@gotcos/glasses-server 6.99.25 → 6.99.33

package/server/lib/agent-session-output-images.ts

@@ -0,0 +1,280 @@
+// Native transcript output previews. A transcript reference is evidence of selection, not
+// permission to read arbitrary files: only the session's exact recorded workspace is eligible.
+// The public id is process-scoped (reload the session after a server restart). Raw sources
+// stay in this module. Normalized media is a bounded, staged cache, never a fake COS message.
+import { createHash, createHmac, randomBytes } from 'node:crypto'
+import { constants, realpathSync, statSync } from 'node:fs'
+import { open } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { isAbsolute, join, relative, resolve, sep } from 'node:path'
+import { agentSessionRoots, findAgentSessionFile, isWrapperPrompt, latestAssistantReply, LATEST_REPLY_MAX, type AgentProvider } from './agent-session-store.js'
+import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './attached-workspace.js'
+import { readComposerFacts } from './cursor-session-model.js'
+import { MAX_OUTPUT_ARTIFACT_BYTES } from './image-safety.js'
+import { getMediaStore, STAGED_TTL_MS, type MediaStore } from './media-store.js'
+import { readRecentSessionTurns, SESSION_TURNS_MAX, type SessionTurnProjection } from './agent-session-turns.js'
+
+export interface SessionOutputImage {
+  id: string
+  label: string
+  state: 'available' | 'unavailable'
+  /**
+   * `outside_workspace`: permanent (the path leaves the workspace, or the workspace is a broad
+   * root that is never eligible). `unavailable`: the workspace lookup failed this time; the
+   * content route re-resolves it, so a retry can succeed.
+   */
+  reason?: 'outside_workspace' | 'unavailable'
+}
+export const SESSION_OUTPUT_IMAGE_ID = /^ai_[a-f0-9]{64}$/
+export const OUTPUT_IMAGES_PER_TURN = 5
+export const OUTPUT_IMAGE_SCAN_CHARS = 128 * 1024
+export const OUTPUT_IMAGE_CACHE_MAX = 128
+export const OUTPUT_IMAGE_CONCURRENCY = 2
+const CACHE_TTL = Math.min(30 * 60_000, STAGED_TTL_MS)
+interface Candidate { source: string; label: string }
+interface Source { candidate: Candidate; root: string | null; descriptor: SessionOutputImage }
+interface PreviewContext { project: SessionTurnProjection; sources: Map<string, Source> }
+interface MediaCache { id: string; at: number }
+type PreviewStore = Pick<MediaStore, 'ingestOutputImage' | 'getContent'>
+export interface OutputImageDeps {
+  findSession(provider: AgentProvider, id: string): Promise<string | null>
+  workspace(provider: AgentProvider, id: string, transcript: string): Promise<string | null>
+  store(): PreviewStore
+  secret: Buffer
+  now(): number
+  /** The home directory the broad-root denylist is built from (tests inject a scratch home). */
+  home?(): string
+}
+
+function assistantText(provider: AgentProvider, row: Record<string, unknown>): string | null {
+  if (row.isSidechain === true || row.isMeta === true || row.isCompactSummary === true) return null
+  let message: Record<string, unknown> | null = null
+  if (provider === 'claude') {
+    if (row.type !== 'assistant') return null
+    message = row.message as Record<string, unknown> | null
+  } else if (provider === 'codex') {
+    if (row.type !== 'response_item') return null
+    const p = row.payload as Record<string, unknown> | null
+    if (!p || p.type !== 'message' || p.role !== 'assistant') return null
+    message = p
+  } else {
+    if (row.role !== 'assistant') return null
+    message = row.message as Record<string, unknown> | null
+  }
+  if (!message || typeof message !== 'object') return null
+  // The generic prose extractor trims each block, which destroys Markdown indentation.
+  // Preserve it here: an indented first line must not become an image selection.
+  const content = message.content
+  const text = typeof content === 'string' ? content : Array.isArray(content)
+    ? content.flatMap(block => {
+      if (!block || typeof block !== 'object') return []
+      const b = block as Record<string, unknown>
+      return ['text', 'input_text', 'output_text'].includes(String(b.type)) && typeof b.text === 'string' ? [b.text] : []
+    }).join('\n\n') : ''
+  return text.trim() && !isWrapperPrompt(text) ? text : null
+}
+// Deliberately bounded Markdown subset: inline image destinations, including angle-wrapped
+// paths with spaces and balanced parentheses. No HTML, reference definitions, code or URLs.
+function imageTokens(raw: string): Array<Candidate & { start: number; end: number }> {
+  const text = raw.slice(0, OUTPUT_IMAGE_SCAN_CHARS)
+  const out: Array<Candidate & { start: number; end: number }> = []
+  let fence = '', inline = 0
+  for (let i = 0; i < text.length; i++) {
+    if (i === 0 || text[i - 1] === '\n') {
+      // An indented example is literal text, never an output selection.
+      if (!fence && /^(?: {4}| {0,3}\t)/.test(text.slice(i, i + 4))) {
+        i = text.indexOf('\n', i); if (i < 0) break; continue
+      }
+      const m = /^( {0,3})(`{3,}|~{3,})/.exec(text.slice(i, i + 80))
+      if (m) { if (!fence) fence = m[2]; else if (m[2][0] === fence[0] && m[2].length >= fence.length) fence = ''; i = text.indexOf('\n', i); if (i < 0) break; continue }
+    }
+    if (fence) continue
+    if (text[i] === '\\') { i++; continue }
+    if (text[i] === '`') { let n = 1; while (text[i + n] === '`') n++; if (!inline) inline = n; else if (inline === n) inline = 0; i += n - 1; continue }
+    if (inline) continue
+    // Comments may span lines; nothing inside them authorizes a file read.
+    if (text.startsWith('<!--', i)) {
+      const end = text.indexOf('-->', i + 4); if (end < 0) break
+      i = end + 2; continue
+    }
+    if (text.slice(i, i + 2) !== '![') continue
+    const endLabel = text.indexOf('](', i + 2)
+    if (endLabel < 0 || endLabel - i > 250 || text.slice(i, endLabel).includes('\n')) continue
+    let j = endLabel + 2, source = '', valid = false
+    if (text[j] === '<') {
+      const end = text.indexOf('>', j + 1)
+      if (end >= 0 && text[end + 1] === ')') { source = text.slice(j + 1, end); j = end + 2; valid = true }
+    } else {
+      const start = j; let depth = 1
+      while (j < text.length && j - start <= 4096) {
+        if (text[j] === '\n') break
+        if (text[j] === '(') depth++
+        if (text[j] === ')' && --depth === 0) { source = text.slice(start, j); j++; valid = true; break }
+        j++
+      }
+    }
+    if (!valid || !source || source.length > 4096 || /[\u0000-\u001f\u007f]/.test(source)) continue
+    // Only local paths. Scheme-like strings, network paths and URI escaping stay inert.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(source) || source.startsWith('//') || source.includes('\\')) { i = j - 1; continue }
+    const alt = text.slice(i + 2, endLabel).trim()
+    const label = alt && !/[\\/\u0000-\u001f]/.test(alt) ? alt.slice(0, 120) : 'Output image'
+    out.push({ source, label, start: i, end: j }); i = j - 1
+  }
+  return out
+}
+export function assistantImageCandidates(provider: AgentProvider, row: Record<string, unknown>): Candidate[] {
+  const raw = assistantText(provider, row)
+  return raw ? imageTokens(raw).slice(0, OUTPUT_IMAGES_PER_TURN).map(({ source, label }) => ({ source, label })) : []
+}
+function inside(root: string, path: string): boolean {
+  const rel = relative(root, path)
+  return rel !== '' && rel !== '..' && !rel.startsWith('..' + sep) && !isAbsolute(rel)
+}
+/**
+ * Exact roots that are never a session workspace, however a session recorded them. EXACT
+ * match only: `~/Documents/GitHub/x` stays eligible while `~/Documents` itself is not. Each
+ * entry is compared both as written and canonicalized, since the workspace is realpath'd.
+ */
+export function broadWorkspaceRoots(home = homedir()): Set<string> {
+  const raw = ['/', '/Users', '/tmp', '/private/tmp', '/var', '/private/var', '/Volumes', home,
+    join(home, 'Documents'), join(home, 'Library'), join(home, '.cos-glasses')]
+  const out = new Set<string>()
+  for (const entry of raw) {
+    out.add(entry)
+    try { out.add(realpathSync(entry)) } catch { /* absent on this Mac: the literal still counts */ }
+  }
+  return out
+}
+/** A canonical workspace root, `'broad'` for a denied exact root, or null when the lookup failed. */
+function canonicalRoot(path: string | null, home: string): string | 'broad' | null {
+  if (!path || !isAbsolute(path)) return null
+  try {
+    const root = realpathSync(path)
+    if (broadWorkspaceRoots(home).has(root)) return 'broad'
+    if (!statSync(root).isDirectory()) return null
+    return root
+  } catch { return null }
+}
+function digest(value: string): string { return createHash('sha256').update(value).digest('hex') }
+
+export class AgentSessionOutputImages {
+  private cache = new Map<string, MediaCache>()
+  private pending = new Map<string, Promise<string>>()
+  private active = 0
+  private readers = 0
+  constructor(private readonly deps: OutputImageDeps) {}
+
+  async context(provider: AgentProvider, sessionId: string, transcript: string): Promise<PreviewContext> {
+    let workspace: string | null = null
+    try { workspace = await this.deps.workspace(provider, sessionId, transcript) } catch { /* unavailable, words still load */ }
+    const canonical = canonicalRoot(workspace, this.deps.home?.() ?? homedir())
+    const root = canonical === 'broad' ? null : canonical
+    // A failed lookup is temporary and the content route re-resolves it; a broad root is not.
+    const lookupFailed = canonical === null
+    const sources = new Map<string, Source>()
+    const transcriptKey = digest(resolve(transcript))
+    const project: SessionTurnProjection = (p, row, turn) => {
+      const raw = assistantText(p, row)
+      if (!raw) return turn
+      // Prose cleanup can collapse a huge whitespace/code prefix, bringing an unscanned
+      // suffix into the visible reply. Never project that suffix. Drop the boundary line
+      // too: it might end halfway through a Markdown destination (or an ordinary sentence).
+      const shortened = raw.length > OUTPUT_IMAGE_SCAN_CHARS
+      const scanned = shortened ? raw.slice(0, raw.lastIndexOf('\n', OUTPUT_IMAGE_SCAN_CHARS - 1) + 1) : raw
+      const candidates = imageTokens(scanned)
+      if (!candidates.length && !shortened) return turn
+      const recordKey = digest(JSON.stringify(row))
+      const refs = candidates.slice(0, OUTPUT_IMAGES_PER_TURN).map((c, ordinal) => {
+        const id = 'ai_' + createHmac('sha256', this.deps.secret).update(JSON.stringify([provider, sessionId, transcriptKey, recordKey, ordinal, c.source])).digest('hex')
+        const allowed = root !== null && inside(root, resolve(root, c.source))
+        const descriptor: SessionOutputImage = { id, label: c.label, state: allowed ? 'available' : 'unavailable', ...(!allowed ? { reason: lookupFailed ? 'unavailable' as const : 'outside_workspace' as const } : {}) }
+        sources.delete(id); sources.set(id, { candidate: c, root, descriptor })
+        while (sources.size > (SESSION_TURNS_MAX + 1) * OUTPUT_IMAGES_PER_TURN) sources.delete(sources.keys().next().value!)
+        return descriptor
+      })
+      // Never turn an explicit local image into a browser-visible Mac path. Existing callers
+      // without this opt-in projection retain their original text and contract.
+      // The preview cap limits DTOs, not redaction: the sixth image is still private.
+      const parts: string[] = []; let end = 0
+      for (const token of candidates) { parts.push(scanned.slice(end, token.start), '[Output image]'); end = token.end }
+      parts.push(scanned.slice(end))
+      const omission = '[Reply shortened at the image preview scan limit.]'
+      const text = shortened
+        ? [latestAssistantReply(parts.join(''), LATEST_REPLY_MAX - omission.length - 1), omission].filter(Boolean).join('\n')
+        : latestAssistantReply(parts.join(''))
+      const at = typeof row.timestamp === 'string' && Number.isFinite(Date.parse(row.timestamp)) ? row.timestamp : undefined
+      return { ...(turn ?? { role: 'assistant' as const, text: '', ...(at ? { at } : {}) }), text, outputImages: refs }
+    }
+    return { project, sources }
+  }
+
+  async content(provider: AgentProvider, sessionId: string, imageId: string, variant: 'thumb' | 'phone') {
+    if (!SESSION_OUTPUT_IMAGE_ID.test(imageId)) return { status: 'not_found' as const }
+    // Admission covers discovery, transcript parsing, authorization and image IO alike.
+    if (this.readers >= OUTPUT_IMAGE_CONCURRENCY) return { status: 'unavailable' as const }
+    this.readers++
+    try {
+      const transcript = await this.deps.findSession(provider, sessionId)
+      if (!transcript) return { status: 'not_found' as const }
+      const context = await this.context(provider, sessionId, transcript)
+      const recent = await readRecentSessionTurns(provider, transcript, SESSION_TURNS_MAX, undefined, context.project)
+      if (!recent.turns.some(t => t.outputImages?.some(i => i.id === imageId))) return { status: 'not_found' as const }
+      const source = context.sources.get(imageId)
+      if (!source?.root || source.descriptor.state !== 'available') return { status: 'unavailable' as const }
+      const path = resolve(source.root, source.candidate.source)
+      const canonical = realpathSync(path)
+      if (!inside(source.root, canonical)) return { status: 'unavailable' as const }
+      // Reject symlinks in any component and recheck path/fd identity after reading.
+      // A changed path never becomes a published preview.
+      if (canonical !== path) return { status: 'unavailable' as const }
+      const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+      let bytes: Buffer, key: string
+      try {
+        const before = await file.stat()
+        if (!before.isFile() || before.size <= 0 || before.size > MAX_OUTPUT_ARTIFACT_BYTES) return { status: 'unavailable' as const }
+        key = digest(JSON.stringify([imageId, before.dev, before.ino, before.size, before.mtimeMs, before.ctimeMs]))
+        // Even a cache hit rechecks that the authorized source still exists within the root.
+        const hit = this.cache.get(key)
+        if (hit && this.deps.now() - hit.at < CACHE_TTL) {
+          const current = statSync(path)
+          if (realpathSync(path) !== canonical || current.dev !== before.dev || current.ino !== before.ino) return { status: 'unavailable' as const }
+          const content = this.deps.store().getContent(hit.id, variant)
+          if (content.status === 'ok') return content
+        }
+        // Bounded positional read, not readFile(): an append during read cannot allocate past the cap.
+        bytes = Buffer.alloc(before.size)
+        let offset = 0
+        while (offset < bytes.length) { const got = await file.read(bytes, offset, bytes.length - offset, offset); if (!got.bytesRead) break; offset += got.bytesRead }
+        const after = await file.stat(), current = statSync(path)
+        if (offset !== bytes.length || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || current.dev !== before.dev || current.ino !== before.ino || realpathSync(path) !== canonical) return { status: 'unavailable' as const }
+      } finally { await file.close() }
+      let job = this.pending.get(key!)
+      if (!job) {
+        if (this.active >= OUTPUT_IMAGE_CONCURRENCY) return { status: 'unavailable' as const }
+        this.active++
+        job = this.deps.store().ingestOutputImage({ bytes: bytes!, kind: 'generated_visual', label: source.candidate.label }).then(ref => {
+          this.cache.set(key!, { id: ref.id, at: this.deps.now() })
+          while (this.cache.size > OUTPUT_IMAGE_CACHE_MAX) this.cache.delete(this.cache.keys().next().value!)
+          return ref.id
+        }).finally(() => { this.active--; this.pending.delete(key!) })
+        this.pending.set(key!, job)
+      }
+      return this.deps.store().getContent(await job, variant)
+    } catch { return { status: 'unavailable' as const } }
+    finally { this.readers-- }
+  }
+}
+
+export const agentSessionOutputImages = new AgentSessionOutputImages({
+  findSession: (p, id) => findAgentSessionFile(p, id, agentSessionRoots()),
+  workspace: async (provider, id, transcript) => {
+    const deps = realAttachedWorkspaceDeps()
+    // Use the exact transcript already selected by the route, including keyed Codex roots.
+    const workspace = resolveAttachedWorkspace(provider, id, { ...deps, transcriptPath: () => transcript })?.path
+    if (workspace) return workspace
+    if (provider === 'cursor') return (await readComposerFacts([id], agentSessionRoots().cursorComposerDb)).get(id.toLowerCase())?.workspace ?? null
+    return null
+  },
+  store: getMediaStore,
+  secret: randomBytes(32), now: Date.now,
+})

package/server/lib/agent-session-store.ts

@@ -12,6 +12,7 @@ import { join } from 'node:path'
 import { createInterface } from 'node:readline'
 import { promisify } from 'node:util'
 import { codexUserAsk, unwrapPeerMessage } from './session-stream-events.js'
+import { withoutTurnFooter } from './turn-footer.js'
 import { profileCodexHomeSubdirs } from './codex-homes.js'
 
 const execFileAsync = promisify(execFile)
@@ -1831,7 +1832,8 @@ export async function parseAgentSession(
         // frame. It IS the user's prompt (dictated on the glasses), so it is the
         // turn's query and never an injected row; the frame is stripped.
         const peer = (obj.origin as { kind?: unknown } | undefined)?.kind === 'peer' ? unwrapPeerMessage(text) : null
-        const query = peer ?? text
+        // 6.99.29: the verify footer of a glasses, phone or web turn is never the turn's query or title.
+        const query = withoutTurnFooter(peer ?? text)
         collectTurn(query, tail, peer === null && (obj.isMeta === true || obj.isCompactSummary === true))
         if (!firstPrompt) firstPrompt = firstLineTitle(query)
         if (!title) title = firstLineTitle(query)

package/server/lib/agent-session-turns.ts

@@ -33,15 +33,21 @@ import {
   payloadText,
   type AgentProvider,
 } from './agent-session-store.js'
+import type { SessionOutputImage } from './agent-session-output-images.js'
 import { unwrapPeerMessage } from './session-stream-events.js'
+import { withoutTurnFooter } from './turn-footer.js'
 
 export interface SessionTurn {
   role: 'user' | 'assistant'
   text: string
   /** The record's ISO timestamp, when the provider writes one (Cursor does not). */
   at?: string
+  /** Opt-in native-session output previews. No local paths or COS message identities. */
+  outputImages?: SessionOutputImage[]
 }
 
+export type SessionTurnProjection = (provider: AgentProvider, record: Record<string, unknown>, turn: SessionTurn | null) => SessionTurn | null
+
 /** What a client may ask for in one read. Forty messages is ~10 lens pages of words. */
 export const SESSION_TURNS_MAX = 40
 
@@ -103,10 +109,12 @@ export function sessionTurnFromRecord(provider: AgentProvider, obj: Record<strin
     // (a teammate's report, an idle notification, another session's SendMessage),
     // written as a plain user row with no origin. QA found 20 of those in one session
     // rendering as "YOU".
-    const peer = unwrapPeerMessage(text)
+    // 6.99.29: the verify footer a glasses, phone or web turn carries is for the agent, not the reader.
+    const wrapped = unwrapPeerMessage(text)
+    const peer = wrapped === null ? null : withoutTurnFooter(wrapped)
     if (peer !== null) return (obj.origin as { kind?: unknown } | undefined)?.kind === 'peer' ? shaped('user', peer, at) : null
     if (obj.isMeta === true || obj.isCompactSummary === true) return null
-    return shaped('user', text, at)
+    return shaped('user', withoutTurnFooter(text), at)
   }
   if (provider === 'codex') {
     if (obj.type !== 'response_item' || !obj.payload || typeof obj.payload !== 'object') return null
@@ -117,22 +125,24 @@ export function sessionTurnFromRecord(provider: AgentProvider, obj: Record<strin
     // and an attached-file message reads as the request that was typed.
     const text = payload.role === 'user' ? codexUserText(payload) : payloadText(payload)
     if (!text) return null
-    return shaped(payload.role, text, iso(obj.timestamp))
+    return shaped(payload.role, payload.role === 'user' ? withoutTurnFooter(text) : text, iso(obj.timestamp))
   }
   if (obj.role !== 'user' && obj.role !== 'assistant') return null
   const message = obj.message && typeof obj.message === 'object' ? obj.message as Record<string, unknown> : null
   const text = message ? payloadText(message) : null
   if (!text) return null
-  return shaped(obj.role, obj.role === 'user' ? cursorQuery(text) : text, iso(obj.timestamp))
+  // QA 6.99.29: a Cursor user row carries the verify footer inside its <user_query> block, like any other turn.
+  return shaped(obj.role, obj.role === 'user' ? withoutTurnFooter(cursorQuery(text)) : text, iso(obj.timestamp))
 }
 
 /** The newest `limit` messages among these lines (file order in, file order out). */
-export function recentSessionTurns(provider: AgentProvider, lines: readonly string[], limit: number): SessionTurn[] {
+export function recentSessionTurns(provider: AgentProvider, lines: readonly string[], limit: number, project?: SessionTurnProjection): SessionTurn[] {
   const out: SessionTurn[] = []
   for (const line of lines) {
     const obj = parseJsonLine(line)
     if (!obj) continue
-    const turn = sessionTurnFromRecord(provider, obj)
+    const parsed = sessionTurnFromRecord(provider, obj)
+    const turn = project ? project(provider, obj, parsed) : parsed
     if (turn) out.push(turn)
   }
   return limit > 0 ? out.slice(-limit) : []
@@ -155,6 +165,7 @@ export async function readRecentSessionTurns(
   path: string,
   limit: number,
   windows: readonly number[] = SESSION_TURNS_WINDOWS,
+  project?: SessionTurnProjection,
 ): Promise<RecentTurnsRead> {
   const want = Math.max(0, Math.min(SESSION_TURNS_MAX, Math.floor(limit)))
   const { size } = await stat(path)
@@ -177,7 +188,7 @@ export async function readRecentSessionTurns(
       const lines = buffer.toString('utf-8').split('\n')
       if (start > 0) lines.shift()
       // One more than wanted, so `more` can be answered from what was read.
-      found = recentSessionTurns(provider, lines, want + 1)
+      found = recentSessionTurns(provider, lines, want + 1, project)
       if (found.length > want || start === 0) break
     }
     const more = found.length > want || start > 0

package/server/lib/client-liveness.ts

@@ -44,6 +44,14 @@
 //     while the Mac sleeps, so on its own it would read a pre-sleep presence as younger
 //     than it is; the wall clock does advance. A wall clock stepped forward reads older
 //     (no hold), never younger.
+//
+// 6.99.26 (Miles 11/07, "Away rule, like phone"): COS Control Web's presence, kept apart from every
+// stamp above. A browser poll `?client=web&hold=1&presenceAgeMs=<int>` (the ms since a touch or a
+// key while the page was in front) records it, and the broker reads it for the away hold ONLY: it
+// never moves the newest poll (/api/health), the 6.59.0 liveness, the `hold=1` poll stamp (which
+// makes a stamped question's client connected without presence), or the wearer presence above. So
+// an open tab nobody touches holds nothing, and at the desk the Mac's own pop-up still shows at once
+// (6.99.13). Same contract and both clocks, forward-only, as the wearer presence.
 
 /** 6.60.0: the most a client may report as `presenceAgeMs`. Anything else is no presence. */
 export const PRESENCE_AGE_MAX_MS = 86_400_000
@@ -53,6 +61,8 @@ let lastLegacyPollAt: number | null = null
 let lastHoldPollAt: number | null = null
 let lastPresenceMono: number | null = null
 let lastPresenceWall: number | null = null
+let lastWebPresenceMono: number | null = null
+let lastWebPresenceWall: number | null = null
 
 /** 6.60.0: the monotonic clock. Milliseconds since this process started; paused while the Mac sleeps. */
 export function monotonicNowMs(): number {
@@ -109,12 +119,35 @@ export function noteQuestionsPoll(at: number, poll: QuestionsPollFacts = {}, mon
  * and the wall-clock age, so a Mac that slept never makes it read younger.
  */
 export function presenceAgeMs(mono: number = monotonicNowMs(), wall: number = Date.now()): number | null {
-  if (lastPresenceMono === null || !Number.isFinite(mono)) return null
-  const monoAge = Math.max(0, mono - lastPresenceMono)
-  const wallAge = lastPresenceWall !== null && Number.isFinite(wall) ? wall - lastPresenceWall : 0
+  return ageOn(lastPresenceMono, lastPresenceWall, mono, wall)
+}
+
+/** The age of a presence stamped on both clocks: the larger of the two, so a Mac that slept never reads younger. */
+function ageOn(stampMono: number | null, stampWall: number | null, mono: number, wall: number): number | null {
+  if (stampMono === null || !Number.isFinite(mono)) return null
+  const monoAge = Math.max(0, mono - stampMono)
+  const wallAge = stampWall !== null && Number.isFinite(wall) ? wall - stampWall : 0
   return Math.max(monoAge, wallAge)
 }
 
+/**
+ * 6.99.26: a COS Control Web poll answered at `at` (server clock) that reported `presenceAgeMs`, the ms
+ * since a touch or a key while the page was in front. Anything outside the contract is no presence and
+ * records nothing. Forward-only on each clock, like the wearer presence.
+ */
+export function noteWebPresence(at: number, presenceAgeMs: number, mono: number = monotonicNowMs()): void {
+  if (!Number.isFinite(at) || !validPresenceAgeMs(presenceAgeMs) || !Number.isFinite(mono)) return
+  const presenceMono = mono - presenceAgeMs
+  const presenceWall = at - presenceAgeMs
+  if (lastWebPresenceMono === null || presenceMono > lastWebPresenceMono) lastWebPresenceMono = presenceMono
+  if (lastWebPresenceWall === null || presenceWall > lastWebPresenceWall) lastWebPresenceWall = presenceWall
+}
+
+/** 6.99.26: how long ago COS Control Web's newest touch or key was, or null when none since this process started. */
+export function webPresenceAgeMs(mono: number = monotonicNowMs(), wall: number = Date.now()): number | null {
+  return ageOn(lastWebPresenceMono, lastWebPresenceWall, mono, wall)
+}
+
 /** When the newest authenticated questions poll of any kind arrived, or null since boot (/api/health). */
 export function lastQuestionsPollAt(): number | null {
   return lastPollAt
@@ -136,4 +169,6 @@ export function __resetClientLivenessForTests(): void {
   lastHoldPollAt = null
   lastPresenceMono = null
   lastPresenceWall = null
+  lastWebPresenceMono = null
+  lastWebPresenceWall = null
 }

package/server/lib/codex-subagent-activity.ts

@@ -139,3 +139,39 @@ export async function readCodexSubagents(
   }
   return out
 }
+
+/**
+ * 6.99.26 candidate (the Today summary, lib/session-subagents.ts): each parent's direct children by name, most recently
+ * updated first, at most `perParent`. The same read-only snapshot and child lifecycle reader as readCodexSubagents.
+ * Name is the child's nickname, else its role; the task is its thread title. Text only goes to the summary's prompt,
+ * cleaned there; ids and paths never leave this function. A failed read is an empty map, never a made-up zero.
+ */
+export interface CodexSubagentDetail { name: string; task: string; state: ChildState; at: number }
+export async function readCodexSubagentDetails(
+  parents: readonly string[], sessionsRoot: string, now = Date.now(), perParent = 6,
+): Promise<Map<string, CodexSubagentDetail[]>> {
+  const ids = [...new Set(parents.filter(id => UUID.test(id)).map(id => id.toLowerCase()))].slice(0, 12)
+  const out = new Map<string, CodexSubagentDetail[]>()
+  if (!ids.length) return out
+  try {
+    const home = dirname(sessionsRoot)
+    const files = (await readdir(home)).filter(n => /^state_\d+\.sqlite$/.test(n)).sort((a,b) => Number(b.match(/\d+/)![0])-Number(a.match(/\d+/)![0]))
+    if (!files.length) return out
+    // UUID validation above is the SQL parameter boundary.
+    const values = ids.map(id => `'${id}'`).join(',')
+    const query = `SELECT e.parent_thread_id AS root, t.rollout_path, t.archived, t.agent_nickname AS nick, t.agent_role AS role, t.title, t.updated_at_ms AS at
+      FROM thread_spawn_edges e LEFT JOIN threads t ON t.id=e.child_thread_id
+      WHERE e.status='open' AND e.parent_thread_id IN (${values}) ORDER BY t.updated_at_ms DESC LIMIT ${ids.length * perParent * 4}`
+    const { stdout } = await exec('/usr/bin/sqlite3', ['-readonly', '-json', join(home,files[0]), query], { timeout: 2000, maxBuffer: 2*1024*1024 })
+    const rows = JSON.parse(stdout || '[]') as Array<{root:string;rollout_path?:string;archived?:number;nick?:string;role?:string;title?:string;at?:number}>
+    const budget = { bytes: MAX_SNAPSHOT_BYTES }
+    for (const row of rows) {
+      const list = out.get(row.root) ?? []
+      if (list.length >= perParent) continue
+      const state: ChildState = row.archived === 1 ? 'completed' : typeof row.rollout_path === 'string' ? await childState(row.rollout_path, sessionsRoot, now, budget) : 'unknown'
+      list.push({ name: String(row.nick || row.role || 'agent').slice(0, 60), task: String(row.title || '').slice(0, 160), state, at: Number(row.at) || 0 })
+      out.set(row.root, list)
+    }
+  } catch { return new Map() }
+  return out
+}