@gotcos/glasses-server 6.94.4 → 6.98.0

package/server/lib/codex-rollout-watermark.ts

@@ -0,0 +1,42 @@
+// 6.97.0: how far a Codex thread's rollout has been written, for the audit only. Codex's usage is a
+// running total for the thread, so charging a resumed turn the difference is only honest if nothing
+// else ran on the thread since. The rollout's size is the one thing that shows a desktop run.
+//
+// Any write moves it, including ones that are not a turn. That direction is safe: the row stays estimated.
+import { statSync } from 'node:fs'
+import { realNativeHeadDeps, transcriptPathFor, type NativeHeadDeps } from './native-head.js'
+import { registerCodexRolloutProbe } from './provider-usage.js'
+
+/** A located rollout stays put, so a turn start costs one stat, not a walk of the sessions tree. */
+const rolloutPaths = new Map<string, string>()
+const ROLLOUT_PATHS_MAX = 512
+
+/** Bytes written so far, or null for UNKNOWN: no rollout found, or it moved or was compressed. Never throws. */
+export function codexRolloutSize(threadId: string, deps?: NativeHeadDeps): number | null {
+  try {
+    const known = rolloutPaths.get(threadId)
+    if (known) {
+      try {
+        return statSync(known).size
+      } catch {
+        rolloutPaths.delete(threadId)
+      }
+    }
+    const path = transcriptPathFor('codex', threadId, deps ?? realNativeHeadDeps())
+    if (!path) return null
+    rolloutPaths.set(threadId, path)
+    if (rolloutPaths.size > ROLLOUT_PATHS_MAX) rolloutPaths.delete(rolloutPaths.keys().next().value!)
+    return statSync(path).size
+  } catch {
+    return null
+  }
+}
+
+/** Called once at boot, in production only. */
+export function installCodexRolloutProbe(): void {
+  registerCodexRolloutProbe(threadId => codexRolloutSize(threadId))
+}
+
+export function _resetCodexRolloutPathsForTest(): void {
+  rolloutPaths.clear()
+}

package/server/lib/cursor-bridge.ts

@@ -533,7 +533,8 @@ export async function callCursorStreaming(
       runId: run.runId,
       sessionId: sid,
       clientJobId: options?.clientJobId,
-      usageKind: 'estimated',
+      // 6.97.0: the chat id only. Cursor's usage stays estimated: its cache parser has no real rows.
+      ...(cursorChatId ? { cliSessionId: cursorChatId } : {}),
     })
     saveEngineSessionBestEffort()
 

package/server/lib/dictation-clean-models.ts

@@ -2,6 +2,8 @@
 export const DICTATION_CLEAN_MODELS = ['haiku', 'sonnet', 'luna-5.6-fast'] as const
 export type DictationCleanModel = typeof DICTATION_CLEAN_MODELS[number]
 export const LUNA_DICTATION_CLI_MODEL = 'gpt-5.6-luna-none-fast'
+/** The polish choice that runs through Cursor, whose path has no system prompt. */
+export const LUNA_DICTATION_MODEL = 'luna-5.6-fast'
 export function isDictationCleanModel(value: unknown): value is DictationCleanModel {
   return value === 'sonnet' || value === 'luna-5.6-fast' || value === 'haiku'
 }

package/server/lib/dictation-clean.ts

@@ -4,7 +4,7 @@ import { homedir, tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { resolveProviderBinary } from './provider-binary.js'
 import { terminateProviderProcess } from './provider-process-lifecycle.js'
-import { isDictationCleanModel, LUNA_DICTATION_CLI_MODEL } from './dictation-clean-models.js'
+import { isDictationCleanModel, LUNA_DICTATION_CLI_MODEL, LUNA_DICTATION_MODEL } from './dictation-clean-models.js'
 import { sanitizeCustomInstructions } from './dictation-polish-instructions.js'
 import { LEARNED_STYLE_MAX_CHARS } from './dictation-learned-style.js'
 import type { DictationRegister } from './dictation-register.js'
@@ -311,7 +311,7 @@ export async function autoCleanDictation(
   if (opts.signal?.aborted) throw new Error('Auto-clean aborted')
   const model = (opts.model || process.env.COS_DICTATION_AUTOCLEAN_MODEL || 'haiku').toLowerCase()
   if (!isDictationCleanModel(model)) throw new Error('Unsupported dictation cleanup model')
-  const cursor = model === 'luna-5.6-fast'
+  const cursor = model === LUNA_DICTATION_MODEL
   const binary = resolveProviderBinary(cursor ? 'cursor' : 'claude')
   if (!binary.ok) throw new Error(`Dictation cleanup ${cursor ? 'Cursor' : 'Claude'} CLI unavailable`)
   const configuredTimeout = Number.parseInt(process.env.COS_DICTATION_AUTOCLEAN_TIMEOUT_MS || '20000', 10)

package/server/lib/dictation-polish-pipeline.ts

@@ -1,9 +1,9 @@
-import type { DictationCleanModel } from './dictation-clean-models.js'
+import { LUNA_DICTATION_MODEL, type DictationCleanModel } from './dictation-clean-models.js'
 import { applyNegativeRules } from './hallucination-filter.js'
 import { applyCorrections } from './whisper-local.js'
 import { applyFuzzyCorrections } from './fuzzy-correct.js'
 import { getAllSpeakerNames } from './speaker-embeddings.js'
-import { autoCleanDictation, AUTOCLEAN_MAX_CHARS } from './dictation-clean.js'
+import { autoCleanDictation, AUTOCLEAN_MAX_CHARS, buildDictationPolishPrompt, DICTATION_POLISH_SYSTEM_PROMPTS, type DictationPromptExtras } from './dictation-clean.js'
 import { dictationPolishPromptVersion, styleAndRegisterApply, type DictationPolishPromptVersion } from './dictation-polish-options.js'
 import { fillerPassEnabled, stripFillersIfEnglish } from './dictation-fillers.js'
 import { polishBudgetExhausted, recordPolishCall, type PolishBucket } from './dictation-polish-budget.js'
@@ -265,6 +265,21 @@ export function guardPolishAnswer(
   return { text: answer, outcome: answer !== cleaned ? 'polished' : 'unchanged' }
 }
 
+/**
+ * 6.97.0, for the audit row only: what the model is sent, on its own field, because `input_chars` stays
+ * the words dictated so old and new rows still compare. Absent if it cannot be worked out. Never throws.
+ */
+function polishPromptChars(
+  cleaned: string, model: string, version: DictationPolishPromptVersion, customInstructions: string, extras: DictationPromptExtras,
+): { promptChars?: number } {
+  try {
+    const system = model === LUNA_DICTATION_MODEL ? 0 : DICTATION_POLISH_SYSTEM_PROMPTS[version].length
+    return { promptChars: system + buildDictationPolishPrompt(cleaned, getVocabulary(), version, customInstructions, extras).length }
+  } catch {
+    return {}
+  }
+}
+
 export async function polishOutboundDictation(
   text: string,
   opts: OutboundOptions,
@@ -334,6 +349,9 @@ export async function polishOutboundDictation(
       ...(canaried ? { polishRegister: register } : {}),
       ...(used.polishPrompt ? { polishPrompt: used.polishPrompt } : {}),
       polishOutcome: guarded.outcome, ...(guarded.guard ? { polishGuard: guarded.guard } : {}),
+      // Real numbers from a warm result. The cold path prints plain text, so its row stays estimated.
+      ...polishPromptChars(cleaned, model, promptVersion, customInstructions, { learnedStyle: style.lines, register }),
+      ...warmEntry?.usage,
     })
     return {
       text: guarded.text, ...(prewarm ? { prewarm } : {}),
@@ -357,6 +375,8 @@ export async function polishOutboundDictation(
         ...(canaried ? { polishRegister: register } : {}),
         ...(used.polishPrompt ? { polishPrompt: used.polishPrompt } : {}),
         polishOutcome: 'aborted',
+        ...polishPromptChars(cleaned, model, promptVersion, customInstructions, { learnedStyle: style.lines, register }),
+        ...warmEntry?.usage,
       })
       console.warn('[prompt-draft] auto-clean aborted by the client (glossary-only)')
     } else {

package/server/lib/dictation-prewarm.ts

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { resolveProviderBinary } from './provider-binary.js'
 import { terminateProviderProcess } from './provider-process-lifecycle.js'
+import { ClaudeRunUsage, type EngineUsage } from './provider-usage.js'
 import {
   buildDictationPolishPrompt, claudePolishArgs, DICTATION_POLISH_SYSTEM_PROMPTS, dictationChildEnv, dictationPolishPromptVersion,
   type DictationPolishPromptVersion, type DictationPromptExtras,
@@ -42,6 +43,8 @@ interface WarmPolish {
   timer: NodeJS.Timeout
   onResult: ((event: any) => void) | null
   onExit: (() => void) | null
+  /** 6.97.0: what the one message used, for the audit row. Read by the caller after the call. */
+  usage?: EngineUsage
 }
 
 /** Unclaimed warm processes, by token. */
@@ -178,6 +181,8 @@ export async function runWarmPolish(
     const abort = () => finish(new Error('Auto-clean aborted'))
     const timer = setTimeout(() => finish(new Error(`Auto-clean timed out (${timeoutMs}ms)`)), timeoutMs)
     entry.onResult = (event) => {
+      // Before the answer is judged, and unable to affect it: the audit reads its own copy.
+      noteWarmUsage(entry, event)
       if (event.subtype !== 'success' || event.is_error || typeof event.result !== 'string') {
         return finish(new Error('Warm polish returned an unsuccessful result'))
       }
@@ -203,6 +208,17 @@ export async function runWarmPolish(
   })
 }
 
+function noteWarmUsage(entry: WarmPolish, event: unknown): void {
+  try {
+    const run = new ClaudeRunUsage(false)
+    run.observe(event)
+    const realUsage = run.take()
+    entry.usage = { ...(realUsage ? { realUsage } : {}), ...(run.cliSessionId ? { cliSessionId: run.cliSessionId } : {}) }
+  } catch {
+    /* the audit row stays estimated */
+  }
+}
+
 /** The server is going away: a detached warm process would outlive it. */
 export function killAllPrewarmsSync(): void {
   for (const entry of alive) {

package/server/lib/direct-bridge.ts

@@ -551,7 +551,8 @@ export async function callDirectStreaming(
 
   let fullText = ''
   let finalized = false
-  const usageTotals = { input: 0, output: 0, usd: 0, measured: false }
+  // statedUsd and allStated: what the provider itself said it cost. `usd` may be priced by COS instead.
+  const usageTotals = { input: 0, output: 0, usd: 0, measured: false, statedUsd: 0, allStated: true, cached: 0 }
   const trail = (draft: JobTrailDraft) => {
     if (!callbacks.onTrail) return
     try { callbacks.onTrail(draft) } catch { /* observation only */ }
@@ -569,11 +570,19 @@ export async function callDirectStreaming(
       runId: run.runId,
       sessionId: sid,
       ...(options?.clientJobId ? { clientJobId: options.clientJobId } : {}),
-      usageKind: usageTotals.measured ? 'provider_final' : 'estimated',
       profile: profile.id,
       lane: 'direct',
       credentialKind: key.kind,
       usd: Math.round(usageTotals.usd * 1e6) / 1e6,
+      // 6.97.0: the tokens the provider reported, with its cost only when every call stated one.
+      ...(usageTotals.measured ? { realUsage: {
+        // prompt_tokens includes cached ones; the row keeps them apart.
+        inputTokens: usageTotals.input - usageTotals.cached,
+        outputTokens: usageTotals.output,
+        cacheReadTokens: usageTotals.cached,
+        ...(usageTotals.allStated ? { costUsd: usageTotals.statedUsd } : {}),
+        resolvedModel: profile.model,
+      } } : {}),
     })
   }
 
@@ -745,6 +754,9 @@ export async function callDirectStreaming(
       usageTotals.output += parser.usage.output
       usageTotals.usd += usd
       usageTotals.measured = true
+      if (parser.usage.costUsd === undefined) usageTotals.allStated = false
+      else usageTotals.statedUsd += parser.usage.costUsd
+      usageTotals.cached += parser.usage.cachedInput ?? 0
       settle({
         input: parser.usage.input,
         output: parser.usage.output,

package/server/lib/direct-sse.ts

@@ -35,6 +35,8 @@ export interface DirectSseUsage {
   output: number
   /** Provider-reported cost in USD (OpenRouter `usage.cost`), when present. */
   costUsd?: number
+  /** 6.97.0: the part of `input` read from cache, when the provider says. Only the audit reads it. */
+  cachedInput?: number
 }
 
 export type DirectSseEvent =
@@ -213,10 +215,13 @@ export class DirectSseParser {
     const usage = chunk.usage as Record<string, unknown> | undefined
     if (usage && typeof usage === 'object') {
       const cost = usage.cost
+      const input = nonNegative(usage.prompt_tokens)
+      const cached = (usage.prompt_tokens_details as { cached_tokens?: unknown } | null | undefined)?.cached_tokens
       this.usage = {
-        input: nonNegative(usage.prompt_tokens),
+        input,
         output: nonNegative(usage.completion_tokens),
         ...(typeof cost === 'number' && Number.isFinite(cost) && cost >= 0 ? { costUsd: cost } : {}),
+        ...(typeof cached === 'number' && Number.isSafeInteger(cached) && cached > 0 && cached <= input ? { cachedInput: cached } : {}),
       }
     }
     const choices = Array.isArray(chunk.choices) ? chunk.choices : []

package/server/lib/display-bus.ts

@@ -10,7 +10,7 @@ bus.setMaxListeners(20) // Multiple glasses clients
 export interface DisplayEvent {
   type: 'chunk' | 'done' | 'error' | 'tool_status' | 'start' | 'session_restore' | 'transcript_chunk' | 'prompt_transcript' | 'recording_start' | 'recording_stop' | 'coaching_nudge' | 'coaching_nudge_v2'
     // Control asked the glasses to stop a G2 meeting (routes/meeting.ts stop-request).
-    | 'meeting_stop_requested'
+    | 'meeting_stop_requested' | 'mac_speaker_live_revision'
   data: Record<string, unknown>
 }
 

package/server/lib/fork-thread.ts

@@ -89,6 +89,8 @@ import { PROVIDER_AUTH_RE, PROVIDER_OVERFLOW_RE, PROVIDER_QUOTA_RE } from './pro
 import { cursorIsolationUnavailableError, cursorSpawnEnv, isCursorIsolationUnavailable, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
 import { anyKeyedSessions, isKeyedSession } from './keyed-sessions.js'
 import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
+import { SideRunTap } from './provider-usage.js'
+import { logTokenAudit, type TokenAuditEntry } from './token-audit.js'
 
 /**
  * Providers that can be forked.
@@ -496,6 +498,8 @@ export interface ForkDeps {
    * always supply it.
    */
   sourceWatermark?: (provider: ForkProvider, nativeThreadId: string) => string | null
+  /** 6.97.0: where the run's audit row goes. Only production wiring sets it, so no test writes a real ledger. */
+  auditRun?: (entry: TokenAuditEntry) => void
   /**
    * Argv builder. Optional, defaults to the real one.
    *
@@ -793,8 +797,13 @@ async function run(request: ForkRequest, deps: ForkDeps, startedAt: number): Pro
   }
 
   let outcome: ForkResult
+  // 6.97.0: a passive reader, wired after the run's own listeners, for one audit row at the end.
+  const usageTap = deps.auditRun ? new SideRunTap(provider) : null
   try {
-    outcome = await driveChild({ child, deps, provider, sourceNativeThreadId, prompt, timeoutMs, startedAt })
+    const running = driveChild({ child, deps, provider, sourceNativeThreadId, prompt, timeoutMs, startedAt })
+    usageTap?.attach(child.stdout as any)
+    outcome = await running
+    auditForkRun(deps, usageTap, outcome, provider, prompt)
   } finally {
     // EVERY path: success, mismatch, non-zero exit, timeout, throw. A leaked entry
     // outlives the process and lets a RECYCLED pid inherit our self-ownership
@@ -1058,6 +1067,27 @@ function driveChild(input: DriveInput): Promise<ForkResult> {
 // Production wiring
 // ---------------------------------------------------------------------------
 
+/** One row for a fork that reached an end and names its new thread. Never changes the fork's outcome. */
+function auditForkRun(deps: ForkDeps, tap: SideRunTap | null, outcome: ForkResult, provider: ForkProvider, prompt: string): void {
+  try {
+    if (!tap || !deps.auditRun) return
+    const realUsage = tap.finish()
+    if (!outcome.newNativeThreadId || (!outcome.ok && !tap.sawEnd)) return
+    deps.auditRun({
+      source: 'g2-fork',
+      caller: outcome.ok ? 'fork_thread' : `fork_thread:${outcome.reason}`,
+      model: provider,
+      inputChars: prompt.length,
+      outputChars: tap.outputChars,
+      durationMs: outcome.durationMs,
+      cliSessionId: outcome.newNativeThreadId,
+      ...(realUsage ? { realUsage } : {}),
+    })
+  } catch {
+    // The audit never changes a fork's outcome.
+  }
+}
+
 /**
  * The real dependency set.
  *
@@ -1071,6 +1101,7 @@ export function realForkDeps(
 ): ForkDeps {
   return {
     now: () => Date.now(),
+    auditRun: entry => logTokenAudit(entry),
     resolveBinary: provider => resolveProviderBinary(provider),
     spawn: request => {
       // 6.62.0 (plan 3.4): the Cursor fork's `--model` must not rewrite the CLI default.

package/server/lib/held-naming-batches.ts

@@ -15,6 +15,7 @@ import { MeetingStore } from './meeting-store.js'
 import { appendCorrection, closeInterruptedCorrections, pendingCorrections, readCorrections, appliedCorrections, type CorrectionRow } from './meeting-corrections.js'
 import { patchValue, relabelSpeakerPositions, undoSpeakerMarkdown, strippedTranscript, validatedRawMap, type SpeakerPatch } from './meeting-speaker-labels.js'
 import { acquireMeetingSyncLock } from './meeting-sync-lock.js'
+import { inspectOriginalViewTransaction } from './mac-speaker-call-original-view.js'
 
 export const NAMING_CAPABILITIES = {preview:true,apply:true,undo:true,version:1} as const
 const PREVIEW_TTL = 15 * 60 * 1000
@@ -180,6 +181,23 @@ function checkedRevision(value:unknown):number {
   if(typeof value!=='number'||!Number.isSafeInteger(value)||value<0)throw new Error('Invalid meeting revision')
   return value
 }
+/** A call-wide view is bound to the original BASE and correction ledger. Legacy
+ * physical renames (including Undo and profile fan-out) must not silently make
+ * that view, or a later human annotation, disappear. Presence is deliberately
+ * enough: a malformed or interrupted artifact is not permission to overwrite. */
+const CALL_OVERLAY_REFUSAL='Call-wide speaker review is active or needs recovery. Use the exact reviewed segment naming flow; legacy naming cannot change this meeting.'
+function assertNoCallSpeakerOverlay(sidecarPath:string,sessionId:string):void {
+  const stem=sidecarPath.replace(/\.g2-chunks\.json$/,'')
+  if(/^mac_[A-Za-z0-9_-]{1,100}$/.test(sessionId)){
+    const original=inspectOriginalViewTransaction({sidecarPath,meetingPath:stem+'.md'},sessionId)
+    if(original.status==='prepared'||original.status==='recovery-invalid')throw new Error(CALL_OVERLAY_REFUSAL)
+  }
+  const artifacts=[...['.speaker-call.json','.speaker-call-state.json','.speaker-call-human.json','.speaker-call-human-transaction.json','.speaker-call-interval-human.json','.speaker-call-interval-human-transaction.json'].map(suffix=>stem+suffix),join(dirname(sidecarPath),`.${sessionId}.speaker-call.lock`)]
+  for(const artifact of artifacts){
+    try{lstatSync(artifact)}catch(e){if((e as NodeJS.ErrnoException).code==='ENOENT')continue;throw e}
+    throw new Error(CALL_OVERLAY_REFUSAL)
+  }
+}
 function resolveCopies(sessionId:string):ResolvedCopy[] {
   if(sessionBusy(sessionId)||existsSync(dataPath('meeting-finalization-jobs',`${sessionId}.json`)))throw new Error('Meeting is recording or finalizing; retry after it finishes')
   const local = new MeetingStore().findBySessionId(sessionId)
@@ -198,6 +216,7 @@ function resolveCopies(sessionId:string):ResolvedCopy[] {
     throw new Error('Configured operations folder is unavailable; retry after sync')
   }
   return paths.map(p=>{
+    assertNoCallSpeakerOverlay(p.sidecarPath,sessionId)
     assertFile(p.sidecarPath)
     const raw=readFileSync(p.sidecarPath,'utf8'),doc=JSON.parse(raw)
     if(doc.sessionId!==sessionId) throw new Error('Meeting identity changed')
@@ -429,8 +448,22 @@ export async function undoHeldNaming(batchId:string,confirm:boolean){
   let lock:Awaited<ReturnType<typeof acquireMeetingSyncLock>>|undefined
   try{
     try{lock=await acquireMeetingSyncLock()}catch(e){throw new HeldGroupError(409,'sync_running',errorText(e))}
+    // One meeting that cannot be undone must not stop the others: Undo restores
+    // what it can and reports the rest as partial. Each meeting is still checked
+    // before its intent row, because that row changes the ledger its copies share,
+    // and a ledger change would invalidate a human overlay in a sibling copy.
+    const refused:string[]=[]
+    let attempted=false
     for(const meeting of batch.meetings){
       if(!meeting.receipts.length)continue
+      if(meeting.receipts.some(r=>r.status!=='reverted')){
+        try{resolveCopies(meeting.sessionId)}catch(e){
+          // Kept in memory until the outcome is known: a full refusal below leaves the batch record untouched.
+          meeting.error=errorText(e);refused.push(meeting.error)
+          continue
+        }
+      }
+      attempted=true
       const undoId=randomUUID(),row:CorrectionRow={id:undoId,phase:'intent',at:new Date().toISOString(),from:batch.speaker,to:'prior labels',chunks:[...meeting.namedChunks,...meeting.widerChunks],scope:'meeting',batchId:batch.batchId,source:'undo'}
       try{
         const later=appliedCorrections(meeting.sessionId).filter(r=>r.batchId!==batchId&&r.at>=batch.at)
@@ -463,6 +496,9 @@ export async function undoHeldNaming(batchId:string,confirm:boolean){
       }catch(e){meeting.error=errorText(e);appendCorrection(meeting.sessionId,{...row,phase:'failed',error:meeting.error})}
       writeRecord('batch',batch.batchId,batch)
     }
+    // Nothing could be attempted and a call-wide review is why: that is a refusal
+    // with a next step, not a partial Undo.
+    if(!attempted&&refused.includes(CALL_OVERLAY_REFUSAL))throw new HeldGroupError(409,'call_review_active',CALL_OVERLAY_REFUSAL)
     batch.status=batch.meetings.filter(m=>m.receipts.length).every(m=>m.status==='reverted')?'reverted':'partial'
     writeRecord('batch',batch.batchId,batch)
     return{...batchView(batch),kind:'undone',samplesKept:true,audioRestored:false}

package/server/lib/job-audit-caller.ts

@@ -0,0 +1,20 @@
+// 6.97.0: the token-audit caller of a dispatched task or a meeting review, which read as `full_query`
+// before. Routines have their own (routines-config.ts). Import-free, so the review runtime can mark a
+// job without loading the job runtime.
+
+/** Review jobs in this process. A review resumed after a restart reads as an ordinary query again. */
+const workReviewJobs = new Set<string>()
+const WORK_REVIEW_JOBS_MAX = 256
+
+/** Reviews carry no origin (a new kind would reach the phone and COS Control), so they are marked here. */
+export function noteWorkReviewJob(clientJobId: string): void {
+  workReviewJobs.delete(clientJobId)
+  workReviewJobs.add(clientJobId)
+  if (workReviewJobs.size > WORK_REVIEW_JOBS_MAX) workReviewJobs.delete(workReviewJobs.values().next().value!)
+}
+
+/** '' for every other job, whose caller stays what the bridge picks. */
+export function jobAuditCaller(request: { clientJobId?: string; origin?: { kind: string } }): string {
+  if (request.origin?.kind === 'task') return 'dispatch_task'
+  return request.clientJobId && workReviewJobs.has(request.clientJobId) ? 'work_review' : ''
+}

package/server/lib/lens-gist-engines.ts

@@ -27,6 +27,7 @@ import { resolveProviderBinary } from './provider-binary.js'
 import { getOllamaCatalog, ollamaFetch, resolveOllamaOrigin } from './ollama-catalog.js'
 import { PROVIDER_QUOTA_RE } from './provider-proof.js'
 import { logTokenAudit } from './token-audit.js'
+import { normalizeRealUsage, readOneShotUsage, type EngineUsage } from './provider-usage.js'
 
 /**
  * The provider itself said its plan, session, rate or capacity limit is spent. Raised only
@@ -341,10 +342,14 @@ async function runCli(
   prompt: string,
   opts: LensGistRunOptions,
   parse: (stdout: string) => LensGistEngineRun,
+  onStdout?: (provider: 'claude' | 'codex' | 'cursor', stdout: string) => void,
 ): Promise<LensGistEngineRun> {
   const binary = binaryFor(provider)
   const result = await withScratchWorkspace(workspace =>
     runProcess(binary, args(workspace), { stdin: prompt, cwd: workspace, timeoutMs: opts.timeoutMs, label: provider, cursorIsolation: provider === 'cursor', maxOutputTokens: opts.maxOutputTokens, signal: opts.signal }))
+  // 6.97.0: its own read of the output for the audit, before the answer's parser and independent of
+  // it, so a call that failed after using tokens still reports them.
+  onStdout?.(provider, result.stdout)
   const providerText = `${result.stdout}\n${result.stderr}`
   if (result.code !== 0) {
     // Codex reports its failure as a JSON event AND a non-zero exit; the event says why.
@@ -400,14 +405,14 @@ async function runOllama(model: string, prompt: string, opts: LensGistRunOptions
   }
 }
 
-function dispatch(engine: LensGistEngineName, model: string, prompt: string, opts: LensGistRunOptions): Promise<LensGistEngineRun> {
+function dispatch(engine: LensGistEngineName, model: string, prompt: string, opts: LensGistRunOptions, onStdout: (provider: 'claude' | 'codex' | 'cursor', stdout: string) => void): Promise<LensGistEngineRun> {
   switch (engine) {
     case 'claude':
-      return runCli('claude', () => buildClaudeGistArgs(model, opts.system), prompt, opts, parseClaudeGistOutput)
+      return runCli('claude', () => buildClaudeGistArgs(model, opts.system), prompt, opts, parseClaudeGistOutput, onStdout)
     case 'codex':
-      return runCli('codex', workspace => buildCodexGistArgs(model, workspace), prompt, opts, parseCodexGistOutput)
+      return runCli('codex', workspace => buildCodexGistArgs(model, workspace), prompt, opts, parseCodexGistOutput, onStdout)
     case 'cursor':
-      return runCli('cursor', workspace => buildCursorGistArgs(model, workspace), prompt, opts, parseCursorGistOutput)
+      return runCli('cursor', workspace => buildCursorGistArgs(model, workspace), prompt, opts, parseCursorGistOutput, onStdout)
     case 'ollama':
       return runOllama(model, prompt, opts)
   }
@@ -423,10 +428,16 @@ export async function runLensGistEngine(
   const started = Date.now()
   let outputChars = 0
   let resolvedModel = model
+  let usage: EngineUsage = {}
   try {
-    const run = await dispatch(engine, model, prompt, opts)
+    const run = await dispatch(engine, model, prompt, opts, (provider, stdout) => { usage = readOneShotUsage(provider, stdout, model) })
     outputChars = run.text.length
     resolvedModel = run.model || model
+    // Ollama answers over HTTP, so it has no stdout to read; its reply already carries the counts.
+    if (engine === 'ollama') {
+      const realUsage = normalizeRealUsage({ inputTokens: run.usage?.inputTokens as number, outputTokens: run.usage?.outputTokens as number, resolvedModel: run.model })
+      if (realUsage) usage = { realUsage }
+    }
     return run
   } finally {
     logTokenAudit({
@@ -436,6 +447,7 @@ export async function runLensGistEngine(
       inputChars: prompt.length + opts.system.length,
       outputChars,
       durationMs: Date.now() - started,
+      ...usage,
     })
   }
 }

package/server/lib/live-cos-ask.ts

@@ -122,6 +122,12 @@ export interface LiveAskDeps {
   explicitWebQuery?: string | null
   publicTopicQuery?: boolean
   benchmarkWebQuery?: string | null
+  /** 6.97.8: a public factual comparison. These queries (at most three, each already built from the user's own words) are searched together
+   *  before the answer, the planner may not search again, and the answer takes the comparison shape (COMPARISON_FINAL). */
+  comparisonQueries?: string[]
+  /** 6.97.8: read when each prompt is built. True lets the answer carry one line starting "Not checked against a source:" with the general
+   *  knowledge answer when no page was read (search withheld, failed or empty). False for a privacy withhold. */
+  uncheckedLine?: () => boolean
   /** The wearer's name, so "You owe" can match a line that names them. null when unknown. */
   wearer?: () => string | null
   /** Who owns this COS (6.76.0), from the profile. null or absent: no card, and nothing about the Ask changes. */
@@ -131,6 +137,11 @@ export interface LiveAskDeps {
   /** Wall clock for timings only; now() keeps the cache clock. */
   clock?: () => number
 }
+/** The answer shape for a public factual comparison. Rows stay So what and Details; a row is one line, so figures are short sentences, each cited. */
+export const COMPARISON_FINAL = 'This is a public factual comparison. Return two rows plus the confidence object. So what: ONE sentence, the verdict that answers the question directly; when the question is about something a person in the room said, name who was right or wrong, using the speaker label only from the transcript sources. Details: three to five short sentences, one key figure each, with its unit and scope, each cited with the [W#] of a page that was read (pageRead true); then ONE sentence with the single real caveat. Use only figures that appear in a cited page. Up to 190 words in all. Do not hedge the verdict when the cited figures are clear; do not list every number a page has.';
+/** When no page was read, the answer still answers, labeled, from general knowledge. */
+export const UNCHECKED_FINAL = 'If no web page was read to answer this (the search was withheld, failed or returned nothing usable), do not stop at "Unverified". Answer the question in one short line that starts exactly "Not checked against a source:" and gives the answer from general knowledge with hedged ranges, no citation and no invented precise figures. Never present it as verified.';
+export const REVIEW_COMPARISON_ADDENDUM = ' When comparison is true: keep the labels So what and Details, a one-sentence verdict first in So what, one cited figure per Details sentence and one caveat; up to maxWords. Every figure must come from a cited page with pageRead=true and appear in the support quote. When uncheckedLineAllowed is true and no page was read for a point, keep or add ONE line starting exactly "Not checked against a source:" that answers from general knowledge with hedged ranges and no citation; it is not a verified verdict, so do not replace it with "unverified" and do not add a citation to it.';
 const PADDING = /^(?:none|n\/?a|nothing|nothing yet|not yet|nothing to report|-+)\.?$/i
 /**
  * The model's sections, validated for one action. Labels match case-insensitively (a trailing colon is
@@ -360,7 +371,18 @@ export function createLiveAsk(overrides: Partial<LiveAskDeps> = {}) {
       // Do this before the answer planner so it cannot substitute a benchmark for
       // the original article. One further lookup remains for a comparison.
       const preloadedWeb = input.action === 'ask' && !!deps.publicTopicQuery && !!deps.explicitWebQuery && !!deps.webAvailable
+      const comparison = input.action === 'ask' && !!deps.webAvailable && !!deps.comparisonQueries?.length && !preloadedWeb
       if(preloadedWeb){webAsked=true;const queries=[deps.explicitWebQuery!,...(deps.benchmarkWebQuery?[deps.benchmarkWebQuery]:[])];for(const found of await Promise.all(queries.map(q=>lookup(q,'web'))))absorb(found)}
+      // A comparison runs its searches together, so the wait is the slowest one; the answer hop below may not search again.
+      if (comparison) {
+        webAsked = true
+        // allSettled, not all: when one search throws (the Ask was aborted, a child could not be confirmed stopped) the others are waited for,
+        // never left running behind a thrown error. The first failure is rethrown once every search has ended.
+        const settled = await Promise.allSettled(deps.comparisonQueries!.slice(0, 3).map(q => lookup(q, 'web')))
+        for (const r of settled) if (r.status === 'fulfilled') absorb(r.value)
+        const failed = settled.find((r): r is PromiseRejectedResult => r.status === 'rejected')
+        if (failed) throw failed.reason
+      }
       // 6.76.0: a question about who someone is, or about the owner's own history, always looks in COS
       // first (memories and earlier meetings, every domain), whatever the planner would have chosen. It
       // takes one of the two lookups and saves the planner hop. Never the web: that stays explicit-only.
@@ -380,9 +402,10 @@ export function createLiveAsk(overrides: Partial<LiveAskDeps> = {}) {
       for (let hop = 0; hop < 3; hop++) {
         if (signal?.aborted) throw new AskError('cancelled', 499)
         // A typed question may look up twice (COS or web). What to ask may look up once, in COS only.
-        const searchAllowed = input.action === 'ask' ? !(emptyCosLookup&&!deps.explicitWebQuery) && hop < (preloadedWeb ? deps.evidenceQuestion || deps.benchmarkWebQuery ? 0 : 1 : forcedLookup ? 1 : 2) : input.action === 'questions' && hop < 1
-        const detailed = input.action === 'ask' && /\b(?:detail(?:ed)?|comprehensive|thorough|deep dive)\b/i.test(input.question)
-        const prompt = JSON.stringify({ responsePolicy: { maxWords: detailed ? 220 : input.action==='ask'?80:120, targetWords: input.action === 'ask' ? 50 : 90, confidenceMaxWords: 16, detailsOptional: true, avoidRepeatedWarnings: true, userEntityClarificationIsOrientation: true }, question: input.action === 'ask' ? input.question : TASKS[input.action], labels: input.action === 'questions' ? ['So what', 'Ask'] : input.action === 'ask' && !detailed ? ['So what'] : MEETING_ASK_LABELS[input.action], wearer: deps.wearer?.() ?? null, ...(input.action === 'questions' ? { recentSinceMs: recentSinceMs(input) } : {}), history: input.action === 'ask' ? followup.history : [], searchAllowed, orientation: deps.orientation ?? null, ...(card ? { owner: { name: card.name, sourceId: cardId } } : {}), ...(ownerMatch && card ? { ownerMatch: { heard: ownerMatch.heard, readAs: card.name } } : {}), ...(lookups.some(l => l.scope === 'cos') ? { cosLookups: lookups.filter(l => l.scope === 'cos').map(l => ({ query: l.query, searched: 'COS memories and earlier meetings', results: l.results })) } : {}), evidence: evidence.sources, groundingHints: moneyGroundingHints(evidence.sources), finalInstructions: detailed ? 'Give the requested detail with concise confidence.' : input.action === 'ask' ? 'Return only one So what row, 40–80 words (up to 100 for many updates), plus the confidence object with at most 16 words. Do not repeat the confidence in the row. Respect the user supplied account/project name; never equate it with another transcript name without evidence. Summarize direct speaker updates, not unrelated earlier client work. Do not infer done from worked on it or a behavior description. Keep an ambiguous deadline with its nearest feature or omit the deadline; never attach it to an earlier feature. If a count is garbled, state it is unclear rather than guessing a range.' : 'Use only essential nonempty rows, one short sentence per row. Aim for 90 words total; keep the entire response including confidence under 120 words.' })
+        const searchAllowed = input.action === 'ask' ? !comparison && !(emptyCosLookup&&!deps.explicitWebQuery) && hop < (preloadedWeb ? deps.evidenceQuestion || deps.benchmarkWebQuery ? 0 : 1 : forcedLookup ? 1 : 2) : input.action === 'questions' && hop < 1
+        const detailed = input.action === 'ask' && (comparison || /\b(?:detail(?:ed)?|comprehensive|thorough|deep dive)\b/i.test(input.question))
+        const unchecked = input.action === 'ask' && !!deps.uncheckedLine?.()
+        const prompt = JSON.stringify({ responsePolicy: { maxWords: detailed ? 220 : input.action==='ask'?80:120, targetWords: input.action === 'ask' ? (comparison ? 140 : 50) : 90, confidenceMaxWords: 16, detailsOptional: true, avoidRepeatedWarnings: true, userEntityClarificationIsOrientation: true }, question: input.action === 'ask' ? input.question : TASKS[input.action], labels: input.action === 'questions' ? ['So what', 'Ask'] : input.action === 'ask' && !detailed ? ['So what'] : MEETING_ASK_LABELS[input.action], wearer: deps.wearer?.() ?? null, ...(input.action === 'questions' ? { recentSinceMs: recentSinceMs(input) } : {}), history: input.action === 'ask' ? followup.history : [], searchAllowed, orientation: deps.orientation ?? null, ...(card ? { owner: { name: card.name, sourceId: cardId } } : {}), ...(ownerMatch && card ? { ownerMatch: { heard: ownerMatch.heard, readAs: card.name } } : {}), ...(lookups.some(l => l.scope === 'cos') ? { cosLookups: lookups.filter(l => l.scope === 'cos').map(l => ({ query: l.query, searched: 'COS memories and earlier meetings', results: l.results })) } : {}), evidence: evidence.sources, groundingHints: moneyGroundingHints(evidence.sources), finalInstructions: comparison ? COMPARISON_FINAL + (unchecked ? ' ' + UNCHECKED_FINAL : '') : detailed ? 'Give the requested detail with concise confidence.' + (unchecked ? ' ' + UNCHECKED_FINAL : '') : input.action === 'ask' ? (unchecked ? UNCHECKED_FINAL + ' ' : '') + 'Return only one So what row, 40–80 words (up to 100 for many updates), plus the confidence object with at most 16 words. Do not repeat the confidence in the row. Respect the user supplied account/project name; never equate it with another transcript name without evidence. Summarize direct speaker updates, not unrelated earlier client work. Do not infer done from worked on it or a behavior description. Keep an ambiguous deadline with its nearest feature or omit the deadline; never attach it to an earlier feature. If a count is garbled, state it is unclear rather than guessing a range.' : 'Use only essential nonempty rows, one short sentence per row. Aim for 90 words total; keep the entire response including confidence under 120 words.' })
         const runStarted = clock()
         let run: { text: string; model?: string }
         try { run = await deps.run(prompt, signal) } catch (e) { phases.push({ phase: 'answer', ms: Math.max(0, clock() - runStarted), failed: true }); throw e }
@@ -448,16 +471,16 @@ export function createLiveAsk(overrides: Partial<LiveAskDeps> = {}) {
         }
         if (deps.review) {
           const maxWords = detailed ? 220 : input.action === 'ask' ? 80 : 120
-          const reviewInput={question:input.action==='ask'?input.question:TASKS[input.action],labels:input.action==='ask'&&!detailed?['So what']:MEETING_ASK_LABELS[input.action],maxWords:maxWords-18,targetWords:Math.max(30,maxWords-30),omitUnrequestedMoney:!!deps.evidenceQuestion || input.action==='ask' && /401|403|retirement/i.test(input.question) && !/\b(?:balance|amount|fee|cost|money|savings)\b/i.test(input.question),draft:{sections:normalized,confidence},sources:evidence.sources.map(s=>({...s,pageRead:pageWasRead(s)}))}
+          const reviewInput={...(comparison?{comparison:true}:{}),...(unchecked?{uncheckedLineAllowed:true}:{}),question:input.action==='ask'?input.question:TASKS[input.action],labels:input.action==='ask'&&!detailed?['So what']:MEETING_ASK_LABELS[input.action],maxWords:maxWords-18,targetWords:Math.max(30,maxWords-30),omitUnrequestedMoney:!!deps.evidenceQuestion || input.action==='ask' && /401|403|retirement/i.test(input.question) && !/\b(?:balance|amount|fee|cost|money|savings)\b/i.test(input.question),draft:{sections:normalized,confidence},sources:evidence.sources.map(s=>({...s,pageRead:pageWasRead(s)}))}
           let reviewed:any,problem:string|null='invalid_answer'
           for(let attempt=0;attempt<2;attempt++){
             const reviewStarted=clock()
             let checked:{text:string;model?:string}
-            try{checked=await deps.review(JSON.stringify({...reviewInput,...(attempt?{repairReason:problem,repairDiagnostics:reviewRepairDiagnostics(reviewed,evidence.sources),previousDraft:reviewed}: {})}),REVIEW_SYSTEM,signal)}catch(e){phases.push({phase:'review',ms:Math.max(0,clock()-reviewStarted),failed:true});throw e}
+            try{checked=await deps.review(JSON.stringify({...reviewInput,...(attempt?{repairReason:problem,repairDiagnostics:reviewRepairDiagnostics(reviewed,evidence.sources),previousDraft:reviewed}: {})}),REVIEW_SYSTEM+(comparison||unchecked?REVIEW_COMPARISON_ADDENDUM:''),signal)}catch(e){phases.push({phase:'review',ms:Math.max(0,clock()-reviewStarted),failed:true});throw e}
             phases.push({phase:'review',ms:Math.max(0,clock()-reviewStarted)})
             if(checked.model&&checked.model!==model){evidence.notices.push(`Grounding review used ${checked.model}; the requested answer draft used ${model}.`);model=checked.model}
             try { reviewed=normalizeReviewConfidence(parseAskReply(checked.text));reviewed.sections=normalizeSections(input.action,reviewed.sections,allowed);if(deps.evidenceQuestion && reviewed?.confidence)reviewed.confidence.reason="Only general rules can be checked; this plan's terms remain unverified." } catch { reviewed=null }
-            problem=reviewProblem(reviewed,evidence.sources,maxWords)
+            problem=reviewProblem(reviewed,evidence.sources,maxWords,comparison||unchecked?{uncitedFigures:true}:undefined)
             if(!problem&&reviewInput.omitUnrequestedMoney&&/\$\s*\d|\b[0-9,]+\s+(?:dollars|grand)\b/i.test(JSON.stringify(reviewed.sections)))problem='unrequested_money'
             if(!problem&&input.action==='ask'&&!detailed&&reviewed.sections.some((s:any)=>s.label!=='So what'))problem='extra_sections'
             if(!problem)break