@gotcos/glasses-server 6.98.1 → 6.99.16

package/server/routes/meeting.ts

@@ -19,7 +19,7 @@ import { existsSync, readdirSync, readFileSync, rmSync, statSync, unlinkSync } f
 import { isWorthRecovering } from '../lib/quarantine-auto-recover.js'
 import { basename, resolve } from 'node:path'
 import { createHash } from 'node:crypto'
-import { Router, type RequestHandler } from 'express'
+import { Router, type RequestHandler, type Response } from 'express'
 import { emitDisplay } from '../lib/display-bus.js'
 import { createStopRequestStore, isStopRequestRefusal, STOP_REQUEST_CLAIM_WINDOW_MS, type StopRequest, type StopRequestStore } from '../lib/meeting-stop-requests.js'
 import { appendAutonomousSaveLog, getStopIntentStore, type StopIntent, type StopIntentStore } from '../lib/meeting-stop-intents.js'
@@ -153,6 +153,7 @@ import {
   getSessionChunks,
   getSessionProviderCandidates,
   getSessionStartTime,
+  publishLiveTitleSteer,
   getSessionTranscript,
   getMeetingSessionStatus,
   getStrandedCaptures,
@@ -175,6 +176,7 @@ import {
 import { derivedSourcesFor, findDerivedRecord } from '../lib/imported-library-rows.js'
 import { assertVoiceEvidenceSource } from '../lib/voice-evidence-guard.js'
 import { domainForMeeting, resolveDomains } from '../lib/domains.js'
+import { effectiveSaveTitle, getTitleSteerStore, normalizeTitleSteer, TitleSteerError, type TitleSteerStore } from '../lib/meeting-title-steer.js'
 import { getOwnerSpeakerLabel } from '../lib/profile.js'
 import {
   DEATTRIBUTED_PREFIX,
@@ -319,6 +321,8 @@ interface MeetingSessionSource {
   delete(sessionId: string, options?: { preserveAudio?: boolean }): void
   /** 6.53.3: live, closed within its retention, or unknown (`getMeetingSessionStatus`). */
   getState?(sessionId: string): 'active' | 'closed' | 'missing'
+  /** 6.99.0: write a changed title steer into the live session's record (transcribe-stream publishLiveTitleSteer). */
+  publishTitleSteer?(sessionId: string): boolean
   /** 6.81.0: the received/ASR ledger the server's own save of a stopped meeting reads. */
   getLedger?(sessionId: string): SessionLedger
 }
@@ -340,6 +344,8 @@ function defaultSessionLedger(sessionId: string): SessionLedger {
 
 export interface MeetingRouteDependencies {
   store?: MeetingStore
+  /** 6.99.0: the live title steer ledger (lib/meeting-title-steer.ts). Tests inject one on a scratch path. */
+  titleSteer?: TitleSteerStore
   /** 6.93.0: is any meeting capture (glasses, Mac or iPhone) live right now? Assigning a Mac voice to a profile is refused while one is. */
   captureActive?: () => boolean
   sessions?: MeetingSessionSource
@@ -656,6 +662,7 @@ const defaultSessionSource: MeetingSessionSource = {
   moveAudioToPending: moveSessionAudioToPending,
   delete: deleteSession,
   getState: defaultSessionState,
+  publishTitleSteer: publishLiveTitleSteer,
 }
 
 function countWords(text: string): number {
@@ -794,6 +801,7 @@ const macAssignInFlight = new Set<string>()
 
 export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router {
   const store = deps.store ?? getMeetingStore()
+  const titleSteer = deps.titleSteer ?? getTitleSteerStore()
   const sessions = deps.sessions ?? defaultSessionSource
   const runBatch = deps.runBatch ?? runMeetingBatchPipeline
   const scheduleBackground = deps.scheduleBackground ?? (task => { void task })
@@ -886,6 +894,43 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
   })
   autoDeps.onCreate?.(autonomousFinalizer)
 
+  // ── 6.99.0: title steer ─────────────────────────────────────────────────────────────
+  // A name typed in COS Control while a Mac recording or glasses meeting is live. It is a hint the title model receives
+  // at save (and the title itself when the save sends none), never the final word. See lib/meeting-title-steer.ts.
+  // The title is never logged here or anywhere: names and companies. Length only.
+  const steerFailure = (res: Response, error: unknown, sessionId: string) => {
+    if (error instanceof TitleSteerError) {
+      res.status(error.status).json({ error: error.reason, reason: error.reason, ...(error.reason === 'title_changed' ? { current: titleSteer.get(sessionId) } : {}) })
+      return
+    }
+    console.error('[meeting/title-steer] Unexpected failure:', error instanceof Error ? error.name : 'unknown')
+    res.status(500).json({ error: 'title_steer_error', reason: 'title_steer_error' })
+  }
+  router.get('/meeting/title-steer', (req, res) => {
+    const sessionId = typeof req.query.sessionId === 'string' ? req.query.sessionId : ''
+    res.set('Cache-Control', 'private, no-store')
+    try { res.json(titleSteer.get(sessionId)) } catch (error) { steerFailure(res, error, sessionId) }
+  })
+  router.put('/meeting/title-steer', (req, res) => {
+    const body = (req.body ?? {}) as Record<string, unknown>
+    const sessionId = typeof body.sessionId === 'string' ? body.sessionId : ''
+    res.set('Cache-Control', 'private, no-store')
+    try {
+      // Malformed input is a 400 whether or not the session is live; only a well-formed request earns a 404/409.
+      titleSteer.get(sessionId)
+      normalizeTitleSteer(body.title)
+      if (!Number.isSafeInteger(body.expectedRevision) || (body.expectedRevision as number) < 0) throw new TitleSteerError('invalid_revision', 400)
+      if ((sessions.getState ?? defaultSessionState)(sessionId) !== 'active') throw new TitleSteerError('session_not_live', 404)
+      // The save reads the steer once, then awaits before it closes the session. A rename in that gap would answer 200 and miss the
+      // filed meeting, so it is refused: the meeting is being filed under the name it had.
+      if (savingSessions.has(sessionId)) throw new TitleSteerError('save_in_progress', 409)
+      const view = titleSteer.set(sessionId, body.title, body.expectedRevision)
+      ;(sessions.publishTitleSteer ?? (() => false))(sessionId)
+      console.log(`[meeting/title-steer] ${view.title ? 'set' : 'cleared'} ${sessionId} length=${view.title ? Array.from(view.title).length : 0} revision=${view.revision}`)
+      res.json(view)
+    } catch (error) { steerFailure(res, error, sessionId) }
+  })
+
   let recoveryPendingLogged = false
   router.get('/meeting/sessions/:sessionId/status', (req, res) => {
     const sessionId = String(req.params.sessionId ?? '')
@@ -963,6 +1008,8 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       disposition: publicDisposition(disposition),
       // 6.81.0, additive: the Stop the server holds for this meeting, if any. Older clients ignore it.
       stopIntent: intent ? publicStopIntent(intent) : null,
+      // 6.99.0, additive: the name typed while it recorded (null = none). Older clients ignore it.
+      titleSteer: titleSteer.title(sessionId),
     })
   })
 
@@ -1371,14 +1418,19 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       // save — infer from the content instead of filing everything under one
       // domain. Keyword scoring, no model call: this runs on every save, and a
       // per-meeting LLM call would breach the recurring-caller rule.
+      // 6.99.0: the title steer (a name typed while it recorded) is the title when the request sends none, and is filed
+      // beside the title either way so the title model can read it. It feeds the domain through the title, as a title does.
+      const steer = titleSteer.title(sessionId)
+      const savedTitle = effectiveSaveTitle(body?.title, steer)
       const filedDomain = domainForMeeting(
         body?.domain as string | undefined,
-        `${(body?.title as string | undefined) ?? ''}\n${transcript}`,
+        `${savedTitle ?? ''}\n${transcript}`,
         resolveCosOperationsDir(),
       )
       const saved = store.save({
         sessionId,
-        title: body?.title as string | undefined,
+        title: savedTitle,
+        ...(steer ? { titleSteer: steer } : {}),
         domain: filedDomain,
         transcript: cleanFinalTranscript(transcript),
         startTime,
@@ -3496,12 +3548,16 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
         words: item.words,
         canonical: true,
       }))
+      // 6.99.0: same rule as POST /meeting/save: the title steer names the meeting when the request does not.
+      const steer = titleSteer.title(sessionId)
+      const recoveredTitle = effectiveSaveTitle(body.title, steer)
       const saved = store.save({
         sessionId,
-        title: typeof body.title === 'string' && body.title.trim() ? body.title : undefined,
+        title: recoveredTitle,
+        ...(steer ? { titleSteer: steer } : {}),
         domain: domainForMeeting(
           typeof body.domain === 'string' && body.domain.trim() ? body.domain : undefined,
-          `${typeof body.title === 'string' ? body.title : ''}\n${transcript}`,
+          `${recoveredTitle ?? ''}\n${transcript}`,
           resolveCosOperationsDir(),
         ),
         transcript,

package/server/routes/permission-broker.ts

@@ -30,6 +30,13 @@
 // so a surface that only shows a count can poll without making the Mac hold questions it
 // cannot answer. It checks X-Cos-Token itself as well, in constant time, and a request
 // without it is refused and never counted, whatever sits in front of this router.
+// 6.99.12: COS Control Web reads the same list with its signed browser session (the
+// `cos_web_session` cookie, verified by `webSessionAuthorized`, the check the /api gate runs).
+// The hook token still opens nothing here. A browser poll counts as a live answering client
+// only with `?client=web`, which the page sends only while it shows the cards (a visible tab);
+// the same 30 s window as the phone. A cookie poll naming `glasses` or `phone`, or no client,
+// never counts, and a token poll naming `web` never counts either. A browser never reports
+// wearer presence, so it never enables the away hold.
 // 6.60.0: a poll with `&hold=1&presenceAgeMs=<int>` (COS Glasses 6.9.563 and later) records
 // wearer presence for the away hold instead of the 6.59.0 liveness; a `hold=1` poll without
 // a valid `presenceAgeMs` makes no client live and enables no hold. The response adds
@@ -40,6 +47,7 @@ import { timingSafeTokenEqual } from '../lib/token-auth.js'
 import {
   ANSWERING_CLIENTS,
   CLIENT_LIVE_WINDOW_MS,
+  WEB_ANSWERING_CLIENT,
   SESSION_QUESTIONS_PROTOCOL_VERSION,
   type BrokerAdmission,
   type HookReplyChannel,
@@ -138,8 +146,13 @@ export function createPermissionBrokerHookRouter(deps: PermissionBrokerHookRoute
 
 export interface SessionQuestionsRouterDeps {
   broker: PermissionBroker
-  /** The pairing token (X-Cos-Token). A poll counts as a live client only with it. */
+  /** The pairing token (X-Cos-Token). A poll counts as a live client only with it, or with the web session below. */
   apiToken: () => string
+  /**
+   * 6.99.12: whether this request carries a valid COS Control Web session (the cookie, its epoch, and the origin
+   * rules: `isWebSessionAuthorized` in production). Absent: only the token opens the list, as before.
+   */
+  webSessionAuthorized?: (req: Request) => boolean
   /** Where a counted poll is recorded; `noteQuestionsPoll` in production. */
   notePoll?: (at: number, poll: QuestionsPollFacts) => void
   now?: () => number
@@ -171,14 +184,21 @@ export function createSessionQuestionsRouter(deps: SessionQuestionsRouterDeps):
     res.set('Cache-Control', 'private, no-store')
     let expected = ''
     try { expected = deps.apiToken() } catch { expected = '' }
+    const byToken = timingSafeTokenEqual(req.headers['x-cos-token'], expected)
+    let byWebSession = false
+    if (!byToken && deps.webSessionAuthorized) {
+      try { byWebSession = deps.webSessionAuthorized(req) === true } catch { byWebSession = false }
+    }
     // A hook token, or nothing: refused, and never a live client.
-    if (!timingSafeTokenEqual(req.headers['x-cos-token'], expected)) {
+    if (!byToken && !byWebSession) {
       res.status(401).json({ error: 'unauthorized' })
       return
     }
     // Only a client that says it can answer (and shows the cards) counts as live.
     const client = typeof req.query.client === 'string' ? req.query.client : ''
-    if (ANSWERING_CLIENTS.has(client)) notePoll(now(), questionsPollFacts(req.query as Record<string, unknown>))
+    if (byToken && ANSWERING_CLIENTS.has(client)) notePoll(now(), questionsPollFacts(req.query as Record<string, unknown>))
+    // 6.99.13 (Miles, option B): a browser poll never counts as live, so an open web tab never holds a question
+    // back from the Mac's own pop-up. The web still lists and answers what the glasses or phone are holding.
     const health = deps.broker.health()
     // Listed first: a deadline the timer has not caught yet is settled by the listing.
     const items = deps.broker.list()

package/server/routes/transcribe-stream.ts

@@ -128,6 +128,7 @@ import {
 import { feedLiveCueTranscript } from '../lib/live-cues-engine.js'
 import { armMacLiveCues, type MacLiveCuesAnswer } from '../lib/live-cues-v2.js'
 import { liveProvisional } from '../lib/live-provisional.js'
+import { getTitleSteerStore, TITLE_STEER_CAPABILITY } from '../lib/meeting-title-steer.js'
 import { chunkLevel, restoreChunkLevels, withChunkLevel, type ChunkLevel } from '../lib/chunk-levels.js'
 import { preemptMetalBatchForLive, registerLiveActivityProbe } from '../lib/whisper-metal-gate.js'
 import {
@@ -792,6 +793,8 @@ function persistSessionRequired(sessionId: string, certified?:MacSpeakerLivePrep
       startTime: session.startTime,
       lastActivityAt: session.lastActivityAt,
       title: session.title,
+      // 6.99.0: the name typed in COS Control while recording (lib/meeting-title-steer.ts). Control reads this file directly.
+      ...titleSteerField(sessionId),
       // `chunks` = legacy dense form, kept for backward compatibility with
       // existing readers; `chunksIndexed` preserves original indices so gap
       // detection survives recovery. Recovery prefers chunksIndexed.
@@ -818,6 +821,34 @@ function persistSessionRequired(sessionId: string, certified?:MacSpeakerLivePrep
   }
 }
 
+/** `{ titleSteer }` for the active-session record: the live name, or nothing (the key is absent, never an empty string). */
+function titleSteerField(sessionId: string): { titleSteer?: string } {
+  const title = getTitleSteerStore().title(sessionId)
+  return title ? { titleSteer: title } : {}
+}
+
+/**
+ * 6.99.0: put a changed title steer into the live session's record NOW, so COS Control (which reads the active-session
+ * file, not a route) shows it without waiting for the next chunk. A targeted edit of one key, not persistSessionRequired:
+ * that rebuilds the whole record from memory and would re-judge the Mac speaker projection outside the chunk path. A
+ * session with no record yet gets the key at its first persist. Returns whether the file was updated; never throws.
+ */
+export function publishLiveTitleSteer(sessionId: string): boolean {
+  try {
+    if (!sessions.has(sessionId)) return false
+    const filePath = resolve(CHUNK_PERSIST_DIR, `${sessionId}.json`)
+    const stat = lstatSync(filePath)
+    if (!stat.isFile() || stat.size > 256 * 1024 * 1024) return false   // lstat: a symlink is not a file here
+    const record = JSON.parse(readFileSync(filePath, 'utf-8')) as Record<string, unknown>
+    if (record.sessionId !== sessionId) return false
+    const { titleSteer, ...rest } = record
+    const field = titleSteerField(sessionId)
+    if (titleSteer === field.titleSteer) return true
+    durableAtomicWriteFileSync(filePath, JSON.stringify({ ...rest, ...field }), { mode: 0o600 })
+    return true
+  } catch { return false }
+}
+
 function persistSessionBestEffort(sessionId: string): void {
   try { persistSessionRequired(sessionId) } catch { /* recovery cleanup is non-admission work */ }
 }
@@ -2300,6 +2331,14 @@ function emptyChunkResponse(
   }
 }
 
+/**
+ * 6.99.16: an iPhone recording's live lines come from the same server Whisper as a G2 meeting,
+ * prompted with the profile vocabulary, so the dictionary shows while recording (Miles,
+ * 2026-11-05: "as close to the g2 stack as possible"). Parakeet takes no prompt. The saved
+ * transcript is unchanged: strict Parakeet, as the capability's asrModel says.
+ */
+export const PHONE_LIVE_ENGINE: 'server-whisper' | 'parakeet-ultra' = 'server-whisper'
+
 async function transcribeWithServerWhisper(audioBuffer: Buffer, whisperAudio: Buffer, whisperContext: string, isQuiet: boolean): Promise<{ text: string; words?: WhisperWord[]; backend: string }> {
   // The worker owns reconciliation of stale health. Always attempt local ASR
   // once; an availability snapshot must not divert meeting audio to cloud.
@@ -2608,7 +2647,7 @@ async function processStreamChunk(opts: {
     model = candidate.model
     mode = candidate.mode
     latencyMs = candidate.latencyMs
-  } else if (phoneCapture) {
+  } else if (phoneCapture && PHONE_LIVE_ENGINE === 'parakeet-ultra') {
     const result = await transcribePhoneParakeet(whisperAudio, quiet.speechSec)
     rawText = result.text; words = result.words; backend = result.backend; asrProvider = result.asrProvider; model = result.model; latencyMs = result.latencyMs
   } else if (MAC_CAPTURE_ID.test(sessionId) && stt.hq === 'parakeet-ultra') {
@@ -2945,7 +2984,7 @@ export function assertMacCaptureComplete(sessionId: string, expectedChunkCount:
 transcribeStreamRouter.get('/mac-recording/capabilities', (_req, res) => {
   // 6.83.2: `discard` advertises POST /api/meeting/sessions/:id/discard for a stranded no-sound capture. Older
   // servers omit it, and COS Control then discards only its own local copy and says so.
-  res.set('Cache-Control', 'private, no-store').json({ available: true, ...MAC_AUDIO, serverInstanceId: getServerInstanceId(), discard: true })
+  res.set('Cache-Control', 'private, no-store').json({ available: true, ...MAC_AUDIO, serverInstanceId: getServerInstanceId(), discard: true, titleSteer: TITLE_STEER_CAPABILITY })
 })
 function requireMacPin(req: { get(name: string): string | undefined }): string {
   const pin = req.get('X-COS-Server-Instance')?.trim()
@@ -2969,12 +3008,12 @@ transcribeStreamRouter.post('/mac-recording/start', (req, res) => {
     if (!session.chunks.some(Boolean)) session.startTime = recording.startTime
     persistSessionRequired(recording.sessionId)
     // Arming happens only after the recording is admitted, and its answer never fails the start (armMacLiveCues returns a
-    // reason code instead of throwing). Without `liveCues: true` the answer is byte for byte what 6.85.0 sent.
+    // reason code instead of throwing). Without `liveCues: true` the answer is what 6.85.0 sent plus the additive `titleSteer` (6.99.0).
     let liveCues: MacLiveCuesAnswer | undefined
     if (req.body.liveCues === true) {
       try { liveCues = armMacLiveCues(recording.sessionId) } catch { liveCues = { armed: false, reason: 'unavailable' } }
     }
-    res.json({ ...MAC_AUDIO, ...recording, replayed, serverInstanceId, ...(liveCues ? { liveCues } : {}) })
+    res.json({ ...MAC_AUDIO, ...recording, replayed, serverInstanceId, ...(liveCues ? { liveCues } : {}), titleSteer: getTitleSteerStore().title(recording.sessionId) })
   } catch (error) { sendStreamError(res, error) } finally { lease?.release() }
 })
 const macChunkLocks = new Set<string>()