in PreToolUse|UserPromptSubmit)
       case "$TN" in '"AskUserQuestion"'*|'"ExitPlanMode"'*) NEED=1 ;; esac ;;
     esac
   fi
+  # 6.62.0 (QA W13): a COS block Codex imported from the Claude settings runs with no
+  # COS_HOOK_PROVIDER, and the Claude reply makes Codex fail open. Codex writes its rollout as
+  # the payload's SECOND key, right behind session_id; Claude writes its own transcript there,
+  # and the same key further in (a tool that reads a rollout) is not the payload's. Read only
+  # when a marker or a spool needs it, so a plain tool call stays one read and a `case`.
+  codex_of() {
+    case "$HEAD" in *'"session_id"'*'"transcript_path"'*) ;; *) return ;; esac
+    A=${HEAD#*'"session_id"'}; B=${A%%'"transcript_path"'*}
+    [ ${#B} -le 64 ] || return
+    TP=${A#*'"transcript_path"'}; TP=${TP#"${TP%%[!:[:space:]]*}"}
+    case "$TP" in '"'*) TP=${TP#?}; TP=${TP%%'"'*} ;; *) return ;; esac
+    case "$TP" in */.codex/sessions/*) PROV=codex ;; esac
+  }
+  [ -n "$PROV" ] || { [ -z "$ANY" ] && [ -z "$NEED" ]; } || codex_of
   case "$SID" in *[A-F]*) SID=$(printf '%s' "$SID" | tr 'A-F' 'a-f') ;; esac
   if [ -z "$SID" ]; then :
   elif [ "$EVENT" = UserPromptSubmit ]; then
@@ -82,7 +109,12 @@ case "$EVENT" in PreToolUse|UserPromptSubmit)
     # reading the id and clearing it. Then the prompt is spooled as before.
     rm -f "$HALT/$SID" 2>/dev/null
   elif [ -f "$HALT/$SID" ]; then
-    printf '%s' '{"continue":false,"stopReason":"Cancelled from COS","hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Cancelled from COS"}}'
+    if [ "$PROV" = codex ]; then
+      # 6.62.0 (C10, C12): deny only, and a reason that tells the model to stop.
+      printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Cancelled from COS. Stop and do not work around this."}}'
+    else
+      printf '%s' '{"continue":false,"stopReason":"Cancelled from COS","hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Cancelled from COS"}}'
+    fi
     exec cat >/dev/null
   fi
   # Every other tool call ends here with nothing written and nothing printed.
@@ -125,14 +157,17 @@ if [ "$EVENT" = PermissionRequest ]; then
     if [ ${#2} -le 4 ] && [ "$2" -ge 20 ] && [ "$2" -le 3600 ]; then WAIT=$2; STAMP_WAIT=",\"hookWaitS\":$2"; fi ;;
   esac
 fi
-{ printf '{"ts":%s,"ppid":%s,"event":"%s"%s,"payload":' "$TS" "$PPID" "$EVENT" "$STAMP_WAIT"; cat "$T.in"; printf '}\n'; } > "$T"
+# 6.62.0: the provider, when the command said it (only the Codex command does).
+STAMP_PROV=''; [ -z "$PROV" ] || STAMP_PROV=",\"provider\":\"$PROV\""
+{ printf '{"ts":%s,"ppid":%s,"event":"%s"%s%s,"payload":' "$TS" "$PPID" "$EVENT" "$STAMP_WAIT" "$STAMP_PROV"; cat "$T.in"; printf '}\n'; } > "$T"
 rm -f "$T.in"
 # 6.51.0, CURSOR ONLY. Cursor runs this hook from ~/.claude/settings.json for its own
 # composers, and submits a Stop hook's {"followup_message":...} as that composer's next
 # message. A turn COS queued for the composer is handed over here, at the end of its turn.
 # Claude Code sets no CURSOR_VERSION and sends no cursor_version, so a Claude Stop takes
-# the line below this block exactly as before and never touches the network.
-if [ "$EVENT" = Stop ] && [ -n "${CURSOR_VERSION:-}" ] && grep -Eq '"cursor_version"[[:space:]]*:[[:space:]]*"' "$T" 2>/dev/null; then
+# the line below this block exactly as before and never touches the network. 6.62.0: nor
+# does a Codex Stop, whatever its environment says: a follow-up is Cursor-only output.
+if [ "$EVENT" = Stop ] && [ "$PROV" != codex ] && [ -n "${CURSOR_VERSION:-}" ] && grep -Eq '"cursor_version"[[:space:]]*:[[:space:]]*"' "$T" 2>/dev/null; then
   cp "$T" "$T.req" 2>/dev/null; mv "$T" "$SPOOL/$TS-$$-$EVENT.json"
   # Nothing queued for this composer (almost every Stop): no request at all. The queue
   # folder sits beside the spool. If it is not there, or the id cannot be read here,

package/docs/provider-parity.md

@@ -0,0 +1,43 @@
+# Provider parity (6.62.0)
+
+What the server promises about Claude, Codex and Cursor desk sessions, and where each promise stops.
+
+## Contract on the wire
+
+- `GET /api/health` and `GET /api/models`: `providers.<claude|codex|cursor>.act` (`continueIdle`, `continueBusy`, `fork`, `cancelDesk`, `approvals`, `nativeQueue`, `keepModel`, `permissions`, each false with a reason code). Both routes also carry `providers.<p>.observe` (`hooks`, `liveState`, `children`, `compaction`, `reasoning`).
+- `threadForkSupported` stays a boolean; `threadForkProviders` lists who can fork.
+- `features.sessionCancel`: `cosTurn`, `deskClaude`, `deskCodex`, `deskCursor`.
+- `sessionHooks`: `state` / `installed` are Claude's (Control's banner reads them). `sessionHooks.codex = {present, installed, trust, scriptOk}`; `sessionHooks.cursorObserver = {installed, nodeOk}`.
+- Session rows: `running` and `running_active`; detail additionally carries `reported_model` and `continue_note` (≤60 chars). List polling does not wait for model lookups.
+
+## Hooks
+
+| Engine | Where | Trust | Turn start / end |
+|---|---|---|---|
+| Claude | `~/.claude/settings.json` | n/a | UserPromptSubmit / Stop, registry idle flip |
+| Codex | `~/.codex/hooks.json` (COS blocks replaced in place) | Codex `hooks/list`; untrusted hooks never run | UserPromptSubmit / Stop, Interrupt |
+| Cursor | the Claude hooks (third-party extensibility) + `~/.cursor/hooks.json` observer | n/a | IDE: UserPromptSubmit / Stop; CLI `-p` fires neither |
+
+The halt reply is provider-specific: Claude and Cursor keep the 6.53 bytes; Codex gets deny-only (it fails open on `continue:false`).
+
+## Continue posture
+
+| Engine | Continue runs with | Fallback |
+|---|---|---|
+| Claude | the session itself (live inbox) or `claude -p --resume` with the user's default mode | unchanged |
+| Codex | session `-m`, effort, `-s` from the latest `turn_context`; `danger-full-access` only in a trusted folder | 6.61 posture + note |
+| Cursor | `--force --model <session slug>` only after client note acknowledgement, on its own config dir | composer-2.5-fast + note |
+
+`COS_CONTINUE_FULL_PERMISSIONS=0` restores the 6.61 argv. Fork is read-only for every engine.
+
+## Compatibility and limits
+
+Cursor Run Everything requires `X-COS-Continue-Note: 1` on the turn request. Queue admission persists the acknowledgement and replays it on drain. Clients without it retain Ask mode. Continue/Fork refuse if private Cursor configuration isolation fails.
+
+Run `codex` in Terminal to review and trust the installed hooks. COS reads hook trust through a bounded app-server call every five minutes; it does not write hook trust. Codex hooks use their own script copy. Desk Cancel requires observed hooks for the specific thread, not merely an installed script. Continue only uses danger-full-access for an already trusted working directory or its canonical Git root, rechecked at spawn; a trusted arbitrary parent does not qualify. Starting new Codex sessions may cause Codex itself to write project trust; resumed sessions do not.
+
+Busy Codex Continue accepts the moving head and enters the native app queue, which is not exposed in COS Queue. Cursor CLI queued turns start when the chat is free and use the saved note acknowledgement. Cursor Fork creates a new read-only chat with recent context. Cursor IDE composers cannot accept outside messages, and Cursor CLI approvals cannot be answered remotely.
+
+Cursor reasoning is briefly on disk in the observer spool until drained, then in memory and the live stream, never the ledger. A stale drain stops new thought writes. Codex rollout compaction completion closes an observed phase; start needs hook evidence. Cursor open turns quiet beyond five minutes remain OPEN until the 30-minute ceiling. Claude/Codex completion can lag by 30 seconds.
+
+Set `COS_CONTINUE_FULL_PERMISSIONS=0` in `~/.cos-glasses/.env` and restart to restore the previous posture; Control does not yet carry this key through updates. Before rolling the server back to 6.61.7, use the pinned 6.62.0 CLI to remove Codex hooks (`--hooks uninstall --codex`), then use Control rollback and reinstall the older hooks. Do not run the old CLI with `--codex`: it does not understand that flag.

package/managed-runtime-contract.json

@@ -30,6 +30,7 @@
     "COS_SCRIPTS_DIR",
     "COS_SESSION_HOOKS",
     "COS_CONTINUE_LIVE",
+    "COS_CONTINUE_FULL_PERMISSIONS",
     "COS_SESSION_HOOKS_SPOOL_DIR",
     "COS_SESSION_HOOK_SSE",
     "COS_PERMISSION_BROKER",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.61.6",
+  "version": "6.62.1",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -50,6 +50,7 @@
     "!server/scripts/nemotron-mutation-gate.mjs",
     "!server/scripts/merged-scribe-mutation-gate.mjs",
     "!server/scripts/nemotron-replay.ts",
+    "!server/scripts/turn-request-mutation-gate.mjs",
     "!server/scripts/mutation-gate.mjs",
     "!server/lib/meeting-engine/__fixtures__/**",
     "!server/lib/__fixtures__/**",
@@ -73,7 +74,9 @@
     "docs/work-handoff-requests.md",
     "work-task-runtime",
     "docs/work-task-runtime.md",
-    "!server/scripts/build-work-task-runtime.py"
+    "!server/scripts/build-work-task-runtime.py",
+    "bin/hooks/cos-cursor-observer.cjs",
+    "docs/provider-parity.md"
   ],
   "author": "COS Contributors",
   "license": "MIT",