@gotcos/glasses-server 6.99.29 → 7.0.7

package/server/lib/local-path-redact.ts

@@ -0,0 +1,272 @@
+// No absolute Mac path reaches the browser through a session's words (7.0.4 S1).
+//
+// WHY. A reply is sent as the agent wrote it, and agents link the files they touched with full
+// paths: `[app.ts](/Users/<name>/repo/server/app.ts#L42)`, Codex's `[app.ts](/abs/app.ts:42)`, a
+// bare `~/Documents/...`, a path in backticks. A read-only scan of 14 days of transcripts found 111
+// Claude links and 826 Codex links carrying `/Users/...` into Control Web. The path names the
+// person, their folders and their projects, and the browser has no use for it: it cannot open it.
+//
+// WHAT. Every private local path in a string becomes its base name, keeping a line anchor
+// (`app.ts:42`, from `:42` or `#L42`). A Markdown link to a local file becomes its words (or the
+// base name when it has none). Web URLs are untouched; relative paths stay as written; a site path
+// such as `/api/x` is not a Mac path and stays too. `redactLocalPathsDeep` applies this to every
+// string in a JSON value, so a field added to the session detail later is covered without a list.
+//
+// WHAT COUNTS AS LOCAL (narrowed in 7.0.4 B1). Only places that name this Mac's people and data:
+// a path under `/Users/<name>`, `/Volumes/<name>`, `/private/...` (where /var and /tmp really
+// live) or `/var/folders/...` (per-user temp), a home shorthand (`~/`, `~name/` with a letter
+// first, `$HOME/`, `${HOME}/`), a `file://` URL, or an editor URL that opens a file
+// (`vscode://file/...`). The `.cos-glasses` data folder lives under the home folder, so it is
+// covered. Everything else is ordinary text and stays exactly as written: `/dev/null`,
+// `/usr/bin/env`, `/tmp/out`, `/opt/homebrew`, `/home`, `/run/start`, `~80/100`, `~1/3`, `A/B`,
+// dates and fractions. The first cut treated every Unix top-level folder as private and `~<digit>`
+// as home, and rewrote prose: "Pacing ~80/100 leads" read "Pacing 100 leads", "#!/usr/bin/env
+// node" read "#!env node".
+//
+// SPACES. A folder name with spaces (`/Users/x/Ukaoma Chief Of Staff/MU-Chief-Staff/CLAUDE.md`)
+// is followed across capitalised words, but only when the continuation ends at a real file
+// extension or a `/`. A continuation that ends anywhere else ("/Users/x/out Next Steps: Review
+// A/B results") is not taken, so the words after a path are never eaten. Either way the private
+// head (`/Users/<name>`) is removed.
+
+/** Editor and file URL schemes whose target is a file on this Mac. */
+const LOCAL_SCHEMES = ['file', 'vscode', 'vscode-insiders', 'cursor', 'windsurf', 'zed', 'idea', 'subl', 'txmt', 'mvim']
+
+/** Delimiters a path never runs through (besides whitespace) in prose, Markdown and code. */
+const DELIMS = `<>"'\`“”‘’|)\\]}*,;`
+const STOP = `\\s${DELIMS}`
+/** A root name in any letter case: APFS is case-insensitive, so `/USERS/jane` is the same folder as `/Users/jane`. */
+function anyCase(word: string): string {
+  return [...word].map(c => /[a-z]/i.test(c) ? `[${c.toUpperCase()}${c.toLowerCase()}]` : c).join('')
+}
+const USERS = anyCase('Users')
+/** A private root, followed by at least one more name: `/Users` alone, or "the /Users folder", is not a path. `//Users` counts. */
+const PRIVATE_ROOT = `/+(?:${USERS}|${anyCase('Volumes')}|${anyCase('private')})(?=/[^${STOP}/])|/+${anyCase('var')}/${anyCase('folders')}(?=/)`
+/** A home shorthand: `~/`, `~name/` (a letter first, so `~80/100` and `~1/3` stay numbers), `$HOME/`, `${HOME}/`. */
+const HOME_SHORTHAND = `(?:~(?:[A-Za-z][A-Za-z0-9._-]*)?|\\$HOME|\\$\\{HOME\\})(?=/)`
+const HEAD = `(?:${HOME_SHORTHAND}|${PRIVATE_ROOT})`
+/** A bare path follows prose punctuation, never a path segment (including ./ or ../). Web spans are handled separately. */
+const BARE = new RegExp(`(^|[^\\p{L}\\p{N}_./-])(${HEAD})([^${STOP}]*)`, 'gu')
+const SCHEME_URL = new RegExp(`\\b(?:${LOCAL_SCHEMES.join('|')}):\\/\\/[^${STOP}]*`, 'gi')
+/** Complete HTTP(S) tokens, including query/fragment paths. Keep their original bytes rather than reserializing a URL. */
+const WEB_URL = /\bhttps?:\/\/[^\s<>"'`“”‘’]+/gi
+/** `[words](destination)` and `![words](destination)`, the destination angle-wrapped or not (spaces allowed). */
+const LINK = /(!?)\[([^\]\n]{0,500})\]\(\s*(<[^>\n]{1,4096}>|[^\s()<>\n][^)\n]{0,4096}?)\s*\)/g
+const LOCAL_DEST = new RegExp(`^(?:${HEAD})`)
+const LOCAL_SCHEME_DEST = new RegExp(`^(?:${LOCAL_SCHEMES.join('|')}):\\/\\/`, 'i')
+/** One word of a folder name with spaces: capitalised or a number, no colon, and not ending a sentence. */
+const SPACED_WORD = `[A-Z0-9](?:[^\\s/:${DELIMS}]*[^\\s/:.!?${DELIMS}])?`
+/** One more space-separated folder name, while the words are capitalised and lead to another `/`. */
+const SPACED_TAIL = new RegExp(`^( (?:${SPACED_WORD} ){0,4}${SPACED_WORD}/[^${STOP}]*)`)
+/** A real file extension (with a letter in it, so `v1.2` and `10.15` are not), plus any `:line` anchors. */
+const HAS_EXTENSION = /\.(?=[A-Za-z0-9]{0,9}[A-Za-z])[A-Za-z0-9]{1,10}(?::\d+)*$/
+const TRAILING_PUNCTUATION = /[.:!?]+$/
+
+function decoded(value: string): string {
+  try { return decodeURIComponent(value) } catch { return value }
+}
+
+/** The base name of a path, with any line anchor it carries (`:42`, or `#L42` turned into `:42`). */
+function baseName(path: string): string {
+  let value = path
+  let anchor = ''
+  const hash = value.indexOf('#')
+  if (hash >= 0) {
+    const line = /^L(\d+)/i.exec(value.slice(hash + 1))
+    if (line) anchor = ':' + line[1]
+    value = value.slice(0, hash)
+  }
+  const query = value.indexOf('?')
+  if (query >= 0) value = value.slice(0, query)
+  const plain = decoded(value)
+  // The home folder itself names the person: it reads `~`, never its base name.
+  if (/^\/+users\/[^/]+\/?$/i.test(plain)) return '~' + anchor
+  const parts = plain.split('/').filter(Boolean)
+  const last = parts.pop() || '~'
+  return /:\d+$/.test(last) ? last : last + anchor
+}
+
+/** A path that may be carried across spaces: it ends at a real file extension or at a folder separator. */
+function endsAtFileOrFolder(path: string): boolean {
+  const core = path.replace(TRAILING_PUNCTUATION, '')
+  return core.endsWith('/') || HAS_EXTENSION.test(core)
+}
+
+function redactBare(text: string): string {
+  // Find the matches and their spaced tails first, then rebuild the string once.
+  const pieces: string[] = []
+  let cursor = 0
+  BARE.lastIndex = 0
+  for (let m = BARE.exec(text); m; m = BARE.exec(text)) {
+    const [match, before, head, body] = m
+    const start = m.index
+    if (start < cursor) continue
+    let path = head + body
+    let end = start + match.length
+    // A folder name with spaces is followed only when the continuation ends at a file extension or a `/`.
+    // A path that already ends that way, or that ends a sentence, is never extended.
+    if (!endsAtFileOrFolder(path) && !TRAILING_PUNCTUATION.test(path)) {
+      let probe = path
+      let probeEnd = end
+      for (let guard = 0; guard < 8; guard++) {
+        const tail = SPACED_TAIL.exec(text.slice(probeEnd))
+        if (!tail) break
+        probe += tail[1]
+        probeEnd += tail[1].length
+        if (endsAtFileOrFolder(probe)) { path = probe; end = probeEnd; break }
+        if (TRAILING_PUNCTUATION.test(probe)) break
+      }
+    }
+    const punctuation = TRAILING_PUNCTUATION.exec(path)?.[0] ?? ''
+    const core = punctuation ? path.slice(0, -punctuation.length) : path
+    pieces.push(text.slice(cursor, start), before, baseName(core), punctuation)
+    cursor = end
+    BARE.lastIndex = Math.max(end, start + 1)
+  }
+  pieces.push(text.slice(cursor))
+  return pieces.join('')
+}
+
+/** URL query values can look exactly like local paths; redact only the text between whole web tokens. */
+function redactOutsideWebURLs(text: string): string {
+  const redact = (part: string) => redactBare(part.replace(SCHEME_URL,
+    url => baseName(url.replace(LOCAL_SCHEME_DEST, '').replace(/^[^/]*\//, '/'))))
+  const pieces: string[] = []
+  let cursor = 0
+  WEB_URL.lastIndex = 0
+  for (let match = WEB_URL.exec(text); match; match = WEB_URL.exec(text)) {
+    let token = match[0]
+    // A prose/Markdown closing parenthesis ends the token; balanced URL path
+    // parentheses remain part of it. Explicit angle/quote wrapping supplies its own end.
+    if (!/[<"'`“‘]/.test(text[match.index - 1] ?? '')) {
+      let depth = 0
+      for (let i = 0; i < token.length; i++) {
+        if (token[i] === '(') depth++
+        else if (token[i] === ')' && depth-- === 0) { token = token.slice(0, i); break }
+      }
+    }
+    try { new URL(token) } catch { continue }
+    pieces.push(redact(text.slice(cursor, match.index)), hideHomeInUrl(token))
+    cursor = match.index + token.length
+    WEB_URL.lastIndex = cursor
+  }
+  pieces.push(redact(text.slice(cursor)))
+  return pieces.join('')
+}
+
+/**
+ * `/Users/<name>` (any letter case, any number of leading slashes). In code spans, code blocks and command fields it
+ * reads as the visible marker `[home]`, keeping the rest of the path, so a reader sees where the path was and that it
+ * was changed. The result is a display, not a runnable command: `~` was not used because a quoted `'~/x'` does not
+ * expand, so it would read as exact while meaning something else. In a web URL's query it reads `~`, which keeps the
+ * URL well formed. `/Users/Shared` is not a person's home and stays.
+ */
+const HOME_FOLDER = new RegExp(`(^|[^\\p{L}\\p{N}_.-])/+${USERS}/(?!Shared(?:/|$|[${STOP}]))[^${STOP}/&?#=]+`, 'gu')
+/** The same inside a URL query, percent-encoded: `%2FUsers%2Fjane` is `~`. */
+const ENCODED_HOME_FOLDER = /(?:%2F)+users%2F(?!shared(?:%2F|[&#\s]|$))[^%&?#=\s/]+/gi
+/** What a hidden home folder reads as in code and commands. */
+export const HOME_MARKER = '[home]'
+
+/** Every `/Users/<name>` in this text as the visible `[home]` marker; nothing else changes. */
+export function markHomeFolder(text: string): string {
+  if (typeof text !== 'string' || !text) return text
+  return text.replace(HOME_FOLDER, (_match, before: string) => before + HOME_MARKER)
+}
+
+/** A web URL exactly as written, except a home folder in its query or fragment (`?path=/Users/jane/a.pdf`). */
+function hideHomeInUrl(url: string): string {
+  const at = url.search(/[?#]/)
+  if (at < 0) return url
+  return url.slice(0, at) + url.slice(at).replace(HOME_FOLDER, (_match, before: string) => before + '~').replace(ENCODED_HOME_FOLDER, '~')
+}
+
+/**
+ * Code in Markdown: fenced blocks (``` or ~~~, closed by a fence of the same kind at least as long, or by the end of the
+ * text) and inline code spans (a run of backticks closed by a run of the same length, within one paragraph).
+ */
+function codeRanges(text: string): Array<[number, number]> {
+  const ranges: Array<[number, number]> = []
+  let open: { start: number; mark: string; length: number } | null = null
+  for (let pos = 0; pos <= text.length;) {
+    const newline = text.indexOf('\n', pos)
+    const end = newline < 0 ? text.length : newline
+    const line = text.slice(pos, end)
+    if (!open) {
+      const fence = /^ {0,3}(`{3,}|~{3,})/.exec(line)
+      if (fence && !(fence[1][0] === '`' && line.slice(fence[0].length).includes('`'))) open = { start: pos, mark: fence[1][0]!, length: fence[1].length }
+    } else {
+      const close = /^ {0,3}(`{3,}|~{3,})[ \t]*$/.exec(line)
+      if (close && close[1][0] === open.mark && close[1].length >= open.length) { ranges.push([open.start, end]); open = null }
+    }
+    if (newline < 0) break
+    pos = newline + 1
+  }
+  if (open) ranges.push([open.start, text.length])
+  const inFence = (at: number) => ranges.some(([s, e]) => at >= s && at < e)
+  const INLINE = /(?<!`)(`+)(?!`)([\s\S]*?[^`])\1(?!`)/g
+  const spans: Array<[number, number]> = []
+  for (let m = INLINE.exec(text); m; m = INLINE.exec(text)) {
+    if (inFence(m.index)) { INLINE.lastIndex = m.index + 1; continue }
+    if (/\n[ \t]*\n/.test(m[2]!)) { INLINE.lastIndex = m.index + m[1]!.length; continue }
+    spans.push([m.index, m.index + m[0].length])
+  }
+  return [...ranges, ...spans].sort((x, y) => x[0] - y[0])
+}
+
+/**
+ * Every private local path in this text. In prose a path becomes its base name (Markdown links to a local file become
+ * their words). In code spans and code blocks the path is kept and only the home folder is replaced, by the visible
+ * `[home]` marker: the code is then a display of the command, not the command. Web URLs are untouched except a home folder in their query; relative paths, site
+ * paths and system paths (`/dev/null`, `/usr/bin/env`, `/tmp/x`) stay as written.
+ */
+export function redactLocalPaths(text: string): string {
+  if (typeof text !== 'string' || !text) return text
+  const before = codeRanges(text)
+  const inCode = (at: number) => before.some(([s, e]) => at >= s && at < e)
+  const linked = text.replace(LINK, (match: string, _bang: string, words: string, rawDest: string, offset: number) => {
+    if (inCode(offset)) return match // a link written inside code is code
+    const dest = rawDest.startsWith('<') ? rawDest.slice(1, -1).trim() : rawDest.trim()
+    let target: string | null = null
+    if (LOCAL_SCHEME_DEST.test(dest)) target = dest.replace(LOCAL_SCHEME_DEST, '').replace(/^[^/]*\//, '/')
+    else if (LOCAL_DEST.test(dest)) target = dest
+    if (target === null) return match // a web URL, a relative path or a site path: left exactly as written
+    const name = baseName(target)
+    const label = words.trim()
+    if (!label) return name
+    // `[app.ts](/abs/app.ts#L42)` keeps its line: the words named the file, the anchor was in the link.
+    const anchor = /:\d+$/.exec(name)?.[0] ?? ''
+    return anchor && !/:\d+$/.test(label) && label.split('/').pop() === name.slice(0, -anchor.length) ? label + anchor : label
+  })
+  const pieces: string[] = []
+  let cursor = 0
+  for (const [start, end] of codeRanges(linked)) {
+    if (start < cursor) continue
+    pieces.push(redactOutsideWebURLs(linked.slice(cursor, start)), markHomeFolder(linked.slice(start, end)))
+    cursor = end
+  }
+  pieces.push(redactOutsideWebURLs(linked.slice(cursor)))
+  return pieces.join('')
+}
+
+/**
+ * Fields whose words are a command or a reason (a waiting permission's command, a failure): the path is kept and only
+ * the home folder reads `[home]`, so `rm -rf /Users/<name>/Documents` reads `rm -rf [home]/Documents`, never the
+ * harmless-looking `rm -rf Documents`. Control Web labels that line as a display. The exact command is on the approval
+ * card (`/api/session-questions`), which is not redacted.
+ */
+export const COMMAND_KEYS: ReadonlySet<string> = new Set(['waiting_detail', 'failure'])
+
+/** A copy of this JSON value with every string redacted (keys are left alone). Command fields keep their paths. */
+export function redactLocalPathsDeep<T>(value: T): T {
+  const walk = (item: unknown, command: boolean): unknown => {
+    if (typeof item === 'string') return command ? markHomeFolder(item) : redactLocalPaths(item)
+    if (Array.isArray(item)) return item.map(entry => walk(entry, command))
+    if (item && typeof item === 'object') {
+      const out: Record<string, unknown> = {}
+      for (const [key, entry] of Object.entries(item as Record<string, unknown>)) out[key] = walk(entry, command || COMMAND_KEYS.has(key))
+      return out
+    }
+    return item
+  }
+  return walk(value, false) as T
+}

package/server/lib/meeting-ask-orientation.ts

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto'
-import { callPython } from './python-bridge.js'
+import { countsAsMeeting, readCalendar } from './calendar-source.js'
+import { callPython, pythonBridgeAvailable } from './python-bridge.js'
 import { redactSecrets } from './lens-gist-engines.js'
 import { type MeetingAskCalendarMatch, type MeetingAskOrientation } from '../../shared/meeting-ask.js'
 import { domainNames, isSafeDomainName } from './domains.js'
@@ -8,13 +9,19 @@ import { domainLabel } from './domain-label.js'
 import { AskError } from './live-cos-ask.js'
 export const meetingDomains = () => domainNames(resolveCosOperationsDir()).map(id => ({id,label:domainLabel(id)}))
 export const emptyOrientation = (): MeetingAskOrientation => ({ revision: 0, domain: null, calendar: null })
+type CandidateEvent = { match: MeetingAskCalendarMatch; event: any }
 export function calendarCandidates(raw: unknown, startedAt: number | null): MeetingAskCalendarMatch[] {
+  return candidateEvents(raw, startedAt).map(c => c.match)
+}
+// QA W23: the same prep filter as Next up and Today (countsAsMeeting), so a declined meeting or a family flight that
+// covers the recording's start is never offered as "this meeting".
+function candidateEvents(raw: unknown, startedAt: number | null): CandidateEvent[] {
   if (startedAt === null || !Number.isFinite(startedAt)) return []
   const data = raw as any
   if (!data || data.is_stale || !Array.isArray(data.today_events)) return []
   const seen = new Set<string>()
-  return data.today_events.slice(0, 200).flatMap((event: any) => {
-    if (!event || event.is_all_day || typeof event.title !== 'string' || event.title.length > 500) return []
+  return data.today_events.slice(0, 200).flatMap((event: any): CandidateEvent[] => {
+    if (!event || !countsAsMeeting(event) || typeof event.title !== 'string' || event.title.length > 500) return []
     const start = Date.parse(event.start_time), end = Date.parse(event.end_time)
     // Match the recording's start, never whichever event happens to be current when Ask runs.
     if (!Number.isFinite(start) || !Number.isFinite(end) || end <= start || end - start > 24 * 3600000 || startedAt < start - 5 * 60000 || startedAt >= end) return []
@@ -22,14 +29,41 @@ export function calendarCandidates(raw: unknown, startedAt: number | null): Meet
     if (!title || /\booo\b|out of office|vacation|\bpto\b/i.test(title)) return []
     const match: MeetingAskCalendarMatch = { id: createHash('sha256').update(JSON.stringify([title, start, end])).digest('hex').slice(0, 24), title, start: new Date(start).toISOString(), end: new Date(end).toISOString(), ...(typeof event.domain === 'string' && isSafeDomainName(event.domain) ? { suggestedDomain: event.domain } : {}) }
     if (seen.has(match.id)) return []
-    seen.add(match.id); return [match]
+    seen.add(match.id); return [{ match, event }]
   }).slice(0, 5)
 }
+/**
+ * QA W21: snapshot rows carry domain: null (the bridge's classifier is Python people context), so ask the bridge's
+ * `calendar-classify` for the candidates that lack one: the exact rule its own calendar answer uses
+ * (classify_event_by_attendees on title, attendee names and calendar name). Names only over stdin, never addresses or
+ * domains. No bridge, an old bridge, a slow one or a bad answer: no suggestion, as before.
+ */
+export async function classifyWithBridge(rows: Array<{ title: string; attendees: string[]; calendar_name: string | null }>): Promise<Array<string | null> | null> {
+  if (!rows.length || !pythonBridgeAvailable()) return null
+  const out = await callPython(['calendar-classify'], 3000, JSON.stringify({ events: rows })) as any
+  if (!out || !Array.isArray(out.results) || out.results.length !== rows.length) return null
+  return out.results.map((r: any) => (r && typeof r.domain === 'string' ? r.domain : null))
+}
+async function withSuggestedDomains(found: CandidateEvent[], classify = classifyWithBridge): Promise<MeetingAskCalendarMatch[]> {
+  const need = found.filter(f => !f.match.suggestedDomain)
+  if (!need.length) return found.map(f => f.match)
+  let domains: Array<string | null> | null = null
+  try {
+    domains = await classify(need.map(f => ({
+      title: f.match.title,
+      attendees: Array.isArray(f.event.attendees) ? f.event.attendees.filter((n: unknown): n is string => typeof n === 'string' && !n.includes('@')).slice(0, 50) : [],
+      calendar_name: typeof f.event.calendar_name === 'string' ? f.event.calendar_name : null,
+    })))
+  } catch { domains = null }
+  if (!domains) return found.map(f => f.match)
+  need.forEach((f, i) => { const d = domains![i]; if (typeof d === 'string' && isSafeDomainName(d)) f.match.suggestedDomain = d })
+  return found.map(f => f.match)
+}
 export async function meetingCalendar(startedAt: number | null): Promise<{ candidates: MeetingAskCalendarMatch[]; notices: string[] }> {
   if (startedAt === null) return { candidates: [], notices: ['Calendar matching is available for a live recording. Choose a domain for this meeting.'] }
   try {
-    const raw = await callPython(['calendar'], 5000) as any
-    const candidates = calendarCandidates(raw, startedAt)
+    const raw = (await readCalendar(5000)).data as any
+    const candidates = await withSuggestedDomains(candidateEvents(raw, startedAt))
     return { candidates, notices: candidates.length ? [] : [raw?.error || raw?.is_stale ? 'Calendar context is unavailable or stale. Choose a domain manually.' : 'No calendar event matches this recording. Choose a domain manually.'] }
   } catch { return { candidates: [], notices: ['Calendar context is unavailable. Choose a domain manually.'] } }
 }

package/server/lib/meeting-ask-runner.ts

@@ -21,6 +21,8 @@ export interface MeetingAskRunBudget {
     deadlineMs?: number;
 }
 export const MEETING_ASK_DEFAULT_BUDGET = { maxOutputTokens: 1400, maxThinkingTokens: 0, deadlineMs: 45000 } as const;
+export const MEETING_ASK_TERMINATION_PROOF_MS = 4500;
+export const MEETING_ASK_LATE_PROOF_POLL_MS = 250;
 /** The child environment's token limits for a budget; the default is exactly '1400' and '0'. */
 export function meetingAskTokenEnv(budget?: MeetingAskRunBudget): { CLAUDE_CODE_MAX_OUTPUT_TOKENS: string; MAX_THINKING_TOKENS: string } {
     const output = budget?.maxOutputTokens ?? MEETING_ASK_DEFAULT_BUDGET.maxOutputTokens;
@@ -28,7 +30,9 @@ export function meetingAskTokenEnv(budget?: MeetingAskRunBudget): { CLAUDE_CODE_
     return { CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(output + thinking), MAX_THINKING_TOKENS: String(thinking) };
 }
 export class AskProcessError extends Error {
-    constructor(message: string, readonly terminationUnconfirmed = false) { super(message); }
+    constructor(message: string, readonly terminationUnconfirmed = false,
+        /** Runner-issued proof: resolves only after the original child closed and its group is absent. Never an expiry. */
+        readonly terminationConfirmed?: Promise<void>) { super(message); }
 }
 export function runMeetingAskModel(model: MeetingAskModel, prompt: string, system: string, signal?: AbortSignal, adapter?: {
     workspace: string;
@@ -57,16 +61,17 @@ budget?: MeetingAskRunBudget): Promise<{
     const stdin = adapter?.stdin ?? (provider === 'claude' ? prompt : `${system}\n\n${prompt}`);
     return new Promise((resolve, reject) => {
         const child = spawn(binary.path, args, { cwd: workspace, detached: true, stdio: ['pipe', 'pipe', 'pipe'], env: { ...lensGistChildEnv(binary.path), ...meetingAskTokenEnv(budget) } });
+        const processGroupId = child.pid;
         let stdout = '', failure: string | null = null, done = false, closeSeen = false, code: number | null = null;
         let killTimer: NodeJS.Timeout | undefined, proofTimer: NodeJS.Timeout | undefined;
-        const kill = (sig: NodeJS.Signals) => { if (child.pid)
+        const kill = (sig: NodeJS.Signals) => { if (processGroupId)
             try {
-                process.kill(-child.pid, sig);
+                process.kill(-processGroupId, sig);
             }
             catch { } };
-        const alive = () => { if (!child.pid)
+        const alive = () => { if (!processGroupId)
             return false; try {
-            process.kill(-child.pid, 0);
+            process.kill(-processGroupId, 0);
             return true;
         }
         catch (e) {
@@ -99,8 +104,23 @@ budget?: MeetingAskRunBudget): Promise<{
             signal?.removeEventListener('abort', abort);
             if (!unconfirmed && !adapter)
                 rmSync(workspace, { recursive: true, force: true });
-            if (unconfirmed)
-                return reject(new AskProcessError('child_exit_unconfirmed', true));
+            if (unconfirmed) {
+                // Answer the request within its shutdown budget, but keep observing the
+                // original child. An unconfirmed exit is not permission to admit another
+                // provider. This watcher is passive: no later signal can hit a reused PID.
+                let prove!: () => void;
+                const terminationConfirmed = new Promise<void>(resolve => { prove = resolve; });
+                const proof = setInterval(() => {
+                    // A missing/reused/permission-denied group alone is not enough: the
+                    // close event belongs to this original child, and ESRCH proves absence.
+                    if (!closeSeen || !processGroupId || alive()) return;
+                    clearInterval(proof);
+                    if (!adapter) try { rmSync(workspace, { recursive: true, force: true }); } catch { /* proof does not depend on scratch cleanup */ }
+                    prove();
+                }, MEETING_ASK_LATE_PROOF_POLL_MS);
+                proof.unref();
+                return reject(new AskProcessError('child_exit_unconfirmed', true, terminationConfirmed));
+            }
             if (failure || code !== 0)
                 return reject(new AskProcessError(failure ?? 'provider_failed'));
             try {
@@ -135,7 +155,7 @@ budget?: MeetingAskRunBudget): Promise<{
             const start = Date.now();
             proofTimer = setInterval(() => { if (closeSeen && !alive())
                 finish();
-            else if (Date.now() - start > 4500)
+            else if (Date.now() - start > MEETING_ASK_TERMINATION_PROOF_MS)
                 finish(true); }, 50);
         };
         const abort = () => stop('cancelled');
@@ -143,11 +163,11 @@ budget?: MeetingAskRunBudget): Promise<{
         signal?.addEventListener('abort', abort, { once: true });
         if (signal?.aborted)
             abort();
-        child.stdout.on('data', (b: Buffer) => { stdout += b.toString(); if (stdout.length > 1000000)
+        child.stdout.on('data', (b: Buffer) => { if (done) return; stdout += b.toString(); if (stdout.length > 1000000)
             stop('output_limit'); });
         child.stderr.on('data', () => { }); // Never surface provider credentials/raw errors.
         child.stdin.on('error', () => stop('provider_input_failed'));
-        child.on('error', () => { failure = 'provider_unavailable'; closeSeen = true; finish(); });
+        child.on('error', () => { failure = 'provider_unavailable'; finish(); });
         child.on('close', exit => { closeSeen = true; code = exit; if (failure) {
             if (!alive())
                 finish();

package/server/lib/morning-brief-runtime.ts

@@ -42,6 +42,7 @@ import {
 import { importedLibraryMonths, supersededDayCounts } from './imported-library-rows.js'
 import { getMeetingStore } from './meeting-store.js'
 import { COS_SCRIPTS_DIR, callPython, contextSourceAvailable, pythonBridgeAvailable } from './python-bridge.js'
+import { readCalendar } from './calendar-source.js'
 import { resolveProviderWorkDir } from './launch-dir.js'
 
 /** Highest stamped message number in the active era: live sessions, the day
@@ -113,8 +114,9 @@ export async function probeContext(): Promise<ContextProbe | null> {
 }
 
 export async function probeCalendar(): Promise<CalendarProbe | null> {
-  if (!pythonBridgeAvailable()) return null
-  const data = await callPython(['calendar'], 8_000) as { meetings_today_count?: unknown; today_events?: unknown; data_source?: unknown } | null
+  const read = await readCalendar(8_000)
+  if (read.source === 'none' || (read.source === 'bridge' && !pythonBridgeAvailable())) return null
+  const data = read.data as { meetings_today_count?: unknown; today_events?: unknown; data_source?: unknown } | null
   if (!data || typeof data !== 'object') return null
   const today = typeof data.meetings_today_count === 'number'
     ? data.meetings_today_count

package/server/lib/native-mac-caller.ts

@@ -0,0 +1,29 @@
+// 7.0.4 W1: is this request COS Control's own helper on this Mac, rather than a browser?
+//
+// WHY. S1 redaction turns paths in a session's words into base names before they leave the Mac. COS Control
+// (0.5.378 and 0.5.379, unchanged) recognises that a Work prompt it sent has ARRIVED by comparing the first 60
+// letters and digits of its own, unredacted prompt with the user turns of `GET /api/agent-sessions/:p/:id?turns=N`
+// (WorkProgress.promptArrival, through the helper's `session-recent-replies`). A prompt that opens with a path then
+// never matched: no replies shown, Continue refused, a Cursor note stuck at queued.
+//
+// WHO. The helper calls `http://127.0.0.1:<port>` with the X-COS-Token header, from URLSession: no Origin, no
+// Referer, no Sec-Fetch-* metadata, and a CFNetwork user agent. A browser always sends fetch metadata
+// (Chrome 76, Firefox 90, Safari 16.4 and later) and a `Mozilla/` user agent; Control Web signs in with a cookie,
+// not the header; a phone is never on loopback; a `tailscale serve` hop arrives on loopback but carries proxy
+// headers (isLoopbackSocket refuses it). Any other local process holding the token can already read the files.
+import type { Request, Response } from 'express'
+import { API_AUTH_BY_LOCAL } from './api-auth.js'
+import { isLoopbackSocket } from './network-policy.js'
+
+const BROWSER_HEADERS = ['origin', 'referer', 'sec-fetch-site', 'sec-fetch-mode', 'sec-fetch-dest', 'sec-fetch-user'] as const
+
+/** True only for a header-token request on this Mac's loopback, not proxied, carrying nothing a browser sends. */
+export function isNativeMacCaller(req: Pick<Request, 'headers' | 'socket'>, res: Pick<Response, 'locals'>): boolean {
+  if (res.locals?.[API_AUTH_BY_LOCAL] !== 'token') return false
+  if (!isLoopbackSocket(req)) return false
+  const headers = req.headers ?? {}
+  for (const name of BROWSER_HEADERS) if (headers[name] !== undefined) return false
+  const agent = headers['user-agent']
+  if (typeof agent === 'string' && /\bMozilla\//.test(agent)) return false
+  return true
+}

package/server/lib/ping-engine.ts

@@ -34,7 +34,7 @@ const POLLED: ReadonlySet<PingSource> = new Set<PingSource>(['prep', 'followups'
 export const PING_STATE_LIMITS = { held: 200, consumed: 5_000, consumedDays: 30, fileBytes: 4_000_000 } as const
 
 export interface PingSnapshot {
-  nextEvent?: { title?: unknown; time?: unknown } | null
+  nextEvent?: { title?: unknown; time?: unknown; occurrence?: unknown } | null
   intakeOpen?: readonly IntakeRow[] | null
   threads?: readonly ThreadRow[] | null
   signals?: readonly SignalRow[] | null

package/server/lib/ping-sources.ts

@@ -19,6 +19,8 @@ import { createHash } from 'node:crypto'
 import { localClock } from './morning-brief-schedule.js'
 import { clockLabel } from './drop-when.js'
 import { PING_RANK, type PingSource } from './ping-budget.js'
+import { parsePrepOccurrence } from './prep-store.js'
+import type { PrepOccurrence } from '../../shared/prep.js'
 
 export interface PingLink { kind: 'card' | 'session' | 'handoff' | 'thread' | 'memory' | 'meeting' | 'file' | 'reminder' | 'ask'; id: string; label: string; domain?: string }
 export interface PingCandidate {
@@ -29,10 +31,10 @@ export interface PingCandidate {
   line: string
   links: PingLink[]
   /**
-   * 6.99.19: the prep card's "Prep me" action also carries `prep` (title, startsAt and a null occurrence: the calendar
-   * gives no event ids today), so a client can open a Prep draft for that event. Additive; a client may ignore it.
+   * 6.99.19: the prep card's "Prep me" action also carries `prep` (title, startsAt and the occurrence when the calendar
+   * gave one, else null), so a client can open the Prep draft for that event. Additive; a client may ignore it.
    */
-  actions: Array<{ id: string; label: string; prep?: { title: string; startsAt: string; occurrence: null } }>
+  actions: Array<{ id: string; label: string; prep?: { title: string; startsAt: string; occurrence: PrepOccurrence | null } }>
   /** Epoch ms the source saw it. */
   createdAt: number
   /** Epoch ms after which it is no longer worth posting (prep: the meeting start). */
@@ -76,17 +78,20 @@ export function isoWeek(nowMs: number, timezone: string): string {
 }
 
 /** Prep: the next meeting, inside 15 minutes of its start. Expires at the start. */
-export function prepCandidates(next: { title?: unknown; time?: unknown } | null | undefined, nowMs: number, timezone: string): PingCandidate[] {
+export function prepCandidates(next: { title?: unknown; time?: unknown; occurrence?: unknown } | null | undefined, nowMs: number, timezone: string): PingCandidate[] {
   if (!next) return []
+  let occurrence: PrepOccurrence | null = null
+  if (next.occurrence != null) { try { occurrence = parsePrepOccurrence(next.occurrence) } catch { occurrence = null } }
   const start = typeof next.time === 'string' ? Date.parse(next.time) : NaN
   const title = clip(next.title, PING_TEXT.title)
   if (!Number.isFinite(start) || !title) return []
   if (start <= nowMs || start - nowMs > PREP_LEAD_MS) return []
   const day = localClock(start, timezone).day
   return [{
-    source: 'prep', key: `prep:${hash(`${title}\n${next.time}`)}:${day}`,
+    // An occurrence key is the real event; without one, title and time as before.
+    source: 'prep', key: `prep:${occurrence ? hash(occurrence.key) : hash(`${title}\n${next.time}`)}:${day}`,
     title, line: `${title} at ${clockLabel(localClock(start, timezone).minutes)}. Prep me?`,
-    links: [], actions: [{ id: 'prep', label: 'Prep me', prep: { title, startsAt: new Date(start).toISOString(), occurrence: null } }, { id: 'dismiss', label: 'Not now' }],
+    links: [], actions: [{ id: 'prep', label: 'Prep me', prep: { title, startsAt: new Date(start).toISOString(), occurrence } }, { id: 'dismiss', label: 'Not now' }],
     createdAt: nowMs, expiresAt: start,
   }]
 }