@gotcos/glasses-server 6.99.20 → 6.99.25

package/server/lib/web-pet.ts

@@ -0,0 +1,226 @@
+/**
+ * The session pet on COS Control Web (Miles 11/06: "pets brought to the COS ... on home").
+ *
+ * COS Control keeps the active pet as horizontal PNG strips plus `session-pet-states.json`
+ * in `~/Library/Application Support/COS Control`. The web reads that same map, so the phone
+ * shows the pet the Mac shows, with no copy to keep in step.
+ *
+ * The Mac's 1x strips are 256 px tall and up to ~56,000 px wide (Windu's working cast is
+ * 184 frames, 3.2 MB). That is too much for a phone to decode at once, so each pose is
+ * resized to WEB_PET_HEIGHT with macOS `sips` and cut into chunks no wider than
+ * WEB_PET_MAX_CHUNK_WIDTH, each holding whole frames. The result is cached on disk, keyed by
+ * the source file's size and mtime, so a pet change on the Mac shows on the next load.
+ *
+ * `sips` quirk (measured 11/06): `--cropOffset 0 0` crops from the CENTER, while any other
+ * offset is measured from the top-left. The first chunk is therefore cut by flipping the
+ * strip, cropping from the far end, and flipping back. Pixel-identical to a direct crop.
+ */
+import crypto from 'crypto'
+import { execFile } from 'child_process'
+import fs from 'fs'
+import os from 'os'
+import path from 'path'
+
+/** The poses COS Control's live pet uses (PetSpritePose.liveCases). */
+export const WEB_PET_POSES = ['idle', 'patrol', 'waiting', 'working', 'duel', 'trio', 'swarm', 'done', 'error', 'attention'] as const
+export type WebPetPose = typeof WEB_PET_POSES[number]
+/** Frame height sent to the phone, in pixels. */
+export const WEB_PET_HEIGHT = 160
+/** Widest chunk sent, in pixels. Keeps each decoded image near 5 MB. */
+export const WEB_PET_MAX_CHUNK_WIDTH = 8192
+
+export interface PetPoseSource { pose: WebPetPose; file: string; frames: number; interval: number; width: number; height: number; size: number; mtimeMs: number }
+export interface PetPosePlan extends PetPoseSource { outHeight: number; frameWidth: number; perChunk: number; chunks: number; key: string }
+
+export function controlSupportDir(env: NodeJS.ProcessEnv = process.env): string {
+  return env.COS_CONTROL_SUPPORT_DIR || path.join(os.homedir(), 'Library', 'Application Support', 'COS Control')
+}
+
+/** Width and height from a PNG's IHDR, or null for anything that is not a PNG. */
+export function pngSize(file: string): { width: number; height: number } | null {
+  let fd: number | null = null
+  try {
+    // Non-blocking: a FIFO planted at this path would otherwise hang the whole server (hazard-invariants.test.ts).
+    fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK)
+    if (!fs.fstatSync(fd).isFile()) return null
+    const head = Buffer.alloc(24)
+    if (fs.readSync(fd, head, 0, 24, 0) < 24) return null
+    if (head.readUInt32BE(0) !== 0x89504e47 || head.toString('ascii', 12, 16) !== 'IHDR') return null
+    return { width: head.readUInt32BE(16), height: head.readUInt32BE(20) }
+  } catch {
+    return null
+  } finally {
+    if (fd !== null) fs.closeSync(fd)
+  }
+}
+
+/** A file name from the state map, kept inside the support folder. */
+function insideDir(dir: string, name: unknown): string | null {
+  if (typeof name !== 'string' || !name || name.includes('\0') || path.isAbsolute(name)) return null
+  const full = path.resolve(dir, name)
+  return full.startsWith(path.resolve(dir) + path.sep) ? full : null
+}
+
+/** Read the Mac's pet. Poses with a missing, unreadable or mismatched strip are left out. */
+export function readPetSources(dir: string): Partial<Record<WebPetPose, PetPoseSource>> {
+  let map: { poses?: Record<string, { file?: unknown; frames?: unknown; interval?: unknown }> }
+  const mapFile = path.join(dir, 'session-pet-states.json')
+  try {
+    // Only a regular file is read: readFileSync on a FIFO blocks the event loop.
+    if (!fs.statSync(mapFile).isFile()) return {}
+    map = JSON.parse(fs.readFileSync(mapFile, 'utf8'))
+  } catch { return {} }
+  const out: Partial<Record<WebPetPose, PetPoseSource>> = {}
+  for (const pose of WEB_PET_POSES) {
+    const row = map?.poses?.[pose]
+    if (!row) continue
+    const file = insideDir(dir, row.file)
+    const frames = Number(row.frames)
+    if (!file || !Number.isInteger(frames) || frames < 1 || frames > 1000) continue
+    let stat: fs.Stats
+    try { stat = fs.statSync(file) } catch { continue }
+    if (!stat.isFile()) continue
+    const size = pngSize(file)
+    if (!size || size.height < 8 || size.width % frames !== 0) continue
+    const interval = Number(row.interval)
+    out[pose] = {
+      pose, file, frames, interval: Number.isFinite(interval) && interval >= 0.01 && interval <= 2 ? interval : 0.12,
+      width: size.width, height: size.height, size: stat.size, mtimeMs: stat.mtimeMs,
+    }
+  }
+  return out
+}
+
+/** How a pose is resized and chunked. Frame width is rounded once, so every chunk holds whole frames. */
+export function planPose(src: PetPoseSource, height = WEB_PET_HEIGHT, maxChunk = WEB_PET_MAX_CHUNK_WIDTH): PetPosePlan {
+  const frameWidth = Math.max(1, Math.round((src.width / src.frames) * (height / src.height)))
+  const perChunk = Math.max(1, Math.floor(maxChunk / frameWidth))
+  const chunks = Math.ceil(src.frames / perChunk)
+  const key = crypto.createHash('sha256')
+    .update(`${src.file}\0${src.size}\0${src.mtimeMs}\0${src.frames}\0${height}\0${maxChunk}\0v1`)
+    .digest('hex').slice(0, 16)
+  return { ...src, outHeight: height, frameWidth, perChunk, chunks, key }
+}
+
+export function webPetManifest(dir: string = controlSupportDir(), pet = 'mac') {
+  const sources = readPetSources(dir)
+  const poses: Record<string, { frames: number; interval: number; frameWidth: number; height: number; perChunk: number; chunks: string[] }> = {}
+  for (const pose of WEB_PET_POSES) {
+    const src = sources[pose]
+    if (!src) continue
+    const p = planPose(src)
+    poses[pose] = {
+      frames: p.frames, interval: p.interval, frameWidth: p.frameWidth, height: WEB_PET_HEIGHT, perChunk: p.perChunk,
+      chunks: Array.from({ length: p.chunks }, (_, i) => `/api/web-pet/sheet/${pose}/${i}?pet=${encodeURIComponent(pet)}&v=${p.key}`),
+    }
+  }
+  return { available: Object.keys(poses).length > 0, poses }
+}
+
+type Run = (cmd: string, args: string[]) => Promise<void>
+const sips: Run = (cmd, args) => new Promise((resolve, reject) => {
+  execFile(cmd, args, { timeout: 30_000 }, (err) => (err ? reject(err) : resolve()))
+})
+
+export interface PetChunkOptions { cacheDir: string; run?: Run; sipsPath?: string }
+const inflight = new Map<string, Promise<string>>()
+
+/**
+ * The PNG path for one chunk of one pose, building it on first request. Every chunk of the pose
+ * is built together, so a pose costs one resize. Concurrent requests share one build.
+ */
+export function petChunk(plan: PetPosePlan, index: number, opts: PetChunkOptions): Promise<string> {
+  if (!Number.isInteger(index) || index < 0 || index >= plan.chunks) return Promise.reject(new Error('no_such_chunk'))
+  const base = path.join(opts.cacheDir, `${plan.pose}-${plan.key}`)
+  const target = `${base}-${index}.png`
+  if (fs.existsSync(target)) return Promise.resolve(target)
+  let job = inflight.get(base)
+  if (!job) {
+    job = buildPose(plan, base, opts).finally(() => inflight.delete(base))
+    inflight.set(base, job)
+  }
+  return job.then(() => target)
+}
+
+async function buildPose(plan: PetPosePlan, base: string, opts: PetChunkOptions): Promise<string> {
+  const run = opts.run ?? sips
+  const bin = opts.sipsPath ?? '/usr/bin/sips'
+  fs.mkdirSync(opts.cacheDir, { recursive: true })
+  const tmp = fs.mkdtempSync(path.join(opts.cacheDir, '.build-'))
+  try {
+    const H = plan.outHeight
+    const total = plan.frameWidth * plan.frames
+    const resized = path.join(tmp, 'resized.png')
+    await run(bin, ['-z', String(H), String(total), plan.file, '--out', resized])
+    let flipped: string | null = null
+    for (let i = 0; i < plan.chunks; i++) {
+      const x = i * plan.perChunk * plan.frameWidth
+      const w = Math.min(plan.perChunk, plan.frames - i * plan.perChunk) * plan.frameWidth
+      const out = path.join(tmp, `${i}.png`)
+      if (plan.chunks === 1) {
+        fs.copyFileSync(resized, out)
+      } else if (x === 0) {
+        // `--cropOffset 0 0` means centre to sips: cut the first chunk from the mirrored strip's far end.
+        if (!flipped) { flipped = path.join(tmp, 'flipped.png'); await run(bin, ['-f', 'horizontal', resized, '--out', flipped]) }
+        const far = path.join(tmp, `${i}-far.png`)
+        await run(bin, ['-c', String(H), String(w), '--cropOffset', '0', String(total - w), flipped, '--out', far])
+        await run(bin, ['-f', 'horizontal', far, '--out', out])
+      } else {
+        await run(bin, ['-c', String(H), String(w), '--cropOffset', '0', String(x), resized, '--out', out])
+      }
+    }
+    for (let i = 0; i < plan.chunks; i++) fs.renameSync(path.join(tmp, `${i}.png`), `${base}-${i}.png`)
+    // Drop this pose's older builds (a pet change on the Mac makes a new key).
+    const keep = path.basename(base) + '-'
+    for (const name of fs.readdirSync(opts.cacheDir)) {
+      if (name.startsWith(`${plan.pose}-`) && !name.startsWith(keep) && name.endsWith('.png')) fs.rmSync(path.join(opts.cacheDir, name), { force: true })
+    }
+    return base
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true })
+  }
+}
+
+/** Height of the first-frame previews in the pet picker. */
+export const WEB_PET_PREVIEW_HEIGHT = 96
+
+/**
+ * One still frame (the first frame of idle, else of the first pose this pet has) for the picker, built once
+ * with sips and cached. Uses the same flip-and-crop as the first chunk, since sips reads offset 0 as centre.
+ */
+export function petPreview(dir: string, cacheDir: string, opts: { run?: Run; sipsPath?: string } = {}): Promise<string> {
+  const sources = readPetSources(dir)
+  const src = sources.idle ?? WEB_PET_POSES.map((p) => sources[p]).find(Boolean)
+  if (!src) return Promise.reject(new Error('no_pet_art'))
+  const plan = planPose(src, WEB_PET_PREVIEW_HEIGHT)
+  const target = path.join(cacheDir, `preview-${plan.key}.png`)
+  if (fs.existsSync(target)) return Promise.resolve(target)
+  let job = inflight.get(target)
+  if (!job) {
+    job = (async () => {
+      const run = opts.run ?? sips
+      const bin = opts.sipsPath ?? '/usr/bin/sips'
+      fs.mkdirSync(cacheDir, { recursive: true })
+      const tmp = fs.mkdtempSync(path.join(cacheDir, '.preview-'))
+      try {
+        const H = plan.outHeight, total = plan.frameWidth * plan.frames, w = plan.frameWidth
+        const resized = path.join(tmp, 'resized.png'), out = path.join(tmp, 'out.png')
+        await run(bin, ['-z', String(H), String(total), plan.file, '--out', resized])
+        if (plan.frames === 1) {
+          fs.copyFileSync(resized, out)
+        } else {
+          const flipped = path.join(tmp, 'flipped.png'), far = path.join(tmp, 'far.png')
+          await run(bin, ['-f', 'horizontal', resized, '--out', flipped])
+          await run(bin, ['-c', String(H), String(w), '--cropOffset', '0', String(total - w), flipped, '--out', far])
+          await run(bin, ['-f', 'horizontal', far, '--out', out])
+        }
+        fs.renameSync(out, target)
+        return target
+      } finally {
+        fs.rmSync(tmp, { recursive: true, force: true })
+      }
+    })().finally(() => inflight.delete(target))
+    inflight.set(target, job)
+  }
+  return job
+}

package/server/lib/work-lens-rounds.ts

@@ -36,7 +36,14 @@ const MAX_SENDS_KEPT = 8
 const MAX_STOPS_KEPT = 8
 
 const WORK_ID = /^task:[a-z_]+:[a-f0-9]{12}$/
-const CLIENT_ROUND_ID = /^lens-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+const CLIENT_ROUND_ID = /^(lens|web)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+/**
+ * Who made the plan: the lens, or COS Control Web (Work chat on the phone or in a browser; GET /api/work/chat/web-plans
+ * says this server takes it). The client round id starts with its source (`lens-`, `web-`). A web round is the same contract as a
+ * lens round: recorded, sent only by COS Control through its own Send, never by this server.
+ */
+export const ROUND_SOURCES = ['lens', 'web'] as const
+export type RoundSource = typeof ROUND_SOURCES[number]
 const SID = /^(claude|codex|cursor):[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/
 const ITEM_ID = /^[a-z]{1,8}(:[a-f0-9]{12})?$/
 const RECEIPT_ID = /^[A-Za-z0-9_.:-]{1,80}$/
@@ -72,6 +79,8 @@ export interface LensRound {
   /** The card's sessions (Control snapshot links and receipts) when the plan was recorded; null when no snapshot. */
   cardSessions: string[] | null
   sends: LensSendRequest[]; stops: LensStopRequest[]; updatedAt: number
+  /** Set only on a round COS Control Web made. A lens round has no `source`, so its stored shape is unchanged. */
+  source?: 'web'
   /** COS Control's own Send of this round's assignments on the Mac (the lens was told to send from the Mac): when, and which. */
   mac?: { at: number; ids: string[] } | null
 }
@@ -89,7 +98,7 @@ const newId = (prefix: string) => `${prefix}_${randomBytes(8).toString('hex')}`
 
 export interface LensRoundInput {
   workID: string; clientRoundId: string; question: string; answer: string; planner: string | null; effort: string | null
-  orchestrator: boolean; assignments: Omit<LensAssignment, 'state'>[]; createdAt: string
+  orchestrator: boolean; assignments: Omit<LensAssignment, 'state'>[]; createdAt: string; source: RoundSource
 }
 
 /** The record body. Unknown keys are ignored and never stored. */
@@ -103,7 +112,8 @@ export function parseLensRound(v: unknown): LensRoundInput {
   if (v.planner !== undefined && !(WORK_CHAT_PLANNERS as readonly unknown[]).includes(v.planner)) throw invalid('planner')
   if (v.effort !== undefined && !(WORK_CHAT_EFFORTS as readonly unknown[]).includes(v.effort)) throw invalid('effort')
   if (v.orchestrator !== undefined && typeof v.orchestrator !== 'boolean') throw invalid('orchestrator')
-  if (v.source !== 'lens') throw invalid('source')
+  if (!(ROUND_SOURCES as readonly unknown[]).includes(v.source)) throw invalid('source')
+  if (!v.clientRoundId.startsWith(`${v.source}-`)) throw invalid('clientRoundId', 'The round id must start with its source.')
   if (!iso(v.createdAt)) throw invalid('createdAt')
   if (!Array.isArray(v.assignments) || v.assignments.length > WORK_CHAT_MAX_ASSIGNMENTS) throw invalid('assignments')
   const assignments: LensRoundInput['assignments'] = []
@@ -122,7 +132,19 @@ export function parseLensRound(v: unknown): LensRoundInput {
       ...(a.contextItemIDs ? { contextItemIDs: [...new Set<string>(a.contextItemIDs)] } : {}) })
   })
   return { workID: v.workID, clientRoundId: v.clientRoundId, question: v.question, answer: v.answer, planner: v.planner ?? null,
-    effort: v.effort ?? null, orchestrator: v.orchestrator === true, assignments, createdAt: v.createdAt }
+    effort: v.effort ?? null, orchestrator: v.orchestrator === true, assignments, createdAt: v.createdAt, source: v.source }
+}
+
+/**
+ * A web round sent again under the same id must be the same plan. The lens keeps its replay rule (the stored round is
+ * answered, whatever the repeat carries); a web repeat with any other question, answer, planner, effort or assignment is
+ * refused, so one id can never stand for two plans. createdAt is when the plan was made and may be re-sent as it was.
+ */
+export function sameRoundContent(round: LensRound, input: LensRoundInput): boolean {
+  const plan = (r: { workID: string; question: string; answer: string; planner: string | null; effort: string | null; orchestrator: boolean;
+    assignments: Omit<LensAssignment, 'state'>[] }) => JSON.stringify([r.workID, r.question, r.answer, r.planner, r.effort, r.orchestrator,
+    r.assignments.map(a => [a.id, a.mode, a.sessionID ?? null, a.provider ?? null, a.prompt, a.contextItemIDs ?? null])])
+  return plan(round) === plan(input)
 }
 
 /** The card's sessions as COS Control's snapshot records them: confirmed links, receipt targets and fork children. */
@@ -240,6 +262,7 @@ export class LensRoundStore {
       answer: input.answer, planner: input.planner, effort: input.effort, orchestrator: input.orchestrator,
       assignments: input.assignments.map(a => ({ ...a, state: 'pending' as const })), createdAt: input.createdAt, recordedAt: now,
       inHistory: false, historyAt: null, autoSendCard: false, cardSessions, sends: [], stops: [], updatedAt: now,
+      ...(input.source === 'web' ? { source: 'web' as const } : {}),
     }
     this.file.rounds.push(round)
     while (this.file.rounds.length > LENS_ROUNDS_MAX) {
@@ -320,6 +343,7 @@ export class LensRoundStore {
     if (changed) this.persist()
     const content = (r: LensRound) => ({ roundId: r.roundId, workID: r.workID, clientRoundId: r.clientRoundId, question: r.question, answer: r.answer,
       planner: r.planner, effort: r.effort, orchestrator: r.orchestrator, createdAt: r.createdAt, recordedAt: new Date(r.recordedAt).toISOString(),
+      ...(r.source === 'web' ? { source: 'web' as const } : {}),
       assignments: r.assignments.map(a => ({ id: a.id, mode: a.mode, ...(a.sessionID ? { sessionID: a.sessionID } : {}), ...(a.provider ? { provider: a.provider } : {}),
         prompt: a.prompt, ...(a.contextItemIDs ? { contextItemIDs: a.contextItemIDs } : {}) })) })
     return {
@@ -432,6 +456,7 @@ export function roundView(r: LensRound) {
   }
   return {
     roundId: r.roundId, workID: r.workID, state, inHistory: r.inHistory, autoSendCard: r.autoSendCard,
+    ...(r.source === 'web' ? { source: 'web' as const } : {}),
     assignments: r.assignments.map(a => ({ id: a.id, state: a.state, ...(a.reportedSessionID ?? a.sessionID ? { sessionID: a.reportedSessionID ?? a.sessionID } : {}),
       ...(a.receiptId ? { receiptId: a.receiptId } : {}), ...(a.detail ? { detail: a.detail } : {}) })),
     updatedAt: new Date(r.updatedAt).toISOString(),

package/server/routes/web-control.ts

@@ -1,4 +1,7 @@
 import express, { Router, type Request, type Response } from 'express'
+import fs from 'node:fs'
+import crypto from 'node:crypto'
+import path from 'node:path'
 import { hostname, networkInterfaces } from 'node:os'
 import {
   hasProxyForwardedHeaders,
@@ -39,11 +42,20 @@ import {
 } from '../lib/web-memories-bridge.js'
 import { listLiveTranscriptSessions, readLiveTranscriptSession } from '../lib/web-live-chunks.js'
 import { getWebUsageSummary } from '../lib/web-usage-bridge.js'
+import { WEB_PET_POSES, controlSupportDir, petChunk, petPreview, planPose, readPetSources, webPetManifest, type WebPetPose } from '../lib/web-pet.js'
+import { controlResourcesDir, galleryPets, galleryThumb, parsePetChoice, petChoiceKey, resolvePet, shippedPets, type PetChoice, type PetFetcher } from '../lib/web-pet-choice.js'
+import { dataPath } from '../lib/data-dir.js'
 
 export { isMemoryWebOpReadOnly, MUTATING_MEMORY_WEB_OPS, READ_ONLY_MEMORY_WEB_OPS }
 
 export interface WebControlRouterDeps {
   apiToken: () => string
+  /** Tests: where the pet's state map and strips live, the chunk cache, and a stand-in for sips. */
+  petSupportDir?: () => string
+  petCacheDir?: () => string
+  petRun?: (cmd: string, args: string[]) => Promise<void>
+  petResourcesDir?: () => string | null
+  petFetch?: PetFetcher
   port: () => number
   publicPort?: () => number
   httpsPort?: () => number | null
@@ -166,17 +178,15 @@ export function webControlEnabled(env: NodeJS.ProcessEnv = process.env): boolean
 }
 
 /**
- * CSP for `/control/*`. The shell (index.html, app.js, theme.js) has no inline script, so it
- * gets `script-src 'self'`: an injected `<img onerror>` in rendered session or meeting text
- * cannot run. The hosted Memories page is the native bundle as shipped and still uses inline
- * `onclick` handlers, so only `/control/memories/*` keeps `'unsafe-inline'`.
+ * CSP for `/control/*`. No page has inline script, so every path gets `script-src 'self'`: an injected
+ * `<img onerror>` in rendered session or meeting text cannot run. 6.99.25: Memories is a native pane
+ * (panes/memories.js); the hosted page and its `/control/memories/*` 'unsafe-inline' exception are gone.
  * `frame-ancestors 'self'` stops another site framing the signed-in page.
  */
-export function webControlCsp(requestPath: string): string {
-  const inlineScripts = requestPath.startsWith('/memories/')
+export function webControlCsp(_requestPath: string): string {
   return [
     "default-src 'self'",
-    inlineScripts ? "script-src 'self' 'unsafe-inline'" : "script-src 'self'",
+    "script-src 'self'",
     "style-src 'self' 'unsafe-inline'",
     "font-src 'self' data:",
     "img-src 'self' data: blob:",
@@ -550,6 +560,99 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
     res.json(summary)
   })
 
+  // The session pet on Home (lib/web-pet.ts) and the pet picker (lib/web-pet-choice.ts). `?pet=` is the browser's
+  // choice: mac (default), shipped:<id> or gallery:<id>. Everything here reads COS Control's files; nothing writes them.
+  const petDir = (): string => deps.petSupportDir?.() ?? controlSupportDir()
+  const petResources = (): string | null => (deps.petResourcesDir ? deps.petResourcesDir() : controlResourcesDir())
+  const petCacheRoot = (): string => deps.petCacheDir?.() ?? dataPath('web-pet')
+  const petCacheFor = (name: string): string => (name ? path.join(petCacheRoot(), name) : petCacheRoot())
+  const petChoiceOf = (req: Request): PetChoice | null => parsePetChoice(req.query.pet ?? 'mac')
+  const resolveFor = (choice: PetChoice) => resolvePet(choice, { supportDir: petDir(), resources: petResources() })
+  const sendImage = async (res: Response, file: string, type: string, immutable: boolean): Promise<void> => {
+    res.set('Cache-Control', immutable ? 'private, max-age=31536000, immutable' : 'private, no-cache')
+    // Not sendFile: it refuses any path with a dot folder, and the cache lives under ~/.cos-glasses.
+    res.type(type).send(await fs.promises.readFile(file))
+  }
+  const fileTag = (file: string): string => { try { const st = fs.statSync(file); return `${st.size}-${Math.round(st.mtimeMs)}` } catch { return '0' } }
+
+  router.get('/web-pet', (req: Request, res: Response) => {
+    res.set('Cache-Control', 'private, no-store')
+    const choice = petChoiceOf(req)
+    if (!choice) return res.status(400).json({ error: 'pet_choice_invalid' })
+    const key = petChoiceKey(choice)
+    const found = resolveFor(choice)
+    if (!found) return res.json({ available: false, pet: key, poses: {} })
+    if (found.kind === 'strips') return res.json({ ...webPetManifest(found.dir, key), pet: key, kind: 'strips' })
+    const tag = found.kind === 'still' ? fileTag(found.file) : found.preview
+    return res.json({ available: true, pet: key, kind: 'still', poses: {}, still: `/api/web-pet/still?pet=${encodeURIComponent(key)}&v=${encodeURIComponent(crypto.createHash('sha256').update(tag).digest('hex').slice(0, 16))}` })
+  })
+
+  router.get('/web-pet/sheet/:pose/:chunk', async (req: Request, res: Response) => {
+    const choice = petChoiceOf(req)
+    const found = choice ? resolveFor(choice) : null
+    if (!found || found.kind !== 'strips') return res.status(404).json({ error: 'pet_unavailable' })
+    const pose = String(req.params.pose) as WebPetPose
+    const src = (WEB_PET_POSES as readonly string[]).includes(pose) ? readPetSources(found.dir)[pose] : undefined
+    if (!src) return res.status(404).json({ error: 'pet_pose_unavailable' })
+    const plan = planPose(src)
+    const index = Number(req.params.chunk)
+    if (!Number.isInteger(index) || index < 0 || index >= plan.chunks) return res.status(404).json({ error: 'pet_chunk_unavailable' })
+    try {
+      const file = await petChunk(plan, index, { cacheDir: petCacheFor(found.cacheName), run: deps.petRun })
+      await sendImage(res, file, 'png', req.query.v === plan.key)
+    } catch (err) {
+      log(`[web-pet] could not build ${pose} chunk ${index}: ${err instanceof Error ? err.message : String(err)}`)
+      res.status(503).json({ error: 'pet_build_failed' })
+    }
+  })
+
+  // A still pet: COS Control's single sprite, Cloud Puff, or a gallery picture (downloaded once, as the Mac does).
+  router.get('/web-pet/still', async (req: Request, res: Response) => {
+    const choice = petChoiceOf(req)
+    const found = choice ? resolveFor(choice) : null
+    if (!found || found.kind === 'strips') return res.status(404).json({ error: 'pet_unavailable' })
+    try {
+      const art = found.kind === 'still' ? found : await galleryThumb(found, petCacheFor('gallery'), deps.petFetch, petDir())
+      await sendImage(res, art.file, art.type, typeof req.query.v === 'string' && req.query.v.length > 0)
+    } catch (err) {
+      log(`[web-pet] gallery picture failed for ${found.kind === 'gallery' ? found.id : 'still'}: ${err instanceof Error ? err.message : String(err)}`)
+      res.status(502).json({ error: 'pet_picture_unavailable' })
+    }
+  })
+
+  // The picker's small picture: an animated pet's first frame, or the still itself.
+  router.get('/web-pet/preview', async (req: Request, res: Response) => {
+    const choice = petChoiceOf(req)
+    const found = choice ? resolveFor(choice) : null
+    if (!found) return res.status(404).json({ error: 'pet_unavailable' })
+    try {
+      if (found.kind === 'strips') return await sendImage(res, await petPreview(found.dir, petCacheFor(found.cacheName || 'mac-preview'), { run: deps.petRun }), 'png', typeof req.query.v === 'string')
+      const art = found.kind === 'still' ? found : await galleryThumb(found, petCacheFor('gallery'), deps.petFetch, petDir())
+      await sendImage(res, art.file, art.type, typeof req.query.v === 'string')
+    } catch (err) {
+      log(`[web-pet] preview failed: ${err instanceof Error ? err.message : String(err)}`)
+      res.status(502).json({ error: 'pet_picture_unavailable' })
+    }
+  })
+
+  // What the picker lists: the Mac's pet, the characters COS Control ships, and its OpenPets gallery.
+  router.get('/web-pet/catalog', (_req: Request, res: Response) => {
+    res.set('Cache-Control', 'private, no-store')
+    const preview = (key: string, tag: string) => `/api/web-pet/preview?pet=${encodeURIComponent(key)}&v=${encodeURIComponent(crypto.createHash('sha256').update(tag).digest('hex').slice(0, 16))}`
+    const mac = resolveFor({ kind: 'mac' })
+    const macTag = mac ? (mac.kind === 'still' ? fileTag(mac.file) : fileTag(path.join(petDir(), 'session-pet-states.json'))) : ''
+    res.json({
+      mac: { available: !!mac, preview: mac ? preview('mac', 'mac:' + macTag) : null },
+      // The tag follows the art on disk, so a COS Control update with new art gets a new preview URL.
+      shipped: shippedPets(petResources()).map((p) => {
+        const r = resolveFor({ kind: 'shipped', id: p.id })
+        const tag = r?.kind === 'strips' ? fileTag(path.join(r.dir, 'session-pet-states.json')) : r?.kind === 'still' ? fileTag(r.file) : ''
+        return { ...p, pet: `shipped:${p.id}`, preview: preview(`shipped:${p.id}`, `shipped:${p.id}:${tag}`) }
+      }),
+      gallery: galleryPets(petDir()).map((p) => ({ id: p.id, name: p.name, description: p.description, category: p.category, pet: `gallery:${p.id}`, preview: preview(`gallery:${p.id}`, p.preview) })),
+    })
+  })
+
   // Today / Work "Your Move" compatibility route
   router.get('/work-board/your-move', async (_req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')

package/server/routes/work-lens-rounds.ts

@@ -1,11 +1,16 @@
 /**
  * 6.83.0: lens plans in Work chat history, and "Send this plan" (docs/work-orchestrator.md, "Lens plans").
  *
- * Lens (over the network, token auth from the parent /api mount):
- *   POST /api/work/chat/lens-rounds                       record a plan the lens made (idempotent on clientRoundId)
+ * Lens, and COS Control Web (over the network, token or browser sign-in from the parent /api mount):
+ *   POST /api/work/chat/lens-rounds                       record a plan the lens or the web made (idempotent on clientRoundId;
+ *                                                         source "lens" with a lens- id, or "web" with a web- id)
  *   GET  /api/work/chat/lens-rounds/:roundId              the round's live state, never its prompts
  *   POST /api/work/chat/lens-rounds/:roundId/send         ask COS Control to send it (two-step confirm, or card Auto-send)
  *   POST /api/work/chat/lens-rounds/:roundId/stop         ask COS Control to Stop assignments
+ * COS Control Web:
+ *   GET  /api/work/chat/web-plans                         { protocolVersion: 1, webPlans: 1, sources }: this server records web plans
+ *                                                         (a web round is refused 409 round_id_conflict when its id is reused
+ *                                                         for a different plan; GET /api/work/chat is unchanged)
  * COS Control (this Mac only):
  *   GET  /api/work/chat/lens-inbox?since=<cursor>[&autoSend=1]   rounds not yet in history, send and stop requests
  *   POST /api/work/chat/lens-rounds/:roundId/history      { state: "in_history", autoSendCard? }
@@ -17,8 +22,8 @@
  * (index.ts leaves these paths to this router so the error code is the contract's).
  */
 import { Router, type Request, type Response } from 'express'
-import { LensRoundError, LensRoundStore, LENS_ROUND_BODY_BYTES, ROUND_ID, SEND_ID, cardSessionsOf, parseLensRound, parseResultBody,
-  parseSendBody, parseStopBody, roundView, defaultLensRoundStore } from '../lib/work-lens-rounds.js'
+import { LensRoundError, LensRoundStore, LENS_ROUND_BODY_BYTES, ROUND_ID, ROUND_SOURCES, SEND_ID, cardSessionsOf, parseLensRound, parseResultBody,
+  parseSendBody, parseStopBody, roundView, sameRoundContent, defaultLensRoundStore } from '../lib/work-lens-rounds.js'
 import type { ControlSnapshot } from '../lib/work-orchestrator/snapshot.js'
 import { orchestratorSnapshots } from '../lib/work-orchestrator/runtime.js'
 import { acquireMaintenanceWork, maintenanceAdmissionsOpen } from '../lib/maintenance-lifecycle.js'
@@ -96,6 +101,9 @@ export function createWorkLensRoundsRouter(given: Partial<WorkLensRoundsDeps> =
     const input = parseLensRound(req.body)
     // A repeat is answered from the store, even when the board has since changed or is unreachable.
     const replay = deps.store.replay(input.clientRoundId)
+    if (replay && input.source === 'web' && !sameRoundContent(replay, input)) {
+      throw new LensRoundError('round_id_conflict', 409, 'This round id was used for a different plan. Plan again.')
+    }
     if (!replay) {
       let known: boolean
       try { known = await deps.knownWork(input.workID) }
@@ -103,10 +111,16 @@ export function createWorkLensRoundsRouter(given: Partial<WorkLensRoundsDeps> =
       if (!known) throw new LensRoundError('unknown_work', 404, 'This card is not on the Work board any more.')
     }
     const { round, created } = deps.store.record(input, cardSessionsOf(deps.snapshot(), input.workID))
-    if (created) console.log(`[work-lens-rounds] recorded ${round.roundId} work=${round.workID} assignments=${round.assignments.length}`)
+    if (created) console.log(`[work-lens-rounds] recorded ${round.roundId} work=${round.workID} assignments=${round.assignments.length}${round.source === 'web' ? ' source=web' : ''}`)
     return res.status(created ? 201 : 200).json({ roundId: round.roundId, workID: round.workID, state: roundView(round).state, control: { connected: connected() } })
   }))
 
+  // COS Control Web asks this before it shows Work chat. A server without it answers 404, and the web says it needs an update.
+  router.get('/work/chat/web-plans', (_req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    return res.json({ protocolVersion: 1, webPlans: 1, sources: [...ROUND_SOURCES] })
+  })
+
   router.get('/work/chat/lens-rounds/:roundId', (req, res) => {
     try {
       const round = deps.store.find(roundIdOf(req))

package/server/web-control/app.css

@@ -200,6 +200,30 @@ select.field {
 
 /* ── Today ───────────────────────────────────────────────── */
 .today-date { color: var(--sub); font-size: 15px; margin: 6px 0 0; }
+/* The session pet on Today: the pet COS Control shows, in the pose the Mac would pick. */
+.today-pet { display: flex; flex-direction: column; align-items: center; margin: 6px 0 14px; min-height: 166px; }
+.today-pet.hidden { display: none; }
+.pet-btn { background: none; border: 0; padding: 0; cursor: pointer; display: flex; flex-direction: column; align-items: center; gap: 4px; color: inherit; font: inherit; }
+.pet-btn:focus-visible { outline: 2px solid var(--sub); outline-offset: 4px; border-radius: 8px; }
+.pet-sprite { height: 140px; background-repeat: no-repeat; }
+.pet-caption { color: var(--sub); font-size: 14px; }
+/* A still pet (gallery pick, Cloud Puff, single image). Small pixel art scales without blur. */
+.pet-still { height: 140px; width: auto; max-width: 220px; object-fit: contain; }
+.pet-still.pixel { image-rendering: pixelated; }
+.pet-change { background: none; border: 0; padding: 6px 10px; margin-top: 2px; color: var(--sub); font: inherit; font-size: 13px; cursor: pointer; text-decoration: underline; text-underline-offset: 3px; }
+.pet-change:focus-visible { outline: 2px solid var(--sub); outline-offset: 2px; border-radius: 6px; }
+/* Settings > Pet */
+.pet-choice .pet-thumb { width: 44px; height: 44px; flex: 0 0 44px; object-fit: contain; image-rendering: pixelated; border-radius: 8px; }
+.pet-search { width: 100%; box-sizing: border-box; margin: 4px 0 10px; padding: 10px 12px; border-radius: 10px; border: 1px solid var(--panel-border); background: var(--panel); color: inherit; font: inherit; }
+.pet-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(88px, 1fr)); gap: 8px; }
+.pet-tile { display: flex; flex-direction: column; align-items: center; gap: 6px; padding: 10px 6px; border-radius: 12px; border: 1px solid var(--panel-border); background: var(--panel); color: inherit; font: inherit; font-size: 12px; cursor: pointer; min-width: 0; }
+.pet-tile img { width: 56px; height: 56px; object-fit: contain; image-rendering: pixelated; }
+.pet-tile span { max-width: 100%; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.pet-tile[aria-pressed="true"] { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent) inset; }
+.pet-tile.hidden { display: none; }
+.pet-tile:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+/* Unfolded: top of the right-hand column, above Needs you (app.js placePet). */
+.today-side > .today-pet { margin: 0 0 14px; }
 .ask-bar {
   display: flex; align-items: center; gap: 10px; width: 100%;
   min-height: 52px; padding: 0 14px; margin-top: 16px;
@@ -365,9 +389,6 @@ select.field {
 .speaker-row audio { width: 100%; height: 40px; margin-top: 8px; grid-column: 1 / -1; }
 .speaker-row .capture-row { grid-column: 1 / -1; margin-top: 8px; }
 
-/* Memories: the native Memories page, hosted as-is. */
-.pane.flush { max-width: none; margin: -4px calc(-1 * (var(--gutter) + var(--safe-right))) 0 calc(-1 * (var(--gutter) + var(--safe-left))); }
-.memories-frame { display: block; width: 100%; height: calc(100dvh - var(--topbar-h) - var(--safe-top)); border: 0; background: var(--page); }
 
 /* Ask sheet (⌘K on desktop) */
 .sheet-backdrop { position: fixed; inset: 0; z-index: 50; background: rgba(23, 18, 14, 0.45); display: flex; align-items: flex-start; justify-content: center; animation: fade 160ms ease; }
@@ -445,8 +466,6 @@ select.field {
   .run-title, .run-meta { grid-column: 2; }
   .composer { position: sticky; bottom: calc(var(--safe-bottom) + 12px); }
   .toast { top: auto; bottom: 24px; }
-  .pane.flush { margin: calc(-1 * (var(--safe-top) + 22px)) calc(-1 * (var(--gutter) + var(--safe-right))) calc(-1 * (var(--safe-bottom) + 40px)) calc(-1 * var(--gutter)); }
-  .memories-frame { height: 100dvh; }
   .sheet-backdrop { padding-top: 8vh; }
   .sheet { max-width: 620px; border-radius: 18px; padding: 16px 18px 18px; max-height: 80dvh; box-shadow: 0 24px 60px rgba(0, 0, 0, 0.25); }
 }