@gotcos/glasses-server 6.81.0 → 6.83.0

package/server/lib/work-orchestrator/discovery.ts

@@ -0,0 +1,99 @@
+/**
+ * 6.83.0 (M1, canary C3): which sessions belong to a Work card, from COS Control's snapshot and the tag index.
+ * Pure: no I/O. The rules and their ranks are in docs/work-orchestrator.md.
+ */
+import type { ControlSnapshot } from './snapshot.js'
+import type { TagHit } from './tag-index.js'
+import { tagForWorkID, tagsIn } from './tags.js'
+
+/** Evidence kinds, strongest first. The first five make a session the card's; status and listed confirm one. */
+export const EVIDENCE_RANK = ['link', 'created', 'forked', 'continued', 'prompt', 'status', 'listed', 'meeting'] as const
+export type Evidence = typeof EVIDENCE_RANK[number]
+const MEMBER: ReadonlySet<Evidence> = new Set(['link', 'created', 'forked', 'continued', 'prompt'])
+const CONFIRMS: ReadonlySet<Evidence> = new Set(['status', 'listed'])
+
+export interface CardSession {
+  id: string
+  /** Evidence kinds for this card, in rank order. */
+  discoveredBy: Evidence[]
+  /** True: one of ranks 1 to 5 holds. False: a suggestion (status or listed alone, or the source-meeting join). */
+  member: boolean
+  linked: boolean
+  /** Newest evidence for this card (ms). */
+  lastTouchedCard: number | null
+  /** Set when the session's newest strong evidence is on another card: it works there now, and keeps this one as history. */
+  onAnotherCard: boolean
+}
+
+interface Ev { kind: Evidence; at: number | null }
+
+/**
+ * Strong evidence per card tag and session, from Control's records and the logs.
+ * A placeholder or never-used tag (canary precision fix 7: `aaaaaaaaaaaa`, `0123456789ab`) is inert by construction: only
+ * the requested card's own tag is read for this card, and only member evidence (a Control record or a real handoff
+ * prompt) can make another card the newer owner, so a status line with an unknown tag never changes a row.
+ */
+function strongByTag(snapshot: ControlSnapshot | null, hits: TagHit[]): Map<string, Map<string, Ev[]>> {
+  const out = new Map<string, Map<string, Ev[]>>()
+  const add = (tag: string, sid: string | null, kind: Evidence, at: number | null) => {
+    if (!sid) return
+    let card = out.get(tag); if (!card) out.set(tag, card = new Map())
+    let list = card.get(sid); if (!list) card.set(sid, list = [])
+    list.push({ kind, at })
+  }
+  for (const l of snapshot?.links ?? []) add(tagForWorkID(l.workID), l.sessionID, 'link', l.at * 1000)
+  for (const r of snapshot?.receipts ?? []) {
+    const tag = tagForWorkID(r.workID), at = r.createdAt * 1000
+    if (r.mode === 'newSession') add(tag, r.sessionID, 'created', at)
+    else if (r.mode === 'fork') {
+      // A fork's child: journaled by Control 0.5.333, or a sessionID that is not the source (canary precision fix 1).
+      const child = r.forkChildID ?? (r.sessionID && r.sessionID !== r.sourceSessionID ? r.sessionID : null)
+      add(tag, child, 'forked', at)
+    } else add(tag, r.sessionID ?? r.sourceSessionID, 'continued', at)
+    // A sourceSessionID is where a fork or new session came FROM, never membership (precision fix 2).
+  }
+  for (const h of hits) {
+    if (h.kind === 'prompt') add(h.tag, h.sid, 'prompt', h.at)
+    else if (h.kind === 'status') add(h.tag, h.sid, 'status', h.at)
+  }
+  for (const row of snapshot?.live?.rows ?? []) {
+    for (const tag of tagsIn(row.summary)) add(tag, row.id, 'listed', row.updatedAt ? Date.parse(row.updatedAt) || null : null)
+  }
+  return out
+}
+
+const newest = (list: Ev[], kinds?: ReadonlySet<Evidence>) => list.filter(e => !kinds || kinds.has(e.kind)).reduce<number | null>((m, e) => (e.at !== null && (m === null || e.at > m) ? e.at : m), null)
+
+/**
+ * The card's sessions. `meetingWorkIDs`: the card's confirmed source meetings as meeting cards (`meeting:<recordId>`);
+ * a session that is a member of one of them is suggested here with the reason (rule 8).
+ */
+export function discoverCardSessions(workID: string, snapshot: ControlSnapshot | null, hits: TagHit[], meetingWorkIDs: string[] = []): CardSession[] {
+  const byTag = strongByTag(snapshot, hits)
+  const tag = tagForWorkID(workID)
+  const mine = new Map<string, Ev[]>(byTag.get(tag) ?? [])
+  for (const m of meetingWorkIDs) {
+    for (const [sid, list] of byTag.get(tagForWorkID(m)) ?? []) {
+      if (!list.some(e => MEMBER.has(e.kind))) continue
+      const at = newest(list, MEMBER)
+      mine.set(sid, [...(mine.get(sid) ?? []), { kind: 'meeting', at }])
+    }
+  }
+  const out: CardSession[] = []
+  for (const [sid, list] of mine) {
+    const kinds = EVIDENCE_RANK.filter(k => list.some(e => e.kind === k))
+    const member = kinds.some(k => MEMBER.has(k))
+    if (!member && !kinds.some(k => CONFIRMS.has(k) || k === 'meeting')) continue
+    // Newest strong evidence decides "working on" (precision fix 5): another card with newer member evidence wins.
+    const here = newest(list, MEMBER) ?? newest(list)
+    let elsewhere: number | null = null
+    for (const [otherTag, sessions] of byTag) {
+      if (otherTag === tag || meetingWorkIDs.some(m => tagForWorkID(m) === otherTag)) continue
+      const t = newest(sessions.get(sid) ?? [], MEMBER)
+      if (t !== null && (elsewhere === null || t > elsewhere)) elsewhere = t
+    }
+    out.push({ id: sid, discoveredBy: kinds, member, linked: kinds.includes('link'), lastTouchedCard: newest(list),
+      onAnotherCard: elsewhere !== null && here !== null && elsewhere > here })
+  }
+  return out
+}

package/server/lib/work-orchestrator/input.ts

@@ -0,0 +1,109 @@
+/**
+ * 6.83.0: the orchestrator input for one Work card. Joins discovery, the live session list Control just read, the
+ * pick-up notes and the usage snapshot into the rows the planner sees, ranked and bounded, with what was left out and
+ * why. It sends nothing and changes nothing.
+ */
+import type { ControlSnapshot, SnapshotLiveRow } from './snapshot.js'
+import { discoverCardSessions, type CardSession, type Evidence } from './discovery.js'
+import { pickupNote, PICKUP_MAX_CHARS } from './pickup.js'
+import type { UsageProvider, UsageView } from './usage.js'
+import type { LogProvider } from './session-log.js'
+
+export const ORCHESTRATOR_MAX_ROWS = 12
+export const ORCHESTRATOR_MAX_LEFT_OUT = 12
+/** The live list Control sends is "just read" for this long; older, rows read as not in the session list. */
+export const LIVE_FRESH_MS = 3 * 60_000
+
+export const UNAVAILABLE_REASONS = ['not_in_session_list', 'app_owned', 'cursor', 'plan_limit', 'on_another_card'] as const
+export type UnavailableReason = typeof UNAVAILABLE_REASONS[number]
+
+export interface OrchestratorRow {
+  id: string; title: string; summary: string; status: string
+  discoveredBy: Evidence[]; linked: boolean; member: boolean
+  lastTouchedCard: string | null; lastActivity: string | null
+  live: boolean; busy: boolean; pickup: string
+  available: boolean; reason?: UnavailableReason
+  /** A fork can start from it: Claude or Codex, its log is on this Mac, and that provider has plan usage left. */
+  forkable: boolean
+}
+export interface LeftOut { id: string; title: string; reason: string }
+export interface OrchestratorInput {
+  protocolVersion: 1; workID: string; now: string
+  rows: OrchestratorRow[]; leftOut: LeftOut[]; usage: UsageView[]
+  snapshotAgeSec: number | null; liveListAgeSec: number | null; logScanComplete: boolean
+  discovered: number
+}
+
+export interface InputDeps {
+  snapshot: ControlSnapshot | null
+  hits: import('./tag-index.js').TagHit[]
+  usage: UsageView[]
+  /** Log path for a session, or null when this Mac has none. */
+  pathOf: (sid: string) => Promise<string | null>
+  /** Last-modified time of a log, for sessions outside the live list. */
+  mtimeOf?: (path: string) => Promise<number | null>
+  skipped?: Set<string>
+  logScanComplete?: boolean
+  now?: number
+  home?: string
+}
+
+const iso = (ms: number | null | undefined) => (ms ? new Date(ms).toISOString() : null)
+
+export async function buildOrchestratorInput(workID: string, meetingWorkIDs: string[], deps: InputDeps): Promise<OrchestratorInput> {
+  const now = deps.now ?? Date.now()
+  const snapshot = deps.snapshot
+  const liveFresh = !!snapshot?.live && now - snapshot.live.checkedAt * 1000 <= LIVE_FRESH_MS
+  const live = new Map<string, SnapshotLiveRow>((liveFresh ? snapshot!.live!.rows : []).map(r => [r.id, r]))
+  const usageBy = new Map<UsageProvider, UsageView>(deps.usage.map(u => [u.provider, u]))
+  const found = discoverCardSessions(workID, snapshot, deps.hits, meetingWorkIDs)
+  const leftOut: LeftOut[] = []
+  const candidates: Array<{ s: CardSession; row: SnapshotLiveRow | undefined }> = []
+  for (const s of found) {
+    if (deps.skipped?.has(s.id)) { leftOut.push({ id: s.id, title: '', reason: 'codex child thread (guardian or subagent)' }); continue }
+    candidates.push({ s, row: live.get(s.id) })
+  }
+  // Members before suggestions; in the live list before not; the session that touched this card most recently first.
+  candidates.sort((a, b) => Number(b.s.member) - Number(a.s.member) || Number(!!b.row) - Number(!!a.row)
+    || Number(!b.s.onAnotherCard) - Number(!a.s.onAnotherCard) || (b.s.lastTouchedCard ?? 0) - (a.s.lastTouchedCard ?? 0) || a.s.id.localeCompare(b.s.id))
+  const kept = candidates.slice(0, ORCHESTRATOR_MAX_ROWS)
+  for (const c of candidates.slice(ORCHESTRATOR_MAX_ROWS)) leftOut.push({ id: c.s.id, title: c.row?.title ?? '', reason: 'more than 12 sessions on this card' })
+  const rows: OrchestratorRow[] = []
+  for (const { s, row } of kept) {
+    const provider = s.id.split(':')[0] as LogProvider
+    const path = await deps.pathOf(s.id).catch(() => null)
+    let pickup = 'No log for this session on this Mac.'
+    let lastActivity: string | null = row?.updatedAt ?? null
+    if (path) {
+      try {
+        const note = await pickupNote(path, provider, s.id.split(':')[1]!, row ? { busy: row.busy, waitingOnUser: row.waitingOnUser } : undefined, deps.home)
+        pickup = note.note.slice(0, PICKUP_MAX_CHARS)
+        lastActivity = lastActivity ?? note.lastActivity
+      } catch { pickup = 'The log could not be read.' }
+      if (!lastActivity && deps.mtimeOf) lastActivity = iso(await deps.mtimeOf(path).catch(() => null))
+    }
+    const usage = provider === 'cursor' ? undefined : usageBy.get(provider)
+    const exhausted = usage?.state === 'exhausted'
+    let reason: UnavailableReason | undefined
+    if (provider === 'cursor') reason = 'cursor'
+    else if (s.onAnotherCard) reason = 'on_another_card'
+    else if (exhausted) reason = 'plan_limit'
+    else if (!row) reason = 'not_in_session_list'
+    else if (row.appOwned) reason = 'app_owned'
+    rows.push({
+      id: s.id, title: (row?.title || '').slice(0, 300) || s.id.slice(0, 15), summary: (row?.summary ?? '').slice(0, 2000),
+      status: (row ? row.status || 'idle' : 'not in the session list').slice(0, 100),
+      discoveredBy: s.discoveredBy, linked: s.linked, member: s.member,
+      lastTouchedCard: iso(s.lastTouchedCard), lastActivity,
+      live: !!row, busy: !!row?.busy, pickup,
+      available: !reason, ...(reason ? { reason } : {}),
+      forkable: (provider === 'claude' || provider === 'codex') && !!path && !exhausted,
+    })
+  }
+  return {
+    protocolVersion: 1, workID, now: new Date(now).toISOString(), rows, leftOut: leftOut.slice(0, ORCHESTRATOR_MAX_LEFT_OUT), usage: deps.usage,
+    snapshotAgeSec: snapshot ? Math.round(now / 1000 - snapshot.receivedAt) : null,
+    liveListAgeSec: snapshot?.live ? Math.round(now / 1000 - snapshot.live.checkedAt) : null,
+    logScanComplete: deps.logScanComplete ?? true, discovered: found.length,
+  }
+}

package/server/lib/work-orchestrator/pickup.ts

@@ -0,0 +1,85 @@
+/**
+ * 6.83.0 (M2 planner input, canary C2): a bounded, deterministic "where it stopped, what is next" note from the tail of
+ * a session's log. No model call. The note goes only into the planner input; it is redacted (secrets and customer
+ * identifiers) before it leaves this module, and never longer than PICKUP_MAX_CHARS.
+ */
+import { readTail, turnsFrom, type LogProvider, type Turn } from './session-log.js'
+import { redactNote } from './redact.js'
+import { statusLines } from './tags.js'
+
+export const PICKUP_MAX_CHARS = 1500
+
+/** User turns the harness writes, not the person: task notifications, compaction summaries, interrupts. */
+const HARNESS = ['Perform any necessary follow-up actions', 'Briefly inform the user about the task result', '<task-notification>',
+  'This session is being continued from a previous conversation', '[Request interrupted', 'The following is the Codex agent history']
+
+export interface LiveOverlay { busy?: boolean; waitingOnUser?: boolean }
+
+const clip = (s: string, n: number) => {
+  const t = (s || '').replace(/\s+/g, ' ').trim()
+  return t.length <= n ? t : t.slice(0, n - 1).trimEnd() + '…'
+}
+
+export function pendingTodos(turns: Turn[]): string[] {
+  for (let i = turns.length - 1; i >= 0; i--) {
+    const t = turns[i]!
+    if (t.role !== 'todo') continue
+    let items: unknown
+    try { items = JSON.parse(t.text) } catch { items = undefined }
+    if (typeof items === 'string') { try { items = JSON.parse(items) } catch { items = undefined } }
+    if (items && typeof items === 'object' && !Array.isArray(items)) items = (items as any).plan ?? (items as any).todos
+    if (!Array.isArray(items)) return []
+    return items.filter(it => it && typeof it === 'object' && !['completed', 'done'].includes(String((it as any).status ?? '').toLowerCase()))
+      .map(it => `${String((it as any).status || 'open')}: ${String((it as any).content ?? (it as any).step ?? (it as any).activeForm ?? '')}`)
+  }
+  return []
+}
+
+export function questionsIn(text: string): string[] {
+  const out: string[] = []
+  for (const piece of text.split(/(?<=[.?!])\s+|\n/)) {
+    const l = piece.trim().replace(/^[-*#> ]+/, '').replace(/[-*#> ]+$/, '')
+    if (l.endsWith('?') && l.length > 12 && l.length < 300 && !/^(https?:|what i |why )/i.test(l)) out.push(l)
+  }
+  return out.slice(-4)
+}
+
+export interface PickupNote { note: string; lastActivity: string | null; state: 'running' | 'mid_turn' | 'after_tools' | 'finished' | 'empty' }
+
+/** The note from turns already read. `mtimeMs` stands in for Cursor's missing timestamps. */
+export function pickupFromTurns(turns: Turn[], options: { live?: LiveOverlay; mtimeMs?: number; home?: string } = {}): PickupNote {
+  const r = (s: string) => redactNote(s, options.home)
+  const human = turns.filter(t => t.role === 'user' && t.text.trim() && !/^\s*[<{]/.test(t.text) && !HARNESS.some(h => t.text.trimStart().startsWith(h)))
+  const replies = turns.filter(t => t.role === 'assistant' && t.text.trim())
+  if (!human.length && !replies.length) return { note: 'No readable turns in the log tail.', lastActivity: null, state: 'empty' }
+  const lastUser = human[human.length - 1]
+  const lastReply = replies[replies.length - 1]
+  const iUser = turns.lastIndexOf(lastUser!), iReply = turns.lastIndexOf(lastReply!)
+  const toolsAfter = iReply >= 0 ? turns.slice(iReply + 1).filter(t => t.role === 'tool').length : 0
+  let state: PickupNote['state'] = iUser > iReply ? 'mid_turn' : toolsAfter ? 'after_tools' : 'finished'
+  let stateLine = state === 'mid_turn' ? 'Stopped mid-turn: the last ask has no reply yet.'
+    : state === 'after_tools' ? `Stopped after ${toolsAfter} tool call(s) with no closing reply.` : 'Stopped after a reply (turn finished).'
+  if (options.live?.busy) { state = 'running'; stateLine = 'Still running: a turn is in flight now, so this is a moving snapshot.' }
+  else if (options.live?.waitingOnUser) stateLine += ' The session list says it is waiting on the user.'
+  const stamp = lastReply?.at ?? lastUser?.at ?? null
+  const lastActivity = stamp ?? (options.mtimeMs ? new Date(options.mtimeMs).toISOString() : null)
+  const when = stamp ? `${stamp.slice(0, 16).replace('T', ' ')} UTC` : options.mtimeMs ? `${new Date(options.mtimeMs).toISOString().slice(0, 16).replace('T', ' ')} UTC (file time)` : 'unknown'
+  const parts = [`State: ${stateLine} Last activity ${when}.`]
+  parts.push('Last ask: ' + clip(r(lastUser?.text ?? ''), 300))
+  parts.push('Last result: ' + clip(r(lastReply?.text ?? ''), 520))
+  const status = lastReply ? statusLines(lastReply.text)[0] : undefined
+  if (status) parts.push('Status line: ' + clip(r(`${status.status}: ${status.evidence}`), 160))
+  const todos = pendingTodos(turns)
+  if (todos.length) parts.push('Open todos: ' + clip(r(todos.join('; ')), 220))
+  const qs = lastReply ? questionsIn(lastReply.text) : []
+  parts.push('Open questions: ' + (qs.length ? clip(r(qs.join(' | ')), 260) : 'none found in the last reply.'))
+  let note = parts.join('\n')
+  if (note.length > PICKUP_MAX_CHARS) note = note.slice(0, PICKUP_MAX_CHARS - 1) + '…'
+  return { note, lastActivity, state }
+}
+
+export async function pickupNote(path: string, provider: LogProvider, sessionID: string, live?: LiveOverlay, home?: string): Promise<PickupNote> {
+  const tail = await readTail(path)
+  const turns = turnsFrom(tail.text, provider, provider === 'claude' ? sessionID : undefined)
+  return pickupFromTurns(turns, { live, mtimeMs: tail.mtimeMs, home })
+}

package/server/lib/work-orchestrator/plan-log.ts

@@ -0,0 +1,38 @@
+/**
+ * 6.83.0: every Work chat plan, from any client, leaves one JSONL row and one server log line: the sessions sent with
+ * their availability, what was left out and why, the usage snapshot's age per provider, the assignments (mode and
+ * target, never prompt text), the planner, the outcome and the time taken. Bounded: past 2 MB the file keeps its newest
+ * half. Ids and enums only; no question, prompt, summary or pick-up text is written.
+ */
+import { appendFileSync, mkdirSync, readFileSync, statSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { atomicWriteFileSync } from '../atomic-fs.js'
+
+export const PLAN_LOG_MAX_BYTES = 2 * 1024 * 1024
+
+export interface PlanLogRow {
+  at: string; workID: string; mode: string; planner: string; effort: string; orchestrator: boolean
+  sessions: Array<{ id: string; automatic: boolean; available?: boolean; reason?: string; discoveredBy?: string[] }>
+  leftOut: Array<{ id: string; reason: string }>
+  usageAgeSec: Record<string, number | null>
+  usageState: Record<string, string>
+  assignments: Array<{ mode: string; target: string }>
+  outcome: 'planned' | 'invalid_answer' | 'unavailable' | 'aborted'
+  ms: number
+}
+
+export function appendPlanLog(path: string, row: PlanLogRow): void {
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 })
+    let size = 0
+    try { size = statSync(path).size } catch { /* new file */ }
+    if (size > PLAN_LOG_MAX_BYTES) {
+      const lines = readFileSync(path, 'utf8').split('\n').filter(Boolean)
+      atomicWriteFileSync(path, lines.slice(Math.floor(lines.length / 2)).join('\n') + '\n')
+    }
+    appendFileSync(path, JSON.stringify(row) + '\n', { mode: 0o600 })
+  } catch (e) { console.warn(`[work-orchestrator] plan log not written: ${(e as Error).message}`) }
+  const sent = row.sessions.map(s => `${s.id.slice(0, 15)}${s.automatic ? '' : '(no-continue)'}${s.reason ? `[${s.reason}]` : ''}`).join(',') || 'none'
+  const usage = Object.entries(row.usageState).map(([p, s]) => `${p}=${s}/${row.usageAgeSec[p] ?? '-'}s`).join(' ') || 'none'
+  console.log(`[work-orchestrator] plan work=${row.workID} outcome=${row.outcome} planner=${row.planner}/${row.effort} orchestrator=${row.orchestrator} sessions=${sent} leftOut=${row.leftOut.length} usage=${usage} assignments=${row.assignments.map(a => `${a.mode}:${a.target.slice(0, 15)}`).join(',') || 'none'} ms=${row.ms}`)
+}

package/server/lib/work-orchestrator/redact.ts

@@ -0,0 +1,41 @@
+/**
+ * 6.83.0: what a pick-up note may carry. Session logs hold secrets and customer identifiers; a note goes to the planner
+ * (and from there into a prompt), so both are removed here, before the note leaves the orchestrator.
+ *
+ * Secrets: the server's shared `redactSecrets` patterns, plus `name=value` secrets and credential file paths (canary C2).
+ * Customer identifiers (canary C2, N1 named a merchant's proposal slug with its fees): email addresses, phone numbers,
+ * the path and query of any URL (the host stays, so "bottlepos.com" still says where), money amounts, and long numeric
+ * ids (order, account, ticket and HubSpot ids). The replacements say what was there, never what it was.
+ */
+import { homedir } from 'node:os'
+import { redactSecrets } from '../lens-gist-engines.js'
+
+const escape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+function homeRes(home: string): Array<[RegExp, string]> {
+  const h = `(?:~|${escape(home)})`
+  return [
+    [new RegExp(`${h}/\\.(?:codex/auth\\.json|ssh/[\\w.\\-]+|aws/credentials|npmrc|netrc|config/gh/hosts\\.yml)`, 'g'), '[credential path]'],
+    [new RegExp(`${h}/\\.cos-glasses/[\\w.\\-/]*(?:token|key|secret)[\\w.\\-]*`, 'gi'), '[credential path]'],
+    // A path to an env file, or a bare `.env` token. `process.env` is code, not a file, and stays.
+    [new RegExp(`(?<![\\w])${h}?(?:/[\\w\\-.]+)*/\\.env(?:\\.[\\w-]+)?\\b|(?<![\\w.])\\.env(?:\\.[\\w-]+)?\\b`, 'g'), '[env file]'],
+  ]
+}
+
+const SECRET_ASSIGN = /\b(token|api[_-]?key|secret|password|passwd|x-cos-token|client[_-]?secret)\b(["']?\s*[:=]\s*["']?)[A-Za-z0-9_\-./+=]{12,}/gi
+const CUSTOMER: Array<[RegExp, string]> = [
+  [/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, '[email]'],
+  // A URL keeps its scheme and host; its path, query and fragment can name a customer (slugs, ids, proposals).
+  [/\b(https?:\/\/[A-Za-z0-9.-]+(?::\d+)?)(?:[/?#][^\s)\]"'<>]*)/g, '$1/[path]'],
+  [/(?<![\w.])(?:\+?1[\s.-]?)?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}(?!\d)/g, '[phone]'],
+  [/(?:[$£€]\s?\d[\d,]*(?:\.\d+)?(?:\s?(?:k|m|million|thousand))?|\b\d[\d,]*(?:\.\d+)?\s?(?:USD|dollars)\b)/gi, '[amount]'],
+  [/\b\d{6,}\b/g, '[id]'],
+]
+
+export function redactNote(text: string, home = homedir()): string {
+  let out = redactSecrets(text)
+  out = out.replace(SECRET_ASSIGN, '$1=[secret]')
+  for (const [re, to] of homeRes(home)) out = out.replace(re, to)
+  for (const [re, to] of CUSTOMER) out = out.replace(re, to)
+  return home.length > 1 ? out.split(home).join('~') : out
+}

package/server/lib/work-orchestrator/runtime.ts

@@ -0,0 +1,74 @@
+/**
+ * 6.83.0: the orchestrator's process-wide state, created on first use (importing this module starts nothing).
+ * Files live under `data/work-orchestrator/`.
+ */
+import { stat } from 'node:fs/promises'
+import { dataPath } from '../data-dir.js'
+import { agentSessionRoots, findAgentSessionFile, type AgentProvider } from '../agent-session-store.js'
+import { setUsageEventSink } from './usage-events.js'
+import { SnapshotStore, type ControlSnapshot } from './snapshot.js'
+import { TagIndex } from './tag-index.js'
+import { UsageMonitor, type UsageProvider } from './usage.js'
+import { buildOrchestratorInput, type OrchestratorInput } from './input.js'
+
+let snapshots: SnapshotStore | null = null
+let index: TagIndex | null = null
+let usage: UsageMonitor | null = null
+
+export function orchestratorSnapshots(): SnapshotStore { return snapshots ??= new SnapshotStore(dataPath('work-orchestrator', 'control-snapshot.json')) }
+export function orchestratorTagIndex(): TagIndex { return index ??= new TagIndex({ roots: agentSessionRoots(), path: dataPath('work-orchestrator', 'tag-index.json') }) }
+export function orchestratorUsage(): UsageMonitor {
+  if (!usage) {
+    // Inside a test the real probes are never reachable: any test that reads usage through this monitor gets an
+    // error reading, never a spawned claude or codex CLI (the boot guard below covers the poll; this covers on demand).
+    const inTest = !!(process.env.VITEST || process.env.NODE_ENV === 'test')
+    const noProbe = async (): Promise<never> => { throw new Error('not probed inside a test') }
+    const monitor = usage = new UsageMonitor({ path: dataPath('work-orchestrator', 'usage.json'), ...(inTest ? { probes: { claude: noProbe, codex: noProbe } } : {}) })
+    // Jobs report limits and rate-limit frames through the leaf module; this monitor is where they land.
+    setUsageEventSink({ limit: (p, message, source) => monitor.noteLimit(p as UsageProvider, message, source), claudeFrame: frame => monitor.noteClaudeRateLimitEvent(frame) })
+  }
+  return usage
+}
+export const PLAN_LOG_PATH = () => dataPath('work-orchestrator', 'plans.jsonl')
+
+/**
+ * Called once by the server at boot: registers the usage-event sink and schedules a first log scan. Usage is read on
+ * demand (a plan input or GET /usage); the 10-minute background poll starts only with `COS_WORK_USAGE_POLL=1`.
+ */
+export function startWorkOrchestrator(env: NodeJS.ProcessEnv = process.env): void {
+  // A test that boots the server must never spawn the real claude or codex CLI, nor scan this Mac's session logs.
+  orchestratorUsage() // registers the usage-event sink, so job limits and rate-limit frames are kept from boot
+  if (env.VITEST || env.NODE_ENV === 'test') return
+  orchestratorUsage().start(env) // opt-in only: a no-op unless COS_WORK_USAGE_POLL=1
+  setTimeout(() => { void orchestratorTagIndex().refresh().catch(() => {}) }, 45_000).unref?.()
+}
+
+/** How long a plan waits for the log scan before it answers with what the index already holds. */
+export const INPUT_SCAN_WAIT_MS = 20_000
+
+/** What one plan input reads. The server passes the process-wide stores; a test passes its own. */
+export interface OrchestratorParts { tags: TagIndex; usage: UsageMonitor; snapshot: () => ControlSnapshot | null }
+
+export async function orchestratorInputFor(workID: string, meetingWorkIDs: string[], parts?: OrchestratorParts): Promise<OrchestratorInput> {
+  const tags = parts?.tags ?? orchestratorTagIndex()
+  const monitor = parts?.usage ?? orchestratorUsage()
+  const scan = tags.refresh().catch(() => null)
+  const scanned = await Promise.race([scan, new Promise<null>(r => setTimeout(() => r(null), INPUT_SCAN_WAIT_MS).unref?.())])
+  // On demand: the plan this input feeds may fork or start a session, so a reading older than 2 minutes is re-read.
+  const usageViews = await monitor.forPlan()
+  const roots = agentSessionRoots()
+  return buildOrchestratorInput(workID, meetingWorkIDs, {
+    snapshot: parts ? parts.snapshot() : orchestratorSnapshots().get(),
+    hits: tags.hits(),
+    usage: usageViews,
+    skipped: tags.skippedSessions(),
+    logScanComplete: !!scanned?.complete,
+    pathOf: async sid => {
+      const known = tags.pathOf(sid)
+      if (known) return known
+      const [provider, id] = sid.split(':') as [AgentProvider, string]
+      return findAgentSessionFile(provider, id, roots)
+    },
+    mtimeOf: async path => (await stat(path)).mtimeMs,
+  })
+}

package/server/lib/work-orchestrator/session-log.ts

@@ -0,0 +1,114 @@
+/**
+ * 6.83.0: read the END of a session log without reading the whole file, and turn its rows into human-visible turns.
+ * Codex rollouts reach 1.4 GB (canary C2), so the reader seeks from the end: at most `TAIL_BYTES`, starting at the first
+ * whole line. Read-only; never writes beside the log.
+ *
+ * Row shapes (measured in canary C2 on 2026-10-20):
+ *   Claude  {type:'user'|'assistant', sessionId, timestamp, isSidechain, isMeta, message:{role, content}}
+ *   Cursor  {role, message:{content:[{type:'text', text:'<user_query>…</user_query>'}]}} (no timestamps: use mtime)
+ *   Codex   {timestamp, type:'response_item', payload:{type:'message', role, content:[{text}]}} and function calls
+ */
+import { open, stat } from 'node:fs/promises'
+
+export const TAIL_BYTES = 6_000_000
+export type LogProvider = 'claude' | 'codex' | 'cursor'
+export type TurnRole = 'user' | 'assistant' | 'tool' | 'todo' | 'ask'
+export interface Turn { role: TurnRole; text: string; at: string | null }
+
+/** Harness text that is not the person's ask nor the agent's answer. */
+const NOISE = ['<environment_context>', '<user_instructions>', '# AGENTS.md', '<permissions instructions>', '<system-reminder>',
+  '<command-name>', '<local-command', 'Caveat: The messages below', '<external_codex_apps_open_page>', '<turn_aborted>']
+const noisy = (text: string) => { const head = text.slice(0, 300); return NOISE.some(n => head.includes(n)) }
+
+export async function readTail(path: string, maxBytes = TAIL_BYTES): Promise<{ text: string; size: number; mtimeMs: number; truncated: boolean }> {
+  const info = await stat(path)
+  const start = Math.max(0, info.size - maxBytes)
+  const handle = await open(path, 'r')
+  try {
+    const length = info.size - start
+    const buffer = Buffer.alloc(length)
+    let read = 0
+    while (read < length) {
+      const { bytesRead } = await handle.read(buffer, read, length - read, start + read)
+      if (bytesRead === 0) break
+      read += bytesRead
+    }
+    let text = buffer.subarray(0, read).toString('utf8')
+    // Seeking lands mid-line: drop the partial first line so every row parses whole.
+    if (start > 0) { const nl = text.indexOf('\n'); text = nl < 0 ? '' : text.slice(nl + 1) }
+    return { text, size: info.size, mtimeMs: info.mtimeMs, truncated: start > 0 }
+  } finally { await handle.close() }
+}
+
+function record(line: string): Record<string, any> | null {
+  try { const v = JSON.parse(line); return v && typeof v === 'object' && !Array.isArray(v) ? v : null } catch { return null }
+}
+
+/**
+ * Turns from JSONL text. `onlySession`: a Claude file can replay rows of the session it was resumed from; only rows whose
+ * own `sessionId` is this one count (canary C3 precision fix 4). Rows without a sessionId are kept.
+ */
+export function turnsFrom(text: string, provider: LogProvider, onlySession?: string): Turn[] {
+  const out: Turn[] = []
+  const want = onlySession?.toLowerCase()
+  for (const line of text.split('\n')) {
+    if (!line.trim()) continue
+    const o = record(line)
+    if (!o) continue
+    const at = typeof o.timestamp === 'string' ? o.timestamp : null
+    if (provider === 'claude' || provider === 'cursor') {
+      if (provider === 'claude') {
+        if (o.type !== 'user' && o.type !== 'assistant') continue
+        if (want && typeof o.sessionId === 'string' && o.sessionId.toLowerCase() !== want) continue
+      }
+      if (o.isSidechain || o.isMeta) continue
+      const m = o.message && typeof o.message === 'object' ? o.message : {}
+      const role = (m.role || o.role || o.type) as string
+      const content = m.content
+      if (typeof content === 'string') { if (!noisy(content)) out.push({ role: role === 'assistant' ? 'assistant' : 'user', text: content, at }); continue }
+      if (!Array.isArray(content)) continue
+      for (const b of content) {
+        if (!b || typeof b !== 'object') continue
+        if (b.type === 'text' && typeof b.text === 'string') {
+          let tx: string = b.text
+          if (provider === 'cursor') {
+            tx = tx.replace(/<timestamp>[\s\S]*?<\/timestamp>\s*/g, '')
+            const q = /<user_query>([\s\S]*?)<\/user_query>/.exec(tx)
+            if (q) tx = q[1]!
+          }
+          if (!noisy(tx)) out.push({ role: role === 'assistant' ? 'assistant' : 'user', text: tx, at })
+        } else if (b.type === 'tool_use') {
+          const input = b.input && typeof b.input === 'object' ? b.input : {}
+          if (b.name === 'TodoWrite' || Array.isArray(input.todos)) out.push({ role: 'todo', text: JSON.stringify(input.todos ?? []).slice(0, 3000), at })
+          else if (b.name === 'AskUserQuestion') out.push({ role: 'ask', text: JSON.stringify(input).slice(0, 1500), at })
+          else out.push({ role: 'tool', text: String(b.name || 'tool'), at })
+        }
+      }
+      continue
+    }
+    const p = o.payload && typeof o.payload === 'object' ? o.payload : {}
+    if (o.type === 'response_item' && p.type === 'message') {
+      const tx = (Array.isArray(p.content) ? p.content : []).map((b: any) => (b && typeof b.text === 'string' ? b.text : '')).join('\n')
+      if ((p.role === 'user' || p.role === 'assistant') && !noisy(tx)) out.push({ role: p.role, text: tx, at })
+    } else if (o.type === 'response_item' && (p.type === 'function_call' || p.type === 'custom_tool_call')) {
+      if (p.name === 'update_plan') out.push({ role: 'todo', text: String(p.arguments ?? '').slice(0, 3000), at })
+      else out.push({ role: 'tool', text: String(p.name || 'tool'), at })
+    }
+  }
+  return out
+}
+
+/** The first line of a Codex rollout says whether it is a child thread (canary C3 precision fix 3). */
+export interface CodexThreadKind { kind: 'thread' | 'guardian' | 'spawn' | 'other_child'; parent?: string }
+export function codexThreadKind(firstLine: string): CodexThreadKind {
+  const meta = record(firstLine)?.payload
+  const source = meta && typeof meta === 'object' ? meta.source : undefined
+  if (!source || typeof source !== 'object' || !('subagent' in source)) return { kind: 'thread' }
+  const sub = (source as any).subagent
+  if (sub && typeof sub === 'object' && sub.thread_spawn && typeof sub.thread_spawn.parent_thread_id === 'string') {
+    return { kind: 'spawn', parent: sub.thread_spawn.parent_thread_id.toLowerCase() }
+  }
+  if (sub && typeof sub === 'object' && sub.other === 'guardian') return { kind: 'guardian' }
+  if (sub === 'guardian') return { kind: 'guardian' }
+  return { kind: 'other_child' }
+}