@gotcos/glasses-server 6.99.20 → 6.99.25

package/CHANGELOG.md

@@ -1,3 +1,94 @@
+## 6.99.25 - COS Control Web: act from Today, Work chat, Memories rebuilt, change the pet (private)
+
+2026-11-07. Private build on 6.99.24 (Codex root's mobile layout fix, bb5ff2c, kept unchanged). Server only. Works with COS Control 0.5.376 as installed; two Mac follow-ups are listed at the end.
+
+Miles, 11/06 23:06 to 23:14: rebuild Memories for the Duo, message the orchestrator from Work like the Mac, build the change pet picker with an on/off switch using the 300 pets COS Control has, and make Today a place to act ("on click it opened up an overlay on the today panel that allowed me to see and interact with and make a decision"), with COS aware of what Today shows. Built by three agents and this session, then checked by five review agents (User, Skeptic, Completionist, Ghost Hunter, Parity) and fixed. Plan: `operations/personal/wk45_2026/PLAN_control_web_mobile_hub_2026-11-06.md`.
+
+**Today is a place to act** (`panes/today-actions.js`, loaded on first tap)
+- Tap a Needs you item, a running session or a meeting's suggestions and it opens over Today: a bottom sheet when folded, a side sheet when unfolded. Close with X, a tap outside, Escape or Back. A reload with it open reopens it.
+- Needs you shows what the session waits on, with the same question cards and answer route as the Sessions reader, its last reply and a reply box; a waiting session never shows as working or offers Stop. If sessions could not be read, Today says so instead of "No agents are running". Running opens a peek with the live feed, a note box and Stop (tap, then tap again). Meeting suggestions offer Create task, Link, Dismiss, Open in Work and Open card through `POST /api/work-intake/:id/resolve`, one decision at a time. With no Undo route on this server, Dismiss takes a second tap.
+- Taps inside a sheet are ignored until it has finished opening (at least 500 ms, from the sheet's and backdrop's own motion), so a double tap cannot act on something unread. Every tap-then-tap-again confirm (Dismiss, Stop, Send anyway, and Allow, Deny and Send on question cards wherever they show) ignores the second tap for 400 ms after arming. A reply typed in the overlay is kept per session for seven days and resent under the same id, so a retry never posts twice.
+- Sending uses the Sessions reader's own `continueSession` and `parkTurn` (exported as `COSWeb.sessionKit`); the send gates, turn watch and verdict box are copies.
+- **Needs you reads more of what the Mac's does:** sessions waiting on you, Work handoffs (merged with their session), held voices to name (one row, `/api/voice/held-groups`) and memories to review. The Mac also lists dictation fixes, older items to sort and meetings with unnamed voices; the web does not yet. Once Today has drawn, its count, headline and rail come from the same rows, and "Nothing is waiting on you" shows only after every source answered; a failed source says so. In quiet hours (evenings, nights, weekends) everything but waiting sessions folds under "can wait until tomorrow"; the Mac's switch to turn that off is not on the web.
+- "Up next" is now "Next up", with Prep me and Open meeting. ⌘K can file a task to the Work inbox (`POST /api/tasks/capture`).
+- **COS knows what Today shows.** An Ask from Today carries a summary of Today (at most 4,000 characters, the overflow marker included; titles and text, never ids) in the existing query-jobs `reference` field, quoted to the model as untrusted data. A session with no title is "A session", never its folder or id. If building it fails, the Ask goes without it.
+
+**Work chat on the Work card**
+- Type a request, tap Plan, review each assignment, then Send all or Send or Skip each one, with "Show what is sent" for COS Control's exact prompt. Plan uses the Mac's own requests (`/api/work/orchestrator/input`, `POST /api/work/chat` with `orchestrator: true`), Opus at high effort by default.
+- Send saves the plan as a lens round with the new `source: "web"` (`lib/work-lens-rounds.ts`, additive; a lens round is unchanged), so COS Control on the Mac sends it through its own Send, journal and fences and attaches the card's and its meetings' files. The web shows "Waiting for COS Control on your Mac to send this" until it does, never Sent before. Capability: `GET /api/work/chat/web-plans` (`GET /api/work/chat` is unchanged).
+- Also on the card: Agent workspace with Open session, View progress, Link a meeting, Mark complete, and Not done yet moving a sent card back to Draft. Drafts survive fold, reload and a second tab. A plan never sent can be removed; one whose Send answer was lost cannot, since COS Control may already be sending it.
+- Not the same as the Mac: the card shows only plans made in this browser (the Mac's Work chat history lives on the Mac), and Unlink, Link session, Review changes, outputs, files, Mark reviewed and Clear handoff stay on the Mac (their data is local to COS Control).
+
+**Memories is part of the app** (`panes/memories.js`)
+- Replaces the Mac page in a frame that left white bars on the Duo. Fills the screen, keeps your place across fold, unfold and reload (the tab is in the address, `#/memories/t/<tab>`), and covers Recent learning, Applied this week, All memories with search, To review, Knowledge (Ask the graph, sources, setup, index, duplicates and merge preview), the reader (Open sources, Explore in graph, Copy context), the activity log and Memory settings, through the same `/api/web-bridge/memories` ops.
+- New: **Cues to rate** and **Rated cues**, like the Mac's cue review (Useful, Late, Repeat, Wrong, Obvious, a note, Skip; change or clear a rating), through `GET /api/live-cues/history` and `POST /api/live-cues/feedback`.
+- Behaviour changes: To review lists the items that need you first, matching its count (before: the tab said 7 and listed 76 other proposals); recall rows name the memory; plain labels and errors; removing a Knowledge folder takes a second tap; Recent learning keeps one order; on phones the large header is hidden. The old hosted page (about 1 MB) and its `/control/memories/*` 'unsafe-inline' CSP exception are removed: every path is `script-src 'self'`.
+
+**Change pet** (Settings > Pet, or "Change pet" under the pet on Today)
+- Show or hide the pet on Today, and pick Same as my Mac, a character COS Control ships (the four Jedi, animated, and Cloud Puff) or one of the ~300 OpenPets gallery pets COS Control lists, shown as its gallery picture as on the Mac. The choice is per browser; the Mac's own pet still changes in COS Control.
+- Gallery pictures follow the Mac helper's rule exactly (https, host openpets.dev, path ending /thumb.webp, WebP only, 512 KB enforced while reading, 6 s); a thumbnail COS Control already fetched is used without a second download. **This adds an outbound request from the server to openpets.dev** whenever a gallery picture it has not seen scrolls into view in Settings.
+- The pet's running count uses the Running card's own test, so the two never disagree.
+
+**Loading**
+- A pane script that stalls can no longer hang a tap: Today taps wait 4 s before their old destination, the Ask summary 1.5 s, a section 15 s before Try again (and clears itself if the script arrives later).
+
+**Default-on changes for every web user**
+- Today rows open overlays instead of jumping to the tab (Open session still goes to the reader). Needs you lists more kinds of items, and the Today headline and rail count them. "Next up" replaces "Up next".
+- An Ask from Today sends a summary of Today to the model.
+- Work cards show Work chat. Plan makes a planner model call on the Mac; nothing is sent until Send.
+- Memories is the new pane, with the behaviour changes above and the two cue views.
+- The pet picker and "Change pet"; the server fetches gallery pictures from openpets.dev.
+- Unknown tools in session feeds read "Used <tool>" in the overlay and in the Sessions reader.
+- Question cards (Allow, Deny, Send) ignore a confirming tap for 400 ms after arming, everywhere they show.
+- Server: lens rounds accept `source: "web"` with `web-<uuid>` ids; new `GET /api/work/chat/web-plans`; new `/api/web-pet/catalog`, `/still`, `/preview`, and `?pet=` on `/api/web-pet` and its sheets.
+
+**Needs COS Control follow-ups (relayed to the Mac lane, not in this build)**
+- COS Control 0.5.376 labels a web plan "From glasses" and posts "A plan from your glasses is waiting" when it arrives (on Send only). It should read `source` and say "From the web".
+- Setting the Mac's own pet from the web needs COS Control to accept a pet request.
+
+## 6.99.24 - Mobile prep and recording controls fit small screens (private)
+
+2026-11-06. Private build on 6.99.23, compatible with COS Control 0.5.376/build 430. Server-served web layout only.
+
+- Recording actions fit a 320 px viewport. Phone recording and prep controls have 44 px touch targets.
+- The mobile prep suggestion reserves enough room for its text and Add to this meeting button.
+- Prep context and files continue through the existing explicit Add to this meeting action. No new automatic calendar binding.
+- Default-on changes: these responsive layout adjustments for web users. No API, recording, transcription, cue, profile, or permission changes.
+
+## 6.99.23 - Sessions and Work open at once; the pet moves right when unfolded (private)
+
+2026-11-06. Private build on 6.99.22. Server only; no Mac app change.
+
+Miles, 11/06 22:4x: "It's still fairly slow when loading sessions and other tabs", and move the pet to the right on the unfolded screen.
+
+- **One session list for every pane.** Timed in the browser on 6.99.22: `/api/agent-sessions` took 5.1 s on Sessions and 2.1 s on Work (it walks every session folder and runs a 2 to 3 s lock probe on the Mac); everything else on those tabs answered in under 0.25 s. Today, Sessions, Work and the section stories each fetched it separately. COS Control Web now keeps one copy: a pane opened within 15 s of the last fetch uses it, a fetch already on the wire is shared, and Sessions paints the last copy at once with "Refreshing…" while a fresh one loads. Measured after: Sessions showed its 68 rows 0.6 s after opening with no new request; Work made no session request (slowest call 0.2 s). The server route is unchanged.
+- **The pet on the unfolded Duo** sits at the top of the right-hand column, above Needs you. Folded, it stays above the story.
+- Default-on changes: Sessions and Work can show a session list up to 15 s old while a fresh one loads; the pet's position when unfolded. No API change.
+
+## 6.99.22 - The pet comes to COS Control Web (private)
+
+2026-11-06. Private build on 6.99.21. Server only; no Mac app change.
+
+Miles, 11/06: bring the pet to COS Control Web, at the top of Home.
+
+- **The pet on Today.** The same pet COS Control shows, read from its own `session-pet-states.json` in `~/Library/Application Support/COS Control`, so a pet change on the Mac shows on the phone. It takes the pose the Mac would pick (COS Control's `PetSpritePose.resolve`): waiting on you with nothing running is waiting; one, two, three, or four or more sessions in play are working, duel, trio and swarm; an open quiet session is patrol; none is idle. Under it, plain text: "3 running", "1 waiting on you", or "Nothing running". Tapping it opens Sessions. Reduced motion shows a still frame. The loop runs only while Today is on screen.
+- **Phone-sized strips.** The Mac's strips are 256 px tall and up to about 56,000 px wide. `server/lib/web-pet.ts` resizes each pose to 160 px with macOS `sips` and cuts it into chunks no wider than 8,192 px, each holding whole frames, cached under the data folder and keyed by the source file. Only the pose on screen downloads; each is cached for a year. Windu's heaviest pose (swarm) is 4.8 MB across 7 chunks, the lightest (error) 74 KB. Routes: `GET /api/web-pet` and `GET /api/web-pet/sheet/:pose/:chunk`, behind the usual sign-in.
+- `sips` treats a crop offset of 0 as "centre", so the first chunk is cut from the mirrored strip and flipped back. A test runs real `sips` on a synthetic strip and checks every frame's colour in its chunk.
+- **Sign-in wording.** COS Control Web's "Sign in another device" is now "Use COS on another phone or browser", says it is for the iPhone Camera, and says glasses pair from COS Control on the Mac (Miles 11/06: the two QR codes read like the same thing).
+- Default-on changes: the pet on Today and the renamed sign-in row. No change for the glasses app or any other client.
+
+## 6.99.21 - COS Control Web opens faster on the phone (private)
+
+2026-11-06. Private build on 6.99.20. Server only; no Mac app change.
+
+Miles, 11/06: speed up COS Control Web and make it sturdier on the iPhone, first step of the mobile hub plan (`operations/personal/wk45_2026/PLAN_control_web_mobile_hub_2026-11-06.md`).
+
+- **Files are compressed and cached.** `/control` used to serve every file uncompressed with `Cache-Control: max-age=0`, so each open re-checked all 26 boot files with the Mac over Tailscale. `server/lib/web-control-static.ts` now gives each script, stylesheet, font and icon a content hash, rewrites the references in `index.html` and the CSS to `?v=<hash>`, and serves a matching versioned file as cacheable for a year. `index.html`, other HTML pages and any unversioned or stale URL are `no-cache` with an ETag, so a new release shows on the next open. Text files go out brotli or gzip compressed.
+- **Measured on the Mac against 6.99.20** (loopback, browser-style cache): first open 1,969 KB to 708 KB on the wire; a repeat open 26 requests to 1. Not yet timed on the phone over Tailscale.
+- `express.static` stays behind the new layer, so every URL that worked before still works. The tree is re-checked at most once a second, so a worktree test copy picks up edits without a restart.
+- **Heavy sections load when first opened.** Messages, Threads, Speakers, Meetings, Work, Dictation and Settings (about 600 KB of scripts) no longer load at startup. Each loads the first time you open it, and once the page is showing the rest load in the background, so later taps are instant. A section that fails to load says why and offers Try again. Together with compression, the first open went from 26 requests and 1,969 KB to 19 requests and 561 KB on the Mac.
+- Default-on changes: response headers and compression on `/control/*`, and sections loading on first open. No API, data or server behaviour change.
+
 ## 6.99.20 - Prep opens from COS Control on the Mac (private)
 
 2026-11-06. Private fix on 6.99.19, matched to COS Control 0.5.376 already installed.

package/docs/work-orchestrator.md

@@ -182,3 +182,23 @@ Rules the server enforces:
 Checks: `server/routes/work-lens-rounds.test.ts` (record, idempotent repeat, send with and without confirm, Auto-send,
 423, `plan_stale`, expiry, stop, loopback-only, maintenance, the existing GET and POST unchanged) and
 `server/scripts/work-lens-rounds-mutation-gate.mjs` (not packaged).
+
+## Web plans (COS Control Web's Work chat)
+
+COS Control Web messages the orchestrator about a card the way the lens does. It plans with the Mac's routes and body
+(`GET /api/work/chat`, `POST /api/work/orchestrator/input` with `{workID, meetingWorkIDs}`, then `POST /api/work/chat`
+with `orchestrator: true`, the card's context in the helper's `work-context` format, and the planner and effort the
+server advertises), then records the plan with `POST /api/work/chat/lens-rounds` and asks COS Control to send it with
+`POST .../:roundId/send` (`confirm: "two-step"`: Send, then "Send to <session>", after the plan was shown). Nothing new
+can send: COS Control performs every send through its own Send path, with its journal, fences and receipts.
+
+| Change | Detail |
+| --- | --- |
+| `GET /api/work/chat/web-plans` (new) | `{protocolVersion: 1, webPlans: 1, sources: ["lens", "web"]}`. The web shows its composer only when this answers 1; an older server answers 404. `GET /api/work/chat` is unchanged. |
+| `POST /api/work/chat/lens-rounds` | `source` is `lens` (a `lens-<uuid>` id, as before) or `web` (a `web-<uuid>` id, validated by the same pattern). An id that does not start with its source is 400 `invalid_lens_round`, field `clientRoundId`. A web id reused for a different plan (question, answer, planner, effort or any assignment) is 409 `round_id_conflict`; the same plan again is 200 with the stored round. A lens repeat keeps the lens rule (200, the stored round, whatever the repeat carries). |
+| A web round | stored with `source: "web"`; the round view and the inbox carry `source: "web"`. A lens round has no `source` key, so its stored shape, view and inbox entry are byte for byte as before. |
+
+COS Control 0.5.3xx reads every inbox round as a lens round, so it labels a web round "From glasses" until it reads
+`source`. Card files and meeting files stay on the Mac: COS Control attaches them when it sends (a round with no
+`contextItemIDs` sends every linked item). The web cannot list or add them. Checks: `server/routes/work-web-rounds.test.ts`
+and `server/web-control/work-composer-web.test.ts`; `server/routes/work-lens-rounds.test.ts` is unchanged and passes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.99.20",
+  "version": "6.99.25",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -219,6 +219,7 @@ import { isPublicApiRequest, requireApiToken } from './lib/api-auth.js'
 import { PairingState, pairingHostsFrom } from './lib/glasses-pairing.js'
 import { createPairingRouter } from './routes/pairing.js'
 import { createWebControlRouter, isAllowedCorsOrigin, webControlCsp, webControlEnabled } from './routes/web-control.js'
+import { createWebControlStatic } from './lib/web-control-static.js'
 import { isWebControlSocketAllowed, isWebSessionAuthorized, setWebSessionEpochFile } from './lib/web-session-auth.js'
 import { getTailnetSelfName, installTailnetSelfName } from './lib/tailnet-self-name.js'
 import { isManagedRuntime, managedServerVersion } from './lib/managed-runtime.js'
@@ -1524,7 +1525,7 @@ if (webControlEnabled()) {
     res.setHeader('X-Content-Type-Options', 'nosniff')
     res.setHeader('Referrer-Policy', 'no-referrer')
     next()
-  }, express.static(webControlDir))
+  }, createWebControlStatic(webControlDir), express.static(webControlDir))
   app.use('/api', createWebControlRouter({
     apiToken: () => API_TOKEN,
     serverVersion: () => managedServerVersion() ?? 'unknown',

package/server/lib/web-control-static.ts

@@ -0,0 +1,226 @@
+/**
+ * Fast static serving for COS Control Web (`/control/*`).
+ *
+ * Before this, `/control` went straight to `express.static`: no compression and
+ * `Cache-Control: public, max-age=0`, so every open on the phone re-asked the Mac about
+ * all 22 boot files over Tailscale and downloaded about 1.2 MB of uncompressed JS and CSS
+ * plus 770 KB of fonts whenever anything changed.
+ *
+ * What this does:
+ * - Every asset gets a content hash. `index.html` and the CSS files have their
+ *   `/control/...` references rewritten to `/control/...?v=<hash>`.
+ * - A request whose `?v=` matches the current hash is cached for a year as `immutable`.
+ *   Anything else (index.html, a stale or missing `?v=`) is `no-cache`, so it revalidates
+ *   with its ETag and a new release is picked up on the next open.
+ * - Text assets are served brotli or gzip compressed when the browser accepts it. The
+ *   compressed bytes are built on first request and kept in memory.
+ * - Files on disk are re-checked at most once per `recheckMs`, so a test copy served from
+ *   a worktree picks up edits without a restart.
+ *
+ * Anything not in the table (a path this walker skips) falls through to `next()`, and the
+ * caller keeps `express.static` behind it, so no URL that worked before stops working.
+ */
+import crypto from 'crypto'
+import fs from 'fs'
+import path from 'path'
+import zlib from 'zlib'
+import type { NextFunction, Request, RequestHandler, Response } from 'express'
+
+/** A versioned URL's lifetime. Safe because the hash changes whenever the bytes do. */
+export const IMMUTABLE_CACHE = 'public, max-age=31536000, immutable'
+/** Unversioned and HTML responses: always revalidate, so a new release shows on the next open. */
+export const REVALIDATE_CACHE = 'no-cache'
+
+const TYPES: Record<string, string> = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.json': 'application/json; charset=utf-8',
+  '.ttf': 'font/ttf',
+  '.woff2': 'font/woff2',
+  '.png': 'image/png',
+  '.webp': 'image/webp',
+  '.jpg': 'image/jpeg',
+}
+/** Worth compressing. WOFF2 and images are already compressed. */
+const COMPRESSIBLE = new Set(['.html', '.js', '.css', '.svg', '.json', '.ttf'])
+/** Files whose `/control/...` references are rewritten to versioned URLs. */
+const REWRITTEN = new Set(['.html', '.css'])
+/** Only assets of these types get a versioned URL; HTML pages are always revalidated. */
+const VERSIONABLE = new Set(['.js', '.css', '.svg', '.json', '.ttf', '.woff2', '.png', '.webp', '.jpg'])
+
+export interface WebAsset {
+  /** Path under the mount, with a leading slash: `/panes/work.js`. */
+  urlPath: string
+  ext: string
+  type: string
+  body: Buffer
+  /** First 16 hex characters of the SHA-256 of `body` (after any rewrite). */
+  hash: string
+  gzip?: Promise<Buffer>
+  br?: Promise<Buffer>
+}
+
+export type WebAssetTable = Map<string, WebAsset>
+
+/** Dotfiles are never served. Sources (`.ts`) and maps stay out because TYPES does not list them. */
+function skip(name: string): boolean {
+  return name.startsWith('.')
+}
+
+function walk(dir: string, base = ''): Array<{ urlPath: string; file: string; stat: fs.Stats }> {
+  const out: Array<{ urlPath: string; file: string; stat: fs.Stats }> = []
+  let names: string[]
+  try { names = fs.readdirSync(dir) } catch { return out }
+  for (const name of names.sort()) {
+    if (skip(name)) continue
+    const file = path.join(dir, name)
+    let stat: fs.Stats
+    try { stat = fs.statSync(file) } catch { continue }
+    const urlPath = `${base}/${name}`
+    if (stat.isDirectory()) out.push(...walk(file, urlPath))
+    else if (stat.isFile() && TYPES[path.extname(name).toLowerCase()]) out.push({ urlPath, file, stat })
+  }
+  return out
+}
+
+/** A cheap fingerprint of the tree: every path, size and mtime. */
+export function treeSignature(dir: string): string {
+  return walk(dir).map((f) => `${f.urlPath}:${f.stat.size}:${f.stat.mtimeMs}`).join('|')
+}
+
+function sha(body: Buffer): string {
+  return crypto.createHash('sha256').update(body).digest('hex').slice(0, 16)
+}
+
+/**
+ * Rewrite `/control/<path>` references (quoted, or inside `url(...)`) to carry `?v=<hash>`.
+ * Only references to a known, versionable asset are touched; a reference that already has a
+ * query string, or names a file that does not exist, is left exactly as written.
+ */
+export function rewriteReferences(text: string, mount: string, hashes: Map<string, string>): string {
+  const prefix = mount.replace(/\/$/, '')
+  const re = new RegExp(`(["'(])${prefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(/[A-Za-z0-9_./-]+)(["')])`, 'g')
+  return text.replace(re, (whole, open: string, rel: string, close: string) => {
+    const hash = hashes.get(rel)
+    if (!hash || !VERSIONABLE.has(path.extname(rel).toLowerCase())) return whole
+    return `${open}${prefix}${rel}?v=${hash}${close}`
+  })
+}
+
+/**
+ * Build the table. Leaves (JS, fonts, images) are hashed first, then CSS is rewritten against
+ * them and hashed, then HTML is rewritten against everything. So a font change gives its CSS a
+ * new hash, and that gives index.html new references.
+ */
+export function buildWebAssetTable(dir: string, mount = '/control'): WebAssetTable {
+  const files = walk(dir)
+  const hashes = new Map<string, string>()
+  const table: WebAssetTable = new Map()
+  const read = (file: string): Buffer | null => { try { return fs.readFileSync(file) } catch { return null } }
+  const add = (urlPath: string, ext: string, body: Buffer): void => {
+    const hash = sha(body)
+    hashes.set(urlPath, hash)
+    table.set(urlPath, { urlPath, ext, type: TYPES[ext], body, hash })
+  }
+  const pass = (pick: (ext: string) => boolean): void => {
+    for (const f of files) {
+      const ext = path.extname(f.urlPath).toLowerCase()
+      if (!pick(ext)) continue
+      const raw = read(f.file)
+      if (!raw) continue
+      const body = REWRITTEN.has(ext) ? Buffer.from(rewriteReferences(raw.toString('utf8'), mount, hashes), 'utf8') : raw
+      add(f.urlPath, ext, body)
+    }
+  }
+  pass((ext) => !REWRITTEN.has(ext))
+  pass((ext) => ext === '.css')
+  pass((ext) => ext === '.html')
+  return table
+}
+
+/** Which encoding to send: brotli, then gzip, then none. `q=0` refuses an encoding. */
+export function pickEncoding(acceptEncoding: string | undefined): 'br' | 'gzip' | null {
+  const accepted = new Map<string, number>()
+  for (const part of String(acceptEncoding || '').toLowerCase().split(',')) {
+    const [name, ...params] = part.trim().split(';')
+    if (!name) continue
+    const q = params.map((p) => p.trim()).find((p) => p.startsWith('q='))
+    accepted.set(name.trim(), q ? Number(q.slice(2)) || 0 : 1)
+  }
+  const ok = (name: string): boolean => (accepted.get(name) ?? accepted.get('*') ?? 0) > 0
+  if (ok('br')) return 'br'
+  if (ok('gzip')) return 'gzip'
+  return null
+}
+
+function compressed(asset: WebAsset, encoding: 'br' | 'gzip'): Promise<Buffer> {
+  if (encoding === 'br') {
+    asset.br ??= new Promise((resolve, reject) => zlib.brotliCompress(asset.body, {
+      params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 9, [zlib.constants.BROTLI_PARAM_SIZE_HINT]: asset.body.length },
+    }, (err, out) => (err ? reject(err) : resolve(out))))
+    return asset.br
+  }
+  asset.gzip ??= new Promise((resolve, reject) => zlib.gzip(asset.body, { level: 9 }, (err, out) => (err ? reject(err) : resolve(out))))
+  return asset.gzip
+}
+
+export interface WebControlStaticOptions {
+  mount?: string
+  /** How often the tree is re-checked for edits. 0 checks on every request. */
+  recheckMs?: number
+  now?: () => number
+}
+
+export function createWebControlStatic(dir: string, opts: WebControlStaticOptions = {}): RequestHandler & { table: () => WebAssetTable } {
+  const mount = opts.mount ?? '/control'
+  const recheckMs = opts.recheckMs ?? 1000
+  const now = opts.now ?? Date.now
+  let signature = treeSignature(dir)
+  let table = buildWebAssetTable(dir, mount)
+  let checkedAt = now()
+
+  const current = (): WebAssetTable => {
+    if (now() - checkedAt >= recheckMs) {
+      checkedAt = now()
+      const next = treeSignature(dir)
+      if (next !== signature) { signature = next; table = buildWebAssetTable(dir, mount) }
+    }
+    return table
+  }
+
+  const handler = (req: Request, res: Response, next: NextFunction): void => {
+    if (req.method !== 'GET' && req.method !== 'HEAD') { next(); return }
+    let urlPath = req.path || '/'
+    if (urlPath.endsWith('/')) urlPath += 'index.html'
+    const asset = current().get(urlPath)
+    if (!asset) { next(); return }
+
+    const versioned = VERSIONABLE.has(asset.ext) && req.query.v === asset.hash
+    const encoding = COMPRESSIBLE.has(asset.ext) ? pickEncoding(req.headers['accept-encoding'] as string | undefined) : null
+    const etag = `"${asset.hash}${encoding ? `-${encoding}` : ''}"`
+    res.setHeader('Content-Type', asset.type)
+    res.setHeader('Cache-Control', versioned ? IMMUTABLE_CACHE : REVALIDATE_CACHE)
+    res.setHeader('ETag', etag)
+    if (COMPRESSIBLE.has(asset.ext)) res.setHeader('Vary', 'Accept-Encoding')
+
+    const inm = String(req.headers['if-none-match'] || '')
+    if (inm && inm.split(',').map((t) => t.trim().replace(/^W\//, '')).includes(etag)) { res.status(304).end(); return }
+
+    const send = (body: Buffer): void => {
+      if (encoding) res.setHeader('Content-Encoding', encoding)
+      res.setHeader('Content-Length', String(body.length))
+      if (req.method === 'HEAD') res.end(); else res.end(body)
+    }
+    if (!encoding) { send(asset.body); return }
+    compressed(asset, encoding).then(send, () => {
+      // Compression failed: send the plain bytes rather than nothing.
+      res.removeHeader('Content-Encoding')
+      res.setHeader('ETag', `"${asset.hash}"`)
+      res.setHeader('Content-Length', String(asset.body.length))
+      if (req.method === 'HEAD') res.end(); else res.end(asset.body)
+    })
+  }
+  return Object.assign(handler, { table: current })
+}

package/server/lib/web-memories-bridge.ts

@@ -306,14 +306,15 @@ export async function dispatchMemoriesWebOp(
       return r.status === 200 ? reply(true, 'Duplicates ready', r.body) : reply(false, r.body.message || r.body.error || 'Failed')
     }
     case 'cues.summary': {
-      // Rating cues opens Control's native cue pane, which the browser does not have, so the
-      // page is told cues are unavailable and hides "Cues to rate" rather than show a button
-      // that does nothing. The counts use Control's keys for when a web cue pane exists.
-      const r = await loopbackFetch('/api/live-cues/history?days=7&limit=200', { timeoutMs: 10_000 })
-      const counts = (r.status === 200 ? r.body.counts ?? {} : {}) as Record<string, any>
-      const unrated = typeof counts.unrated === 'number' ? counts.unrated : 0
-      const rated = typeof counts.rated === 'number' ? counts.rated : 0
-      return reply(true, 'Cues', { available: false, unrated, rated, total: unrated + rated })
+      // Control's CueVerdicts.summary: the cue history read is the capability check. A 200 in the v1 contract means the
+      // server keeps the cue log and verdicts, and COS Control Web rates them in Memories (Cues to rate, Rated cues), so
+      // the answer is available with the week's counts; anything else is unavailable and the entries hide.
+      const r = await loopbackFetch('/api/live-cues/history?days=7&unrated=1&limit=1', { timeoutMs: 10_000 })
+      const counts = (r.status === 200 && r.body.v === 1 ? r.body.counts ?? null : null) as Record<string, any> | null
+      if (!counts || typeof counts.unrated !== 'number' || typeof counts.rated !== 'number' || typeof counts.total !== 'number') {
+        return reply(true, 'Cues', { available: false })
+      }
+      return reply(true, 'Cues', { available: true, unrated: counts.unrated, rated: counts.rated, total: counts.total })
     }
     case 'copy':
       return reply(true, 'Copied', {})

package/server/lib/web-pet-choice.ts

@@ -0,0 +1,225 @@
+/**
+ * Which pet COS Control Web shows (Miles 11/06 23:06: "build the change pet picker ... Just use the
+ * existing 300 pack that we have on the COS control").
+ *
+ * A choice is one of:
+ *   mac               the pet COS Control shows (its own session-pet-states.json, or its single sprite)
+ *   shipped:<id>      a character COS Control ships in its app bundle (BundledCharacters/<id>, animated),
+ *                     or shipped:cloud-puff, the StarterPet still
+ *   gallery:<id>      one of the OpenPets gallery pets COS Control lists (openpets-catalog.json, about 300).
+ *                     As on the Mac (installOpenPetsThumb), a gallery pick is the gallery picture as a still.
+ *
+ * The choice is kept per browser. Changing the Mac's own pet stays in COS Control on the Mac: the app does
+ * not watch its pet folder, so writing it from here would leave the Mac showing the old pet.
+ * Everything here reads COS Control's files and never writes them.
+ */
+import crypto from 'crypto'
+import fs from 'fs'
+import path from 'path'
+import { controlSupportDir, readPetSources } from './web-pet.js'
+
+export type PetChoice =
+  | { kind: 'mac' }
+  | { kind: 'shipped'; id: string }
+  | { kind: 'gallery'; id: string }
+
+const ID = /^[a-z0-9][a-z0-9-]{0,80}$/
+
+export function parsePetChoice(raw: unknown): PetChoice | null {
+  if (raw === undefined) return { kind: 'mac' }
+  // A repeated ?pet= arrives as an array: refuse it rather than guess.
+  if (typeof raw !== 'string') return null
+  const s = raw
+  if (s === '' || s === 'mac') return { kind: 'mac' }
+  const m = s.match(/^(shipped|gallery):(.+)$/)
+  if (!m || !ID.test(m[2])) return null
+  return { kind: m[1] as 'shipped' | 'gallery', id: m[2] }
+}
+
+export function petChoiceKey(c: PetChoice): string {
+  return c.kind === 'mac' ? 'mac' : `${c.kind}:${c.id}`
+}
+
+/** COS Control's app resources. Most installs live in /Applications; ~/Applications is checked too. */
+export function controlResourcesDir(env: NodeJS.ProcessEnv = process.env): string | null {
+  if (env.COS_CONTROL_RESOURCES_DIR) return env.COS_CONTROL_RESOURCES_DIR
+  for (const base of ['/Applications', path.join(env.HOME || '', 'Applications')]) {
+    const dir = path.join(base, 'COS Control.app', 'Contents', 'Resources')
+    try { if (fs.statSync(dir).isDirectory()) return dir } catch { /* next */ }
+  }
+  return null
+}
+
+/** Names and summaries word for word from COS Control (Models.swift bundledCharacters). Cloud Puff has no
+ *  summary there (defaultCharacterName only), so its line is ours. Keep in step when Control adds a character. */
+const SHIPPED_NAMES: Record<string, { name: string; summary: string }> = {
+  'jedi-miles-windu': { name: 'Jedi Miles Windu', summary: 'Ten animated states. Purple saber and escalating droid fights.' },
+  'jedi-nia-solari': { name: 'Jedi Nia Solari', summary: 'Eight-frame idle and four combat loops. Purple saber, braided silhouette, and Force counters.' },
+  'jedi-elara-vale': { name: 'Jedi Elara Vale', summary: 'Eight-frame idle and four combat loops. Green saber, auburn braid, and agile redirects.' },
+  'jedi-rowan-vale': { name: 'Jedi Rowan Vale', summary: 'Eight-frame idle and four combat loops. Blue saber, two-handed guard, and grounded strikes.' },
+  'cloud-puff': { name: 'Cloud Puff', summary: 'A simple, calm figure. The default for new installs.' },
+}
+
+function isFile(p: string): boolean {
+  try { return fs.statSync(p).isFile() } catch { return false }
+}
+
+export interface ShippedPet { id: string; name: string; summary: string; animated: boolean }
+
+/** Characters the installed COS Control carries. Only folders with a valid state map count. */
+export function shippedPets(resources: string | null = controlResourcesDir()): ShippedPet[] {
+  if (!resources) return []
+  const out: ShippedPet[] = []
+  let names: string[] = []
+  try { names = fs.readdirSync(path.join(resources, 'BundledCharacters')).filter((n) => ID.test(n)).sort() } catch { /* none */ }
+  for (const id of names) {
+    if (Object.keys(readPetSources(path.join(resources, 'BundledCharacters', id))).length === 0) continue
+    const label = SHIPPED_NAMES[id] ?? { name: id.replace(/-/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase()), summary: '' }
+    out.push({ id, name: label.name, summary: label.summary, animated: true })
+  }
+  if (isFile(path.join(resources, 'StarterPet', 'cloud-puff.webp'))) out.push({ id: 'cloud-puff', ...SHIPPED_NAMES['cloud-puff'], animated: false })
+  return out
+}
+
+export interface GalleryPet { id: string; name: string; description: string; category: string; preview: string }
+
+/** The OpenPets gallery COS Control fetched (openpets-catalog.json). Only https previews on openpets.dev. */
+export function galleryPets(dir: string = controlSupportDir()): GalleryPet[] {
+  const file = path.join(dir, 'openpets-catalog.json')
+  let raw: { catalog?: { pets?: unknown[] } }
+  try {
+    if (!isFile(file)) return []
+    raw = JSON.parse(fs.readFileSync(file, 'utf8'))
+  } catch { return [] }
+  const pets = Array.isArray(raw?.catalog?.pets) ? raw.catalog!.pets! : []
+  const out: GalleryPet[] = []
+  const seen = new Set<string>()
+  for (const p of pets as Array<Record<string, unknown>>) {
+    const id = typeof p?.id === 'string' ? p.id : ''
+    const preview = typeof p?.preview === 'string' ? p.preview : ''
+    if (!ID.test(id) || seen.has(id) || !isOpenPetsUrl(preview)) continue
+    seen.add(id)
+    out.push({
+      id,
+      name: typeof p.displayName === 'string' && p.displayName ? p.displayName : id,
+      description: typeof p.description === 'string' ? p.description : '',
+      category: [p.category, p.subcategory].filter((x) => typeof x === 'string' && x).join(' '),
+      preview,
+    })
+  }
+  return out
+}
+
+/** The Mac helper's rule, exactly (HelperSources/main.swift isAllowedThumbURL): https, host openpets.dev, a path
+ *  ending in /thumb.webp, no user or password. The catalog is untrusted; nothing else is ever fetched. */
+export function isOpenPetsUrl(url: string): boolean {
+  try {
+    const u = new URL(url)
+    return u.protocol === 'https:' && u.hostname === 'openpets.dev' && u.port === '' && !u.username && !u.password && u.pathname.endsWith('/thumb.webp')
+  } catch { return false }
+}
+
+export type ResolvedPet =
+  | { kind: 'strips'; dir: string; cacheName: string }
+  | { kind: 'still'; file: string; type: string }
+  | { kind: 'gallery'; id: string; preview: string }
+
+const STILL_TYPES: Record<string, string> = { '.png': 'image/png', '.webp': 'image/webp', '.gif': 'image/gif', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg' }
+
+/** Where the chosen pet's art lives, or null when that pet is not available on this Mac. */
+export function resolvePet(choice: PetChoice, opts: { supportDir?: string; resources?: string | null } = {}): ResolvedPet | null {
+  const support = opts.supportDir ?? controlSupportDir()
+  const resources = opts.resources === undefined ? controlResourcesDir() : opts.resources
+  if (choice.kind === 'mac') {
+    if (Object.keys(readPetSources(support)).length > 0) return { kind: 'strips', dir: support, cacheName: '' }
+    // A gallery pick or a single custom image on the Mac: COS Control's plain sprite (PetSpriteStore.fileStem).
+    for (const ext of Object.keys(STILL_TYPES)) {
+      const file = path.join(support, `session-pet-sprite${ext}`)
+      if (isFile(file)) return { kind: 'still', file, type: STILL_TYPES[ext] }
+    }
+    return null
+  }
+  if (choice.kind === 'shipped') {
+    if (!resources) return null
+    if (choice.id === 'cloud-puff') {
+      const file = path.join(resources, 'StarterPet', 'cloud-puff.webp')
+      return isFile(file) ? { kind: 'still', file, type: 'image/webp' } : null
+    }
+    const dir = path.join(resources, 'BundledCharacters', choice.id)
+    return Object.keys(readPetSources(dir)).length > 0 ? { kind: 'strips', dir, cacheName: `shipped-${choice.id}` } : null
+  }
+  const pet = galleryPets(support).find((p) => p.id === choice.id)
+  return pet ? { kind: 'gallery', id: pet.id, preview: pet.preview } : null
+}
+
+/** The Mac helper's limits (openPetsThumbMaxBytes, timeout 6): 512 KB, enforced while reading, and 6 seconds. */
+export const GALLERY_MAX_BYTES = 512 * 1024
+export const GALLERY_TIMEOUT_MS = 6_000
+/** COS Control keeps the thumbnails it already fetched here (main.swift openPetsThumbsDir, <id>.webp). */
+export const MAC_THUMBS_DIR = 'openpets-thumbs'
+
+function isWebP(b: Buffer): boolean {
+  return b.length >= 12 && b.toString('ascii', 0, 4) === 'RIFF' && b.toString('ascii', 8, 12) === 'WEBP'
+}
+
+/** Read at most max bytes from a response body, cancelling the stream past the limit. */
+async function readCapped(res: Response, max: number): Promise<Buffer> {
+  const reader = res.body?.getReader()
+  if (!reader) return Buffer.from(await res.arrayBuffer())
+  const parts: Buffer[] = []
+  let total = 0
+  for (;;) {
+    const { done, value } = await reader.read()
+    if (done) break
+    total += value.byteLength
+    if (total > max) { await reader.cancel().catch(() => {}); throw new Error('gallery_too_large') }
+    parts.push(Buffer.from(value))
+  }
+  return Buffer.concat(parts)
+}
+
+export type PetFetcher = (url: string, init: { signal: AbortSignal; redirect: 'error' }) => Promise<Response>
+const galleryInflight = new Map<string, Promise<{ file: string; type: string }>>()
+/** A picture that just failed is not asked for again for this long, so a broken gallery is not hammered. */
+export const GALLERY_RETRY_MS = 10 * 60_000
+const galleryFailedAt = new Map<string, number>()
+
+/**
+ * The gallery picture for one pet, downloaded once from openpets.dev (as COS Control does) and kept under
+ * the data folder. Refuses anything the Mac helper would (not WebP, over 512 KB, redirected, slower than 6 s).
+ */
+export function galleryThumb(pet: { id: string; preview: string }, cacheDir: string, fetcher: PetFetcher = fetch as unknown as PetFetcher, macSupportDir: string | null = null): Promise<{ file: string; type: string }> {
+  if (!ID.test(pet.id) || !isOpenPetsUrl(pet.preview)) return Promise.reject(new Error('gallery_pet_invalid'))
+  // The thumbnail COS Control already fetched, when it is a real WebP: no second download (read only).
+  if (macSupportDir) {
+    const mac = path.join(macSupportDir, MAC_THUMBS_DIR, `${pet.id}.webp`)
+    try {
+      if (fs.statSync(mac).isFile() && fs.statSync(mac).size <= GALLERY_MAX_BYTES && isWebP(fs.readFileSync(mac))) return Promise.resolve({ file: mac, type: 'image/webp' })
+    } catch { /* not there: fetch below */ }
+  }
+  const tag = crypto.createHash('sha256').update(pet.preview).digest('hex').slice(0, 12)
+  const base = path.join(cacheDir, `${pet.id}-${tag}`)
+  if (isFile(base + '.webp')) return Promise.resolve({ file: base + '.webp', type: 'image/webp' })
+  const failed = galleryFailedAt.get(base)
+  if (failed && Date.now() - failed < GALLERY_RETRY_MS) return Promise.reject(new Error('gallery_recently_failed'))
+  let job = galleryInflight.get(base)
+  if (!job) {
+    job = (async () => {
+      const res = await fetcher(pet.preview, { signal: AbortSignal.timeout(GALLERY_TIMEOUT_MS), redirect: 'error' })
+      if (res.status !== 200) throw new Error(`gallery_http_${res.status}`)
+      const declared = Number(res.headers.get('content-length') || 0)
+      if (declared > GALLERY_MAX_BYTES) throw new Error('gallery_too_large')
+      const body = await readCapped(res, GALLERY_MAX_BYTES)
+      // WebP only, as the Mac (isOpenPetsWebP).
+      if (!isWebP(body)) throw new Error('gallery_not_image')
+      fs.mkdirSync(cacheDir, { recursive: true })
+      const tmp = `${base}.${process.pid}.${Date.now()}.tmp`
+      fs.writeFileSync(tmp, body)
+      fs.renameSync(tmp, base + '.webp')
+      return { file: base + '.webp', type: 'image/webp' }
+    })().then((ok) => { galleryFailedAt.delete(base); return ok }, (err) => { galleryFailedAt.set(base, Date.now()); throw err })
+      .finally(() => galleryInflight.delete(base))
+    galleryInflight.set(base, job)
+  }
+  return job
+}