@gotcos/glasses-server 6.98.1 → 6.99.12

package/server/lib/meeting-store.ts

@@ -183,6 +183,8 @@ export interface MeetingDetail extends MeetingMeta {
 export interface SaveMeetingInput {
   sessionId: string
   title?: string
+  /** 6.99.0: the name typed in COS Control while it recorded. Filed beside the title (header row + sidecar `titleSteer`) so the title model can read it. */
+  titleSteer?: string
   domain?: string
   transcript: string
   startTime: number
@@ -339,6 +341,48 @@ const SIDECAR_HEAD_BYTES = 4096
  * a matching prefix alone cannot prove a valid committed capture. */
 const SAVE_RECEIPT_SIDECAR_MAX_BYTES = 32 * 1024 * 1024
 
+/** 6.99.7: findBySessionId read and parsed every saved sidecar (813 files, 1.8 GB on Miles's Mac) on the main thread
+ * for any session not yet saved, and Control asks that of each live recording every few seconds. Two live recordings
+ * froze the server for 4 to 17 s at a time, so dictation's 5 s capability check timed out ("Server stopped").
+ * A sidecar's top-level sessionId is remembered by file stamp (inode, size, mtime): a lookup now stats files and
+ * fully reads only the one that matches. null means the sidecar has no sessionId, so it can never match. */
+const sidecarSessions = new Map<string, { stamp: string; sessionId: string | null }>()
+const SIDECAR_SESSION_CACHE_MAX = 50_000
+
+function sidecarStamp(path: string): string | undefined {
+  try {
+    const st = lstatSync(path, { throwIfNoEntry: false })
+    return st?.isFile() ? `${st.ino}:${st.size}:${st.mtimeMs}` : undefined
+  } catch {
+    return undefined
+  }
+}
+
+function knownSidecarSession(path: string, stamp: string): string | null | undefined {
+  const entry = sidecarSessions.get(path)
+  return entry && entry.stamp === stamp ? entry.sessionId : undefined
+}
+
+function rememberSidecarSession(path: string, stamp: string, sessionId: string | null): void {
+  if (sidecarSessions.size >= SIDECAR_SESSION_CACHE_MAX && !sidecarSessions.has(path)) sidecarSessions.clear()
+  sidecarSessions.set(path, { stamp, sessionId })
+}
+
+/** The top-level sessionId from a sidecar's head, only when nothing but scalar members precede it (so it cannot be a
+ * nested object's sessionId). Every saved sidecar starts `{"schemaVersion": N, "sessionId": ...`; a Mac capture puts
+ * its captureSource object first, so its head is undecided (undefined) and it is read in full once, then remembered. */
+const SIDECAR_HEAD_SESSION = /^\s*\{(?:\s*"[A-Za-z0-9_]+"\s*:\s*(?:-?[0-9][0-9.eE+-]*|true|false|null|"(?:[^"\\]|\\.)*")\s*,)*\s*"sessionId"\s*:\s*"([A-Za-z0-9:_-]{3,96})"/
+
+export function sidecarHeadSessionId(head: string | null): string | undefined {
+  if (!head) return undefined
+  return SIDECAR_HEAD_SESSION.exec(head)?.[1]
+}
+
+/** Tests only. */
+export function clearSidecarSessionCache(): void {
+  sidecarSessions.clear()
+}
+
 export class MeetingStore {
   readonly root: string
 
@@ -362,6 +406,10 @@ export class MeetingStore {
     const parts = localParts(input.startTime)
     const fallbackTitle = `${mac ? 'Mac' : phone ? 'iPhone' : 'G2'} Recording ${parts.date} ${parts.hourMinute}`
     const title = normalizeTitle(input.title, fallbackTitle)
+    // Kept faithful (slashes stay): it was normalized when typed. This only makes a hand-built input safe to file.
+    const titleSteerText = (input.titleSteer ?? '').normalize('NFKC').replace(/[\u0000-\u001f\u007f]/g, ' ').replace(/\s+/g, ' ').trim()
+    // By code points, like the ledger: a UTF-16 slice could cut an emoji in half.
+    const titleSteer = Array.from(titleSteerText).slice(0, 120).join('')
     const stem = filenameStem(title, `${mac ? 'Mac' : phone ? 'iPhone' : 'G2'}_Recording_${parts.hourMinute}`)
     const durationMs = Number.isFinite(input.durationMs) ? Math.max(0, input.durationMs) : 0
     const durationMin = Math.round(durationMs / 60_000)
@@ -405,6 +453,7 @@ export class MeetingStore {
       ...(phone ? ['| **Capture source** | iphone_microphone |', '| **Speaker policy** | anonymous |'] : []),
       ...(mac ? ['| **Capture source** | mac_system_audio |', '| **Captured voices** | Other participants only |'] : []),
       `| **Domain** | ${escapeTableValue(domain)} |`,
+      ...(titleSteer ? [`| **Title steer** | ${escapeTableValue(titleSteer)} |`] : []),
       `| **Transfer integrity** | ${integrityValue} |`,
       '| **Transcription quality** | streaming |',
       '',
@@ -436,6 +485,7 @@ export class MeetingStore {
       durationMs,
       domain,
       title,
+      ...(titleSteer ? { titleSteer } : {}),
       canonicalProvider: canonicalProvider(input.chunks),
       providers,
       providerCandidates: input.providerCandidates ?? {},
@@ -496,10 +546,21 @@ export class MeetingStore {
         .sort()
         .reverse()
       for (const sidecarName of sidecars) {
+        // 6.99.7: skip a sidecar whose top-level sessionId is already known to differ, from the stamp cache or the
+        // file's head, before reading and parsing all of it. Unknown falls through to the full read, as before.
+        const sidecarPath = join(monthDir, sidecarName)
+        const stamp = sidecarStamp(sidecarPath)
+        let known = stamp ? knownSidecarSession(sidecarPath, stamp) : undefined
+        if (known === undefined) {
+          known = sidecarHeadSessionId(safeReadFileHead(monthDir, monthReal, sidecarName, SIDECAR_HEAD_BYTES))
+          if (known !== undefined && stamp) rememberSidecarSession(sidecarPath, stamp, known)
+        }
+        if (known !== undefined && known !== sessionId) continue
         const sidecarText = safeReadFile(monthDir, monthReal, sidecarName, SAVE_RECEIPT_SIDECAR_MAX_BYTES)
         if (sidecarText === null) continue
         try {
           const sidecar = JSON.parse(sidecarText) as Record<string, unknown>
+          if (stamp) rememberSidecarSession(sidecarPath, stamp, typeof sidecar.sessionId === 'string' ? sidecar.sessionId : null)
           if (sidecar.sessionId !== sessionId) continue
           if (sessionId.startsWith('phone_')) {
             const capture = sidecar.captureSource as Record<string, unknown> | undefined

package/server/lib/meeting-title-steer.ts

@@ -0,0 +1,200 @@
+// Title steer (6.99.0): a name the person types for a meeting WHILE it is recording.
+//
+// WHY. A live Mac recording or glasses meeting is listed as "Mac recording 10:39 PM" until the title model names it at
+// save. Miles wants to rename it live in COS Control. The typed name is a STEER, not the final title: it shows
+// everywhere at once, and at save the title model receives it as a strong hint (the pipeline keeps his names, companies
+// and topic and may sharpen the wording). When a save carries no title of its own the steer becomes the title.
+//
+// WHAT THIS MODULE IS. One small durable ledger: sessionId -> { title, revision, updatedAt }. The shape is the one
+// meeting-ask's context store uses: a per-session revision, and a write that names the revision it read
+// (`expectedRevision`) so two clients editing never silently overwrite each other (409 `title_changed`).
+//
+// WHAT IT IS NOT. It never decides whether a session is live (the route does, from the session map), never touches the
+// transcript, and never logs the title: titles carry names and companies. Callers log a LENGTH only.
+
+import { existsSync, mkdirSync, readFileSync, renameSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { dataPath } from './data-dir.js'
+
+export const TITLE_STEER_FILE_NAME = 'meeting-title-steer.json'
+/** Longest steer, in characters (code points) after normalization. */
+export const TITLE_STEER_MAX_CHARS = 120
+/** An entry untouched this long is dropped. A meeting is saved or abandoned well inside it. */
+export const TITLE_STEER_RETAIN_MS = 7 * 24 * 60 * 60_000
+const SESSION_ID = /^[A-Za-z0-9:_-]{3,96}$/
+
+export class TitleSteerError extends Error {
+  constructor(readonly reason: 'invalid_session_id' | 'invalid_title' | 'invalid_revision' | 'title_changed' | 'session_not_live' | 'save_in_progress' | 'steer_persistence_failed', readonly status: number) {
+    super(reason)
+  }
+}
+
+/** What GET and PUT answer, and what a client holds: the title (null = none), the revision to send back, when it changed. */
+export interface TitleSteerView {
+  sessionId: string
+  title: string | null
+  revision: number
+  updatedAt: string | null
+}
+
+interface TitleSteerEntry { title: string | null; revision: number; updatedAt: number }
+
+/**
+ * The advertised capability flag. `1` is the protocol version of this contract; an older server omits the key, which is
+ * how a client knows not to show the rename control.
+ */
+export const TITLE_STEER_CAPABILITY = 1 as const
+
+/**
+ * NFKC, control characters to spaces, invisible direction/zero-width marks dropped, whitespace collapsed, trimmed.
+ * Returns '' for "no title". Throws invalid_title for a non-string, or one still over the cap after trimming.
+ * Characters, not UTF-16 units: an emoji counts once.
+ */
+export function normalizeTitleSteer(raw: unknown): string {
+  if (raw === null || raw === undefined) return ''
+  if (typeof raw !== 'string') throw new TitleSteerError('invalid_title', 400)
+  const text = raw
+    .normalize('NFKC')
+    .replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ')
+    .replace(/[\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim()
+  if (Array.from(text).length > TITLE_STEER_MAX_CHARS) throw new TitleSteerError('invalid_title', 400)
+  return text
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value)
+}
+
+function readEntries(path: string): Record<string, TitleSteerEntry> {
+  if (!existsSync(path)) return Object.create(null)
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as unknown
+    if (!isRecord(parsed) || !isRecord(parsed.entries)) return Object.create(null)
+    // Null prototype: a session id like `constructor` or `__proto__` fits the id pattern and must read as absent, not as Object's own members.
+    const out: Record<string, TitleSteerEntry> = Object.create(null)
+    for (const [id, raw] of Object.entries(parsed.entries)) {
+      if (!SESSION_ID.test(id) || !isRecord(raw)) continue
+      const { title, revision, updatedAt } = raw
+      if (!Number.isSafeInteger(revision) || (revision as number) < 1 || !Number.isFinite(updatedAt)) continue
+      if (title !== null && typeof title !== 'string') continue
+      // A hand-edited or older file must not smuggle in what a PUT would refuse.
+      let clean: string | null = null
+      if (typeof title === 'string') { try { clean = normalizeTitleSteer(title) || null } catch { continue } }
+      out[id] = { title: clean, revision: revision as number, updatedAt: updatedAt as number }
+    }
+    return out
+  } catch {
+    // A corrupt ledger is set aside, never silently trusted or deleted.
+    try { renameSync(path, `${path}.corrupt.${Date.now()}`) } catch { /* the next write replaces it */ }
+    return Object.create(null)
+  }
+}
+
+export interface TitleSteerStore {
+  readonly path: string
+  /** The current steer, or { title: null, revision: 0, updatedAt: null } when none was ever set. */
+  get(sessionId: string): TitleSteerView
+  /** Just the text a save may use (null when none or cleared). Never throws, whatever the id. */
+  title(sessionId: string): string | null
+  /**
+   * Set (a non-empty title) or clear ('' or null) the steer. `expectedRevision` must equal the current revision (0 when
+   * none), else 409 title_changed. Clearing where nothing was ever set is a no-op that keeps revision 0. Persisted
+   * before it returns; a failed write changes nothing.
+   */
+  set(sessionId: string, rawTitle: unknown, expectedRevision: unknown): TitleSteerView
+}
+
+export function createTitleSteerStore(options: { path?: string; now?: () => number } = {}): TitleSteerStore {
+  const path = options.path ?? dataPath(TITLE_STEER_FILE_NAME)
+  const now = options.now ?? Date.now
+  let cache: Record<string, TitleSteerEntry> | null = null
+
+  const load = (): Record<string, TitleSteerEntry> => {
+    if (!cache) cache = readEntries(path)
+    return cache
+  }
+  const prune = (entries: Record<string, TitleSteerEntry>, at: number) => {
+    for (const [id, entry] of Object.entries(entries)) if (at - entry.updatedAt > TITLE_STEER_RETAIN_MS) delete entries[id]
+  }
+  const view = (sessionId: string, entry: TitleSteerEntry | undefined): TitleSteerView => entry
+    ? { sessionId, title: entry.title, revision: entry.revision, updatedAt: new Date(entry.updatedAt).toISOString() }
+    : { sessionId, title: null, revision: 0, updatedAt: null }
+
+  return {
+    path,
+    get(sessionId) {
+      if (!SESSION_ID.test(sessionId)) throw new TitleSteerError('invalid_session_id', 400)
+      const entries = load()
+      prune(entries, now())
+      return view(sessionId, entries[sessionId])
+    },
+    title(sessionId) {
+      const entries = load()
+      prune(entries, now())
+      // No id check: the ledger has a null prototype and its keys are all valid ids, so an odd id simply is not there.
+      return entries[sessionId]?.title ?? null
+    },
+    set(sessionId, rawTitle, expectedRevision) {
+      if (!SESSION_ID.test(sessionId)) throw new TitleSteerError('invalid_session_id', 400)
+      if (!Number.isSafeInteger(expectedRevision) || (expectedRevision as number) < 0) throw new TitleSteerError('invalid_revision', 400)
+      const title = normalizeTitleSteer(rawTitle)
+      const at = now()
+      const entries = load()
+      prune(entries, at)
+      const current = entries[sessionId]
+      if ((current?.revision ?? 0) !== expectedRevision) throw new TitleSteerError('title_changed', 409)
+      if (!current && !title) return view(sessionId, undefined)
+      const next: TitleSteerEntry = { title: title || null, revision: (current?.revision ?? 0) + 1, updatedAt: at }
+      // Persist a copy first: a failed write must leave the cache, and so the revision, where it was.
+      const draft: Record<string, TitleSteerEntry> = Object.assign(Object.create(null), entries)
+      draft[sessionId] = next
+      try {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 })
+        durableAtomicWriteFileSync(path, JSON.stringify({ schemaVersion: 1, entries: draft }, null, 2), { mode: 0o600 })
+      } catch {
+        throw new TitleSteerError('steer_persistence_failed', 503)
+      }
+      entries[sessionId] = next
+      return view(sessionId, next)
+    },
+  }
+}
+
+let defaultStore: TitleSteerStore | null = null
+/** The process-wide store, created on first use (never at import: tests import this module). */
+export function getTitleSteerStore(): TitleSteerStore {
+  if (!defaultStore) defaultStore = createTitleSteerStore()
+  return defaultStore
+}
+
+// A title COS Control or the store invents when nobody named the meeting: "Mac recording 9:05 PM", "Zoom meeting 10:01 AM",
+// "Glasses meeting 10:10 PM", "iPhone microphone 4:30 PM", and the store's own "Mac Recording 2026-11-03 2105" / "G2 Recording ...".
+// Control 0.5.365 sends one on every Mac save, so without this a steer could never become the title there. Anchored at both
+// ends on purpose: a real title that merely STARTS like one ("Mac recording pipeline review") must win.
+const CLOCK = String.raw`\d{1,2}[:_]\d{2}(?:[:_]\d{2})?(?:[ _-]?(?:AM|PM))?`
+const STAMP = String.raw`(?:\d{4}-\d{2}-\d{2}(?:[ _-]+\d{4})?|\d{4})`
+const PLACEHOLDER_TITLES: RegExp[] = [
+  new RegExp(String.raw`^(?:Mac|G2|iPhone)[ _-]+Recording(?:[ _-]+(?:${CLOCK}|${STAMP}))?$`, 'i'),
+  new RegExp(String.raw`^Glasses[ _-]+meeting(?:[ _-]+${CLOCK})?$`, 'i'),
+  new RegExp(String.raw`^iPhone[ _-]+microphone(?:[ _-]+${CLOCK})?$`, 'i'),
+  // "<App> meeting 10:01 AM": the app's name, then a 12-hour clock (a macOS clock may use a narrow no-break space, which the `\s` collapse turns into a space). The AM/PM is required here so "Q3 meeting 10:30" stays a title.
+  new RegExp(String.raw`^[\w .-]{1,40}?[ _-]meeting[ _-]+\d{1,2}[:_]\d{2}[ _-]?(?:AM|PM)$`, 'i'),
+]
+export function isPlaceholderTitle(title: string): boolean {
+  const text = title.replace(/\s+/g, ' ').trim()
+  return PLACEHOLDER_TITLES.some(pattern => pattern.test(text))
+}
+
+/**
+ * The title a save files under. A title the request sent wins, untouched, unless it is a placeholder and a steer exists: then
+ * the steer names the meeting (a placeholder with no steer is kept, as before). A blank or non-string title is none.
+ * Undefined when neither exists, so the store files its own fallback.
+ */
+export function effectiveSaveTitle(sentTitle: unknown, steer: string | null): string | undefined {
+  const sent = typeof sentTitle === 'string' && sentTitle.trim() ? sentTitle : null
+  if (sent !== null && !(steer !== null && isPlaceholderTitle(sent))) return sent
+  return steer ?? undefined
+}

package/server/lib/network-policy.ts

@@ -19,10 +19,16 @@ export function isTailscaleIpv4(value: string): boolean {
   return !!octets && octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127
 }
 
+/** Tailscale IPv6 ULA range: fd7a:115c:a1e0::/48. */
+export function isTailscaleIpv6(value: string): boolean {
+  const clean = normalizeRemoteIp(value).trim().toLowerCase()
+  return clean.startsWith('fd7a:115c:a1e0:')
+}
+
 export function isAllowedNetworkIp(value: string): boolean {
   const clean = normalizeRemoteIp(value)
   if (clean === '127.0.0.1' || clean === '::1') return true
-  if (isTailscaleIpv4(clean)) return true
+  if (isTailscaleIpv4(clean) || isTailscaleIpv6(clean)) return true
 
   const octets = parseIpv4(clean)
   if (!octets) return false
@@ -31,11 +37,51 @@ export function isAllowedNetworkIp(value: string): boolean {
     (octets[0] === 192 && octets[1] === 168)
 }
 
-export function isAllowedNetworkOrigin(origin: string): boolean {
+/**
+ * Normalize a Tailscale MagicDNS hostname (`Self.DNSName` from `tailscale status --json`).
+ * Strips one trailing dot, lowercases, and requires a strict `<node>.<tailnet>.ts.net` shape.
+ */
+export function normalizeTailscaleDnsName(value: string | undefined | null): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim().toLowerCase().replace(/\.$/, '')
+  if (!trimmed || trimmed.length > 253) return null
+  if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+\.ts\.net$/.test(trimmed)) {
+    return null
+  }
+  return trimmed
+}
+
+export interface AllowedOriginOptions {
+  /** The Mac's own verified `Self.DNSName` from `tailscale status --json`. Never a suffix wildcard. */
+  selfDnsName?: string | null
+  /**
+   * When set, any explicit port in `origin` must match one of these numbers (e.g. `[3141, 3143]`).
+   * Prevents another server on the same host (`localhost:8080`, `<mac>.ts.net:8080`) from passing
+   * CORS or riding a host-scoped cookie session.
+   */
+  allowedPorts?: readonly number[]
+}
+
+export function isAllowedNetworkOrigin(origin: string, options: AllowedOriginOptions = {}): boolean {
   try {
     const url = new URL(origin)
     if (url.protocol !== 'http:' && url.protocol !== 'https:') return false
-    return url.hostname === 'localhost' || isAllowedNetworkIp(url.hostname)
+    const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+    const selfDns = normalizeTailscaleDnsName(options.selfDnsName)
+    const hostAllowed = host === 'localhost'
+      || isAllowedNetworkIp(host)
+      || (selfDns !== null && host === selfDns)
+    if (!hostAllowed) return false
+
+    if (options.allowedPorts && options.allowedPorts.length > 0) {
+      const effectivePort = url.port
+        ? Number(url.port)
+        : (url.protocol === 'https:' ? 443 : 80)
+      if (!Number.isInteger(effectivePort) || !options.allowedPorts.includes(effectivePort)) {
+        return false
+      }
+    }
+    return true
   } catch {
     return false
   }
@@ -57,11 +103,43 @@ export function isLoopbackAddress(value: string | undefined | null): boolean {
     || address.startsWith('127.') || address.startsWith('::ffff:127.')
 }
 
+const PROXY_FORWARDED_HEADERS = [
+  'forwarded',
+  'x-forwarded-for',
+  'x-forwarded-host',
+  'x-forwarded-proto',
+  'x-real-ip',
+  'tailscale-user-login',
+  'tailscale-user-name',
+  'tailscale-user-profile-pic',
+  'tailscale-headers-info',
+] as const
+
+/**
+ * True if a request carries reverse-proxy or `tailscale serve` headers.
+ * A local proxy (like `tailscale serve --bg 3141`) connects over `127.0.0.1`, so
+ * `isLoopbackSocket` must refuse any request carrying proxy headers to prevent remote
+ * tailnet peers from masquerading as the Mac owner on `loopbackOnly` / `macOnly` routes.
+ */
+export function hasProxyForwardedHeaders(headers: Record<string, unknown> | undefined | null): boolean {
+  if (!headers || typeof headers !== 'object') return false
+  for (const name of PROXY_FORWARDED_HEADERS) {
+    const val = headers[name]
+    if (typeof val === 'string' && val.trim().length > 0) return true
+    if (Array.isArray(val) && val.length > 0) return true
+  }
+  return false
+}
+
 /**
- * Loopback check on the SOCKET, never `req.ip` or `X-Forwarded-For`. The server never
- * enables trust-proxy, but reading the socket keeps this true even if someone does.
+ * Loopback check on the SOCKET, never `req.ip` or `X-Forwarded-For` — and false if any
+ * reverse-proxy or `tailscale serve` header is present.
  */
-export function isLoopbackSocket(req: { socket?: { remoteAddress?: string | undefined } | null }): boolean {
+export function isLoopbackSocket(req: {
+  socket?: { remoteAddress?: string | undefined } | null
+  headers?: Record<string, unknown> | null
+}): boolean {
+  if (hasProxyForwardedHeaders(req.headers)) return false
   return isLoopbackAddress(req.socket?.remoteAddress)
 }
 

package/server/lib/permission-broker.ts

@@ -234,6 +234,11 @@ export const QUESTIONS_POLL_INTERVAL_MS = 10_000
 export const POLL_FUTURE_SKEW_MS = 5_000
 /** The `client` values of a questions poll that count as a live answerer. */
 export const ANSWERING_CLIENTS: ReadonlySet<string> = new Set(['glasses', 'phone'])
+/**
+ * 6.99.12: the one `client` value a COS Control Web poll (browser session cookie, never the token) counts under,
+ * sent only while the page shows the cards. Kept apart from ANSWERING_CLIENTS: a token poll naming it never counts.
+ */
+export const WEB_ANSWERING_CLIENT = 'web'
 /** The questions API's own version, advertised at /api/models. */
 export const SESSION_QUESTIONS_PROTOCOL_VERSION = 1
 /** How often a parked item re-reads the desk. */
@@ -1781,6 +1786,11 @@ export interface SessionQuestionsCapability {
    * ms (`COS_PERMISSION_BROKER_AWAY_RECENT_CLIENT_S`); 0 means it must be polling right now.
    */
   awayRecentClientMs: number
+  /**
+   * 6.99.12: the questions route takes the COS Control Web session too, and a poll with `client=web` counts as a
+   * live answering client. A page reads this before it calls the route (an older server answers a cookie 401).
+   */
+  webClient: true
 }
 
 /**
@@ -1803,5 +1813,6 @@ export function sessionQuestionsCapability(): SessionQuestionsCapability {
     liveWindowMs: CLIENT_LIVE_WINDOW_MS,
     awayHoldMs,
     awayRecentClientMs,
+    webClient: true,
   }
 }

package/server/lib/ping-budget.ts

@@ -0,0 +1,149 @@
+/**
+ * Drop it P2 (plan PLAN_drop_it_2026-11-04 section 5, decided in section 10): which pings may interrupt.
+ *
+ * Every ping lands silently in the pinned COS chat. This module only decides which of them also get a banner
+ * (a macOS notification, and for reminders a lens push). Pure: the ledger of past banners, the clock and the
+ * zone are inputs, so canary 6 can drive a fixture week on a fake clock.
+ *
+ * The budget (Miles, 2026-11-04 15:08, "go with your picks"):
+ * - 6 banners a weekday, at most 2 per source, at least 45 minutes apart.
+ * - Reminders he set are exempt: they banner at any hour and do not count against the budget.
+ * - Quiet hours follow Control's rule (C Models.swift:14394-14399): after 6 PM, before 6 AM, and weekends.
+ *   No other banner then. Items held over quiet hours post at 6:00 as one "While you were off" item, and the
+ *   first banner of a weekday is allowed at 8:00.
+ * - On by default for reminders and his own drops' resolutions; other sources are off until he turns them on
+ *   (the first-week review of the tap-through rate).
+ * - Several due at once merge into one "N updates" banner, which counts once.
+ */
+import { localClock } from './morning-brief-schedule.js'
+
+export const PING_SOURCES = ['reminder', 'resolution', 'prep', 'agent', 'followups', 'stale', 'checkin'] as const
+export type PingSource = typeof PING_SOURCES[number]
+/** Ranking (plan section 5): reminder, his own resolution, prep, agent finished, follow-ups, stale or red, check-in. */
+export const PING_RANK: Record<PingSource, number> = { reminder: 0, resolution: 1, prep: 2, agent: 3, followups: 4, stale: 5, checkin: 6 }
+
+export const PING_BUDGET = {
+  perWeekday: 6,
+  perSource: 2,
+  gapMs: 45 * 60_000,
+  /** Control's quiet hours: a weekday from 6:00 to 18:00 is work time. */
+  dayStartMinutes: 6 * 60,
+  dayEndMinutes: 18 * 60,
+  /** The first non-reminder banner of a weekday waits until 8:00. */
+  firstBannerMinutes: 8 * 60,
+} as const
+
+/** The budget in the units the code uses. 6.99.11 settings (drop-p2-settings.ts budgetFrom) fill it; these are the defaults. */
+export interface BudgetOptions {
+  perWeekday: number
+  perSource: number
+  gapMs: number
+  /** Quiet from start to end, minutes past midnight; start after end wraps midnight; equal means no quiet hours. */
+  quietStartMinutes: number
+  quietEndMinutes: number
+  weekendsQuiet: boolean
+  firstBannerMinutes: number
+}
+export const DEFAULT_BUDGET: BudgetOptions = {
+  perWeekday: PING_BUDGET.perWeekday, perSource: PING_BUDGET.perSource, gapMs: PING_BUDGET.gapMs,
+  quietStartMinutes: PING_BUDGET.dayEndMinutes, quietEndMinutes: PING_BUDGET.dayStartMinutes, weekendsQuiet: true,
+  firstBannerMinutes: PING_BUDGET.firstBannerMinutes,
+}
+
+/** Decided 2026-11-04: banners on for reminders and his own drops' resolutions; the rest off for the first week. */
+export const DEFAULT_BANNER_SOURCES: readonly PingSource[] = ['reminder', 'resolution']
+
+export interface BannerRecord {
+  /** Epoch ms the banner was shown. */
+  at: number
+  /** Every source the banner carried (a merged banner carries several). */
+  sources: PingSource[]
+  /** The feed item ids it announced. */
+  ids: string[]
+}
+export interface BannerCandidate { id: string; source: PingSource; createdAt: number }
+export interface BannerPlan {
+  /** Banners to show now, each with the ids it announces. One merged banner has `merged: true`. */
+  banners: Array<{ ids: string[]; sources: PingSource[]; merged: boolean; exempt: boolean }>
+  /** Candidates that stay silent in the chat, with the reason. */
+  silent: Array<{ id: string; reason: SilentReason }>
+}
+export type SilentReason = 'source_off' | 'quiet_hours' | 'before_first_banner' | 'daily_cap' | 'source_cap' | 'too_soon'
+
+/** Control's quiet rule at `nowMs` in `timezone`: weekends, before 6:00 and from 18:00. */
+export function isQuietHours(nowMs: number, timezone: string, budget: BudgetOptions = DEFAULT_BUDGET): boolean {
+  const c = localClock(nowMs, timezone)
+  if (budget.weekendsQuiet && (c.weekday === 0 || c.weekday === 6)) return true
+  const { quietStartMinutes: start, quietEndMinutes: end } = budget
+  if (start === end) return false
+  return start > end ? c.minutes >= start || c.minutes < end : c.minutes >= start && c.minutes < end
+}
+
+/** The local day's non-exempt banners in the ledger (reminders never count). */
+function counted(ledger: readonly BannerRecord[], nowMs: number, timezone: string): BannerRecord[] {
+  const today = localClock(nowMs, timezone).day
+  return ledger.filter(b => b.at <= nowMs && localClock(b.at, timezone).day === today && b.sources.some(s => s !== 'reminder'))
+}
+
+/**
+ * Decide which `candidates` banner now. Reminders always banner (one each, never merged, never counted). The rest
+ * pass the source switch, quiet hours, 8:00, the daily cap, the per-source cap and the 45-minute gap, in that
+ * order; those that pass merge into one banner. The caller records each banner in the ledger before showing it.
+ */
+export function planBanners(
+  candidates: readonly BannerCandidate[],
+  ledger: readonly BannerRecord[],
+  nowMs: number,
+  timezone: string,
+  enabled: readonly PingSource[] = DEFAULT_BANNER_SOURCES,
+  budget: BudgetOptions = DEFAULT_BUDGET,
+  /** Ids that may banner although their source is switched off ("Ping me about" in Settings). Caps still apply. */
+  promoted: ReadonlySet<string> = new Set(),
+): BannerPlan {
+  const plan: BannerPlan = { banners: [], silent: [] }
+  const sorted = [...candidates].sort((a, b) => PING_RANK[a.source] - PING_RANK[b.source] || b.createdAt - a.createdAt)
+  const rest: BannerCandidate[] = []
+  for (const c of sorted) {
+    if (c.source === 'reminder') {
+      // Exempt: any hour, never counted. A reminder is still subject to his switch (on by default).
+      if (enabled.includes('reminder')) plan.banners.push({ ids: [c.id], sources: ['reminder'], merged: false, exempt: true })
+      else plan.silent.push({ id: c.id, reason: 'source_off' })
+    } else rest.push(c)
+  }
+  if (!rest.length) return plan
+
+  const silence = (list: BannerCandidate[], reason: SilentReason) => { for (const c of list) plan.silent.push({ id: c.id, reason }) }
+  const allowed = (c: BannerCandidate) => enabled.includes(c.source) || promoted.has(c.id)
+  const on = rest.filter(allowed)
+  silence(rest.filter(c => !allowed(c)), 'source_off')
+  if (!on.length) return plan
+  if (isQuietHours(nowMs, timezone, budget)) { silence(on, 'quiet_hours'); return plan }
+  if (localClock(nowMs, timezone).minutes < budget.firstBannerMinutes) { silence(on, 'before_first_banner'); return plan }
+
+  const today = counted(ledger, nowMs, timezone)
+  if (today.length >= budget.perWeekday) { silence(on, 'daily_cap'); return plan }
+  const last = today.reduce((max, b) => Math.max(max, b.at), -Infinity)
+  if (nowMs - last < budget.gapMs) { silence(on, 'too_soon'); return plan }
+
+  const perSource = new Map<PingSource, number>()
+  for (const b of today) for (const s of new Set(b.sources)) perSource.set(s, (perSource.get(s) ?? 0) + 1)
+  const pass: BannerCandidate[] = []
+  for (const c of on) {
+    if ((perSource.get(c.source) ?? 0) >= budget.perSource) plan.silent.push({ id: c.id, reason: 'source_cap' })
+    else pass.push(c)
+  }
+  if (!pass.length) return plan
+  const sources = [...new Set(pass.map(c => c.source))]
+  plan.banners.push({ ids: pass.map(c => c.id), sources, merged: pass.length > 1, exempt: false })
+  return plan
+}
+
+/** The banner's words. One item uses its own title; several say how many ("3 updates"). */
+export function bannerTitle(count: number, single: string): string {
+  return count <= 1 ? single : `${count} updates`
+}
+
+/** A ledger trimmed to the last 8 days: enough for any weekday's count and the weekly stale rule. */
+export function trimLedger(ledger: readonly BannerRecord[], nowMs: number): BannerRecord[] {
+  return ledger.filter(b => nowMs - b.at <= 8 * 86_400_000 && b.at <= nowMs + 60_000)
+}