@gotcos/glasses-server 6.99.25 → 6.99.33

package/server/routes/agent-sessions.ts

@@ -83,6 +83,8 @@ import { cosSpawnedPids } from '../lib/agent-session-ownership-store.js'
 import { sessionActFactsFor, sessionActFields } from '../lib/session-act-fields.js'
 import { CONTINUE_NOTE_HEADER, continueNoteAcknowledged } from '../lib/continue-plan.js'
 
+import { agentSessionOutputImages } from '../lib/agent-session-output-images.js'
+
 export const agentSessionsRouter = Router()
 
 function boundedInteger(value: unknown, fallback: number, min: number, max: number): number {
@@ -236,7 +238,7 @@ export function withRunning<T extends { session_id: string }>(entry: T, scan: Oc
     // clears on its own when the work stops. Still a display hint, never a gate.
     // 6.62.0: or the engine's own hooks (or a Codex rollout) say a turn is open and the
     // last event is inside HOOK_ACTIVE_CAP_MS (plan 1.1-1.3).
-    running_active: decides ? hint!.active : occ?.activeRecently === true || hint?.active === true,
+    running_active: decides || hint?.activeDecides === true ? hint!.active : occ?.activeRecently === true || hint?.active === true,
   }
 }
 
@@ -254,14 +256,22 @@ export function withRunning<T extends { session_id: string }>(entry: T, scan: Oc
  *                                             and an Esc with no Stop looks the same, QA W8);
  *                                             Claude and Codex: no hint (occupancy answers)
  *   hook waiting                               running, not active
+ *   hook or registry idle (Claude, Codex)      not active even if the file was just written
+ *                                             (a flush after Stop), unless the transcript's
+ *                                             newest record is more than
+ *                                             TRANSCRIPT_AFTER_IDLE_GRACE_MS past the idle
+ *                                             signal: then no hint (occupancy freshness
+ *                                             answers, a hookless restarted turn)
+ *   hook or registry waiting, ended, failed    not active, ownership kept (Cursor: decided)
  *   Codex rollout turn open inside the cap     running, active (no Codex hooks yet)
  *   Cursor, any other hook state               not running, not active (`decides`)
  *
  * A hook-derived `running` only exists inside the deriver's 30-minute open-turn ceiling, so an
  * open-quiet Cursor row ends there, or at its Stop or SessionEnd.
  *
- * For Claude and Codex the hint only ADDS to occupancy (a held, freshly written thread still
- * reads as it did). For Cursor, whose list has no occupancy at all, a hook signal decides, and
+ * For Claude and Codex, authoritative idle/waiting states suppress recent-write activity
+ * for display while leaving ownership intact. Other hints add to occupancy. For Cursor,
+ * whose list has no occupancy at all, a hook signal decides, and
  * a running Cursor turn is the user's own (an IDE composer or their terminal; COS's own child
  * is kept out of the phase), so it is foreign.
  */
@@ -271,15 +281,42 @@ export interface RunningHint {
   foreign: boolean
   /** Cursor with hook evidence: this hint IS the answer, occupancy and file time are not read. */
   decides: boolean
+  /** Authoritative non-working state suppresses file-write activity without changing occupancy. */
+  activeDecides?: boolean
 }
 
-export function runningHintFor(provider: AgentProvider, derived: DerivedSessionState | undefined, lastEventAt: number | null, now: number): RunningHint | null {
+/**
+ * A transcript write this long after the idle signal is new work, not the flush that
+ * trails a Stop. Claude writes its last records around the Stop hook; a turn that wakes
+ * later (a background-task notification restarts a text-only turn, with no prompt and no
+ * tool call, so no hook fires until its Stop) writes well past this.
+ */
+export const TRANSCRIPT_AFTER_IDLE_GRACE_MS = 5_000
+
+export function runningHintFor(provider: AgentProvider, derived: DerivedSessionState | undefined, lastEventAt: number | null, now: number, transcriptAt: number | null = null): RunningHint | null {
   const cursor = provider === 'cursor'
   const quiet: RunningHint | null = cursor ? { running: false, active: false, foreign: false, decides: true } : null
   if (!derived) return null
+  // The state deriver already arbitrates fresh work, waits and completed turns.
+  // A transcript flush after Stop must not turn an idle/waiting badge back to
+  // working. Keep ownership/open-window evidence intact: this is display only.
+  if ((derived.state_source === 'hook' || derived.state_source === 'registry') && derived.agent_state !== 'running') {
+    // An idle signal OLDER than the transcript's newest real record is not the latest
+    // word: a turn restarted with no hook (see TRANSCRIPT_AFTER_IDLE_GRACE_MS) is writing.
+    // Fall back to occupancy freshness. Idle only: waiting keeps `running: true` and its
+    // question; ended and failed stay settled. Cursor's transcript has no clock.
+    if (!cursor && derived.agent_state === 'idle' && transcriptAt !== null) {
+      const since = Date.parse(derived.state_since)
+      const signalAt = Math.max(Number.isFinite(since) ? since : 0, derived.state_source === 'hook' ? lastEventAt ?? 0 : 0)
+      if (transcriptAt > signalAt + TRANSCRIPT_AFTER_IDLE_GRACE_MS) return null
+    }
+    if (cursor) return derived.agent_state === 'waiting'
+      ? { running: true, active: false, foreign: true, decides: true }
+      : quiet
+    return { running: derived.agent_state === 'waiting', active: false, foreign: false, decides: false, activeDecides: true }
+  }
   const inCap = lastEventAt !== null && now - lastEventAt <= HOOK_ACTIVE_CAP_MS && lastEventAt <= now + 5_000
   if (derived.state_source === 'hook') {
-    if (derived.agent_state === 'waiting') return { running: true, active: false, foreign: cursor, decides: cursor }
     if (derived.agent_state === 'running' && inCap) return { running: true, active: true, foreign: cursor, decides: cursor }
     if (derived.agent_state === 'running' && cursor) return { running: true, active: false, foreign: true, decides: true }
     return quiet
@@ -535,7 +572,7 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
         const derived = derivedById.get(row.session_id)
         const signal = signalFor(row.session_id)
         const facts = rolloutById.get(row.session_id) ?? null
-        const hint = runningHintFor(row.provider, derived, hintClock(signal, derived, facts), now)
+        const hint = runningHintFor(row.provider, derived, hintClock(signal, derived, facts), now, clocks.get(row.session_id) ?? null)
         return {
           ...withRunning(toEntry(row, activity[index], derived, queuedOf(row.provider, row.session_id)), running, hint),
           ...cursorActivityFields(row.provider, signal),
@@ -604,6 +641,37 @@ agentSessionsRouter.get('/agent-sessions/search', async (req, res) => {
   }
 })
 
+// Authenticated by index.ts's shared /api gate. Neither the request nor the response
+// carries a filesystem path; the resolver reauthorizes exact transcript membership.
+agentSessionsRouter.get('/agent-sessions/:provider/:sessionId/output-images/:imageId/content', async (req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  res.set('X-Content-Type-Options', 'nosniff')
+  const provider = asProvider(String(req.params.provider ?? '').toLowerCase())
+  if (!provider || (req.query.variant !== undefined && req.query.variant !== 'thumb' && req.query.variant !== 'phone')) {
+    res.status(404).json({ error: 'image_not_found' }); return
+  }
+  try {
+    const content = await agentSessionOutputImages.content(provider, String(req.params.sessionId), String(req.params.imageId), req.query.variant === 'thumb' ? 'thumb' : 'phone')
+    if (content.status !== 'ok') {
+      res.status(content.status === 'not_found' ? 404 : 503).json({ error: content.status === 'not_found' ? 'image_not_found' : 'image_unavailable' }); return
+    }
+    res.type('image/jpeg')
+    // `send` defaults to `dotfiles: 'ignore'` and applies it to the WHOLE absolute path
+    // when no `root` is given, so a media root under `~/.cos-glasses/data` 404'd on
+    // every default install (see the header of lib/send-audio.ts). 'allow' is safe: the
+    // dot component is our data home, and the resolver above returned an exact,
+    // containment-checked path with no caller-supplied segments.
+    res.sendFile(content.path, { dotfiles: 'allow' }, err => {
+      if (!err) return
+      if (!res.headersSent) res.status(503).json({ error: 'image_unavailable' })
+      else res.destroy()
+    })
+  } catch {
+    console.warn('[agent-sessions] output image unavailable')
+    res.status(503).json({ error: 'image_unavailable' })
+  }
+})
+
 agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res) => {
   res.set('Cache-Control', 'private, no-store')
   const provider = asProvider(String(req.params.provider ?? '').toLowerCase())
@@ -647,7 +715,8 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
     let recentTurns: RecentTurnsRead | null = null
     if (turnsWanted !== null) {
       try {
-        recentTurns = await readRecentSessionTurns(provider, found, turnsWanted)
+        const images = await agentSessionOutputImages.context(provider, sessionId, found)
+        recentTurns = await readRecentSessionTurns(provider, found, turnsWanted, undefined, images.project)
       } catch (error) {
         console.warn(`[agent-sessions] recent turns failed provider=${provider}: ${error instanceof Error ? error.message : error}`)
       }
@@ -684,7 +753,7 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
       derived = deriveCodexRow(parsed.session_id, running.occupied.has(parsed.session_id), rollout, now, false)
     }
     const signal = signalFor(parsed.session_id)
-    const hint = runningHintFor(provider, derived, hintClock(signal, derived, rollout), now)
+    const hint = runningHintFor(provider, derived, hintClock(signal, derived, rollout), now, activityClockMs(st.mtimeMs, activity))
     res.json({
       ...withRunning({ session_id: parsed.session_id }, running, hint),
       ...derivedRowFields(derived),

package/server/routes/client-instance.ts

@@ -32,6 +32,17 @@ export const CLIENT_INSTANCE_MAX_SEEN = 64
 
 export interface ClientInstanceRouterDeps {
   now?: () => number
+  /**
+   * G2 authority Tier 1 (6.99.29): the owner-per-device map, shared so the turn provenance
+   * can ask which app copy holds the ring for a request's address. Absent: private, as before.
+   */
+  owners?: Map<string, ClientInstanceOwner>
+}
+
+/** The ring owner's id for this device address, when it claimed within `freshMs`; else null. */
+export function pairedInstanceFrom(owners: ReadonlyMap<string, ClientInstanceOwner>, device: string, now: number, freshMs: number): string | null {
+  const owner = owners.get(deviceKey(device))
+  return owner && now - owner.seenAt <= freshMs ? owner.id : null
 }
 
 /** A POST that carries a meeting chunk: a live one, or an iPhone offline chunk replayed. The preview is not one. */
@@ -49,7 +60,7 @@ export function createClientInstanceRouter(deps: ClientInstanceRouterDeps | (()
   const opts: ClientInstanceRouterDeps = typeof deps === 'function' ? { now: deps } : deps
   const now = opts.now ?? Date.now
   const router = Router()
-  const owners = new Map<string, ClientInstanceOwner>()
+  const owners = opts.owners ?? new Map<string, ClientInstanceOwner>()
   const chunks = new ClientChunkLedger()
   // 6.52.3: when each copy last claimed, so an older boot proves it was awake before it
   // may take a quiet ring back. Bounded like the chunk ledger.

package/server/routes/cursor-stop-followup.ts

@@ -14,12 +14,15 @@ import express, { Router, type NextFunction, type Request, type Response } from
 import { timingSafeTokenEqual } from '../lib/token-auth.js'
 import { claimNextCursorTurn, cursorStopAcceptsFollowup, cursorStopIsFresh, parseCursorStopEnvelope } from '../lib/cursor-stop-followup.js'
 import { MAX_QUEUED_PER_THREAD, type QueuedThreadTurn } from '../lib/thread-turn-queue.js'
+import { hasFooterShapedLine, type G2TurnProvenance } from '../lib/g2-turn-provenance.js'
 
 export interface CursorStopFollowupDeps {
   /** The per-install hook token, or null when none has been minted (then nothing is answered). */
   hookToken: () => string | null
   readQueue: (provider: string, threadId: string, now: number) => QueuedThreadTurn[]
   writeQueue: (provider: string, threadId: string, queue: QueuedThreadTurn[]) => void
+  /** G2 authority Tier 1 (6.99.29), optional: ledger the hand-off and foot a glasses or phone turn. */
+  provenance?: G2TurnProvenance
   now: () => number
 }
 
@@ -60,6 +63,20 @@ export function createCursorStopFollowupRouter(deps: CursorStopFollowupDeps): Ro
       }
       claimed = claimNextCursorTurn(deps.readQueue('cursor', facts.conversationId, now), now)
       if (!claimed) return res.json({})
+      // G2 authority Tier 1 (Codex re-audit of 910eb90): the queue file is mutable, and this is the
+      // last hand-off before the words reach the composer. Words carrying a footer-shaped line are
+      // refused here exactly as at every other route that hands words to a session: the row is
+      // settled refused (never handed over, never retried) and its parked origin forgotten.
+      if (deps.provenance && hasFooterShapedLine(claimed.turn.prompt)) {
+        const refusedTurn = claimed.turn
+        const settled = claimed.queue.map(t => t.clientTurnId === refusedTurn.clientTurnId
+          ? { ...t, status: 'refused' as const, reason: 'footer_line_refused', settledAt: now }
+          : t)
+        deps.writeQueue('cursor', facts.conversationId, settled)
+        deps.provenance.forgetQueued('cursor', facts.conversationId, refusedTurn.clientTurnId)
+        console.warn(`[cursor-stop-followup] refused a queued turn with a footer-shaped line clientTurnId=${refusedTurn.clientTurnId}`)
+        return res.json({})
+      }
       // Written BEFORE the text leaves: the row must never read `waiting` after the
       // composer has been handed it, or a later Stop would hand it over again.
       deps.writeQueue('cursor', facts.conversationId, claimed.queue)
@@ -68,7 +85,19 @@ export function createCursorStopFollowupRouter(deps: CursorStopFollowupDeps): Ro
       return res.json({})
     }
     console.log(`[cursor-stop-followup] handed a queued turn to Cursor clientTurnId=${claimed.turn.clientTurnId} chars=${claimed.turn.prompt.length} loop=${facts.loopCount ?? 'null'} cursor=${facts.cursorVersion}`)
-    return res.json({ followup_message: claimed.turn.prompt })
+    let followup = claimed.turn.prompt
+    if (deps.provenance) {
+      // The hook's own socket is local; the origin is the one captured when the turn was
+      // parked, and only while the queued text is still the text it vouched for.
+      const turn = claimed.turn
+      const verdict = deps.provenance.queuedVerdict('cursor', facts.conversationId, turn.clientTurnId, turn.prompt) ?? deps.provenance.originOf(req)
+      followup = deps.provenance.footed(turn.prompt, turn.clientTurnId, verdict, 'cursor')
+      // The queue's own hand-off of its parked turn: it continues the record parked under this id.
+      deps.provenance.record({ turnId: turn.clientTurnId, prompt: turn.prompt, verdict, provider: 'cursor', sessionId: facts.conversationId, via: 'cursor-stop-followup', continues: true })
+      // Settled (handed over): the parked origin is forgotten (QA 6.99.29).
+      deps.provenance.forgetQueued('cursor', facts.conversationId, turn.clientTurnId)
+    }
+    return res.json({ followup_message: followup })
   })
   return router
 }

package/server/routes/g2-turns.ts

@@ -0,0 +1,46 @@
+// GET /api/g2-turns/:turnId (and its 6.99.29 alias GET /api/turn-provenance/:turnId): read-only provenance for one turn this server delivered or queued
+// into an agent session (G2 authority Tier 1, see lib/g2-turn-provenance.ts). Behind the global
+// X-Cos-Token gate like every /api route. 400 on a malformed id, 404 `{ found: false }` when no
+// record names it. Answers what was recorded, and vouches (`verifiedOrigin: true`) only for a
+// glasses or phone record this process wrote and still holds, written within 24 hours. A web record
+// is reported with `reason: web_cookie_derivable_from_token` and never vouched (6.99.29).
+
+import { Router } from 'express'
+import { timingSafeTokenEqual } from '../lib/token-auth.js'
+import { describeG2Turn, G2_TURN_ID_RE, type G2TurnProvenance } from '../lib/g2-turn-provenance.js'
+
+export function createG2TurnsRouter(deps: {
+  provenance: G2TurnProvenance
+  now?: () => number
+  /**
+   * 6.99.29: the pairing token. With it, only a request that presents X-Cos-Token is answered: the
+   * /api gate also admits a COS Control Web browser by its cookie, and the verifier runs on this Mac
+   * with the token. Absent: whatever the gate admitted (the 6.66 tests mount the gate alone).
+   */
+  apiToken?: () => string
+}): Router {
+  const router = Router()
+  const now = deps.now ?? Date.now
+  // 6.99.29: one handler, two paths. `/turn-provenance` names what it is now that web turns are
+  // recorded too (reported, never vouched: lib/g2-turn-provenance.ts); `/g2-turns` stays for
+  // verify_g2_turn.py and every caller of the 6.66 design.
+  router.get(['/g2-turns/:turnId', '/turn-provenance/:turnId'], async (req, res) => {
+    res.set('Cache-Control', 'private, no-store')
+    if (deps.apiToken) {
+      let expected = ''
+      try { expected = deps.apiToken() } catch { expected = '' }
+      if (!expected || !timingSafeTokenEqual(req.headers['x-cos-token'], expected)) return void res.status(401).json({ found: false, error: 'token_required' })
+    }
+    const turnId = String(req.params.turnId ?? '')
+    if (!G2_TURN_ID_RE.test(turnId)) return void res.status(400).json({ found: false, error: 'invalid_turn_id' })
+    try {
+      const answer = await describeG2Turn(deps.provenance, turnId, now())
+      if (!answer) return void res.status(404).json({ found: false, turnId })
+      res.json(answer)
+    } catch (error) {
+      console.error(`[g2-turns] lookup failed: ${error instanceof Error ? error.message : error}`)
+      res.status(500).json({ found: false, error: 'lookup_failed' })
+    }
+  })
+  return router
+}

package/server/routes/health.ts

@@ -1,3 +1,5 @@
+import { MAX_ATTACHMENTS_PER_PROMPT } from '../../shared/media-attachment.js'
+import { TURN_FILE_MAX_BYTES } from '../lib/turn-file-store.js'
 import { dropItCapability } from '../lib/drop-settings.js'
 import { PREP_CAPABILITY } from '../../shared/prep.js'
 import { phoneMicrophoneMeetingsCapability } from '../lib/phone-recording.js'
@@ -446,6 +448,13 @@ healthRouter.get('/health', async (_req, res) => {
     ...checks,
     server_version: managedServerVersion(),
     ...threadAttachHealthFields(threadAttach),
+    // 11/07 (Control Web attach): a session turn takes up to this many media-store ids as `attachmentIds`, and the turns
+    // route writes each file's path on this Mac under the words. 0 with attach off; absent on an older server. Either
+    // way a client sends words only.
+    threadTurnAttachments: threadAttach.enabled ? MAX_ATTACHMENTS_PER_PROMPT : 0,
+    // 6.99.27: a session turn also takes ANY file up to this size (lib/turn-file-store.ts), sent to /api/media/file with
+    // X-COS-Purpose: session-turn. 0 with attach off; absent on an older server, which takes only what the media store reads.
+    threadTurnFileBytes: threadAttach.enabled ? TURN_FILE_MAX_BYTES : 0,
     ...sessionHooksHealthFields(),
     // 6.52.0: counts, the mode and two timestamps; never an id, a question, a command, or
     // how many are held (that is on the authenticated questions route).

package/server/routes/media.ts

@@ -22,6 +22,7 @@
 // /api/media/file STREAMS to disk rather than buffering: see
 // createMediaBinaryBodyParser below.
 
+import { getTurnFileStore } from '../lib/turn-file-store.js'
 import { Router, json, type NextFunction, type Request, type Response } from 'express'
 import { createReadStream, createWriteStream, openSync, statSync } from 'node:fs'
 import {
@@ -554,6 +555,15 @@ mediaRouter.post('/media', async (req: Request, res: Response) => {
  * bounded requests, but composer admission still owns the shared five-item
  * prompt cap. Filename and MIME are hints only; the store sniffs and validates
  * the actual staged bytes. */
+/**
+ * 6.99.27: does a refused upload become a turn file? Only for a session turn, and only when the media store refused the
+ * FORMAT (it cannot read the type, or the text is not UTF-8). Too large, too long, or the Mac unable to process media
+ * right now are said as they always were.
+ */
+export function keepsAsTurnFile(purpose: string | undefined, code: unknown): boolean {
+  return purpose === 'session-turn' && (code === 'unsupported_attachment_format' || code === 'corrupt_attachment')
+}
+
 mediaRouter.post('/media/file', async (req: Request, res: Response) => {
   const staged = takeStagedUploadBody(req)
   try {
@@ -566,14 +576,28 @@ mediaRouter.post('/media/file', async (req: Request, res: Response) => {
     if (rawLabel) {
       try { label = decodeURIComponent(rawLabel).slice(0, 120) } catch { label = rawLabel.slice(0, 120) }
     }
-    const attachment = await getMediaStore().ingestRichMediaFromFile({
-      sourcePath: staged.path,
-      byteLength: staged.bytes,
-      label,
-      declaredMime: safeString(req.header('content-type'), 120),
-      capturedAt: safeString(req.header('x-cos-captured-at'), 40),
-      sessionId: safeString(req.header('x-cos-session-id'), 64),
-    })
+    let attachment: unknown
+    try {
+      attachment = await getMediaStore().ingestRichMediaFromFile({
+        sourcePath: staged.path,
+        byteLength: staged.bytes,
+        label,
+        declaredMime: safeString(req.header('content-type'), 120),
+        capturedAt: safeString(req.header('x-cos-captured-at'), 40),
+        sessionId: safeString(req.header('x-cos-session-id'), 64),
+      })
+    } catch (err) {
+      // 6.99.27: a file for a Claude or Codex session turn, in a format the media store does not read (a .zip, a .docx,
+      // a log in another encoding). The session gets its path and opens it itself, so it is kept as a turn file, which
+      // only the turn and fork routes can resolve (lib/turn-file-store.ts). Anything else refuses as before.
+      if (!keepsAsTurnFile(req.header('x-cos-purpose'), (err as { code?: unknown } | null)?.code)) throw err
+      attachment = getTurnFileStore().ingestFromFile({
+        sourcePath: staged.path,
+        byteLength: staged.bytes,
+        label,
+        declaredMime: safeString(req.header('content-type'), 120),
+      })
+    }
     res.json({ attachment })
   } catch (err) {
     sendMediaError(res, err)

package/server/routes/permission-broker.ts

@@ -35,8 +35,14 @@
 // The hook token still opens nothing here. A browser poll counts as a live answering client
 // only with `?client=web`, which the page sends only while it shows the cards (a visible tab);
 // the same 30 s window as the phone. A cookie poll naming `glasses` or `phone`, or no client,
-// never counts, and a token poll naming `web` never counts either. A browser never reports
-// wearer presence, so it never enables the away hold.
+// never counts, and a token poll naming `web` never counts either.
+// 6.99.26 (Miles 11/07, "Away rule, like phone"): a browser poll `?client=web&hold=1&presenceAgeMs=<int>`
+// (the ms since a touch or a key while the page was in front) records COS Control Web's presence for the
+// away hold ONLY (lib/client-liveness noteWebPresence): never a live client, so at the desk the Mac's own
+// pop-up still comes at once (6.99.13). Without `hold=1` or a valid `presenceAgeMs` it records nothing. A
+// token poll naming `web`, and a browser poll naming anything else, still record nothing. QA round 1: neither
+// does a poll from the Mac itself (loopback, or one of its own addresses, with no proxy header): Control Web
+// open on the Mac is the desk, never away.
 // 6.60.0: a poll with `&hold=1&presenceAgeMs=<int>` (COS Glasses 6.9.563 and later) records
 // wearer presence for the away hold instead of the 6.59.0 liveness; a `hold=1` poll without
 // a valid `presenceAgeMs` makes no client live and enables no hold. The response adds
@@ -53,7 +59,9 @@ import {
   type HookReplyChannel,
   type PermissionBroker,
 } from '../lib/permission-broker.js'
-import { noteQuestionsPoll, validPresenceAgeMs, type QuestionsPollFacts } from '../lib/client-liveness.js'
+import { noteQuestionsPoll, noteWebPresence, validPresenceAgeMs, type QuestionsPollFacts } from '../lib/client-liveness.js'
+import { hasProxyForwardedHeaders, isLoopbackAddress, normalizeRemoteIp, reachableIpv4Addresses } from '../lib/network-policy.js'
+import { networkInterfaces } from 'node:os'
 
 export const PERMISSION_BROKER_HOOK_PATH = '/api/permission-requests/ask'
 /** The hook posts its spool envelope, capped at 1 MiB by the script itself. */
@@ -155,6 +163,10 @@ export interface SessionQuestionsRouterDeps {
   webSessionAuthorized?: (req: Request) => boolean
   /** Where a counted poll is recorded; `noteQuestionsPoll` in production. */
   notePoll?: (at: number, poll: QuestionsPollFacts) => void
+  /** 6.99.26: where COS Control Web's presence is recorded; `noteWebPresence` in production. */
+  noteWebPresence?: (at: number, presenceAgeMs: number) => void
+  /** 6.99.26 (QA round 1): whether a request comes from this Mac itself; `requestFromThisMac` in production. */
+  fromThisMac?: (req: Request) => boolean
   now?: () => number
   /** 6.60.0: when this server process started (ISO); defaults to the process's own start. */
   serverStartedAt?: string
@@ -176,9 +188,30 @@ export function questionsPollFacts(query: Record<string, unknown>): QuestionsPol
   return { hold, presenceAgeMs: hold && validPresenceAgeMs(parsed) ? parsed : null }
 }
 
+/**
+ * 6.99.26 (QA round 1): a request from this Mac itself: its socket is loopback or one of the Mac's own addresses (its
+ * tailnet address first), and no proxy header says it was forwarded for someone else (a `tailscale serve` hop arrives on
+ * loopback for a remote peer). Control Web open on the Mac is the desk: its touch never makes the Mac away.
+ */
+export function requestFromThisMac(
+  req: { socket?: { remoteAddress?: string | undefined } | null; headers?: Record<string, unknown> | null },
+  selfAddresses: () => readonly string[] = () => reachableIpv4Addresses(networkInterfaces()).map(a => a.address),
+): boolean {
+  if (hasProxyForwardedHeaders(req.headers)) return false
+  const remote = req.socket?.remoteAddress
+  if (isLoopbackAddress(remote)) return true
+  const ip = normalizeRemoteIp(remote ?? '')
+  if (!ip) return false
+  let own: readonly string[] = []
+  try { own = selfAddresses() } catch { own = [] }
+  return own.includes(ip)
+}
+
 export function createSessionQuestionsRouter(deps: SessionQuestionsRouterDeps): Router {
   const router = Router()
   const notePoll = deps.notePoll ?? noteQuestionsPoll
+  const noteWeb = deps.noteWebPresence ?? ((at: number, ageMs: number) => noteWebPresence(at, ageMs))
+  const fromThisMac = deps.fromThisMac ?? ((req: Request) => requestFromThisMac(req))
   const now = deps.now ?? Date.now
   router.get('/session-questions', (req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')
@@ -199,6 +232,11 @@ export function createSessionQuestionsRouter(deps: SessionQuestionsRouterDeps):
     if (byToken && ANSWERING_CLIENTS.has(client)) notePoll(now(), questionsPollFacts(req.query as Record<string, unknown>))
     // 6.99.13 (Miles, option B): a browser poll never counts as live, so an open web tab never holds a question
     // back from the Mac's own pop-up. The web still lists and answers what the glasses or phone are holding.
+    // 6.99.26: its touch counts for the away hold only, like the phone's (Miles 11/07, "Away rule, like phone").
+    if (byWebSession && client === WEB_ANSWERING_CLIENT) {
+      const facts = questionsPollFacts(req.query as Record<string, unknown>)
+      if (facts.presenceAgeMs !== null && facts.presenceAgeMs !== undefined && !fromThisMac(req)) noteWeb(now(), facts.presenceAgeMs)
+    }
     const health = deps.broker.health()
     // Listed first: a deadline the timer has not caught yet is settled by the listing.
     const items = deps.broker.list()
@@ -227,7 +265,12 @@ export function createSessionQuestionsRouter(deps: SessionQuestionsRouterDeps):
   })
   router.post('/session-questions/:id/answer', (req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')
-    const result = deps.broker.answer(String(req.params.id ?? ''), req.body)
+    // 6.99.27: label the answer by its door (the /api gate already let it in): the token is the Even app, anything else
+    // is COS Control Web's browser session.
+    let expected = ''
+    try { expected = deps.apiToken() } catch { expected = '' }
+    const by = timingSafeTokenEqual(req.headers['x-cos-token'], expected) ? 'app' : 'web'
+    const result = deps.broker.answer(String(req.params.id ?? ''), req.body, by)
     res.status(result.status).json(result.body)
   })
   return router