@gotcos/glasses-server 6.98.0 → 6.99.12

package/server/lib/your-move-count.ts

@@ -0,0 +1,58 @@
+/**
+ * 6.99.10 (Drop it plan section 12): how many Work items in Your move wait on you, for `waiting` on
+ * GET /api/inbox/summary. It is the open-work list GET /api/work-board/activity/open serves (projectOpenWork), counting
+ * the items that want an answer or a look (needsInput, attention, done) and leaving out the ones still running: a run
+ * in progress is not waiting on you.
+ *
+ * The summary is polled, and the board is a bridge read, so one count is shared for `ttlMs` and two callers at once
+ * share one read. A read that fails answers null (the summary then counts the chat alone) and is not cached, so the
+ * next poll tries again.
+ */
+import { projectOpenWork, readWorkJournal, type OpenWorkGroup } from './work-activity.js'
+
+type Journal = ReturnType<typeof readWorkJournal>
+type Rows = Parameters<typeof projectOpenWork>[1]
+
+export interface YourMoveCounterDeps {
+  journal: () => Journal
+  /** The board rows, or null when the board cannot be read in time. */
+  rows: () => Promise<Rows | null>
+  now?: () => number
+  ttlMs?: number
+}
+
+export const YOUR_MOVE_TTL_MS = 30_000
+const WAITING_GROUPS: readonly OpenWorkGroup[] = ['needsInput', 'attention', 'done']
+
+/** The pure count: open-work items whose group waits on you. */
+export function countYourMove(journal: Journal, rows: Rows, nowMs: number): number {
+  if (!journal.available) return 0
+  return projectOpenWork(journal, rows, nowMs).items.filter(item => WAITING_GROUPS.includes(item.group)).length
+}
+
+export function createYourMoveCounter(deps: YourMoveCounterDeps): () => Promise<number | null> {
+  const now = deps.now ?? (() => Date.now())
+  const ttl = deps.ttlMs ?? YOUR_MOVE_TTL_MS
+  let cached: { at: number; value: number } | null = null
+  let inflight: Promise<number | null> | null = null
+  return () => {
+    if (cached && now() - cached.at < ttl) return Promise.resolve(cached.value)
+    if (inflight) return inflight
+    inflight = (async () => {
+      try {
+        const journal = deps.journal()
+        if (!journal.available) return null
+        const rows = await deps.rows()
+        if (!rows) return null
+        const value = countYourMove(journal, rows, now())
+        cached = { at: now(), value }
+        return value
+      } catch {
+        return null
+      } finally {
+        inflight = null
+      }
+    })()
+    return inflight
+  }
+}

package/server/routes/display.ts

@@ -13,6 +13,8 @@ import {
 } from '../lib/display-bus.js'
 import { type DisplayTicketVerdict, explainDisplayTicket } from '../lib/display-ticket.js'
 import { timingSafeTokenEqual } from '../lib/token-auth.js'
+import { isWebSessionAuthorized } from '../lib/web-session-auth.js'
+import { getTailnetSelfName } from '../lib/tailnet-self-name.js'
 
 export const displayRouter = Router()
 
@@ -183,7 +185,15 @@ export function __resetDisplayStreamLogForTests(): void {
  * counter with connections that were never the problem.
  */
 function headerAuthorized(req: Request): boolean {
-  return timingSafeTokenEqual(req.headers['x-cos-token'], process.env.COS_API_TOKEN ?? '')
+  const apiToken = process.env.COS_API_TOKEN ?? ''
+  if (timingSafeTokenEqual(req.headers['x-cos-token'], apiToken)) return true
+  // A COS Control Web browser: same origin rules as the /api gate (review note).
+  const port = Number.parseInt(process.env.PORT ?? '3141', 10)
+  const httpsPort = Number.parseInt(process.env.HTTPS_PORT ?? '3143', 10)
+  return isWebSessionAuthorized(req, apiToken, {
+    selfDnsName: getTailnetSelfName().currentSelfDnsName(),
+    allowedPorts: [port, httpsPort],
+  })
 }
 
 /**

package/server/routes/drops.ts

@@ -0,0 +1,260 @@
+/**
+ * Drop it P1 routes (plan sections 1 to 3 and 6). Auth comes from the parent /api mount. All answers are
+ * `Cache-Control: private, no-store`.
+ *
+ * Off by default (lib/drop-settings.ts): while off, every route here except /drops/settings answers
+ * 404 `{ error: { code: 'drop_it_off' } }`, and no drop or feed file is created. The stores open on the first request
+ * after the feature is turned on. GET /api/sessions/today/all-messages, /live-chats and /api/message-counter are not
+ * touched by anything here.
+ *
+ *   GET  /drops/settings                      { protocol, enabled, source, router }
+ *   PUT  /drops/settings  { enabled }         same answer
+ *   POST /drops           { dropId, text, source, hint?: { sessionId, label? }, file? }  DropAnswer
+ *   GET  /drops           ?q&kind&status&limit&before                                   History
+ *   GET  /drops/:id                                                                     DropAnswer
+ *   POST /drops/:id/undo                                                                DropAnswer
+ *   POST /drops/:id/move  { dest, target?: { id, label, domain? } }                     DropAnswer
+ *   POST /drops/:id/ask   { clientJobId, generation }                                   DropAnswer
+ *   POST /drops/:id/sent                                                                DropAnswer
+ *   GET  /inbox/summary                                                                 { unread, waiting, lastLine, lastAt, version }
+ *   GET  /inbox/feed      ?after&limit                                                  { items, version, more }
+ *   POST /inbox/read      { through }                                                   { unread, waiting, version }
+ *   POST /inbox/action    { itemId, action: 'choose:<id>' | 'undo' }                    DropAnswer
+ *   POST /inbox/action    { itemId, action: 'dismiss' }                                 { unread, waiting, version }
+ *   P2:
+ *   POST /inbox/action    { itemId, action: 'when:tomorrow_9' | 'when:monday_9' | 'when:<ISO>' }  DropAnswer
+ *   POST /inbox/action    { itemId, action: 'reminder_done' | 'snooze_1h' | 'snooze_tomorrow' }  { item, drop, unread, waiting, version }
+ *   GET  /inbox/banners   ?bootId&seq                                                   { bootId, seq, banners }
+ *   GET  /drops/reminders                                                               { reminders: [{ id, at, title, notifyId }] }
+ *   POST /drops/search    { q }                                                         DropSearchResult
+ *
+ * `waiting` (6.99.10, plan section 12) is a plain whole number: live questions, live items marked needsReply, and the
+ * Work items in Your move. It clears only when answered, done or dismissed; `unread` clears when the chat is opened.
+ */
+import { Router, type Response } from 'express'
+import { DropError, DropService, type DropInput, type HistoryStatus } from '../lib/drop-service.js'
+import { DROP_DESTS, DROP_KINDS, DropStore, DropStoreError, InboxFeedStore, parseLink, type DropDest, type DropKind } from '../lib/drop-store.js'
+import { dropItCapability, dropItEnabled, dropItEnvValue, writeDropItSetting } from '../lib/drop-settings.js'
+import { dropDailyCap, dropRouterEnabled } from '../lib/drop-router.js'
+import type { DropP2Runtime } from '../lib/drop-p2-runtime.js'
+import type { DropHistorySearcher } from '../lib/drop-history-search.js'
+import { pendingReminders } from '../lib/reminder-scheduler.js'
+import { unavailable } from '../lib/work-search.js'
+import { mergeP2Settings, P2_DEFAULTS, P2_SETTINGS_PROTOCOL, type P2Settings } from '../lib/drop-p2-settings.js'
+
+export interface DropsRouterDependencies {
+  /** The service, opened on first use. Null when its stores cannot open (locked, unsafe, unreadable). */
+  service: () => DropService | null
+  enabled: () => boolean
+  routerStatus?: () => { on: boolean; dailyCap: number; usedToday?: number; breakerOpenUntil?: string | null }
+  writeSetting?: (enabled: boolean) => void
+  /**
+   * 6.99.10: how many Work items are in Your move, or null when the board cannot be read. Counted into `waiting`.
+   * Optional: without it `waiting` counts the chat alone. It must answer quickly (index.ts caches it).
+   */
+  yourMove?: () => Promise<number | null>
+  /** P2: the pings, reminders and follow-ups runtime, when it is running. Its banner outbox is what Control reads. */
+  p2?: () => DropP2Runtime | null
+  /** P2: History search by meaning. Absent: the search answers search_off and word search carries on. */
+  search?: () => DropHistorySearcher | null
+  /** 6.99.11: P2 settings (drop-p2-settings.ts createP2SettingsReader). Absent: GET answers the defaults, PUT 503. */
+  p2Settings?: { read(): P2Settings; write(next: P2Settings): P2Settings }
+}
+const P2_SECTIONS = new Set(['pings', 'followUps', 'checkin', 'reminders', 'banners', 'steer'])
+
+/** How long the summary waits for the Your move count before answering without it. */
+export const YOUR_MOVE_WAIT_MS = 1_500
+async function boundedYourMove(read: (() => Promise<number | null>) | undefined): Promise<number | null> {
+  if (!read) return null
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([read().catch(() => null), new Promise<null>(done => { timer = setTimeout(() => done(null), YOUR_MOVE_WAIT_MS) })])
+  } finally { if (timer) clearTimeout(timer) }
+}
+
+const HISTORY_STATUSES: readonly HistoryStatus[] = ['open', 'in_progress', 'done', 'undone']
+const send = (res: Response, error: unknown) => {
+  if (error instanceof DropError || error instanceof DropStoreError) {
+    return res.status(error.status).json({ error: { code: error.code, message: error.message === error.code ? undefined : error.message } })
+  }
+  console.error('[drops] request failed:', error instanceof Error ? error.name : 'error')
+  return res.status(500).json({ error: { code: 'drop_failed' } })
+}
+const bad = (res: Response, code: string, message?: string) => res.status(400).json({ error: { code, ...(message ? { message } : {}) } })
+const isRecord = (v: unknown): v is Record<string, unknown> => !!v && typeof v === 'object' && !Array.isArray(v)
+
+/** Opens the two stores once, on the first request that needs them. */
+export function lazyDropService(open: () => DropService): () => DropService | null {
+  let service: DropService | null = null
+  return () => {
+    if (service) return service
+    try { service = open() } catch (e) {
+      console.error('[drops] store unavailable:', e instanceof DropStoreError ? e.code : e instanceof Error ? e.name : 'error')
+      return null
+    }
+    return service
+  }
+}
+export function openDropService(dataRoot: (part: string) => string, deps: Omit<ConstructorParameters<typeof DropService>[0], 'drops' | 'feed'>): DropService {
+  const drops = new DropStore(dataRoot('drops'))
+  let feed: InboxFeedStore
+  try { feed = new InboxFeedStore(dataRoot('inbox')) } catch (e) { drops.close(); throw e }
+  return new DropService({ ...deps, drops, feed })
+}
+
+export function createDropsRouter(deps: DropsRouterDependencies): Router {
+  const router = Router()
+  router.use(['/drops', '/inbox'], (_req, res, next) => { res.set('Cache-Control', 'private, no-store'); next() })
+
+  const settingsView = () => ({ ...dropItCapability(), router: deps.routerStatus?.() ?? { on: dropRouterEnabled(), dailyCap: dropDailyCap() } })
+  router.get('/drops/settings', (_req, res) => res.json(settingsView()))
+  router.put('/drops/settings', (req, res) => {
+    if (!isRecord(req.body) || typeof req.body.enabled !== 'boolean' || Object.keys(req.body).length !== 1) return bad(res, 'invalid_settings', 'Send { "enabled": true } or { "enabled": false }.')
+    try { (deps.writeSetting ?? writeDropItSetting)(req.body.enabled) } catch {
+      return res.status(503).json({ error: { code: 'settings_unwritable' } })
+    }
+    // An environment value wins (COS_DROP_IT); the answer says so through `source`.
+    return res.json({ ...settingsView(), ...(dropItEnvValue() !== null ? { savedButEnvWins: true } : {}) })
+  })
+
+  // 6.99.11 P2 settings, readable and writable while Drop it is off (as the switch is), so they can be set first.
+  const p2View = (settings: P2Settings) => ({ protocol: P2_SETTINGS_PROTOCOL, settings, defaults: P2_DEFAULTS })
+  router.get('/drops/settings/p2', (_req, res) => res.json(p2View(deps.p2Settings?.read() ?? P2_DEFAULTS)))
+  router.put('/drops/settings/p2', (req, res) => {
+    const body = req.body
+    if (!isRecord(body) || !Object.keys(body).length || Object.keys(body).some(k => !P2_SECTIONS.has(k)) || Object.values(body).some(v => !isRecord(v))) {
+      return bad(res, 'invalid_settings', 'Send one or more sections: pings, followUps, checkin, reminders, banners, steer.')
+    }
+    if (!deps.p2Settings) return res.status(503).json({ error: { code: 'settings_unwritable' } })
+    try { return res.json(p2View(deps.p2Settings.write(mergeP2Settings(deps.p2Settings.read(), body)))) } catch {
+      return res.status(503).json({ error: { code: 'settings_unwritable' } })
+    }
+  })
+
+  // Everything else exists only while the feature is on.
+  router.use(['/drops', '/inbox'], (_req, res, next) => {
+    if (!deps.enabled()) return res.status(404).json({ error: { code: 'drop_it_off', message: 'Drop it is off on this server.' } })
+    next()
+  })
+  const withService = (res: Response, fn: (s: DropService) => unknown) => {
+    const service = deps.service()
+    if (!service) return res.status(503).json({ error: { code: 'drop_store_unavailable' } })
+    return fn(service)
+  }
+
+  router.post('/drops', (req, res) => withService(res, async service => {
+    const b = req.body
+    if (!isRecord(b) || Object.keys(b).some(k => !['dropId', 'text', 'source', 'hint', 'file'].includes(k))) return bad(res, 'invalid_drop')
+    try { return res.json(await service.submit(b as unknown as DropInput)) } catch (e) { return send(res, e) }
+  }))
+
+  router.get('/drops', (req, res) => withService(res, async service => {
+    const q = typeof req.query.q === 'string' ? req.query.q.trim() : undefined
+    const kind = req.query.kind, status = req.query.status
+    if (q !== undefined && q.length > 200) return bad(res, 'invalid_query')
+    if (kind !== undefined && !(DROP_KINDS as readonly unknown[]).includes(kind)) return bad(res, 'invalid_kind')
+    if (status !== undefined && !(HISTORY_STATUSES as readonly unknown[]).includes(status)) return bad(res, 'invalid_status')
+    const limit = req.query.limit === undefined ? undefined : Number(req.query.limit)
+    if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 200)) return bad(res, 'invalid_limit')
+    const before = typeof req.query.before === 'string' ? req.query.before : undefined
+    try { return res.json(await service.history({ q: q || undefined, kind: kind as DropKind | undefined, status: status as HistoryStatus | undefined, limit, before })) }
+    catch (e) { return send(res, e) }
+  }))
+
+  // P2, registered before /drops/:id so 'reminders' is never read as a drop id.
+  router.get('/drops/reminders', (_req, res) => withService(res, async service => {
+    try { return res.json({ reminders: pendingReminders(service.p2Stores().drops) }) } catch (e) { return send(res, e) }
+  }))
+  router.get('/drops/:id', (req, res) => withService(res, service => {
+    try { return res.json(service.get(req.params.id)) } catch (e) { return send(res, e) }
+  }))
+  router.post('/drops/:id/undo', (req, res) => withService(res, async service => {
+    try { return res.json(await service.undo(req.params.id)) } catch (e) { return send(res, e) }
+  }))
+  router.post('/drops/:id/move', (req, res) => withService(res, async service => {
+    const b = req.body
+    if (!isRecord(b) || !(DROP_DESTS as readonly unknown[]).includes(b.dest)) return bad(res, 'invalid_move')
+    let target: { id: string; label: string; domain?: string } | undefined
+    if (b.target !== undefined) {
+      const t = b.target
+      if (!isRecord(t)) return bad(res, 'invalid_move')
+      target = { id: t.id as string, label: t.label as string, ...(t.domain !== undefined ? { domain: t.domain as string } : {}) }
+      // The store's own link rule (length, no control characters, id shape), checked before anything is undone or written.
+      try { parseLink({ kind: 'card', ...target }) } catch { return bad(res, 'invalid_move', 'That destination cannot be used.') }
+    }
+    const dest = b.dest as DropDest
+    if ((dest === 'new_card' && !target?.domain) || ((dest === 'existing_card') && (!target?.domain)) || ((dest === 'thread' || dest === 'session') && !target)) return bad(res, 'invalid_move', 'This destination needs a target.')
+    // A new card takes its domain as its target id.
+    const resolved = dest === 'new_card' && target ? { ...target, id: target.domain! } : target
+    try { return res.json(await service.move(req.params.id, { dest, target: resolved })) } catch (e) { return send(res, e) }
+  }))
+  router.post('/drops/:id/ask', (req, res) => withService(res, async service => {
+    const b = req.body
+    if (!isRecord(b) || typeof b.clientJobId !== 'string' || !Number.isSafeInteger(b.generation)) return bad(res, 'invalid_ask_link')
+    try { return res.json(await service.linkAsk(req.params.id, b.clientJobId, b.generation as number)) } catch (e) { return send(res, e) }
+  }))
+  router.post('/drops/:id/sent', (req, res) => withService(res, async service => {
+    try { return res.json(await service.holdSent(req.params.id)) } catch (e) { return send(res, e) }
+  }))
+
+  router.get('/inbox/summary', (_req, res) => withService(res, async service => {
+    try { await service.syncAsks() } catch { /* a summary never fails for a lookup */ }
+    const yourMove = await boundedYourMove(deps.yourMove)
+    try { return res.json(service.summary({ yourMove })) } catch (e) { return send(res, e) }
+  }))
+  router.get('/inbox/feed', (req, res) => withService(res, async service => {
+    const after = typeof req.query.after === 'string' ? req.query.after : undefined
+    const limit = req.query.limit === undefined ? undefined : Number(req.query.limit)
+    if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 200)) return bad(res, 'invalid_limit')
+    try { await service.syncAsks() } catch { /* the chat still reads */ }
+    try { return res.json(service.feed({ after, limit })) } catch (e) { return send(res, e) }
+  }))
+  router.post('/inbox/read', (req, res) => withService(res, async service => {
+    if (!isRecord(req.body) || typeof req.body.through !== 'string') return bad(res, 'invalid_read')
+    let out: { unread: number; waiting: number; version: number }
+    try { out = service.markRead(req.body.through) } catch (e) { return send(res, e) }
+    // The same `waiting` the summary gives, Work's Your move included.
+    const yourMove = await boundedYourMove(deps.yourMove)
+    return res.json({ ...out, waiting: service.summary({ yourMove }).waiting })
+  }))
+  router.post('/inbox/action', (req, res) => withService(res, async service => {
+    const b = req.body
+    if (!isRecord(b) || typeof b.itemId !== 'string' || typeof b.action !== 'string') return bad(res, 'invalid_action')
+    try {
+      if (b.action.startsWith('choose:')) return res.json(await service.choose(b.itemId, b.action.slice('choose:'.length)))
+      if (b.action === 'undo') {
+        return res.json(await service.undo(service.threadOf(b.itemId)))
+      }
+      if (b.action.startsWith('when:')) return res.json(await service.setReminderTime(b.itemId, b.action.slice('when:'.length)))
+      if (b.action === 'reminder_done' || b.action === 'snooze_1h' || b.action === 'snooze_tomorrow') {
+        const out = service.reminderAction(b.itemId, b.action)
+        const yourMove = await boundedYourMove(deps.yourMove)
+        const sum = service.summary({ yourMove })
+        return res.json({ ...out, unread: sum.unread, waiting: sum.waiting, version: sum.version })
+      }
+      if (b.action === 'dismiss') {
+        const out = service.dismiss(b.itemId)
+        const yourMove = await boundedYourMove(deps.yourMove)
+        return res.json({ ...out, waiting: service.summary({ yourMove }).waiting })
+      }
+      return bad(res, 'invalid_action')
+    } catch (e) { return send(res, e) }
+  }))
+  // ── P2 ──
+  router.get('/inbox/banners', (req, res) => withService(res, async () => {
+    const runtime = deps.p2?.()
+    if (!runtime) return res.status(503).json({ error: { code: 'pings_unavailable' } })
+    const bootId = typeof req.query.bootId === 'string' ? req.query.bootId : undefined
+    const seq = typeof req.query.seq === 'string' && /^\d{1,9}$/.test(req.query.seq) ? Number(req.query.seq) : undefined
+    return res.json(runtime.banners({ bootId, seq }))
+  }))
+  router.post('/drops/search', (req, res) => withService(res, async service => {
+    const searcher = deps.search?.()
+    if (!searcher) return res.json(unavailable('search_off'))
+    const q = isRecord(req.body) ? req.body.q : undefined
+    try { return res.json(await searcher.search(q, service.p2Stores().drops.list())) } catch (e) { return send(res, e) }
+  }))
+  return router
+}
+
+export { dropItEnabled }

package/server/routes/health.ts

@@ -1,3 +1,4 @@
+import { dropItCapability } from '../lib/drop-settings.js'
 import { phoneMicrophoneMeetingsCapability } from '../lib/phone-recording.js'
 import { macLiveVoicesSnapshot } from '../lib/mac-window-replay.js'
 import { DICTATION_CLEAN_MODELS } from '../lib/dictation-clean-models.js'
@@ -77,8 +78,10 @@ import { getLocalTtsHealth, refreshLocalTtsHealth } from '../lib/tts-local.js'
 import { liveCuesCapability } from '../lib/live-cues-capability.js'
 import { liveCuesV2Advertised } from '../lib/live-cues-v2.js'
 import { liveMeetingCapability } from '../lib/live-provisional.js'
+import { TITLE_STEER_CAPABILITY } from '../lib/meeting-title-steer.js'
 import { CUE_KINDS } from '../../shared/live-cues-v2.js'
 import { tailscaleNudgeHealthField } from '../lib/tailscale-nudge.js'
+import { WEB_PHONE_LINK_CAPABILITY, webControlEnabled } from './web-control.js'
 
 /** 6.86.0: `capabilities.liveCues.kinds`, the cue kinds this server can write (additive; an older server omits it, which
  *  is how a client knows to expect only reinforce and challenge). Which kinds a given meeting gets is in its arm answer. */
@@ -503,6 +506,10 @@ healthRouter.get('/health', async (_req, res) => {
       // reads it before it holds a token, and an older server omits it, which is how
       // the phone knows to say "Update COS on your Mac (server 6.67 or newer)".
       pairing: { version: PAIRING_PROTOCOL_VERSION },
+      // Open COS on the web from the glasses app: POST /api/web-session/phone-link (routes/web-control.ts).
+      // Present only while COS Control Web is on, which is when the route is mounted. An older
+      // server omits it, and the app then hides its row.
+      ...(webControlEnabled() ? { webPhoneLink: WEB_PHONE_LINK_CAPABILITY } : {}),
       // Advertised on the PUBLIC health route on purpose: a client deciding whether
       // to request a display ticket may not hold a usable token yet, and an old
       // server simply omits this key, which is how a new client detects it.
@@ -527,6 +534,10 @@ healthRouter.get('/health', async (_req, res) => {
       liveCues: withCueKinds(liveCues),
       ...(liveCuesV2Advertised() ? { liveCuesV2: liveCuesV2Advertised() } : {}),
       liveMeeting: liveMeetingCapability(),
+      // 6.99.0: GET/PUT /api/meeting/title-steer (lib/meeting-title-steer.ts). Absent on an older server.
+      titleSteer: TITLE_STEER_CAPABILITY,
+      // Drop it P1: the pinned COS chat (routes/drops.ts). Codes only; `enabled` is false unless turned on. Absent on an older server.
+      dropIt: dropItCapability(),
       // 6.77.0: codes only (this route is public): the protocol and whether the switch is on.
       transcriptCleanup: transcriptCleanupAdvertised(),
       richMedia: {
@@ -708,6 +719,7 @@ healthRouter.get('/models', async (req, res) => {
         // 6.78.0 Messages steer: present only with COS_MESSAGES_STEER on and a Claude CLI that
         // takes stream-json input (probed once). Absent, the app shows today's UI.
         ...steerCapabilityField(durableJobs.enabled),
+        ...(durableJobs.enabled ? { maintenanceWorkflows: ['meeting-consolidation-v1'] } : {}),
       },
       // 6.52.0: the session questions API and its client contract. A client polls
       // `GET /api/session-questions?client=glasses|phone` every `pollIntervalMs`; one
@@ -736,6 +748,10 @@ healthRouter.get('/models', async (req, res) => {
       liveCues: withCueKinds(liveCuesCapability()),
       ...(liveCuesV2Advertised() ? { liveCuesV2: liveCuesV2Advertised() } : {}),
       liveMeeting: liveMeetingCapability(),
+      // 6.99.0: GET/PUT /api/meeting/title-steer (lib/meeting-title-steer.ts). Absent on an older server.
+      titleSteer: TITLE_STEER_CAPABILITY,
+      // Drop it P1: the pinned COS chat (routes/drops.ts). Codes only; `enabled` is false unless turned on. Absent on an older server.
+      dropIt: dropItCapability(),
       richMedia: {
         video: richMedia.video,
         maxPromptVisuals: MAX_MODEL_IMAGE_INPUTS,

package/server/routes/live-cues.ts

@@ -27,7 +27,7 @@ import {
   LIVE_CUES_GENERAL_LIMIT_BOUNDS, LIVE_CUES_GENERAL_LIMIT_NAMES, LIVE_CUES_V2_LIMIT_BOUNDS, LIVE_CUES_V2_LIMIT_NAMES, generalLimitInBounds, isCueMode, isGrounding, limitInBounds,
   type LiveCuesGeneralStoredLimits, type LiveCuesV2StoredLimits,
 } from '../lib/live-cues-v2-settings.js'
-import { LIVE_CUES_V2_LIMITS, LiveCuesV2ArmError, liveCuesV2, liveCuesV2Advertised, liveCuesV2Enabled, liveCuesV2MeetingCounters, liveCuesV2SettingsView, peekLiveCuesV2, setLiveCuesV2Enabled } from '../lib/live-cues-v2.js'
+import { LiveCuesV2ArmError, resolveLiveCuesV2Limits, liveCuesV2, liveCuesV2Advertised, liveCuesV2Enabled, liveCuesV2MeetingCounters, liveCuesV2SettingsView, peekLiveCuesV2, setLiveCuesV2Enabled } from '../lib/live-cues-v2.js'
 import { LIVE_CUE_VERDICTS_PROTOCOL, LIVE_CUE_VERDICT_LIMITS, VerdictsUnreadableError, isCueVerdict, liveCueVerdicts } from '../lib/live-cue-verdicts.js'
 
 const SESSION_ID = /^[A-Za-z0-9:_-]{3,96}$/
@@ -183,13 +183,14 @@ liveCuesRouter.get('/live-cues/history', (req, res) => {
   try {
     const verdicts = liveCueVerdicts()
     const history = verdicts.history({ days, limit, unrated: unrated === '1', ...(sessionIds.length ? { sessionIds } : {}) })
-    const C = LIVE_CUES_V2_LIMITS
+    // 6.99.0: the cap as set now (Settings or env), not the built-in 25: the cap can be raised to 50, writer calls stay twice it.
+    const capNow = resolveLiveCuesV2Limits().maxCuesPerMeeting.value, writerCapNow = 2 * capNow
     const meetings = sessionIds.length ? Object.fromEntries(sessionIds.map(id => {
       // The engine's counters expire 24 h after a meeting; past that the log's count stands in and writerCalls is unknown.
       const counters = liveCuesV2MeetingCounters(id)
-      return [id, { cues: counters?.cues ?? verdicts.loggedCues(id), cap: C.maxCuesPerMeeting, writerCalls: counters?.writerCalls ?? null, writerCap: C.maxWriterCallsPerMeeting }]
+      return [id, { cues: counters?.cues ?? verdicts.loggedCues(id), cap: capNow, writerCalls: counters?.writerCalls ?? null, writerCap: writerCapNow }]
     })) : undefined
-    return res.json({ ...history, maxCuesPerMeeting: C.maxCuesPerMeeting, ...(meetings ? { meetings } : {}) })
+    return res.json({ ...history, maxCuesPerMeeting: capNow, ...(meetings ? { meetings } : {}) })
   } catch (error) {
     if (error instanceof VerdictsUnreadableError) return res.status(503).json({ error: 'the verdicts file is unreadable', reason: error.code })
     return res.status(500).json({ error: 'history_unavailable' })

package/server/routes/meeting.ts

@@ -19,7 +19,7 @@ import { existsSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync } f
 import { isWorthRecovering } from '../lib/quarantine-auto-recover.js'
 import { basename, resolve } from 'node:path'
 import { createHash } from 'node:crypto'
-import { Router, type RequestHandler } from 'express'
+import { Router, type RequestHandler, type Response } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { createStopRequestStore, isStopRequestRefusal, STOP_REQUEST_CLAIM_WINDOW_MS, type StopRequest, type StopRequestStore } from '../lib/meeting-stop-requests.js'
 import { appendAutonomousSaveLog, getStopIntentStore, type StopIntent, type StopIntentStore } from '../lib/meeting-stop-intents.js'
@@ -153,6 +153,7 @@ import {
   getSessionChunks,
   getSessionProviderCandidates,
   getSessionStartTime,
+  publishLiveTitleSteer,
   getSessionTranscript,
   getMeetingSessionStatus,
   getStrandedCaptures,
@@ -175,6 +176,7 @@ import {
 import { derivedSourcesFor, findDerivedRecord } from '../lib/imported-library-rows.js'
 import { assertVoiceEvidenceSource } from '../lib/voice-evidence-guard.js'
 import { domainForMeeting, resolveDomains } from '../lib/domains.js'
+import { effectiveSaveTitle, getTitleSteerStore, normalizeTitleSteer, TitleSteerError, type TitleSteerStore } from '../lib/meeting-title-steer.js'
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
 import {
   DEATTRIBUTED_PREFIX,
@@ -319,6 +321,8 @@ interface MeetingSessionSource {
   delete(sessionId: string, options?: { preserveAudio?: boolean }): void
   /** 6.53.3: live, closed within its retention, or unknown (`getMeetingSessionStatus`). */
   getState?(sessionId: string): 'active' | 'closed' | 'missing'
+  /** 6.99.0: write a changed title steer into the live session's record (transcribe-stream publishLiveTitleSteer). */
+  publishTitleSteer?(sessionId: string): boolean
   /** 6.81.0: the received/ASR ledger the server's own save of a stopped meeting reads. */
   getLedger?(sessionId: string): SessionLedger
 }
@@ -340,6 +344,8 @@ function defaultSessionLedger(sessionId: string): SessionLedger {
 
 export interface MeetingRouteDependencies {
   store?: MeetingStore
+  /** 6.99.0: the live title steer ledger (lib/meeting-title-steer.ts). Tests inject one on a scratch path. */
+  titleSteer?: TitleSteerStore
   /** 6.93.0: is any meeting capture (glasses, Mac or iPhone) live right now? Assigning a Mac voice to a profile is refused while one is. */
   captureActive?: () => boolean
   sessions?: MeetingSessionSource
@@ -656,6 +662,7 @@ const defaultSessionSource: MeetingSessionSource = {
   moveAudioToPending: moveSessionAudioToPending,
   delete: deleteSession,
   getState: defaultSessionState,
+  publishTitleSteer: publishLiveTitleSteer,
 }
 
 function countWords(text: string): number {
@@ -794,6 +801,7 @@ const macAssignInFlight = new Set<string>()
 
 export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router {
   const store = deps.store ?? getMeetingStore()
+  const titleSteer = deps.titleSteer ?? getTitleSteerStore()
   const sessions = deps.sessions ?? defaultSessionSource
   const runBatch = deps.runBatch ?? runMeetingBatchPipeline
   const scheduleBackground = deps.scheduleBackground ?? (task => { void task })
@@ -886,6 +894,43 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   })
   autoDeps.onCreate?.(autonomousFinalizer)
 
+  // ── 6.99.0: title steer ─────────────────────────────────────────────────────────────
+  // A name typed in COS Control while a Mac recording or glasses meeting is live. It is a hint the title model receives
+  // at save (and the title itself when the save sends none), never the final word. See lib/meeting-title-steer.ts.
+  // The title is never logged here or anywhere: names and companies. Length only.
+  const steerFailure = (res: Response, error: unknown, sessionId: string) => {
+    if (error instanceof TitleSteerError) {
+      res.status(error.status).json({ error: error.reason, reason: error.reason, ...(error.reason === 'title_changed' ? { current: titleSteer.get(sessionId) } : {}) })
+      return
+    }
+    console.error('[meeting/title-steer] Unexpected failure:', error instanceof Error ? error.name : 'unknown')
+    res.status(500).json({ error: 'title_steer_error', reason: 'title_steer_error' })
+  }
+  router.get('/meeting/title-steer', (req, res) => {
+    const sessionId = typeof req.query.sessionId === 'string' ? req.query.sessionId : ''
+    res.set('Cache-Control', 'private, no-store')
+    try { res.json(titleSteer.get(sessionId)) } catch (error) { steerFailure(res, error, sessionId) }
+  })
+  router.put('/meeting/title-steer', (req, res) => {
+    const body = (req.body ?? {}) as Record<string, unknown>
+    const sessionId = typeof body.sessionId === 'string' ? body.sessionId : ''
+    res.set('Cache-Control', 'private, no-store')
+    try {
+      // Malformed input is a 400 whether or not the session is live; only a well-formed request earns a 404/409.
+      titleSteer.get(sessionId)
+      normalizeTitleSteer(body.title)
+      if (!Number.isSafeInteger(body.expectedRevision) || (body.expectedRevision as number) < 0) throw new TitleSteerError('invalid_revision', 400)
+      if ((sessions.getState ?? defaultSessionState)(sessionId) !== 'active') throw new TitleSteerError('session_not_live', 404)
+      // The save reads the steer once, then awaits before it closes the session. A rename in that gap would answer 200 and miss the
+      // filed meeting, so it is refused: the meeting is being filed under the name it had.
+      if (savingSessions.has(sessionId)) throw new TitleSteerError('save_in_progress', 409)
+      const view = titleSteer.set(sessionId, body.title, body.expectedRevision)
+      ;(sessions.publishTitleSteer ?? (() => false))(sessionId)
+      console.log(`[meeting/title-steer] ${view.title ? 'set' : 'cleared'} ${sessionId} length=${view.title ? Array.from(view.title).length : 0} revision=${view.revision}`)
+      res.json(view)
+    } catch (error) { steerFailure(res, error, sessionId) }
+  })
+
   let recoveryPendingLogged = false
   router.get('/meeting/sessions/:sessionId/status', (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
@@ -963,6 +1008,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       disposition: publicDisposition(disposition),
       // 6.81.0, additive: the Stop the server holds for this meeting, if any. Older clients ignore it.
       stopIntent: intent ? publicStopIntent(intent) : null,
+      // 6.99.0, additive: the name typed while it recorded (null = none). Older clients ignore it.
+      titleSteer: titleSteer.title(sessionId),
     })
   })
 
@@ -1371,14 +1418,19 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // save — infer from the content instead of filing everything under one
       // domain. Keyword scoring, no model call: this runs on every save, and a
       // per-meeting LLM call would breach the recurring-caller rule.
+      // 6.99.0: the title steer (a name typed while it recorded) is the title when the request sends none, and is filed
+      // beside the title either way so the title model can read it. It feeds the domain through the title, as a title does.
+      const steer = titleSteer.title(sessionId)
+      const savedTitle = effectiveSaveTitle(body?.title, steer)
       const filedDomain = domainForMeeting(
         body?.domain as string | undefined,
-        `${(body?.title as string | undefined) ?? ''}\n${transcript}`,
+        `${savedTitle ?? ''}\n${transcript}`,
         resolveCosOperationsDir(),
       )
       const saved = store.save({
         sessionId,
-        title: body?.title as string | undefined,
+        title: savedTitle,
+        ...(steer ? { titleSteer: steer } : {}),
         domain: filedDomain,
         transcript: cleanFinalTranscript(transcript),
         startTime,
@@ -3496,12 +3548,16 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         words: item.words,
         canonical: true,
       }))
+      // 6.99.0: same rule as POST /meeting/save: the title steer names the meeting when the request does not.
+      const steer = titleSteer.title(sessionId)
+      const recoveredTitle = effectiveSaveTitle(body.title, steer)
       const saved = store.save({
         sessionId,
-        title: typeof body.title === 'string' && body.title.trim() ? body.title : undefined,
+        title: recoveredTitle,
+        ...(steer ? { titleSteer: steer } : {}),
         domain: domainForMeeting(
           typeof body.domain === 'string' && body.domain.trim() ? body.domain : undefined,
-          `${typeof body.title === 'string' ? body.title : ''}\n${transcript}`,
+          `${recoveredTitle ?? ''}\n${transcript}`,
           resolveCosOperationsDir(),
         ),
         transcript,

package/server/routes/permission-broker.ts

@@ -30,6 +30,13 @@
 // so a surface that only shows a count can poll without making the Mac hold questions it
 // cannot answer. It checks X-Cos-Token itself as well, in constant time, and a request
 // without it is refused and never counted, whatever sits in front of this router.
+// 6.99.12: COS Control Web reads the same list with its signed browser session (the
+// `cos_web_session` cookie, verified by `webSessionAuthorized`, the check the /api gate runs).
+// The hook token still opens nothing here. A browser poll counts as a live answering client
+// only with `?client=web`, which the page sends only while it shows the cards (a visible tab);
+// the same 30 s window as the phone. A cookie poll naming `glasses` or `phone`, or no client,
+// never counts, and a token poll naming `web` never counts either. A browser never reports
+// wearer presence, so it never enables the away hold.
 // 6.60.0: a poll with `&hold=1&presenceAgeMs=<int>` (COS Glasses 6.9.563 and later) records
 // wearer presence for the away hold instead of the 6.59.0 liveness; a `hold=1` poll without
 // a valid `presenceAgeMs` makes no client live and enables no hold. The response adds
@@ -40,6 +47,7 @@ import { timingSafeTokenEqual } from '../lib/token-auth.js'
 import {
   ANSWERING_CLIENTS,
   CLIENT_LIVE_WINDOW_MS,
+  WEB_ANSWERING_CLIENT,
   SESSION_QUESTIONS_PROTOCOL_VERSION,
   type BrokerAdmission,
   type HookReplyChannel,
@@ -138,8 +146,13 @@ export function createPermissionBrokerHookRouter(deps: PermissionBrokerHookRoute
 
 export interface SessionQuestionsRouterDeps {
   broker: PermissionBroker
-  /** The pairing token (X-Cos-Token). A poll counts as a live client only with it. */
+  /** The pairing token (X-Cos-Token). A poll counts as a live client only with it, or with the web session below. */
   apiToken: () => string
+  /**
+   * 6.99.12: whether this request carries a valid COS Control Web session (the cookie, its epoch, and the origin
+   * rules: `isWebSessionAuthorized` in production). Absent: only the token opens the list, as before.
+   */
+  webSessionAuthorized?: (req: Request) => boolean
   /** Where a counted poll is recorded; `noteQuestionsPoll` in production. */
   notePoll?: (at: number, poll: QuestionsPollFacts) => void
   now?: () => number
@@ -171,14 +184,21 @@ export function createSessionQuestionsRouter(deps: SessionQuestionsRouterDeps):
     res.set('Cache-Control', 'private, no-store')
     let expected = ''
     try { expected = deps.apiToken() } catch { expected = '' }
+    const byToken = timingSafeTokenEqual(req.headers['x-cos-token'], expected)
+    let byWebSession = false
+    if (!byToken && deps.webSessionAuthorized) {
+      try { byWebSession = deps.webSessionAuthorized(req) === true } catch { byWebSession = false }
+    }
     // A hook token, or nothing: refused, and never a live client.
-    if (!timingSafeTokenEqual(req.headers['x-cos-token'], expected)) {
+    if (!byToken && !byWebSession) {
       res.status(401).json({ error: 'unauthorized' })
       return
     }
     // Only a client that says it can answer (and shows the cards) counts as live.
     const client = typeof req.query.client === 'string' ? req.query.client : ''
-    if (ANSWERING_CLIENTS.has(client)) notePoll(now(), questionsPollFacts(req.query as Record<string, unknown>))
+    if (byToken && ANSWERING_CLIENTS.has(client)) notePoll(now(), questionsPollFacts(req.query as Record<string, unknown>))
+    // 6.99.12: a browser counts only as `web`, and never with presence (no away hold from a tab).
+    else if (byWebSession && client === WEB_ANSWERING_CLIENT) notePoll(now(), {})
     const health = deps.broker.health()
     // Listed first: a deadline the timer has not caught yet is settled by the listing.
     const items = deps.broker.list()