@gotcos/glasses-server 6.95.0 → 6.98.0

package/server/lib/meeting-ask-web.ts

@@ -1,4 +1,4 @@
-import { readRetirementRules } from './meeting-official-rules.js';
+import { readRetirementRules, RETIREMENT_AUTHORITIES } from './meeting-official-rules.js';
 /** One admitted public WebSearch per hop. Hook is an enforcement boundary, not an after-the-fact count. */
 import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
@@ -12,6 +12,41 @@ import { resolveProviderBinary } from './provider-binary.js';
 import { pageWasRead, READ_PAGE_PREFIX } from './meeting-ask-review.js';
 import type { MeetingAskExchange, MeetingAskSource } from '../../shared/meeting-ask.js';
 import { fetchPublicArticle } from './meeting-web-page.js';
+import { webLedger, type WebFeature } from './web-lookup-ledger.js';
+import { privateReference } from './private-reference.js';
+/** The eight 16-bit groups of an IPv6 address `isIP` already accepted ("::" expanded, a trailing dotted IPv4 turned into two groups). */
+function ipv6Groups(h: string): number[] {
+    let text = h.toLowerCase().split('%')[0];
+    const dotted = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text);
+    if (dotted)
+        text = text.slice(0, dotted.index) + ((Number(dotted[1]) << 8) | Number(dotted[2])).toString(16) + ':' + ((Number(dotted[3]) << 8) | Number(dotted[4])).toString(16);
+    const [head, tail] = text.split('::');
+    const left = head ? head.split(':') : [], right = tail === undefined ? [] : tail ? tail.split(':') : [];
+    const fill = tail === undefined ? [] : Array(8 - left.length - right.length).fill('0');
+    return [...left, ...fill, ...right].map(g => parseInt(g, 16));
+}
+/**
+ * Public IPv6 only. Refused: the unspecified and loopback addresses and every address whose first 96 bits are zero (this covers the
+ * deprecated IPv4-compatible form ::a.b.c.d), IPv4-mapped ::ffff:0:0/96, IPv4-translated ::ffff:0:0:0/96, NAT64 64:ff9b::/32 (a gateway forwards it to the embedded IPv4,
+ * private ones included), unique-local fc00::/7, link-local fe80::/10, site-local fec0::/10, multicast ff00::/8, 6to4 2002::/16 and
+ * Teredo 2001::/32 (both embed an IPv4 address), and the documentation range 2001:db8::/32.
+ */
+function publicIPv6(h: string): boolean {
+    const g = ipv6Groups(h);
+    if (g.length !== 8 || g.some(x => !Number.isInteger(x)))
+        return false;
+    if (g.slice(0, 6).every(x => x === 0) || g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff)
+        return false;
+    if (g.slice(0, 4).every(x => x === 0) && g[4] === 0xffff && g[5] === 0)
+        return false;                                                        // IPv4-translated ::ffff:0:a.b.c.d (RFC 2765)
+    if (g[0] === 0x64 && g[1] === 0xff9b)
+        return false;
+    if ((g[0] & 0xfe00) === 0xfc00 || (g[0] & 0xffc0) === 0xfe80 || (g[0] & 0xffc0) === 0xfec0 || (g[0] & 0xff00) === 0xff00)
+        return false;
+    if (g[0] === 0x2002 || g[0] === 0x2001 && (g[1] === 0 || g[1] === 0xdb8))
+        return false;
+    return true;
+}
 export function publicAddress(host: string): boolean {
     const h = host.toLowerCase().replace(/^\[|\]$/g, '');
     if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal'))
@@ -21,7 +56,7 @@ export function publicAddress(host: string): boolean {
         return !(p[0] === 0 || p[0] === 10 || p[0] === 127 || p[0] >= 224 || p[0] === 169 && p[1] === 254 || p[0] === 172 && p[1] >= 16 && p[1] <= 31 || p[0] === 192 && p[1] === 168 || p[0] === 100 && p[1] >= 64 && p[1] <= 127);
     }
     if (isIP(h) === 6)
-        return !(h === '::' || h === '::1' || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('fe80') || h.startsWith('::ffff:'));
+        return publicIPv6(h);
     return h.includes('.');
 }
 export function publicWebUrl(value: unknown): string | null { try {
@@ -78,8 +113,9 @@ export interface WebGateInput {
     /** The user's own earlier questions in this meeting, oldest first. Never answers, transcript or files. */
     priorQuestions?: readonly string[];
 }
-const PRIVATE_COST = /\b(?:private|internal|employee)\b|\b(?:our|my|client|customer)\b.*\b(?:budget|contract|salary|quote)\b/i;
-const SENSITIVE = /\b(?:birthday|birthdate|address|phone|email|salary|medical|diagnosis|password|secret|confidential|wife|husband|daughter|son|family)\b/i;
+const PRIVATE_COST_WORDS = /\b(?:internal|employee)\b|\b(?:our|my|client|customer)\b.*\b(?:budget|contract|salary|quote)\b/i;
+const PRIVATE_COST = { test: (text: string) => PRIVATE_COST_WORDS.test(text) || privateReference(text) };
+const SENSITIVE = /\b(?:birthday|birthdate|address|phone|email|salary|medical|diagnosis|password|secret|confidential|wife|husband|daughter|son|family|hospital|surgery|clinic|therapy|pregnant|pregnancy|fever)\b/i;
 /** normalizeAsk redacts before the journal write, so a stored question shows a secret only as the mark it left. */
 const REDACTION_MARK = /REDACTED|\[private key\]/;
 /** A subjectless follow-up may borrow words from at most this many of the user's latest earlier questions. */
@@ -148,7 +184,14 @@ export function publicIntent(question: string): boolean {
     if (w.some(x => INTENT_WORDS.has(x)))
         return true;
     const s = w.join(' ');
-    if (factCheckRequest(question)) return true;
+    // "Is that true about our pipeline?" asks about the user's own thing, not a public claim; the other fact-check wording is unchanged.
+    const ownThing = /\b(?:my|our|his|her|their|your|we|i)\b/.test(s) && /\bis (?:this|that) (?:true|accurate)\b/.test(s) && !/\bfact check(?:ing)?\b|\bverify\b|\bcompar|\b(?:average|typical|benchmark)\b/.test(s);
+    if (factCheckRequest(question) && !ownThing) return true;
+    // 6.97.8: public safety and statistics questions. "is it true (that)" counts unless it asks about what someone said or about the user's own things.
+    if (/\bis it true\b/.test(s) && !/\b(?:said|says|told|mentioned|claimed|promised|asked|my|our|his|her|their|your|we|i)\b/.test(s))
+        return true;
+    if (/\bsafer than\b|\b(?:more|less) dangerous than\b|\b(?:crash|accident|fatality) rates?\b|\bstatistics?\b|\bhow common\b|\bhow likely\b/.test(s))
+        return true;
     return /\bknown for\b/.test(s) || /\blook (?:\S+ ){0,2}up\b/.test(s);
 }
 /**
@@ -172,7 +215,7 @@ export function factCheckRequest(question: string): boolean {
 /** Public resource requests should not require the user to say "web".
  * Private/internal application and file lookups retain their COS routing. */
 export function publicResourceRequest(question: string): boolean {
-    return !/\b(?:private|internal|confidential|file|document|our app|our application|client application)\b/i.test(question)
+    return !/\b(?:internal|confidential|file|document|our app|our application|client application)\b/i.test(question) && !privateReference(question)
         && /\b(?:find|give|send|show|locate|get|look up)\b.{0,100}\b(?:application|apply|signup|sign up|official link|link|documentation|docs)\b/i.test(question);
 }
 export function explicitWebRequest(question: string): boolean {
@@ -328,14 +371,31 @@ export function parseWebEvidence(raw: unknown, query: string): MeetingAskSource[
     return sources;
 }
 export function meetingWebCapability() { return resolveProviderBinary('claude').ok ? { available: true, engine: 'claude:haiku' } : { available: false, reason: 'claude_search_provider_unavailable' }; }
-export async function searchMeetingWeb(query: string, signal?: AbortSignal): Promise<{
+/** `options.auditCaller`: the token-audit caller label for the search model's row, e.g. live_cues_general. Omitted, the row
+ *  keeps its meeting_ask_web label and every older caller behaves exactly as before. */
+export async function searchMeetingWeb(query: string, signal?: AbortSignal, options?: {
+    auditCaller?: string;
+    /** Result pages to keep (default 2; the page reader tries two more candidates than it keeps). A comparison question gives its three searches 2, 1 and 1: four pages in all. */
+    maxPages?: number;
+    /** Which feature to count the lookup under in the daily web ledger. Omitted: the general cues' audit caller counts as cues, anything else as the meeting assistant. */
+    feature?: WebFeature;
+}): Promise<{
     sources: MeetingAskSource[];
     notices: string[];
 }> {
     if (query !== redactSecrets(query))
         return { sources: [], notices: ['Public search was withheld because the query contained a secret.'] };
     if (/\b(?:application|apply|signup|documentation|docs)\b/i.test(query) && !/\bofficial\b/i.test(query)) query += ' official';
-    if(query.toLowerCase().replace(/[^a-z0-9]/g,'') === '401k403bleavingemployerkeepmoneyinoldretirementplanirsdepartmentoflabor') return readRetirementRules(publicAddress,signal);
+    const feature: WebFeature = options?.feature ?? (options?.auditCaller === 'live_cues_general' ? 'cues' : 'ask');
+    if(query.toLowerCase().replace(/[^a-z0-9]/g,'') === '401k403bleavingemployerkeepmoneyinoldretirementplanirsdepartmentoflabor') {
+        // Not a search, but it fetches the two official pages, so those fetches are counted.
+        const rules = await readRetirementRules(publicAddress,signal);
+        webLedger().pagesRead(feature, rules.sources.length);
+        webLedger().pagesFailed(feature, RETIREMENT_AUTHORITIES.length - rules.sources.length);
+        return rules;
+    }
+    // Counted where the search is dispatched, whatever it returns: a search that ran and found nothing still ran.
+    webLedger().search(feature);
     const root = mkdtempSync(join(tmpdir(), 'cos-ask-web-'));
     writeFileSync(join(root,'query.txt'),query.slice(0,240),{mode:0o600});
     const hook = join(root, 'hook.cjs');
@@ -348,7 +408,7 @@ export async function searchMeetingWeb(query: string, signal?: AbortSignal): Pro
         const early = new AbortController();
         const poll = setInterval(() => { try { JSON.parse(readFileSync(join(root, 'result.json'), 'utf8')); early.abort(); } catch { /* not written yet */ } }, 100);
         try {
-            await runMeetingAskModel({ engine: 'claude', model: 'haiku' }, '', '', signal ? AbortSignal.any([signal, early.signal]) : early.signal, { workspace: root, args: webSearchArgs(hook), stdin: JSON.stringify({ query: query.slice(0, 240), blockedDomains: UNREADABLE_RESULT_HOSTS }) });
+            await runMeetingAskModel({ engine: 'claude', model: 'haiku' }, '', '', signal ? AbortSignal.any([signal, early.signal]) : early.signal, { workspace: root, args: webSearchArgs(hook), stdin: JSON.stringify({ query: query.slice(0, 240), blockedDomains: UNREADABLE_RESULT_HOSTS }) }, options?.auditCaller ? { caller: options.auditCaller } : undefined);
         } catch (e) {
             if (!early.signal.aborted || signal?.aborted || (e instanceof AskProcessError && e.terminationUnconfirmed)) throw e;
         } finally { clearInterval(poll); }
@@ -375,21 +435,23 @@ export async function searchMeetingWeb(query: string, signal?: AbortSignal): Pro
         // (same per-page bounds and DNS pinning) and the first two that read, in priority order, are kept,
         // so one blocked or oversize page no longer leaves a check without a readable source. An
         // unavailable page keeps its honest search-result description, never a fabricated excerpt.
-        const candidates = prioritizeWebPages(sources, query).slice(0, 4);
+        const keepPages = Math.max(1, Math.min(4, Math.trunc(options?.maxPages ?? 2)));
+        const candidates = prioritizeWebPages(sources, query).slice(0, keepPages + 2);
         const focus = words(query).filter(w => w.length > 2 && isSubject(w));
         // Stop waiting once two pages have read; slower attempts end on their own 5 s page bound.
         const pages: Array<Awaited<ReturnType<typeof fetchPublicArticle>> | undefined> = new Array(candidates.length);
         await new Promise<void>(resolve => {
             let settled = 0, read = 0;
             if (!candidates.length) resolve();
-            candidates.forEach((source, i) => { void fetchPublicArticle(source.url!, publicAddress, signal, focus).catch(() => null).then(page => { pages[i] = page; settled++; if (page) read++; if (read >= 2 || settled === candidates.length) resolve(); }); });
+            candidates.forEach((source, i) => { void fetchPublicArticle(source.url!, publicAddress, signal, focus).catch(() => null).then(page => { pages[i] = page; if (!page) webLedger().pagesFailed(feature, 1); settled++; if (page) read++; if (read >= keepPages || settled === candidates.length) resolve(); }); });
         });
         candidates.forEach((source, i) => {
             const page = pages[i];
-            if (!page || fetched >= 2) return;
+            if (!page || fetched >= keepPages) return;
             source.text = READ_PAGE_PREFIX + redactSecrets(page.text); source.url=page.url; if(page.title) source.title=redactSecrets(page.title); fetched++;
         });
-        return { sources, notices: [`Public web: ${fetched} result page${fetched === 1 ? '' : 's'} read (at most two, bounded excerpts). Other links have search-result evidence only. The search summary describes the search, not any single page. Search provider: Claude Haiku.`] };
+        if (fetched) webLedger().pagesRead(feature, fetched);
+        return { sources, notices: [`Public web: ${fetched} result page${fetched === 1 ? '' : 's'} read (at most ${keepPages === 2 ? 'two' : keepPages === 1 ? 'one' : keepPages}, bounded excerpts). Other links have search-result evidence only. The search summary describes the search, not any single page. Search provider: Claude Haiku.`] };
     }
     catch (e) {
         if (e instanceof AskProcessError && e.terminationUnconfirmed) {
@@ -412,3 +474,212 @@ export function recentPublicPages(exchanges:readonly MeetingAskExchange[],sessio
     const prior=exchanges.filter(e=>e.sessionId===sessionId&&e.serverInstanceId===serverInstanceId&&e.status==='completed'&&e.publicWebQuery===query&&now-Date.parse(e.createdAt)>=0&&now-Date.parse(e.createdAt)<900000).sort((a,b)=>a.createdAt.localeCompare(b.createdAt)).at(-1);
     return (prior?.sources??[]).filter(s=>pageWasRead(s)&&now-Date.parse(s.retrievedAt??prior!.createdAt)>=0&&now-Date.parse(s.retrievedAt??prior!.createdAt)<900000).slice(0,2).map(s=>({...s,retrievedAt:s.retrievedAt??prior!.createdAt}));
 }
+
+/*
+ * Pasted links (6.97.8).
+ *
+ * The privacy rule is "a word reaches the web only if the user typed it". A public http(s) address the user typed into the
+ * question is words the user typed, so COS reads that one page even when the question has no public-intent wording ("This is
+ * the article we're discussing by the way: <url>"). It is read, not searched: nothing but the address the user typed is
+ * requested, and the page is fetched by fetchPublicArticle with its DNS pin, redirect checks and size and time caps.
+ *
+ * What stays. publicWebUrl (http or https, public host, no credentials, ports 80 and 443), the public-address check on every
+ * address the host resolves to (fetchPublicArticle), and redactSecrets: a link that carries a key or token, in its path or
+ * in a query parameter named like one, is refused, never fetched. At most PASTED_URL_MAX links are looked at per question;
+ * the rest are ignored. A link found only in the transcript, a file, memory or an earlier ANSWER is never fetched: this
+ * reads the current question text and nothing else.
+ */
+export const PASTED_URL_MAX = 2;
+export type PastedUrlRefusal = 'pasted_not_public' | 'pasted_secret' | 'pasted_over_limit';
+export interface PastedUrls {
+    /** The links that may be read, in the order typed. */
+    urls: string[];
+    /** One entry per link that was looked at and refused, or ignored for being over the limit. */
+    refused: PastedUrlRefusal[];
+}
+const URL_IN_TEXT = /https?:\/\/[^\s<>"'`]+/gi;
+/**
+ * Parameters that carry a credential, a one-time code or a signature, in a link's query or fragment. By name: distinctive words anywhere in
+ * the name (token, secret, passw..., apikey, signature, credential, bearer, hmac), short words as whole pieces of it (pwd, pass, passcode,
+ * sig, auth, session, sid, key, code, otp, jwt, pw), login/reset/verify/magic/invite hashes and keys, and one-letter names (?t=, ?h=, ?k=)
+ * only when the value is a long opaque string (a "?t=30" timestamp is fine). By value: a JWT in any parameter.
+ */
+const SECRET_NAME_ANYWHERE = /token|secret|passw|apikey|signature|credential|bearer|hmac/i;
+const SECRET_NAME_PIECES = new Set(['pwd', 'pass', 'passcode', 'passkey', 'sig', 'auth', 'authorization', 'session', 'sessionid', 'sid', 'key', 'code', 'otp', 'jwt', 'pw', 'secret']);
+const SECRET_NAME_HASHES = /(?:login|reset|verify|verification|confirm|magic|invite|activation|unsubscribe|recovery)[_-]?(?:hash|key|code|id|link|token)/i;
+const JWT_VALUE = /^eyJ[\w-]+\.[\w-]+\.[\w-]*$/;
+function secretParam(name: string, value: string): boolean {
+    if (!value)
+        return false;
+    if (JWT_VALUE.test(value))
+        return true;
+    if (SECRET_NAME_ANYWHERE.test(name) || SECRET_NAME_HASHES.test(name))
+        return true;
+    const pieces = name.replace(/([a-z])([A-Z])/g, '$1_$2').toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+    if (pieces.some(x => SECRET_NAME_PIECES.has(x)))
+        return true;
+    return name.length === 1 && /^[A-Za-z0-9_-]{16,}$/.test(value);
+}
+/** Addresses that are themselves the secret: whoever holds the link can post as the owner. Never fetched, never stored. */
+const WEBHOOK_HOSTS = new Set(['hooks.slack.com', 'hooks.zapier.com', 'maker.ifttt.com', 'events.pagerduty.com', 'hooks.airtable.com', 'webhook.office.com']);
+function webhookLink(u: URL): boolean {
+    const host = u.hostname.toLowerCase(), path = u.pathname.toLowerCase();
+    return WEBHOOK_HOSTS.has(host) || host.endsWith('.webhook.office.com') || /^hook\.[a-z0-9.-]*make\.com$/.test(host) || /^(?:discord|discordapp)\.com$/.test(host) && /^\/api(?:\/v\d+)?\/webhooks\//.test(path)
+        || host === 'outlook.office.com' && path.startsWith('/webhook') || host === 'api.telegram.org' && /^\/bot/.test(path);
+}
+function trimUrl(raw: string): string {
+    let u = raw.replace(/[.,;:!?'"\]}]+$/, '');
+    // A closing parenthesis belongs to the link only when an opening one does.
+    while (u.endsWith(')') && (u.match(/\)/g) ?? []).length > (u.match(/\(/g) ?? []).length)
+        u = u.slice(0, -1).replace(/[.,;:!?'"\]}]+$/, '');
+    return u;
+}
+/** One typed address: the public address to read, or why not. */
+function classifyPastedUrl(raw: string): { ok: string } | { refusal: 'pasted_not_public' | 'pasted_secret' } {
+    let parsed: URL | null = null;
+    try {
+        parsed = new URL(raw);
+    }
+    catch { /* not an address */ }
+    if (!parsed)
+        return { refusal: 'pasted_not_public' };
+    // The fragment is read as parameters too (#access_token=..., or #/route?code=...): it never reaches a server, but it reaches stored text.
+    const fragment = parsed.hash.slice(1), fragmentParams = fragment ? new URLSearchParams(fragment.includes('?') ? fragment.slice(fragment.indexOf('?') + 1) : fragment) : new URLSearchParams();
+    const carriesSecret = !!(parsed.username || parsed.password) || raw !== redactSecrets(raw) || REDACTION_MARK.test(raw) || webhookLink(parsed)
+        || [...parsed.searchParams, ...fragmentParams].some(([name, value]) => secretParam(name, value));
+    if (carriesSecret)
+        return { refusal: 'pasted_secret' };
+    const ok = publicWebUrl(raw);
+    return ok ? { ok } : { refusal: 'pasted_not_public' };
+}
+/** The addresses typed into `question` that COS may read, and what it refused. Pure: no network, no disk. */
+export function pastedPublicUrls(question: string): PastedUrls {
+    const found: string[] = [];
+    for (const m of question.match(URL_IN_TEXT) ?? []) {
+        const u = trimUrl(m);
+        if (u && !found.includes(u))
+            found.push(u);
+    }
+    const urls: string[] = [], refused: PastedUrlRefusal[] = [];
+    found.forEach((raw, i) => {
+        if (i >= PASTED_URL_MAX) {
+            refused.push('pasted_over_limit');
+            return;
+        }
+        const c = classifyPastedUrl(raw);
+        if ('ok' in c)
+            urls.push(c.ok);
+        else
+            refused.push(c.refusal);
+    });
+    return { urls, refused };
+}
+/** A web address written without its scheme but with a query or fragment that holds parameters: example.com/page?access_token=... */
+const SCHEMELESS_WITH_PARAMS = /(?<![\w@.\/-])((?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}(?::\d+)?(?:\/[^\s?#<>"'`]*)?)[?#][^\s<>"'`]*=[^\s<>"'`]*/gi;
+const SCHEMELESS_WEBHOOK = /(?<![\w@.\/-])(?:hooks\.slack\.com|hooks\.zapier\.com|maker\.ifttt\.com|events\.pagerduty\.com|hooks\.airtable\.com|(?:[a-z0-9-]+\.)*webhook\.office\.com|hook\.[a-z0-9.-]*make\.com|(?:discord|discordapp)\.com\/api(?:\/v\d+)?\/webhooks|outlook\.office\.com\/webhook|api\.telegram\.org\/bot)[^\s<>"'`]*/gi;
+/**
+ * `text` as it may be KEPT (a paste_ or web_ file, which the live cues' prompts and the writer read):
+ *   - an address that is not a clean public one (credentials, a key or token anywhere in it, a webhook, a private host) becomes
+ *     "[link removed]";
+ *   - every other address is cut to origin + path, with no query and no fragment (a one-time code, a reset hash or a token that no
+ *     list of parameter names knows about cannot survive);
+ *   - an address written without its scheme loses its query or fragment the same way, and a schemeless webhook address is removed.
+ * Every address counts, not only the first two: the limit of two is about what is read, not about what may sit in a stored file.
+ */
+export function redactUnsafeLinks(text: string): string {
+    const withScheme = text.replace(URL_IN_TEXT, m => {
+        const u = trimUrl(m), tail = m.slice(u.length);
+        if (!u)
+            return m;
+        const c = classifyPastedUrl(u);
+        if (!('ok' in c))
+            return '[link removed]' + tail;
+        const p = new URL(c.ok);                                          // classifyPastedUrl returned it, so it parses
+        return p.origin + p.pathname + tail;
+    });
+    return withScheme.replace(SCHEMELESS_WEBHOOK, '[link removed]').replace(SCHEMELESS_WITH_PARAMS, '$1');
+}
+/** Two addresses for the same page: scheme-agnostic host, no fragment, no tracking parameters, no trailing slash. */
+export function pastedUrlKey(url: string): string {
+    try {
+        const u = new URL(url);
+        const keep = [...u.searchParams].filter(([k]) => !/^(?:utm_|fbclid$|gclid$|mc_|ref$)/i.test(k)).sort(([a], [b]) => a.localeCompare(b));
+        const query = keep.map(([k, v]) => `${k}=${v}`).join('&');
+        return `${u.hostname.toLowerCase().replace(/^www\./, '')}${u.pathname.replace(/\/+$/, '')}${query ? `?${query}` : ''}`;
+    }
+    catch {
+        return url;
+    }
+}
+/** A read page from this meeting's own recent exchanges for the same address (read less than 15 minutes ago), newest first. */
+export function recentPastedPage(exchanges: readonly MeetingAskExchange[], sessionId: string, serverInstanceId: string, url: string, now = Date.now()): MeetingAskSource | null {
+    const key = pastedUrlKey(url);
+    const rows = exchanges.filter(e => e.sessionId === sessionId && e.serverInstanceId === serverInstanceId && e.status === 'completed').sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    for (const e of rows)
+        for (const s of e.sources ?? []) {
+            const at = Date.parse(s.retrievedAt ?? e.createdAt);
+            if (s.url && pageWasRead(s) && pastedUrlKey(s.url) === key && now - at >= 0 && now - at < 900000)
+                return { ...s, retrievedAt: s.retrievedAt ?? e.createdAt };
+        }
+    return null;
+}
+/** "The article", "that link", "the linked story": a follow-up that clearly points back at a link typed earlier, with none of its own.
+ *  A bare "page", "site" or "post" does not count ("what is on page 3 of the deck?" is not about the article). */
+export function pointsAtEarlierLink(question: string): boolean {
+    return pastedPublicUrls(question).urls.length === 0
+        && (/\b(?:the|that|this|those|my|our)\s+(?:(?:linked|pasted|news|web)\s+)?(?:article|story|link|url|piece)\b/i.test(question)
+            || /\b(?:linked|pasted)\s+(?:page|post|article|story|piece)\b/i.test(question));
+}
+/** The pages read for links the USER typed in this meeting's last few questions (read less than 15 minutes ago), newest first, at most PASTED_URL_MAX. */
+export function recentPastedPagesFromUserLinks(exchanges: readonly MeetingAskExchange[], sessionId: string, serverInstanceId: string, now = Date.now()): MeetingAskSource[] {
+    const mine = exchanges.filter(e => e.sessionId === sessionId && e.serverInstanceId === serverInstanceId && e.status === 'completed' && e.action === 'ask' && now - Date.parse(e.createdAt) < 900000)
+        .sort((a, b) => b.createdAt.localeCompare(a.createdAt)).slice(0, 4);
+    const out: MeetingAskSource[] = [];
+    for (const e of mine)
+        for (const url of pastedPublicUrls(e.question).urls) {
+            const page = recentPastedPage(exchanges, sessionId, serverInstanceId, url, now);
+            if (page && !out.some(p => p.url === page.url))
+                out.push(page);
+            if (out.length >= PASTED_URL_MAX)
+                return out;
+        }
+    return out;
+}
+
+
+/*
+ * Comparison and fact-check questions (6.97.8).
+ *
+ * A public factual comparison ("is private aviation safer than commercial?") is answered from more than one page, so it may run up to
+ * COMPARISON_SEARCHES admitted searches in parallel (the usual Ask runs one) and keep COMPARISON_PAGES pages in all (2, 1 and 1).
+ * Cost and timing: three searches start together, so the wait is the slowest one (the 12 s per-search budget), not the sum; each
+ * search is one Haiku call plus the page reads, and each is counted in the daily web ledger. The answer still has to finish inside the
+ * 30 s Ask deadline, so a slow search ends with a notice instead of delaying the answer.
+ * Every query is built from the user's OWN typed words plus the generic modifiers publicSearchGate allows (comparison, average), and
+ * each still passes publicSearchGate in webLookup: nothing from the transcript, files or memory is ever added.
+ */
+export const COMPARISON_SEARCHES = 3;
+export const COMPARISON_PAGES = 4;
+/** "than", "versus", "compared to": the question sets two things side by side. A fact-check request counts on its own (factCheckRequest). */
+export function comparisonQuestion(question: string): boolean {
+    return /\b(?:than|versus|vs\.?|compared (?:to|with)|compare(?:d)?|difference between)\b/i.test(question) || factCheckRequest(question);
+}
+const COMPARATOR = new Set(['than', 'versus', 'vs', 'compared', 'compare']);
+const SIDE_NOISE = new Set(['more', 'less', 'or', 'and', 'much', 'many']);
+/**
+ * Up to three distinct queries for a comparison question, all made of the user's own typed words (those in `base`, the admitted query) and
+ * the modifiers "comparison" and "average": the query as admitted; the first side of the comparison plus "average"; the second side plus
+ * "average" (so each side gets its own pages). The sides come from the words around "than", "versus" or "vs" in the question. With no
+ * comparator they fall back to all the subject words plus "comparison" and plus "average". A typo stays as typed.
+ */
+export function comparisonQueries(base: string, question: string = base): string[] {
+    const baseWords = new Set((base.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? []));
+    const typed = (question.match(/[\p{L}\p{N}]+/gu) ?? []);
+    const at = typed.findIndex(w => COMPARATOR.has(w.toLowerCase()));
+    const uniq = (list: string[]) => list.filter((w, i) => list.findIndex(x => x.toLowerCase() === w.toLowerCase()) === i);
+    const side = (list: string[]) => uniq(list.filter(w => baseWords.has(w.toLowerCase()) && isSubject(w.toLowerCase()) && !SIDE_NOISE.has(w.toLowerCase()) && !COMPARATOR.has(w.toLowerCase())));
+    const all = side(typed);
+    const left = at < 0 ? [] : side(typed.slice(0, at)), right = at < 0 ? [] : side(typed.slice(at + 1)).filter(w => !left.some(l => l.toLowerCase() === w.toLowerCase()));
+    const out = left.length && right.length ? [base, `${left.join(' ')} average`, `${right.join(' ')} average`] : [base, `${all.join(' ')} comparison`, `${all.join(' ')} average`];
+    return out.map(q => q.trim().split(/\s+/).slice(0, 12).join(' ')).filter((q, i, list) => q.split(' ').some(w => isSubject(w.toLowerCase())) && list.indexOf(q) === i).slice(0, COMPARISON_SEARCHES);
+}

package/server/lib/meeting-batch-progress.ts

@@ -5,7 +5,7 @@
 import { existsSync, readdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from 'node:fs'
 import { basename, join } from 'node:path'
 import { dataPath } from './data-dir.js'
-import { MeetingFinalizationJobStore, type MeetingFinalizationJob } from './meeting-finalization-jobs.js'
+import { finalizationStop, MeetingFinalizationJobStore, type MeetingFinalizationJob } from './meeting-finalization-jobs.js'
 import { listActiveRecoveries } from './unsaved-audio-quarantine.js'
 
 export const BATCH_PROGRESS_FILENAME = '_batch_progress.json'
@@ -32,7 +32,8 @@ export interface MeetingBatchProgress {
 
 export interface MeetingSyncMeeting {
   meetingId: string
-  phase: MeetingBatchPhase | 'pending'
+  /** `stopped` (6.97.0): visible, not working, and never counted as active or blocking. */
+  phase: MeetingBatchPhase | 'pending' | 'stopped'
   percent: number | null
   segmentsDone: number | null
   segmentsTotal: number | null
@@ -255,6 +256,27 @@ function finalizationSyncRow(job: MeetingFinalizationJob): MeetingSyncMeeting {
   }
 }
 
+/**
+ * 6.97.0: a job that stopped trying. Says what is true and no more: nothing is running, so it does not
+ * say "do not restart", and it does not say "retrying". Short enough for COS Control's one-line row.
+ */
+function stoppedFinalizationRow(job: MeetingFinalizationJob, chunkFiles: number): MeetingSyncMeeting {
+  const hq = job.phase === 'batch_pending'
+  const what = hq ? 'HQ polish' : job.phase === 'ops_pending' ? 'Library save' : 'Capture save'
+  const audio = hq && job.audioDir ? ' · audio kept' : ''
+  const next = finalizationStop(job)?.reason === 'crash_parked' ? '' : ' · retries later'
+  return {
+    meetingId: job.sessionId,
+    phase: 'stopped',
+    percent: null,
+    segmentsDone: null,
+    segmentsTotal: null,
+    chunkFiles,
+    updatedAt: job.updatedAt,
+    label: `${what} stopped${finalizationStop(job)?.reason === 'crash_parked' ? ' after crashes' : ''}${audio}${next}`,
+  }
+}
+
 /** Snapshot of pending HQ polish work for /api/health and COS Control. */
 export function getMeetingSyncSnapshot(
   root: string = pendingBatchRoot(),
@@ -262,6 +284,16 @@ export function getMeetingSyncSnapshot(
 ): MeetingSyncSnapshot {
   const meetings: MeetingSyncMeeting[] = []
   const retained: MeetingSyncRetainedMeeting[] = []
+  const finalizationJobs = listFinalizationJobsForSnapshot(root, options)
+  // 6.97.0: a stopped job's directory is not evidence of work. A progress file or a fresh marker left
+  // by its last attempt would otherwise read as active below; its one row is the job's own.
+  const stoppedDirs = new Map<string, MeetingFinalizationJob>()
+  for (const job of finalizationJobs) {
+    if (!finalizationStop(job)) continue
+    stoppedDirs.set(job.sessionId, job)
+    if (job.audioDir) stoppedDirs.set(basename(job.audioDir), job)
+  }
+  const stoppedChunks = new Map<string, number>()
   let dirs: string[] = []
   if (existsSync(root)) {
     try {
@@ -285,6 +317,12 @@ export function getMeetingSyncSnapshot(
       chunkFiles = readdirSync(dir).filter(f => f.endsWith('.wav')).length
     } catch { /* ignore */ }
 
+    const stoppedJob = stoppedDirs.get(name)
+    if (stoppedJob) {
+      stoppedChunks.set(stoppedJob.sessionId, chunkFiles)
+      continue
+    }
+
     // A terminal outcome ends the meeting's ACTIVE life. Its WAVs stay for
     // retry, reported as retained — never as running work. The gate is
     // progress==null ONLY: the pending marker is refreshed every segment and
@@ -389,13 +427,21 @@ export function getMeetingSyncSnapshot(
   // then showed Meeting sync Idle with restart locked (2026-09-09 local 6.45.1
   // rollout). Same contract as active recoveries: this window is active work.
   const seen = new Set(meetings.map(meeting => meeting.meetingId))
-  for (const job of listFinalizationJobsForSnapshot(root, options)) {
+  const stoppedRows: MeetingSyncMeeting[] = []
+  for (const job of finalizationJobs) {
     if (seen.has(job.sessionId)) continue
     seen.add(job.sessionId)
-    meetings.push(finalizationSyncRow(job))
+    if (finalizationStop(job)) stoppedRows.push(stoppedFinalizationRow(job, stoppedChunks.get(job.sessionId) ?? 0))
+    else meetings.push(finalizationSyncRow(job))
   }
 
   if (meetings.length === 0) {
+    // 6.97.0: visible, but no work. Control keys Restart, Update and Sync now off `active` and
+    // `blocksRestart` here and off `finalization.pending`, so all three must read idle.
+    if (stoppedRows.length > 0) {
+      const label = stoppedRows.length === 1 ? stoppedRows[0]!.label : `${stoppedRows.length} meetings stopped · audio kept`
+      return { active: false, percent: null, label, blocksRestart: false, meetings: stoppedRows, retained }
+    }
     const label = retained.length > 0
       ? `Idle · ${retained.length} retained batch${retained.length === 1 ? '' : 'es'}`
       : 'Idle'
@@ -416,7 +462,7 @@ export function getMeetingSyncSnapshot(
     percent,
     label,
     blocksRestart: true,
-    meetings,
+    meetings: [...meetings, ...stoppedRows],
     retained,
   }
 }

package/server/lib/meeting-batch-transcribe.ts

@@ -600,6 +600,23 @@ async function decodeWhisperWindow(
 
 /** A Parakeet window with no words over audio the speech detector says holds speech is a failed decode. */
 export const PARAKEET_EMPTY_SPEECH_SEC = 0.5
+/** How long one saved chunk runs; the most a kept live word can be placed from its true time. */
+const LIVE_CHUNK_SEC = 6
+
+/** A window's live words, clocked evenly across each chunk. They need real times on the window's
+ *  clock: one untimed window would make the saver drop speaker labels for the whole meeting. */
+function liveWordsForWindow(segment: BatchSegment, entries: IndexedTranscriptChunk[]): WhisperWord[] {
+  const words: WhisperWord[] = []
+  for (const entry of entries) {
+    if (entry.chunkIndex < segment.startChunkIdx || entry.chunkIndex > segment.endChunkIdx) continue
+    const tokens = (entry.chunk.text ?? '').split(/\s+/).filter(Boolean)
+    const start = (entry.chunk.elapsed - segment.startElapsed) / 1000
+    tokens.forEach((word, i) => {
+      words.push({ word, start: start + (i * LIVE_CHUNK_SEC) / tokens.length, end: start + ((i + 1) * LIVE_CHUNK_SEC) / tokens.length, probability: 0 })
+    })
+  }
+  return words
+}
 
 async function decodeParakeetWindow(
   deps: HqDecodeDeps,
@@ -693,9 +710,25 @@ async function decodeHqWindow(
     }
   } else if (plan.engine === 'parakeet-ultra') {
     try {
-      primary = await parakeetGuarded(job, () => decodeParakeetWindow(deps, input, parakeetTimeout(job), 'parakeet-ultra', true))
+      // A strict plan has no second engine, so an empty window is an answer (laughter, music,
+      // crosstalk), not a reason to fail the whole meeting. As a failure it replayed the same
+      // audio on every retry and no later window was ever saved (2026-10-30, two calls).
+      primary = await parakeetGuarded(job, () => decodeParakeetWindow(deps, input, parakeetTimeout(job), 'parakeet-ultra', !plan.strictPrimary))
+      if (plan.strictPrimary && !primary.text.trim()) {
+        const speech = deps.speechSeconds?.(input) ?? null
+        if (speech !== null && speech >= PARAKEET_EMPTY_SPEECH_SEC) {
+          const live = liveWordsForWindow(segment, entries)
+          fallbackReason = live.length > 0 ? 'parakeet_empty_over_speech; kept_live_words' : 'parakeet_empty_over_speech'
+          console.warn(`[meeting-batch] Parakeet returned no words for ${segment.startChunkIdx}-${segment.endChunkIdx} over ${speech.toFixed(1)} s of speech; ${live.length > 0 ? 'kept the live words' : 'no live words either'}`)
+          if (live.length > 0) primary = { ...primary, text: live.map(w => w.word).join(' '), words: live }
+        }
+      }
     } catch (error) {
-      if (plan.strictPrimary) throw new MacParakeetUnavailableError(error)
+      if (plan.strictPrimary) {
+        // The window and the reason only: a decode error's message can quote what was said.
+        console.warn(`[meeting-batch] Strict Parakeet failed for ${segment.startChunkIdx}-${segment.endChunkIdx}: ${(error as { reason?: unknown })?.reason ?? (error as Error)?.name ?? 'unknown'}`)
+        throw new MacParakeetUnavailableError(error)
+      }
       fallbackReason = `parakeet_failed: ${errorReason(error)}`
       console.warn(`[meeting-batch] Parakeet HQ failed for ${segment.startChunkIdx}-${segment.endChunkIdx}; using Large-v3: ${errorReason(error)}`)
       const w = await decodeWhisperWindow(deps, input, previousText, 'large-v3', segment, audioDir)

package/server/lib/meeting-corrections.ts

@@ -27,6 +27,7 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { dataPath } from './data-dir.js'
+import { sameSpeakerName } from './speaker-name-nfc.js'
 
 export const CORRECTIONS_DIR = 'meeting-corrections'
 
@@ -268,7 +269,7 @@ export function currentLabelFor(sessionId: string, originalLabel: string): strin
   for (let hop = 0; hop < applied.length; hop++) {
     // Latest applied correction FROM the current label wins: a later human
     // decision supersedes an earlier one.
-    const next = [...applied].reverse().find(r => r.from === label)
+    const next = [...applied].reverse().find(r => sameSpeakerName(r.from, label))
     if (!next || seen.has(next.to)) break
     label = next.to
     seen.add(label)

package/server/lib/meeting-fact-check.ts

@@ -27,6 +27,7 @@ import { groundWebLinks } from './meeting-ask-links.js'
 import type { FactCheckClaim } from './meeting-ask-store.js'
 import { isFactCheckCTA, pageWasRead, COVERAGE, normalizeReviewConfidence, reviewRepairDiagnostics, READ_PAGE_PREFIX } from './meeting-ask-review.js'
 import { publicSearchGate } from './meeting-ask-web.js'
+import { webLedger } from './web-lookup-ledger.js'
 import { PRIVATE_QUERY, RESEARCH_WORDS } from './meeting-public-topic.js'
 import { redactSecrets } from './lens-gist-engines.js'
 import { getOwnerHomeArea, HOME_AREA_LABEL } from './profile.js'
@@ -413,6 +414,8 @@ export function admitFactCheckClaims(raw: unknown, input: Pick<AskInput, 'turns'
 export function originQuery(baseQuery: string, origin: OwnerOrigin | null): string | undefined {
   const full = origin ? `${factWords(origin.text).join(' ')} ${baseQuery}` : baseQuery
   const gate = publicSearchGate({ question: 'Search the web for ' + full, query: full })
+  // The one place a fact check's query meets the public-search gate: a refusal is counted here, once per claim it is asked about.
+  if (!gate.ok) webLedger().withheld('factCheck', gate.reason)
   return gate.ok ? gate.query : undefined
 }