@gotcos/glasses-server 6.79.2 → 6.81.0

package/.env.example

@@ -417,3 +417,12 @@ COS_CONTINUE_FULL_PERMISSIONS=1
 # COS_PIN_BOOT_REAP=1     # free a thread a crashed run held, 31 min after the restart and once its child is gone (default on; 0 = the 24 h reap)
 # COS_QUEUE_RESEND=1      # Send again on a refused or expired queued turn (default on)
 # COS_SESSION_STEER=0     # steer a busy Claude session through its peer inbox (default off)
+
+
+# ── Answer with your own key (6.80.0, opt in) ──────────────────────────────────
+# Off by default. With this unset, nothing about key lanes runs until COS Control turns them on
+# from its Settings row (that writes data/key-lanes.json). 1 turns them on from the environment;
+# 0 forces them off and wins over Control. Keys are saved only through COS Control on this Mac,
+# in data/key-secrets/ (0700). Your key is saved on this Mac: apps and agents that run on this
+# Mac as you can read it, so your provider's own spending limit is the real stop.
+# COS_KEY_LANES=0

package/CHANGELOG.md

@@ -1,3 +1,34 @@
+## 6.81.0 - The Mac saves a stopped meeting on its own once it holds every chunk
+
+Miles, 2026-10-20: "if the application isn't in the foreground, it can fail to save the meetings". Both G2 meetings that day saved only once the phone came back on screen: the phone's Stop needs IndexedDB, and iOS suspends IndexedDB while the companion is hidden (11:19 qbbgyq: Stop 12:43, `stop_blocked`, "Load failed", saved 12:47 by a new WebView; 14:07 mip9qb: Stop 15:13:50, saved 15:14:37 only after the phone was visible). The full map is `docs/meeting-autonomous-save.md`.
+
+- **Client matrix.** Server only. Nothing changes until the companion sends the new Stop (a companion release, not in this one). Older companions never call the new route and save exactly as before.
+- **The phone's Stop, durable.** `POST /api/meeting/sessions/:id/stop` `{finalChunkIndex, serverInstanceId}`: one small fetch a hidden phone can still send. The server pin is required. It is written to `data/meeting-stop-intents.json` (0600, atomic) before the 202, so a restart keeps it. A repeat is idempotent; a higher index raises it, a lower one never lowers it. A Stop behind what the Mac already holds is refused 409 `final_index_behind_server`. It never closes the session and never refuses a chunk.
+- **The Mac saves only a complete capture.** Once every chunk 0..finalChunkIndex has arrived and finished ASR, and 45 s have passed since the Stop and since the last chunk (so a phone on screen saves first), the Mac runs the same save the phone's `POST /meeting/save` runs: one lock, one idempotent receipt. A gap means audio exists only on the phone, so the Mac waits and the late chunks land in the SAME live session. There is no timeout that saves with a gap: a gap that never fills is left to the existing 4 h stranded sweep, unchanged. A chunk past the Stop revokes it (the meeting is still recording). Checked every 15 s while a Stop waits, only while admissions are open and session recovery has run.
+- **The phone coming back.** Status answers `saved` with the receipt; `POST /meeting/save` replays it; and a chunk the phone re-sends because its answer was lost while hidden is answered from the saved sidecar instead of 410, so the phone no longer reads that state as a collision. This replay is only for meetings the Mac saved itself; every other closed session still answers 410.
+- **Telemetry.** `[meeting/auto-save]` lines and `data/meeting-autonomous-save.jsonl`: `stop_received`, `waiting` (once per change, with missing count and sample), `finalized` (chunks, canonical, gaps, waited ms), `phone_saved` (or `client_saved` for an unpinned save such as the stranded sweep's), `phone_confirmed` (how and how long after), `late_replay`, `late_chunk_refused`, `revoked`, `stood_down`, `finalize_failed`. The status route carries `stopIntent` additively. `recording_stop` carries `savedBy: "server"` for the Mac's own saves.
+- **Unchanged.** Transcription engines, the G2 matching thresholds, the restart and maintenance gate semantics, the stranded sweeper, and the save route's answers (its body moved into one shared `performSave`; the mutation gate anchor `cx-6533-save-nothing-to-save` follows it).
+- **Checks.** Full suite 8,462 passed, 0 failed, 3 skipped (557 files); `tsc --noEmit` clean. `server/scripts/autonomous-save-mutation-gate.mjs` (not packaged): green baseline (63 tests in 4 files), 42 of 42 mutants killed, each by a named test. The moved `cx-6533-save-nothing-to-save` anchor re-runs killed. Journeys: phone hidden after Stop (the Mac saves alone), phone back late with missing chunks (merged into one meeting), phone and Mac racing (one meeting), against the real chunk and save routes. Needs the companion release to send the Stop before it does anything on a real phone.
+
+## 6.80.0 - Answer with your own key (opt in, off by default)
+
+You can now give COS your own provider key (OpenRouter, Anthropic, OpenAI, or a compatible endpoint) and pick a key profile for a thread, so that thread answers on the key instead of your Claude or ChatGPT plan. **This is opt in. Without a key, nothing changes:** with `COS_KEY_LANES` unset or `0`, or with lanes on but no key profile saved, the server answers, spawns and writes exactly as 6.79.1 did. Turning it on and saving keys happens in COS Control on this Mac.
+
+- **Client matrix.** Server only in this release. COS Control and the companion need their key-lane builds to show the setting, the picker entries and the cost label; older apps never call the new routes and see nothing new. `COS_KEY_LANES=0` (now forwarded to a managed server) forces everything off whatever Control saved.
+- **How a keyed answer runs.** The real key stays inside the server. A keyed Claude or Codex turn talks to a loopback relay (127.0.0.1, an ephemeral port, opened only by the first keyed turn) with a one-turn token; the relay checks it, meters the turn against the key's daily cap, forwards with the key and settles what the answer cost. A direct profile (any OpenRouter model, or a compatible endpoint) answers in process through the same meter and breakers. A keyed turn never falls back to your plan: if the key, the relay or the cap says no, the lens says why and your plan is not used.
+- **What the routes show.** While lanes are on: `/api/key-lanes/*` (status, keys, profiles, catalog, remove all, disable), and `details.keyLanes` on `/api/health`. Status is readable from the phone with the pairing token (cap, today's spend, the UTC reset time as `resetsAt`, never the key); every write stays Mac only. With a key profile saved: `keyProfiles` on `/api/models`, and a keyed answer's `done` event carries `lane`, `credential` (kind, key ref, profile id), `profile` and `usd`. The one route present while lanes are off is `POST /api/key-lanes/enable`, for COS Control on this Mac (token, loopback, no browser).
+- **Errors say what happened.** When the key itself stops a turn (daily cap used, key rejected, out of credit, the model gone, or the key paused after three failures), the lens, the job record and COS Control show the matching one-line reason instead of the CLI's raw error. A turn refused before it starts reads the same way.
+- **Recovered answers keep their cost.** A durable job answered on a key keeps `lane`, `credential`, `profile` and `usd` on its record and through a restart, so an answer the app recovers later still shows what it cost. A job on your plan writes exactly the record it did before.
+- **Keyed Codex threads in Sessions.** With lanes on, a Codex thread that ran on a key is listed, named, searchable and shows its subagents like any other. With lanes off, only the usual Codex home is read.
+- **Where the key lives, plainly.** Keys are saved in `data/key-secrets/provider-keys.json` (0600, in a 0700 folder of their own). While key lanes are on and a key is saved, every Claude run that can use tools is told it may not Read, Edit, Write or `cat` that folder (checked against the real Claude Code 2.1.304: both a Read and a Bash `cat` come back denied). Codex has no way to exclude a folder from what it can read. So the honest statement, which COS Control also shows: Your key is saved on this Mac. Apps and agents that run on this Mac as you can read it. Your provider's spending limit is the real stop. OpenRouter keys still need a credit limit set; Anthropic and OpenAI keys have no provider-side daily backstop, so the cap here is the only one.
+- **The cap is checked mid-reply, and is not a hard stop.** A request reserves its own max_tokens within what the key has left today, and a reply whose running cost would pass the cap is cut and settled at what the provider billed. The cap can be exceeded by the last reply in progress: the provider bills what it already generated, so the overshoot is bounded by that one response's max_tokens (a real-key cut late in a 14k-token reply went $0.003 past $0.0065 of headroom). Your provider limit is the hard stop. A spend that a crash left open still counts after a restart.
+- **More you can do from COS Control.** Reset a key paused after three failures (`POST /api/key-lanes/breaker/reset`); turning a profile off, or changing its key or model, stops its live turn at once, and a new key or model clears the profile's pause. The one-turn "run this one on your key" offer (`keyTurnOnly`) answers that turn on the key without moving the thread onto it.
+- **Tighter edges.** Custom endpoints must be https unless they are on this Mac. Claude managed settings and `CLAUDE_CONFIG_DIR` are checked, and OAuth and Bedrock token names are never passed to a keyed run; a Codex project config that sets a provider refuses a keyed Codex turn. Rate limits, provider errors, refusals and an expired or stopped key turn each read as their own one-line reason.
+- **Fixed from the real-key canaries.** A keyed Claude run now forces agent teams off even when a project settings file turns them on (checked with the real CLI). Parallel subagents on one keyed turn wait for a free slot (16 at once, then a queue) instead of failing, and a turn that still cannot get one reads "Too many steps at once. Your plan was not used." A Codex failure now costs at most 3 attempts on the key, and the key turn ends the moment the answer does. Cached prompt tokens are priced at their real rates, so a reply that fits under the cap is no longer cut, and a cut reply is reconciled to its real cost. Hook events of a keyed Claude session or Codex thread now carry their key profile, also on the `session-hook-events.jsonl` rows (resolved from the keyed-session record the bridge wrote; rows with lanes off are unchanged). Claude Code's reachability probe gets an empty answer instead of a 404.
+- **Safety rails.** Daily cap per key, shared by every profile, turn and lane on it; the cap Control saved wins over any later edit of the key file. Three rejected-key, out-of-credit or gone-model failures pause that key or profile for an hour. Error bodies are scrubbed of the key. A session that ran on a key is never resumed, handed off, continued or forked on your plan (Continue and Fork answer the same 409 `keyed_session` body as handoffs). A keyed Codex thread keeps its own resume slot, so switching lanes never loses the other lane's thread. Scheduled briefs, task dispatch and Work drafts never run on a key.
+- **Known limit (not from key lanes).** When a turn starts background subagents, the CLI can emit a first `result` before they finish ("Eight of the 12 have reported...") and a full one later. COS ends the turn on the first `result`, so the lens gets the partial answer. This is the same on your plan at 6.79.1 (a0035a8) and 6.79.2 (ba4fc66), in normal and steer mode (`claude-bridge-two-results.test.ts` passes on both unchanged), and a keyed turn runs with the same arguments as a plan turn (no stream-json input), so it is recorded here and not changed in this candidate.
+- **Checks.** Full suite 8,399 passed, 0 failed, 3 skipped (553 files), every test that passed at ba4fc66 (6.79.2, 7,962) still passing by name; `tsc --noEmit` clean. Combined gate `server/scripts/key-lanes-mutation-gate.mjs` (not packaged): P1 48, P2 36, P3 34, P4 38, P5 28, P6 30, P8 22 and 104 integration mutants, every one killed by a named test against a green baseline. The off-golden re-recorded at ba4fc66 (6.79.2, a clean tree with no key code) compares each CLI's normalized stdin; it replays with an empty diff at `COS_KEY_LANES=0`; unset, the only difference is the Control enable door; at `=1` with no profile, exactly that door plus `details.keyLanes` and the status route. Journeys (`key-lanes-journeys.ts`, booting `server/index.ts` against a loopback mock): 24 of 24. `npm pack --dry-run` ships no test, gate or fixture.
+
 ## 6.79.2 - Live cue limits from COS Control: the bar, cues per meeting, cooldown and a daily writer ceiling, applied without a restart
 
 Miles, 2026-10-19: cap live-cue spend from COS Control. On 10/19, live cues ran 126 Sonnet writer calls (about 310K writer tokens) across 7 meetings.

package/README.md

@@ -1045,6 +1045,16 @@ usable on Fast and reports the downgrade truthfully. Set
 `COS_BATCH_LARGE_V3=0` to explicitly use turbo. Interactive HQ uses beam 2 by
 default (`COS_HQ_BEAM_INTERACTIVE`); meeting batch remains beam 5.
 
+## Answer with your own key (6.80.0, opt in)
+
+Off by default, and without a key nothing changes. Turn it on in COS Control (Settings, "Answer with your own key"), or set `COS_KEY_LANES=1`; `COS_KEY_LANES=0` forces it off.
+
+- **What it does.** You save a provider key (OpenRouter, Anthropic, OpenAI or a compatible endpoint) in COS Control and make a key profile: which harness answers (Claude Code, Codex, or a direct call), which model, and a daily cap. A thread you put on that profile answers on the key instead of your plan. It never falls back to your plan: when the key, the cap or the provider says no, the lens says why.
+- **Where the key lives.** In `data/key-secrets/provider-keys.json` (0600, in a 0700 folder), used only by the server's loopback relay, which gives each keyed turn a one-turn token instead of the key. Every Claude spawn that can use tools gets deny rules for that folder. Codex has no sandbox read exclusion. Plainly: your key is saved on this Mac, apps and agents that run on this Mac as you can read it, and your provider's spending limit is the real stop. OpenRouter keys must have a credit limit set; Anthropic and OpenAI keys have no provider-side daily backstop, so the cap here is the only one.
+- **Spend.** A daily cap per key (UTC day), shared by every profile on it. A reply that would pass the cap is cut and the lens shows the cap line. The cap can be exceeded by the last reply in progress (by at most that reply's max_tokens); your provider limit is the hard stop. `GET /api/key-lanes/status` shows cap, today's spend and the reset time.
+- **Routes** (all 404 while off, except the enable door COS Control uses): `/api/key-lanes/status`, `keys`, `profiles`, `catalog`, `breaker/reset`, `remove-all`, `enable`, `disable`. Writes answer only COS Control on this Mac (token, loopback, no browser).
+- **Before you downgrade** below 6.80, remove your keys in COS Control. An older server cannot see them and would answer a keyed thread on your plan.
+
 ## Run from source
 
 ```bash

package/managed-runtime-contract.json

@@ -74,6 +74,7 @@
     "COS_PIN_BOOT_REAP",
     "COS_QUEUE_RESEND",
     "COS_SESSION_STEER",
+    "COS_KEY_LANES",
     "COS_DICTATION_AUTOCLEAN_MAX_PER_DAY",
     "COS_DICTATION_AUTOCLEAN_MAX_PER_DAY_MESSAGE",
     "COS_DICTATION_AUTOCLEAN_MAX_PER_DAY_MEETING",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.79.2",
+  "version": "6.81.0",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
@@ -54,6 +54,7 @@
     "!server/scripts/work-search-mutation-gate.mjs",
     "!server/scripts/fact-check-mutation-gate.mjs",
     "!server/scripts/stale-session-mutation-gate.mjs",
+    "!server/scripts/autonomous-save-mutation-gate.mjs",
     "!server/scripts/stt-mutation-gate.mjs",
     "!server/scripts/dictation-stt-mutation-gate.mjs",
     "!server/scripts/pairing-mutation-gate.mjs",
@@ -73,6 +74,14 @@
     "!server/scripts/transcript-cleanup-mutation-gate.mjs",
     "!server/scripts/live-cues-v2-notes-mutation-gate.mjs",
     "!server/scripts/live-cues-verdicts-mutation-gate.mjs",
+    "!server/scripts/key-lanes-p1-mutation-gate.mjs",
+    "!server/scripts/key-lanes-p2-mutation-gate.mjs",
+    "!server/scripts/key-lanes-p3-mutation-gate.mjs",
+    "!server/scripts/key-lanes-p4-mutation-gate.mjs",
+    "!server/scripts/key-lanes-p5-mutation-gate.mjs",
+    "!server/scripts/key-lanes-p6-mutation-gate.mjs",
+    "!server/scripts/key-lanes-p8-mutation-gate.mjs",
+    "!server/scripts/key-lanes-mutation-gate.mjs",
     "!server/scripts/dictation-polish-eval.ts",
     "!server/scripts/dictation-polish-mutation-gate.mjs",
     "!server/lib/meeting-engine/__fixtures__/**",

package/server/index.ts

@@ -74,11 +74,13 @@ import { nativeHead, realNativeHeadDeps, registerClaudeTranscriptHint } from './
 import { threadOccupancy, holderActivity } from './lib/thread-occupancy.js'
 import { displayRouter } from './routes/display.js'
 import { transcribeStreamRouter, getActiveTranscriptionSessionCount } from './routes/transcribe-stream.js'
-import { meetingRouter, resumeMeetingFinalizationJobs, scheduleTranscriptCleanupSweep, transcriptCleanupRouteDeps } from './routes/meeting.js'
+import { meetingRouter, resumeAutonomousMeetingSaves, resumeMeetingFinalizationJobs, scheduleTranscriptCleanupSweep, transcriptCleanupRouteDeps } from './routes/meeting.js'
 import { createTranscriptCleanupRouter } from './routes/transcript-cleanup.js'
 import { meetingsRouter } from './routes/meetings.js'
 import { openaiCompatRouter } from './routes/openai-compat.js'
 import { openaiKeyRouter } from './routes/openai-key.js'
+import { createKeyLanesBodyParser, createKeyLanesRouter } from './routes/key-lanes.js'
+import { wireKeyLanes } from './lib/key-lanes-wiring.js'
 import { firefliesKeyRouter } from './routes/fireflies-key.js'
 import { meetingImportRouter } from './routes/meeting-import.js'
 import { startMeetingImportScheduler, stopMeetingImportScheduler } from './lib/meeting-import.js'
@@ -478,6 +480,10 @@ app.use('/api', (req, res, next) => {
   }
 })
 
+// Key lanes (plan v4 3.1): parses its own small body ahead of the 10 MB parser, and only for a
+// request the key-lanes router will answer. Every other request passes through untouched.
+app.use('/api/key-lanes', ...createKeyLanesBodyParser({ apiToken: () => API_TOKEN }))
+
 // Authenticate before parsing large upload bodies. The 16 MB allowance stays
 // scoped to /api/media; every other route retains the 10 MB ceiling.
 app.use('/api/media/file', mediaBinaryBodyParser)
@@ -1165,6 +1171,11 @@ app.use('/api', memoryRouter)
 app.use('/api', threadsRouter)
 app.use('/api', skillsRouter)
 app.use('/api', openaiKeyRouter)
+// Key lanes (plan v4 3.1). Off (the default): every /api/key-lanes path falls through to the
+// usual 404, except an authenticated loopback POST /api/key-lanes/enable from COS Control.
+app.use('/api', createKeyLanesRouter({ apiToken: () => API_TOKEN }))
+// P11: fill the key-lane seams (map writes only; the relay's status seams only while enabled).
+wireKeyLanes()
 // Fireflies: the key, and importing meetings this Mac did not record (6.47.0).
 app.use('/api', firefliesKeyRouter)
 app.use('/api', meetingImportRouter)
@@ -1462,6 +1473,8 @@ listenRequiredServers(listeners).then(() => {
     // Resume already-saved meetings whose post-response HQ/operations work
     // was interrupted by a prior server update or process exit.
     resumeMeetingFinalizationJobs()
+    // 6.81.0: Stops the phone sent before the last exit; the server saves them once complete.
+    resumeAutonomousMeetingSaves()
     // 6.77.0: transcript cleanup data whose meeting is gone, and screen text past retention.
     scheduleTranscriptCleanupSweep()
 

package/server/lib/agent-session-search.ts

@@ -40,8 +40,9 @@ import {
   codexUserText,
   listCodexJsonlFiles,
   loadClaudeStarredIds,
-  loadCodexPinnedIds,
-  loadCodexThreadNames,
+  codexSessionRootsOf,
+  loadCodexPinnedIdsAll,
+  loadCodexThreadNamesAll,
   loadCursorComposerNames,
   loadCursorPinnedIds,
   parseJsonLine,
@@ -314,10 +315,12 @@ async function collectClaudeDocs(roots: AgentSessionRoots, docs: SearchDoc[], bu
 }
 
 async function collectCodexDocs(roots: AgentSessionRoots, docs: SearchDoc[], budget: ScanBudget) {
-  const names = await loadCodexThreadNames(roots.codexSessions)
-  const pinned = await loadCodexPinnedIds(roots.codexSessions)
+  // Key lanes (P11): every Codex home, the server home first. One root with lanes off.
+  const names = await loadCodexThreadNamesAll(roots)
+  const pinned = await loadCodexPinnedIdsAll(roots)
   const candidates: Array<{ file: string; mtimeMs: number; birthtimeMs: number }> = []
-  for (const file of await listCodexJsonlFiles(roots.codexSessions)) {
+  const files = (await Promise.all(codexSessionRootsOf(roots).map(root => listCodexJsonlFiles(root)))).flat()
+  for (const file of files) {
     const st = await fileStat(file)
     if (!st?.isFile) continue
     candidates.push({ file, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs })

package/server/lib/agent-session-store.ts

@@ -12,6 +12,7 @@ import { join } from 'node:path'
 import { createInterface } from 'node:readline'
 import { promisify } from 'node:util'
 import { codexUserAsk, unwrapPeerMessage } from './session-stream-events.js'
+import { profileCodexHomeSubdirs } from './codex-homes.js'
 
 const execFileAsync = promisify(execFile)
 
@@ -66,6 +67,12 @@ export interface AgentSessionRoots {
   cursorChats: string
   cursorComposerDb: string
   cursorWorkspaceStorage: string
+  /**
+   * Key lanes K1 (plan v4 8.2): `data/codex-homes/<id>/sessions` for each keyed Codex profile
+   * home. Present only while key lanes are on and a profile home exists; absent otherwise, so
+   * the roots (and every list and lookup) are the 963fe25 ones.
+   */
+  codexProfileSessions?: string[]
 }
 
 export function agentSessionRoots(home = process.env.COS_AGENT_SESSIONS_HOME || homedir()): AgentSessionRoots {
@@ -78,7 +85,39 @@ export function agentSessionRoots(home = process.env.COS_AGENT_SESSIONS_HOME ||
     cursorChats: join(home, '.cursor', 'chats'),
     cursorComposerDb: join(home, 'Library', 'Application Support', 'Cursor', 'User', 'globalStorage', 'state.vscdb'),
     cursorWorkspaceStorage: join(home, 'Library', 'Application Support', 'Cursor', 'User', 'workspaceStorage'),
+    ...codexProfileSessionsField(),
+  }
+}
+
+function codexProfileSessionsField(): { codexProfileSessions?: string[] } {
+  const dirs = profileCodexHomeSubdirs('sessions')
+  return dirs.length ? { codexProfileSessions: dirs } : {}
+}
+
+/** The server home's sessions root first, then each profile home's (plan 8.2 codexHomes order). */
+export function codexSessionRootsOf(roots: AgentSessionRoots): string[] {
+  return [roots.codexSessions, ...(roots.codexProfileSessions ?? [])]
+}
+
+/**
+ * Key lanes (P11): thread names across every Codex home, the server home's first (it wins a
+ * clash). With lanes off there is one root and this is exactly loadCodexThreadNames(server).
+ */
+export async function loadCodexThreadNamesAll(roots: AgentSessionRoots): Promise<Map<string, string>> {
+  const [server, ...profiles] = codexSessionRootsOf(roots)
+  const names = await loadCodexThreadNames(server!)
+  for (const root of profiles) {
+    for (const [id, name] of await loadCodexThreadNames(root)) if (!names.has(id)) names.set(id, name)
   }
+  return names
+}
+
+/** Key lanes (P11): pinned thread ids across every Codex home (one root with lanes off). */
+export async function loadCodexPinnedIdsAll(roots: AgentSessionRoots): Promise<Set<string>> {
+  const [server, ...profiles] = codexSessionRootsOf(roots)
+  const pinned = await loadCodexPinnedIds(server!)
+  for (const root of profiles) for (const id of await loadCodexPinnedIds(root)) pinned.add(id)
+  return pinned
 }
 
 export function isSafeSessionId(value: string): boolean {
@@ -1392,7 +1431,7 @@ export async function listAgentSessions(
   let rows = dedupeSessions([
     ...enrichedLive,
     ...await listClaudeSessions(roots.claudeProjects, now, liveIds, cap, starredIds, roots.claudeCodeSessions, dropped, aliases),
-    ...await listCodexSessions(roots.codexSessions, now, cap, dropped),
+    ...(await Promise.all(codexSessionRootsOf(roots).map(root => listCodexSessions(root, now, cap, dropped)))).flat(),
     ...await listCursorSessions(roots.cursorProjects, now, cap, roots.cursorComposerDb, cursorPinned, dropped),
   ])
   if (sort === 'opened') {
@@ -1458,9 +1497,11 @@ export async function findAgentSessionFile(
     return matches.length === 1 ? matches[0] : null
   }
   if (provider === 'codex') {
-    for (const file of await listCodexJsonlFiles(roots.codexSessions)) {
-      const name = file.split('/').pop()?.toLowerCase() ?? ''
-      if (name.includes(needle)) return file
+    for (const root of codexSessionRootsOf(roots)) {
+      for (const file of await listCodexJsonlFiles(root)) {
+        const name = file.split('/').pop()?.toLowerCase() ?? ''
+        if (name.includes(needle)) return file
+      }
     }
     return null
   }

package/server/lib/archive.ts

@@ -19,6 +19,7 @@ import { resolveExchangePairModel } from './conversation.js'
 import type { ModelPreference } from '../../shared/model-preference.js'
 
 import { dataPath } from './data-dir.js'
+import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
 const ARCHIVE_DIR = dataPath('archive')
 
 // ── Interfaces ──────────────────────────────────────────────
@@ -193,7 +194,7 @@ function fallbackDaySummary(chats: ArchivedChat[]): string {
  */
 function runClaudeArchiveSummary(input: string, instruction: string): Promise<string> {
   return new Promise((resolve, reject) => {
-    const proc = spawn('claude', ['-p', '--model', 'sonnet', instruction], {
+    const proc = spawn('claude', ['-p', '--model', 'sonnet', ...claudeKeySecretsGuardArgs(), instruction], {
       stdio: ['pipe', 'pipe', 'pipe'],
     })
 

package/server/lib/attached-provider-adapter.ts

@@ -104,6 +104,8 @@ import { getCodexTrustMode } from './codex-run-ledger.js'
 import { CURSOR_SLOT_MODEL_IDS } from './cursor-model-catalog.js'
 import { cursorIsolationUnavailableError, cursorSpawnEnv, isCursorIsolationUnavailable, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
 import type { PermissionAllowance } from './banned-permission-args.js'
+import { anyKeyedSessions, isKeyedSession } from './keyed-sessions.js'
+import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
 import {
   continueAllowanceFor,
   validateContinuePlan,
@@ -149,6 +151,8 @@ export type AttachedTurnFailure =
   | 'adapter_internal_error'
   /** 6.53.0: the caller's abort signal fired (a cancel from the lens). Never ambiguous. */
   | 'cancelled'
+  /** Key lanes K1 (plan v4 7.3): the thread ran on a key. Refused before anything is built. */
+  | 'keyed_session'
 
 /** See the header. The boundary is the first byte handed to the child's stdin. */
 export type AttachedDeliveryState = 'not_attempted' | 'aborted' | 'ambiguous' | 'delivered' | 'cancelled'
@@ -532,6 +536,7 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
     // never observe the session id we are required to verify.
     '--verbose',
     '--resume', nativeThreadId,
+    ...claudeKeySecretsGuardArgs(),
   ]
 }
 
@@ -820,6 +825,12 @@ async function run(
   }
   const nativeThreadId: string = request.nativeThreadId
 
+  // Key lanes K1 (plan v4 7.3): a thread that ran on a key is not continued here, where it would
+  // resume on the subscription. One failed stat when no keyed session was ever recorded.
+  if (anyKeyedSessions() && isKeyedSession(nativeThreadId)) {
+    return fail('keyed_session', 'not_attempted', { provider, nativeThreadId, durationMs: duration() })
+  }
+
   const base = { provider, nativeThreadId, durationMs: 0 }
 
   if (!isAttachedPermissionPolicy(request.policy)) {

package/server/lib/claude-bridge.ts

@@ -64,6 +64,14 @@ import { claudeSupportsSessionName } from './claude-cli-support.js'
 import { applyTurnRequestEnv, createTurnRequestBinding, spawnWithTurnRequest } from './turn-request.js'
 import { STEER_REAPER_MS, STEER_SETTLE_MS, SteerTracker, composeFirstContent, encodeUserLine, steerClock, type SteerPort } from './claude-steer.js'
 import { randomUUID } from 'node:crypto'
+// Key lanes K1 P3 (plan v4 7): Lane B Claude. Every use below sits behind `options.keyProfile`;
+// without one, argv, env, session keys and the pre-warm handoff are the b7c620e ones.
+import { profilePreference } from '../../shared/key-preference.js'
+import type { AnswerKeyFields, KeyKind, KeyProfile, RelayTurnHandle } from './key-relay-contract.js'
+import { applyLaneBClaudeEnv, LANE_B_COPY, laneBClaudePreflight, laneBRelay } from './lane-b-env.js'
+import { recordKeyedSession } from './keyed-sessions.js'
+import { getSharedKeyMeter } from './key-relay-meter.js'
+import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
 
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
@@ -117,9 +125,19 @@ function cliSessionKey(cosSessionId: string, model: ClaudeModelPreference): stri
   return `${cosSessionId}:${model}`
 }
 
+/** Key lanes (plan v4 7.1): a keyed turn's CLI session is its own key, never `${sid}:${tier}`. */
+export function keyedCliSessionKey(cosSessionId: string, tier: ClaudeModelPreference, profileId: string): string {
+  return `${cosSessionId}:${tier}:p:${profileId}`
+}
+
 function getAnyCliSessionId(cosSessionId: string): string | undefined {
   for (const [key, cliId] of cliSessionMap) {
-    if (key === cosSessionId || key.startsWith(`${cosSessionId}:`)) return cliId
+    if (key === cosSessionId || key.startsWith(`${cosSessionId}:`)) {
+      // Key lanes: a keyed CLI session is never handed out here (handoff, health, Continue). Only
+      // the keyed turn itself reaches it, through its own exact key.
+      if (key.includes(':p:', cosSessionId.length)) continue
+      return cliId
+    }
   }
   return undefined
 }
@@ -235,6 +253,7 @@ export async function preWarmCLI(): Promise<void> {
       '--output-format', 'stream-json',
       '--verbose',
       ...claudePermissionArgs(getClaudeTrustMode(), null),
+      ...claudeKeySecretsGuardArgs(),
       '--system-prompt', buildPrewarmSystemPrompt(),
     ], {
       stdio: ['pipe', 'pipe', 'pipe'],
@@ -324,6 +343,12 @@ export interface ModelRunMetadata {
   ollamaRunId?: string
   outputAttachments?: MediaAttachmentRef[]
   outputImageStats?: RunOutputImageCollectionStats
+  /** Key lanes (plan v4 3.1): present only on a keyed turn. The `model` beside it is then the timeout tier. */
+  keyLane?: AnswerKeyFields
+  /** Key lanes (P11): what this keyed answer cost on the key, settled by the relay. Keyed turns only. */
+  usd?: number
+  /** Key lanes (P5): the direct lane's run ledger id. Direct turns only. */
+  directRunId?: string
 }
 
 /** Public-safe provider launch metadata for durable job coordination. It
@@ -417,6 +442,17 @@ export interface CallOptions {
    * 6.77.0 one. A dispatch never steers.
    */
   steer?: SteerPort
+  /**
+   * Key lanes K1 (plan v4 7): run this turn on a saved key profile (Lane B Claude) through the
+   * loopback relay. The profile's timeoutTier sets the timeouts and its model goes on `--model`;
+   * the `model` argument is ignored. Absent, every argument, env name, session key and stdin
+   * byte is the b7c620e one. Refused (onError, nothing spawned) when lanes are not active, the
+   * profile is off or not a Claude profile, its key is gone, a Claude settings file would bypass
+   * the relay, no relay is registered, or this is a dispatch.
+   */
+  keyProfile?: KeyProfile
+  /** Key lanes (QA U9): run this one profile turn without binding the session to the profile. */
+  keyTurnOnly?: boolean
 }
 
 export async function callClaudeStreaming(
@@ -431,6 +467,25 @@ export async function callClaudeStreaming(
 ): Promise<string> {
   // Get or create session
   const sid = getOrCreateSession(sessionId)
+  // Key lanes: every check a keyed turn needs runs here, before history, the run ledger or a
+  // process. A refusal ends the turn with its lens line; the subscription is never the fallback.
+  const keyProfile = options?.keyProfile
+  let keyKind: KeyKind | null = null
+  if (keyProfile) {
+    const preflight = laneBClaudePreflight({
+      profile: keyProfile,
+      dispatch: !!options?.dispatch,
+      cwd: resolveProviderWorkDir({ scriptsDir: COS_SCRIPTS_DIR }),
+    })
+    if (!preflight.ok) {
+      await callbacks.onError(preflight.message)
+      return sid
+    }
+    keyKind = preflight.keyKind
+  }
+  const keyLane: AnswerKeyFields | null = keyProfile && keyKind
+    ? { lane: 'key', credential: { kind: keyKind, ref: keyProfile.keyRef, profileId: keyProfile.id } }
+    : null
   const history = getHistory(sid)
   const session = getSessionRaw(sid)
   const contextBreaks = session?.contextBreaks ?? []
@@ -439,14 +494,16 @@ export async function callClaudeStreaming(
 
   // Resolve model: per-message > session preference > public-server default.
   const sessionModel = getSessionModel(sid)
-  const resolvedModel: ClaudeModelPreference = model
-    ?? (sessionModel && isClaudeModel(sessionModel) ? sessionModel : DEFAULT_MODEL)
+  const resolvedModel: ClaudeModelPreference = keyProfile ? keyProfile.timeoutTier : (model
+    ?? (sessionModel && isClaudeModel(sessionModel) ? sessionModel : DEFAULT_MODEL))
   const resolvedEffort = options?.effort
   const cliEffortFlag = resolvedEffort ? resolveCliEffortFlag(resolvedEffort) : getClaudeEffortLevel()
 
   // Notify client immediately — model is known before any async work
   // Pass existing CLI session ID if resuming (new sessions get it after first result)
-  const resolvedCliKey = cliSessionKey(sid, resolvedModel)
+  const resolvedCliKey = keyProfile ? keyedCliSessionKey(sid, resolvedModel, keyProfile.id) : cliSessionKey(sid, resolvedModel)
+  // A keyed exchange is stamped with its profile (P6 persists it by syntax), never with the tier.
+  const exchangeModel = keyProfile ? profilePreference(keyProfile.id) as unknown as ModelPreference : resolvedModel
   let existingCliSession = options?.dispatch ? undefined : cliSessionMap.get(resolvedCliKey)
   // 6.58.2: decided before the pre-warmed session below stands in: a COS session that has no
   // Claude session of its own yet starts one here, and only that one may be named.
@@ -454,6 +511,7 @@ export async function callClaudeStreaming(
   callbacks.onStart?.(resolvedModel, sid, existingCliSession, {
     clientJobId: options?.clientJobId,
     generation: options?.generation,
+    ...(keyLane ? { keyLane } : {}),
   })
 
   // Phase: context loading (skipped in lightweight mode)
@@ -531,7 +589,7 @@ export async function callClaudeStreaming(
     globalMsgNum,
     inboundAttachments,
     exchangeProvenance,
-    resolvedModel,
+    exchangeModel,
   )
 
   // Vision queries need the Read tool to see the image files
@@ -559,7 +617,8 @@ export async function callClaudeStreaming(
   // 6.58.2: nor does a named New session (COS Control Work). The warmed session opens with the
   // boot prompt "ready" under the glasses prompt; a session someone will open in the Claude app
   // under its task's name starts clean.
-  if (!options?.dispatch && !options?.sessionName && !existingCliSession && preWarmedCliSessionId && resolvedModel === DEFAULT_MODEL) {
+  // Key lanes: a keyed turn never takes the warmed subscription session.
+  if (!options?.dispatch && !options?.sessionName && !existingCliSession && preWarmedCliSessionId && resolvedModel === DEFAULT_MODEL && !keyProfile) {
     // Only the default model consumes the pre-warmed session.
     // Hey Even (Haiku) cold-starts its own session to avoid model contamination.
     existingCliSession = preWarmedCliSessionId
@@ -582,6 +641,8 @@ export async function callClaudeStreaming(
     '--system-prompt', systemPrompt,
     ...(options?.dispatch ? [] : mcpConfigArgs),
   ]
+  // Key lanes (plan 7.1): a keyed turn names the profile slug on --model (never ANTHROPIC_MODEL, no [1m]).
+  if (keyProfile) args[2] = keyProfile.model
 
   // Full and lightweight paths share the same explicit MCP selector contract.
   if (options?.dispatch) {
@@ -599,6 +660,9 @@ export async function callClaudeStreaming(
   } else {
     args.push(...claudePermissionArgs(getClaudeTrustMode(), tools), '--include-partial-messages')
   }
+  // QA B1: deny the key secrets dir while lanes are on and a key is saved ([] otherwise). A keyed
+  // turn's layer also forces agent teams off over any settings file (canary R12).
+  args.push(...claudeKeySecretsGuardArgs(keyProfile ? { laneB: true } : {}))
 
   if (existingCliSession) {
     // Resume prior CLI session — reuses cached context, avoids cold start
@@ -625,6 +689,33 @@ export async function callClaudeStreaming(
     ? Math.max(defaultWallMax, WALL_MAX_DEEP_EFFORT_MS)
     : defaultWallMax
   const wallMax = isExtendedQuery(query) ? Math.max(WALL_MAX_EXTENDED_MS, effortWallMax) : effortWallMax
+  // Key lanes: one nonce per turn from the relay (P2 contract), then the child env points at it.
+  // Only the child's copy is written. A relay that cannot issue ends the turn before spawn.
+  let keyTurn: RelayTurnHandle | null = null
+  const keyTurnId = keyProfile ? options?.turnId ?? randomUUID() : null
+  if (keyProfile) {
+    try {
+      const relay = await laneBRelay()
+      keyTurn = await relay.issueTurn({
+        keyRef: keyProfile.keyRef,
+        profileId: keyProfile.id,
+        turnId: keyTurnId!,
+        sessionId: sid,
+        engine: 'claude',
+        allowedModel: keyProfile.model,
+      }, { wallMaxMs: wallMax })
+      applyLaneBClaudeEnv(env, { origin: keyTurn.origin, nonce: keyTurn.nonce, slug: keyProfile.model, profileId: keyProfile.id })
+    } catch (err) {
+      keyTurn?.revoke('cancel')
+      outputImagePublisher?.cleanup()
+      cleanupModelImageInputs(imageInputs)
+      removeExchange(sid, pendingUserExchange)
+      console.error(`[claude-bridge] key relay refused the turn: ${err instanceof Error ? err.message.slice(0, 200) : 'unknown'}`)
+      await callbacks.onError(LANE_B_COPY.relayUnavailable)
+      return sid
+    }
+  }
+  const keyAuditFields = keyProfile && keyKind ? { profile: keyProfile.id, lane: 'key' as const, credentialKind: keyKind } : {}
   const startTime = Date.now()
   // 6.78.0 steer (P7 S7): the wall clock's start on the monotonic steer clock, next to the
   // wall timer it describes, so the coordinator's cut-off reads the same clock after a sleep.
@@ -639,7 +730,7 @@ export async function callClaudeStreaming(
     wallMaxMs: wallMax,
     query: fullQuery,
     effortLevel: resolvedEffort ?? getClaudeEffortLevel(),
-    cliModelId: resolveClaudeCliModelId(resolvedModel),
+    cliModelId: keyProfile ? keyProfile.model : resolveClaudeCliModelId(resolvedModel),
   })
 
   // Ultracode is a CLI-only orchestration keyword; history/chat keeps the
@@ -699,6 +790,7 @@ export async function callClaudeStreaming(
    * CLI session mapping is dropped so the next Ask starts a fresh session.
    */
   function abandonUncoveredSteers() {
+    keyTurn?.revoke('steer_abort')
     steerStdinEnded = true
     steerPort!.close()
     if (cliSessionMap.delete(resolvedCliKey)) scheduleCliSessionSave()
@@ -791,7 +883,7 @@ export async function callClaudeStreaming(
       globalMsgNum,
       undefined,
       exchangeProvenance,
-      resolvedModel,
+      exchangeModel,
     )
     if (imagePaths.length > 0) {
       replaceLastExchangeWithSummary(sid, query, text, imagePaths.length)
@@ -827,6 +919,8 @@ export async function callClaudeStreaming(
     // Token audit — log every completed claude -p call
     const totalMs = Date.now() - startTime
     const inputEstimate = systemPrompt.length + fullQuery.length + contextPrompt.length
+    // Key lanes (P11): this turn's settled spend on the key. Keyed turns only.
+    const keyUsdFields = keyTurnId ? { usd: Math.round(getSharedKeyMeter().turnSettledUsd(keyTurnId) * 1e6) / 1e6 } : {}
     logTokenAudit({
       source: options?.lightweight ? 'g2-voice' : 'g2-query',
       model: resolvedModel,
@@ -834,6 +928,8 @@ export async function callClaudeStreaming(
       outputChars: text.length,
       durationMs: totalMs,
       caller: options?.lightweight ? 'voice_query' : 'full_query',
+      ...keyAuditFields,
+      ...keyUsdFields,
     })
 
     finishClaudeRun(run.runId, {
@@ -849,6 +945,7 @@ export async function callClaudeStreaming(
       generation: options?.generation,
       ...(outputAttachments.length > 0 ? { outputAttachments } : {}),
       ...(outputImageStats && outputImageStats.published > 0 ? { outputImageStats } : {}),
+      ...(keyLane ? { keyLane, ...keyUsdFields } : {}),
     })
     if (terminalOwned === false) return
 
@@ -901,6 +998,7 @@ export async function callClaudeStreaming(
   }
 
   function handleAbort() {
+    keyTurn?.revoke('cancel')
     void terminateForTerminal('client disconnect', result => finalizeError(
         'claude-bridge: client disconnected before Claude completed.',
         result.code,
@@ -1022,6 +1120,9 @@ export async function callClaudeStreaming(
         // recorded as before, so the finished job names the session the result names.
         if (!nativeSessionAnnounced && !options?.dispatch && typeof event.session_id === 'string' && event.session_id) {
           nativeSessionAnnounced = true
+          // Key lanes (plan 7.3): recorded before any answer text, so Continue, Fork, attach and
+          // handoff refuse this transcript from the moment it exists.
+          if (keyProfile) recordKeyedSession({ id: event.session_id, engine: 'claude', profileId: keyProfile.id, cosSessionId: sid })
           updateClaudeRun(run.runId, { cliSessionId: event.session_id })
           callbacks.onNativeSession?.({ cliSessionId: event.session_id })
         }
@@ -1112,6 +1213,7 @@ export async function callClaudeStreaming(
           }
           // Capture CLI session ID for future --resume (avoids cold start on next query)
           if (event.session_id && !options?.dispatch) {
+            if (keyProfile) recordKeyedSession({ id: event.session_id, engine: 'claude', profileId: keyProfile.id, cosSessionId: sid })
             cliSessionMap.set(resolvedCliKey, event.session_id)
             scheduleCliSessionSave()
             updateClaudeRun(run.runId, { cliSessionId: event.session_id })
@@ -1160,6 +1262,7 @@ export async function callClaudeStreaming(
 
   proc.on('close', (code) => {
     childClosed = true
+    keyTurn?.childClosed()
     if (steerReaper) clearTimeout(steerReaper)
     steerPort?.close()
     if (terminationRequested) return
@@ -1196,6 +1299,7 @@ export async function callClaudeStreaming(
   })
 
   proc.on('error', (err) => {
+    keyTurn?.revoke('child_close')
     if (terminationRequested) return
     finalizeError(`claude-bridge: ${err.message}`, null)
   })