@gotcos/glasses-server 6.61.7 → 6.63.0

package/server/lib/query-job-runtime.ts

@@ -29,6 +29,7 @@ import {
 } from './conversation.js'
 import {
   isTerminalQueryJobStatus,
+  type QueryJobProviderLinkage,
   type QueryJobRequest,
   type QueryJobSnapshot,
 } from './query-job-types.js'
@@ -179,6 +180,17 @@ export async function projectPublicConversationTerminal(
   flushConversationToDisk()
 }
 
+/**
+ * 6.62.0 (plan 3.9, W11): a provider's early "this is my session" into the job's linkage.
+ * A Claude announcement carries no provider (its bridge is unchanged) and reads as Claude.
+ */
+export function nativeSessionLinkage(linkage: { cliSessionId: string; provider?: 'claude' | 'codex' | 'cursor' }): QueryJobProviderLinkage {
+  const provider = linkage.provider ?? 'claude'
+  return provider === 'codex'
+    ? { provider, codexThreadId: linkage.cliSessionId }
+    : { provider, cliSessionId: linkage.cliSessionId }
+}
+
 const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callbacks }) => {
   // Resolve ids again at execution time. This closes the admission/execution
   // TOCTOU window without ever putting paths or bytes in the journal.
@@ -235,7 +247,10 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
               : { codexRunId: metadata.runId }),
       }),
       // 6.58.2: the provider's own session id, as soon as it names it (Claude: first stream event).
-      onNativeSession: linkage => { void callbacks.onLinkage?.({ provider: 'claude', cliSessionId: linkage.cliSessionId }) },
+      // 6.62.0 (plan 3.9, W11): provider-aware, so a Codex or Cursor job links to its native
+      // session as early as a Claude one. Codex names it as `codexThreadId`, the field its
+      // completion has always used. No naming for Codex or Cursor this release (uncanaried).
+      onNativeSession: linkage => { void callbacks.onLinkage?.(nativeSessionLinkage(linkage)) },
       onChunk: text => { callbacks.onChunk(text) },
       onToolStatus: toolName => {
         const message = request.activityToolMode === 'off'

package/server/lib/query-job-types.ts

@@ -1,3 +1,4 @@
+import { providerFailureCode } from './provider-failure-text.js'
 import { createHash } from 'node:crypto'
 import {
   parseMediaAttachmentRefs,
@@ -587,7 +588,7 @@ export function normalizeQueryJobError(error: unknown, fallbackCode = 'query_job
       : typeof error === 'string' ? error : fallbackCode
   const safe = sanitizeQueryJobActivity(rawMessage)
   return {
-    code,
+    code: providerFailureCode(code, typeof rawMessage === 'string' ? rawMessage : ''),
     message: safe.text,
     ...(candidate.retryable === true ? { retryable: true } : {}),
     ...(typeof candidate.retryAfterMs === 'number' && Number.isFinite(candidate.retryAfterMs)

package/server/lib/session-act-fields.ts

@@ -0,0 +1,61 @@
+// `reported_model` and `continue_note` for the DETAIL route (6.62.0, plans 1.8 and 3.12).
+// The route calls these two helpers and nothing else, so its own row shape (owned by the
+// observation work) is untouched.
+//
+// 6.62.0 /qa (W11): list rows carry neither field. The lens reads both from the detail and
+// the attach verdict only, and the list used to wait on these reads (transcript tails,
+// rollout scans, sqlite) with no budget. Every failure here is an omitted field.
+
+import { mapWithConcurrency, ACTIVITY_READ_CONCURRENCY } from './agent-session-activity.js'
+import { readComposerFacts, type ComposerFacts } from './cursor-session-model.js'
+import { continueFactsFields, resolveSessionContinueFacts, type ContinueFactsDeps, type SessionContinueFacts } from './session-continue-facts.js'
+import { realContinueFactsDeps } from './session-continue-facts-real.js'
+
+let deps: ContinueFactsDeps | null = null
+function liveDeps(): ContinueFactsDeps {
+  deps ??= realContinueFactsDeps()
+  return deps
+}
+
+/** Tests only: drive the helpers with fakes. */
+export function __setSessionActDepsForTests(next: ContinueFactsDeps | null): void {
+  deps = next
+}
+
+export interface SessionActRow {
+  provider: string
+  session_id: string
+  file?: string | null
+}
+
+/** The facts for each row, in order. Composer models for the whole page come from ONE query. */
+export async function sessionActFactsFor(rows: readonly SessionActRow[], options: { noteAck?: boolean } = {}): Promise<Array<SessionContinueFacts | null>> {
+  const d = liveDeps()
+  let composerFacts: Map<string, ComposerFacts | null> | undefined
+  const cursorIds = rows.filter(row => row.provider === 'cursor').map(row => row.session_id)
+  if (cursorIds.length > 0) {
+    try {
+      composerFacts = await readComposerFacts(cursorIds, d.cursorComposerDb)
+    } catch {
+      composerFacts = undefined
+    }
+  }
+  return mapWithConcurrency(rows, ACTIVITY_READ_CONCURRENCY, async row => {
+    try {
+      return await resolveSessionContinueFacts({
+        provider: row.provider,
+        threadId: row.session_id,
+        transcriptPath: row.file ?? null,
+        cwd: null,
+        composerFacts,
+        noteAck: options.noteAck === true,
+      }, d)
+    } catch {
+      return null
+    }
+  })
+}
+
+export function sessionActFields(facts: SessionContinueFacts | null | undefined): { reported_model?: string; continue_note?: string } {
+  return continueFactsFields(facts)
+}

package/server/lib/session-cancel.ts

@@ -10,7 +10,11 @@
 //   desk_run     Claude Code at the desk (a Desktop tab, a terminal, a Continue delivered
 //                live into the open window). A halt marker plus the synchronous PreToolUse
 //                hook stops it at its NEXT tool call (canaries C1b, C5, C10).
-//   unsupported  the Codex app or Cursor. Nothing outside the app can reach the run.
+//                6.62.0: also Cursor (it runs the Claude hooks, so the same marker stops it,
+//                C10), and Codex once the COS hooks are installed in Codex AND Codex trusts
+//                them (its deny-only reply, C10/C12). A pure `js` Codex step is not a tool
+//                call, so a Codex run stops at its next COMMAND (W20).
+//   unsupported  the Codex app or Cursor without hooks that can reach the run.
 //   hooks_*      a desk Claude run on a Mac whose hooks cannot stop it yet.
 //
 // `cancelTargetFor` is the ONE function that decides, and both the cancel route and the
@@ -33,6 +37,74 @@ export interface CancelFacts {
   hooksEnabled: boolean
   /** The hooks installed on this Mac carry the 6.53.0 script and subscription. */
   hooksReady: boolean
+  /**
+   * 6.62.0: the COS hooks in `~/.codex/hooks.json` can stop a desk Codex run: installed, trusted
+   * by Codex itself, and this package's script. Absent: the registered reader answers
+   * (`setCodexDeskCancelReady`), and with none registered, no.
+   */
+  codexHooksReady?: boolean
+  /**
+   * 6.62.0 (QA W1): the Claude hooks Cursor runs carry THIS package's script, not merely a
+   * halt-capable earlier one: the 6.61.7 script reads the first `session_id`, which a Cursor
+   * payload writes behind `tool_input`, so it misses or mis-stops Cursor runs. Absent: the
+   * registered reader answers (`setDeskCancelReaders`), and with none registered, no.
+   */
+  cursorHooksReady?: boolean
+  /** 6.62.0 (QA W2): the thread the cancel is for, so the hooks can be seen to fire for IT. */
+  threadId?: string
+  /**
+   * 6.62.0 (QA W2): a hook event from this engine has already reached COS for this thread:
+   * positive evidence the hooks run there (a freshly trusted Codex hook may not be loaded by a
+   * long-running app; a Cursor IDE halt was canaried in `-p` only). Absent: read through the
+   * registered reader for `threadId`; with neither, no.
+   */
+  threadHookSeen?: boolean
+}
+
+export interface DeskCancelReaders {
+  codexReady: () => boolean
+  cursorReady: () => boolean
+  threadHookSeen: (provider: 'codex' | 'cursor', threadId: string) => boolean
+}
+
+const NO_READERS: DeskCancelReaders = { codexReady: () => false, cursorReady: () => false, threadHookSeen: () => false }
+let readers: DeskCancelReaders = { ...NO_READERS }
+
+/**
+ * 6.62.0: the composition root registers how to read Codex and Cursor readiness and the
+ * per-thread hook evidence (`index.ts`, `provider-observe.ts`). Unregistered reads are "no".
+ */
+export function setDeskCancelReaders(next: Partial<DeskCancelReaders>): void {
+  readers = { ...readers, ...next }
+}
+
+/** 6.62.0: the Codex half of `setDeskCancelReaders`, kept for its callers. */
+export function setCodexDeskCancelReady(read: () => boolean): void {
+  setDeskCancelReaders({ codexReady: read })
+}
+
+export function __resetDeskCancelReadersForTests(): void {
+  readers = { ...NO_READERS }
+}
+
+function readerSays(read: () => boolean): boolean {
+  try { return read() === true } catch { return false }
+}
+
+function codexReady(facts: CancelFacts): boolean {
+  if (typeof facts.codexHooksReady === 'boolean') return facts.codexHooksReady
+  return readerSays(readers.codexReady)
+}
+
+function cursorReady(facts: CancelFacts): boolean {
+  if (typeof facts.cursorHooksReady === 'boolean') return facts.cursorHooksReady
+  return readerSays(readers.cursorReady)
+}
+
+function hookSeen(facts: CancelFacts, provider: 'codex' | 'cursor'): boolean {
+  if (typeof facts.threadHookSeen === 'boolean') return facts.threadHookSeen
+  const threadId = facts.threadId
+  return typeof threadId === 'string' && threadId.length > 0 && readerSays(() => readers.threadHookSeen(provider, threadId))
 }
 
 /**
@@ -40,13 +112,18 @@ export interface CancelFacts {
  *   1. COS's own turn first. It is the one run COS can end at once, and a marker would
  *      also stop it only at its next tool (R3), so aborting the child is always better.
  *   2. Nothing running: null. The lens shows no row at all.
- *   3. Codex and Cursor cannot be stopped from outside their app.
+ *   3. 6.62.0: Cursor stops through the Claude hooks it runs, with THIS package's script
+ *      (`cursorHooksReady`, QA W1), and Codex through its own installed, trusted, current hooks
+ *      (`codexHooksReady`); either only once a hook event of that engine has been seen for the
+ *      thread (`threadHookSeen`, QA W2). Without all of it, still only from their app.
  *   4. A desk Claude run needs the hooks applied AND the new script installed; either
  *      missing is its own answer, because the fixes differ (a setting vs Install hooks).
  */
 export function cancelTargetFor(facts: CancelFacts): CancelTarget | null {
   if (facts.cosTurnInFlight === true) return 'cos_turn'
   if (facts.runningOutsideCos !== true) return null
+  if (facts.provider === 'cursor') return facts.hooksEnabled === true && cursorReady(facts) && hookSeen(facts, 'cursor') ? 'desk_run' : 'unsupported'
+  if (facts.provider === 'codex') return facts.hooksEnabled === true && codexReady(facts) && hookSeen(facts, 'codex') ? 'desk_run' : 'unsupported'
   if (facts.provider !== 'claude') return 'unsupported'
   if (facts.hooksEnabled !== true) return 'hooks_disabled'
   if (facts.hooksReady !== true) return 'hooks_outdated'
@@ -59,10 +136,24 @@ export function cancelTargetFor(facts: CancelFacts): CancelTarget | null {
  * NOW: the hooks applied AND the 6.53 script and subscription installed. False until
  * Install hooks after the update, which is the rollout step Control's banner asks for.
  */
-export function sessionCancelFeature(hooksEnabled: boolean, hooksInstalled: boolean): { cosTurn: true; deskClaude: boolean } {
-  return { cosTurn: true, deskClaude: hooksEnabled === true && hooksInstalled === true }
+export function sessionCancelFeature(hooksEnabled: boolean, hooksInstalled: boolean, codexHooksReady = false, cursorHooksReady = false): { cosTurn: true; deskClaude: boolean; deskCodex: boolean; deskCursor: boolean } {
+  return {
+    cosTurn: true,
+    deskClaude: hooksEnabled === true && hooksInstalled === true,
+    // 6.62.0: whether THIS MAC can stop a desk Codex or Cursor run at all: Codex through its own
+    // installed, trusted, current hooks; Cursor through the Claude hooks with the current script
+    // (QA W1). Each thread's `cancel` field also needs that engine's hooks seen for it (QA W2).
+    deskCodex: hooksEnabled === true && codexHooksReady === true,
+    deskCursor: hooksEnabled === true && cursorHooksReady === true,
+  }
 }
 
+/**
+ * 6.62.0 (W20): what an accepted desk cancel does, in the lens's words. A Codex `js` step is not
+ * a tool call, so a run stops at its next command, not at once; so does every desk run.
+ */
+export const DESK_RUN_EFFECT_COPY = 'Stops the run at its next command.'
+
 /** Refusal codes on the cancel route, with the lens's own words (app 6.9.529 matches). */
 export type CancelRefusal = 'not_running' | 'cancel_unsupported' | 'hooks_outdated' | 'hooks_disabled' | 'cancel_failed' | 'invalid_request'
 

package/server/lib/session-continue-facts-real.ts

@@ -0,0 +1,74 @@
+// The production wiring for `session-continue-facts.ts`: live catalogs and live stores,
+// read-only. A module of its own so the resolver's tests never import the live catalogs
+// (which read ~/.codex and the repo's model cache at import).
+//
+// Roots are read PER CALL, not captured at construction, so `COS_AGENT_SESSIONS_HOME` (the
+// session store's own override, which the route tests set) decides every path here too,
+// the Codex config included.
+
+import { join } from 'node:path'
+import type { ContinueFactsDeps } from './session-continue-facts.js'
+import { agentSessionRoots } from './agent-session-store.js'
+import { getCodexTrustMode } from './codex-run-ledger.js'
+import { codexModelDisplayName, isKnownCodexModel } from './codex-model-catalog.js'
+import { cursorModelDisplayName, isKnownCursorModel } from './cursor-model-catalog.js'
+import { resolveCursorAgentSession } from './cursor-agent-store.js'
+import {
+  codexConfigPath,
+  codexFolderTrusted,
+  codexGitTrustRoot,
+  codexGitTrustRootSync,
+  readCodexConfigText,
+  type GitRunner,
+  type GitRunnerSync,
+} from './codex-session-posture.js'
+import { execFile, execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+
+/** Homebrew's git first: `/usr/bin/git` without the developer tools opens an install dialog. */
+const GIT_BIN = ['/opt/homebrew/bin/git', '/usr/local/bin/git', '/usr/bin/git'].find(path => existsSync(path)) ?? '/usr/bin/git'
+const GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: '0', GIT_TERMINAL_PROMPT: '0' }
+
+export const realGitRunner: GitRunner = (args, cwd, timeoutMs) => new Promise((resolve, reject) => {
+  execFile(GIT_BIN, [...args], { cwd, timeout: timeoutMs, encoding: 'utf8', env: GIT_ENV, maxBuffer: 256 * 1024 }, (error, stdout) => {
+    if (error) reject(error)
+    else resolve(String(stdout))
+  })
+})
+
+export const realGitRunnerSync: GitRunnerSync = (args, cwd, timeoutMs) =>
+  String(execFileSync(GIT_BIN, [...args], { cwd, timeout: timeoutMs, encoding: 'utf8', env: GIT_ENV, maxBuffer: 256 * 1024, stdio: ['ignore', 'pipe', 'ignore'] }))
+
+function liveCodexConfigText(): string | null {
+  const home = process.env.COS_AGENT_SESSIONS_HOME?.trim()
+  return readCodexConfigText(home ? join(home, '.codex', 'config.toml') : codexConfigPath())
+}
+
+/**
+ * 6.62.0 /qa (W5, N1): the adapter's SPAWN-TIME re-check for a full-access Codex plan, read
+ * fresh from the config (the git root usually comes from the plan's cache seconds before).
+ */
+export function codexFolderTrustedNow(cwd: string): boolean {
+  try {
+    return codexFolderTrusted(cwd, codexGitTrustRootSync(cwd, realGitRunnerSync), liveCodexConfigText())
+  } catch {
+    return false
+  }
+}
+
+/** The production wiring: live catalogs, live stores, read-only. */
+export function realContinueFactsDeps(): ContinueFactsDeps {
+  return {
+    codexFallbackSandbox: () => getCodexTrustMode(),
+    isKnownCodexModel: id => isKnownCodexModel(id),
+    codexModelLabel: id => codexModelDisplayName(id),
+    codexConfigText: () => liveCodexConfigText(),
+    codexGitTrustRoot: cwd => codexGitTrustRoot(cwd, realGitRunner),
+    isKnownCursorModel: id => isKnownCursorModel(id),
+    cursorModelLabel: id => cursorModelDisplayName(id),
+    cursorChatDir: threadId => resolveCursorAgentSession(threadId, agentSessionRoots().cursorChats)?.dir ?? null,
+    get cursorComposerDb() {
+      return agentSessionRoots().cursorComposerDb
+    },
+  }
+}

package/server/lib/session-continue-facts.ts

@@ -0,0 +1,267 @@
+// One resolver for "what model is this session on, and what would a Continue run with"
+// (6.62.0, plans 1.8, 3.2, 3.3, 3.12).
+//
+// These readers share the resolver; observations may change between reads:
+//   - the attached shim in index.ts (the plan that becomes argv),
+//   - the detail route (`reported_model`, `continue_note`); list rows skip these reads,
+//   - the attachability verdict (`continue_note`).
+//
+// Every read is bounded and fails to "unknown": `reported_model` is OMITTED on any failure
+// (never blanked, never guessed), and a Continue whose session cannot be read falls back
+// to the 6.61 posture with a note that says so.
+
+import { open, stat } from 'node:fs/promises'
+import {
+  codexReportedModel,
+  planCodexContinue,
+  readCodexConfigText,
+  readCodexSessionPosture,
+  type CodexSessionPosture,
+} from './codex-session-posture.js'
+import {
+  continueFullPermissionsEnabled,
+  killSwitchNote,
+  planCursorContinue,
+  CURSOR_ASK_UNACKED_NOTE,
+  CURSOR_COMPOSER_NOTE,
+  type AttachedContinuePlan,
+} from './continue-plan.js'
+import {
+  cursorSlugCandidates,
+  pickListedCursorModel,
+  readCliChatFacts,
+  readComposerFacts,
+} from './cursor-session-model.js'
+
+/** The lens's own filter for this field (session-model-identity.ts), applied here first. */
+export const REPORTED_MODEL_RE = /^[a-zA-Z0-9][a-zA-Z0-9._:/ -]*$/
+export const REPORTED_MODEL_MAX = 100
+
+export function sanitizeReportedModel(value: unknown): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  if (trimmed.length === 0 || trimmed.length > REPORTED_MODEL_MAX) return null
+  return REPORTED_MODEL_RE.test(trimmed) ? trimmed : null
+}
+
+// ---------------------------------------------------------------------------
+// Claude: the transcript's newest `message.model`
+// ---------------------------------------------------------------------------
+
+const CLAUDE_TAIL_WINDOWS = [1024 * 1024, 8 * 1024 * 1024]
+const claudeModelMemo = new Map<string, { mtimeMs: number; size: number; model: string | null }>()
+const MAX_MEMO = 512
+
+/** Tests only. */
+export function __resetSessionContinueFactsForTests(): void {
+  claudeModelMemo.clear()
+  fallbackLogged.clear()
+}
+
+function newestClaudeModel(text: string): string | null {
+  const lines = text.split('\n')
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i]!
+    if (!line.includes('"assistant"') || !line.includes('"model"')) continue
+    let row: any
+    try { row = JSON.parse(line) } catch { continue }
+    if (row?.type !== 'assistant') continue
+    const model = row?.message?.model
+    // `<synthetic>` is Claude Code's own stand-in for a reply no model wrote (an API error,
+    // an interrupt). It is not what the session runs on.
+    if (typeof model === 'string' && model.trim() && model !== '<synthetic>') return model.trim()
+  }
+  return null
+}
+
+/** Claude's newest real model from the transcript tail, memoized on (mtime, size). */
+export async function readClaudeReportedModel(path: string | null | undefined): Promise<string | null> {
+  if (typeof path !== 'string' || !path.startsWith('/')) return null
+  let mtimeMs: number
+  let size: number
+  try {
+    const st = await stat(path)
+    if (!st.isFile()) return null
+    mtimeMs = st.mtimeMs
+    size = st.size
+  } catch {
+    return null
+  }
+  const memo = claudeModelMemo.get(path)
+  if (memo && memo.mtimeMs === mtimeMs && memo.size === size) return memo.model
+  let model: string | null = null
+  try {
+    const handle = await open(path, 'r')
+    try {
+      for (const window of CLAUDE_TAIL_WINDOWS) {
+        const length = Math.min(window, size)
+        const buffer = Buffer.alloc(length)
+        const { bytesRead } = await handle.read(buffer, 0, length, size - length)
+        model = newestClaudeModel(buffer.subarray(0, bytesRead).toString('utf8'))
+        if (model !== null || length >= size) break
+      }
+    } finally {
+      await handle.close()
+    }
+  } catch {
+    return null
+  }
+  claudeModelMemo.delete(path)
+  claudeModelMemo.set(path, { mtimeMs, size, model })
+  while (claudeModelMemo.size > MAX_MEMO) {
+    const oldest = claudeModelMemo.keys().next()
+    if (oldest.done) break
+    claudeModelMemo.delete(oldest.value)
+  }
+  return model
+}
+
+// ---------------------------------------------------------------------------
+// 6.62.0 /qa (W17): every silent fallback gets a server log line, once per thread per window
+// ---------------------------------------------------------------------------
+
+export const FALLBACK_LOG_EVERY_MS = 10 * 60_000
+const fallbackLogged = new Map<string, number>()
+
+/** Logs `[continue-plan] <what> thread=<8> <detail>` unless the same pair logged recently. */
+export function logContinueFallback(what: string, threadId: string, detail: string, now = Date.now()): boolean {
+  const key = `${what}:${threadId}`
+  const last = fallbackLogged.get(key)
+  if (last !== undefined && now - last < FALLBACK_LOG_EVERY_MS) return false
+  fallbackLogged.delete(key)
+  fallbackLogged.set(key, now)
+  while (fallbackLogged.size > 512) {
+    const oldest = fallbackLogged.keys().next()
+    if (oldest.done) break
+    fallbackLogged.delete(oldest.value)
+  }
+  console.warn(`[continue-plan] ${what} thread=${String(threadId).slice(0, 8)} ${detail}`)
+  return true
+}
+
+// ---------------------------------------------------------------------------
+// The resolver
+// ---------------------------------------------------------------------------
+
+export interface ContinueFactsDeps {
+  env?: NodeJS.ProcessEnv
+  /** The 6.61 Codex sandbox (`getCodexTrustMode`). */
+  codexFallbackSandbox: () => 'read-only' | 'workspace-write'
+  isKnownCodexModel: (id: string) => boolean
+  codexModelLabel: (id: string) => string | null
+  /** `~/.codex/config.toml` text. Defaults to the live, read-only reader. */
+  codexConfigText?: () => string | null
+  /** 6.62.0 /qa (W5): the cwd's git trust root (K7), bounded; absent means no git lookup. */
+  codexGitTrustRoot?: (cwd: string) => Promise<string | null>
+  isKnownCursorModel: (id: string) => boolean
+  cursorModelLabel: (id: string) => string | null
+  /** The CLI chat dir for this id (`~/.cursor/chats/<hash>/<id>`), or null for an IDE composer. */
+  cursorChatDir: (threadId: string) => string | null
+  /** `globalStorage/state.vscdb`. */
+  cursorComposerDb: string
+}
+
+export interface SessionContinueFacts {
+  /** For the attached shim only. Undefined: the 6.61 argv. */
+  plan?: AttachedContinuePlan
+  /** At most 60 characters, or null (Claude: unchanged, so no note). */
+  note: string | null
+  /** Sanitized to the lens rule, or null (then omitted from the wire). */
+  reportedModel: string | null
+}
+
+export interface ContinueFactsInput {
+  provider: string
+  threadId: string
+  /** The transcript or rollout, when the caller already holds it. */
+  transcriptPath: string | null
+  /** The Continue's real cwd (the shim's resolved workspace). Rows pass null. */
+  cwd: string | null
+  /** Pre-read composer facts for list pages (one query for the whole page). */
+  composerFacts?: Map<string, import('./cursor-session-model.js').ComposerFacts | null>
+  /**
+   * 6.62.0 /qa (Q3): the client sent `X-COS-Continue-Note: 1` (it shows this note). Without
+   * it a Cursor Continue gets NO plan (the 6.61 Ask posture) and a note that says so.
+   */
+  noteAck?: boolean
+}
+
+export async function resolveSessionContinueFacts(
+  input: ContinueFactsInput,
+  deps: ContinueFactsDeps,
+): Promise<SessionContinueFacts> {
+  const full = continueFullPermissionsEnabled(deps.env)
+  if (input.provider === 'claude') {
+    return { note: null, reportedModel: sanitizeReportedModel(await readClaudeReportedModel(input.transcriptPath)) }
+  }
+  if (input.provider === 'codex') {
+    let posture: CodexSessionPosture | null = null
+    try {
+      posture = await readCodexSessionPosture(input.transcriptPath)
+    } catch {
+      posture = null
+    }
+    const reportedModel = sanitizeReportedModel(codexReportedModel(posture))
+    let fallback: 'read-only' | 'workspace-write' = 'read-only'
+    try { fallback = deps.codexFallbackSandbox() === 'workspace-write' ? 'workspace-write' : 'read-only' } catch { fallback = 'read-only' }
+    if (!full) return { note: killSwitchNote('codex', fallback), reportedModel }
+    const cwd = input.cwd ?? posture?.cwd ?? ''
+    // Only full access needs the trust question, and only it pays for the git lookup.
+    let gitTrustRoot: string | null = null
+    if (posture?.sandboxType === 'danger-full-access' && typeof deps.codexGitTrustRoot === 'function') {
+      try { gitTrustRoot = await deps.codexGitTrustRoot(cwd) } catch { gitTrustRoot = null }
+    }
+    const plan = planCodexContinue(posture, cwd, {
+      fallbackSandbox: () => fallback,
+      configText: deps.codexConfigText ?? (() => readCodexConfigText()),
+      gitTrustRoot,
+      isKnownModel: deps.isKnownCodexModel,
+      modelLabel: deps.codexModelLabel,
+    })
+    if (plan.source === 'fallback') logContinueFallback('codex posture unreadable', input.threadId, `fallback=${plan.sandbox}`)
+    return { plan, note: plan.note, reportedModel }
+  }
+  if (input.provider === 'cursor') {
+    const id = input.threadId.toLowerCase()
+    let chatDir: string | null = null
+    try { chatDir = deps.cursorChatDir(id) } catch { chatDir = null }
+    if (chatDir) {
+      const chat = await readCliChatFacts(chatDir)
+      const reportedModel = sanitizeReportedModel(chat?.model ?? null)
+      if (!full) return { note: killSwitchNote('cursor', 'read-only'), reportedModel }
+      if (input.noteAck !== true) return { note: CURSOR_ASK_UNACKED_NOTE, reportedModel }
+      const plan = planCursorContinue({
+        candidates: chat?.model ? [chat.model] : [],
+        isKnown: deps.isKnownCursorModel,
+        label: deps.cursorModelLabel,
+        askModeChat: chat?.mode === 'ask',
+      })
+      if (!plan.matched) logContinueFallback('cursor model unmatched', input.threadId, `model=${chat?.model ?? 'unread'} fallback=${plan.model}`)
+      return { plan, note: plan.note, reportedModel }
+    }
+    // An IDE composer: no plan (it is never resumed from outside), and its model is read
+    // from the composer record in a query of its own.
+    let facts = input.composerFacts?.get(id)
+    if (facts === undefined) {
+      try {
+        facts = (await readComposerFacts([id], deps.cursorComposerDb)).get(id) ?? null
+      } catch {
+        facts = null
+      }
+    }
+    const candidates = cursorSlugCandidates(facts?.modelConfig ?? null)
+    const listed = pickListedCursorModel(candidates, deps.isKnownCursorModel)
+    return { note: CURSOR_COMPOSER_NOTE, reportedModel: sanitizeReportedModel(listed ?? candidates[0] ?? null) }
+  }
+  return { note: null, reportedModel: null }
+}
+
+/** The two wire keys, omitted when unknown, so an older client sees the same payload. */
+export function continueFactsFields(facts: SessionContinueFacts | null | undefined): { reported_model?: string; continue_note?: string } {
+  if (!facts) return {}
+  return {
+    ...(facts.reportedModel ? { reported_model: facts.reportedModel } : {}),
+    ...(facts.note ? { continue_note: facts.note } : {}),
+  }
+}
+