@gotcos/glasses-server 6.99.33 → 7.0.18

package/server/lib/local-path-redact.ts

@@ -0,0 +1,272 @@
+// No absolute Mac path reaches the browser through a session's words (7.0.4 S1).
+//
+// WHY. A reply is sent as the agent wrote it, and agents link the files they touched with full
+// paths: `[app.ts](/Users/<name>/repo/server/app.ts#L42)`, Codex's `[app.ts](/abs/app.ts:42)`, a
+// bare `~/Documents/...`, a path in backticks. A read-only scan of 14 days of transcripts found 111
+// Claude links and 826 Codex links carrying `/Users/...` into Control Web. The path names the
+// person, their folders and their projects, and the browser has no use for it: it cannot open it.
+//
+// WHAT. Every private local path in a string becomes its base name, keeping a line anchor
+// (`app.ts:42`, from `:42` or `#L42`). A Markdown link to a local file becomes its words (or the
+// base name when it has none). Web URLs are untouched; relative paths stay as written; a site path
+// such as `/api/x` is not a Mac path and stays too. `redactLocalPathsDeep` applies this to every
+// string in a JSON value, so a field added to the session detail later is covered without a list.
+//
+// WHAT COUNTS AS LOCAL (narrowed in 7.0.4 B1). Only places that name this Mac's people and data:
+// a path under `/Users/<name>`, `/Volumes/<name>`, `/private/...` (where /var and /tmp really
+// live) or `/var/folders/...` (per-user temp), a home shorthand (`~/`, `~name/` with a letter
+// first, `$HOME/`, `${HOME}/`), a `file://` URL, or an editor URL that opens a file
+// (`vscode://file/...`). The `.cos-glasses` data folder lives under the home folder, so it is
+// covered. Everything else is ordinary text and stays exactly as written: `/dev/null`,
+// `/usr/bin/env`, `/tmp/out`, `/opt/homebrew`, `/home`, `/run/start`, `~80/100`, `~1/3`, `A/B`,
+// dates and fractions. The first cut treated every Unix top-level folder as private and `~<digit>`
+// as home, and rewrote prose: "Pacing ~80/100 leads" read "Pacing 100 leads", "#!/usr/bin/env
+// node" read "#!env node".
+//
+// SPACES. A folder name with spaces (`/Users/x/Ukaoma Chief Of Staff/MU-Chief-Staff/CLAUDE.md`)
+// is followed across capitalised words, but only when the continuation ends at a real file
+// extension or a `/`. A continuation that ends anywhere else ("/Users/x/out Next Steps: Review
+// A/B results") is not taken, so the words after a path are never eaten. Either way the private
+// head (`/Users/<name>`) is removed.
+
+/** Editor and file URL schemes whose target is a file on this Mac. */
+const LOCAL_SCHEMES = ['file', 'vscode', 'vscode-insiders', 'cursor', 'windsurf', 'zed', 'idea', 'subl', 'txmt', 'mvim']
+
+/** Delimiters a path never runs through (besides whitespace) in prose, Markdown and code. */
+const DELIMS = `<>"'\`“”‘’|)\\]}*,;`
+const STOP = `\\s${DELIMS}`
+/** A root name in any letter case: APFS is case-insensitive, so `/USERS/jane` is the same folder as `/Users/jane`. */
+function anyCase(word: string): string {
+  return [...word].map(c => /[a-z]/i.test(c) ? `[${c.toUpperCase()}${c.toLowerCase()}]` : c).join('')
+}
+const USERS = anyCase('Users')
+/** A private root, followed by at least one more name: `/Users` alone, or "the /Users folder", is not a path. `//Users` counts. */
+const PRIVATE_ROOT = `/+(?:${USERS}|${anyCase('Volumes')}|${anyCase('private')})(?=/[^${STOP}/])|/+${anyCase('var')}/${anyCase('folders')}(?=/)`
+/** A home shorthand: `~/`, `~name/` (a letter first, so `~80/100` and `~1/3` stay numbers), `$HOME/`, `${HOME}/`. */
+const HOME_SHORTHAND = `(?:~(?:[A-Za-z][A-Za-z0-9._-]*)?|\\$HOME|\\$\\{HOME\\})(?=/)`
+const HEAD = `(?:${HOME_SHORTHAND}|${PRIVATE_ROOT})`
+/** A bare path follows prose punctuation, never a path segment (including ./ or ../). Web spans are handled separately. */
+const BARE = new RegExp(`(^|[^\\p{L}\\p{N}_./-])(${HEAD})([^${STOP}]*)`, 'gu')
+const SCHEME_URL = new RegExp(`\\b(?:${LOCAL_SCHEMES.join('|')}):\\/\\/[^${STOP}]*`, 'gi')
+/** Complete HTTP(S) tokens, including query/fragment paths. Keep their original bytes rather than reserializing a URL. */
+const WEB_URL = /\bhttps?:\/\/[^\s<>"'`“”‘’]+/gi
+/** `[words](destination)` and `![words](destination)`, the destination angle-wrapped or not (spaces allowed). */
+const LINK = /(!?)\[([^\]\n]{0,500})\]\(\s*(<[^>\n]{1,4096}>|[^\s()<>\n][^)\n]{0,4096}?)\s*\)/g
+const LOCAL_DEST = new RegExp(`^(?:${HEAD})`)
+const LOCAL_SCHEME_DEST = new RegExp(`^(?:${LOCAL_SCHEMES.join('|')}):\\/\\/`, 'i')
+/** One word of a folder name with spaces: capitalised or a number, no colon, and not ending a sentence. */
+const SPACED_WORD = `[A-Z0-9](?:[^\\s/:${DELIMS}]*[^\\s/:.!?${DELIMS}])?`
+/** One more space-separated folder name, while the words are capitalised and lead to another `/`. */
+const SPACED_TAIL = new RegExp(`^( (?:${SPACED_WORD} ){0,4}${SPACED_WORD}/[^${STOP}]*)`)
+/** A real file extension (with a letter in it, so `v1.2` and `10.15` are not), plus any `:line` anchors. */
+const HAS_EXTENSION = /\.(?=[A-Za-z0-9]{0,9}[A-Za-z])[A-Za-z0-9]{1,10}(?::\d+)*$/
+const TRAILING_PUNCTUATION = /[.:!?]+$/
+
+function decoded(value: string): string {
+  try { return decodeURIComponent(value) } catch { return value }
+}
+
+/** The base name of a path, with any line anchor it carries (`:42`, or `#L42` turned into `:42`). */
+function baseName(path: string): string {
+  let value = path
+  let anchor = ''
+  const hash = value.indexOf('#')
+  if (hash >= 0) {
+    const line = /^L(\d+)/i.exec(value.slice(hash + 1))
+    if (line) anchor = ':' + line[1]
+    value = value.slice(0, hash)
+  }
+  const query = value.indexOf('?')
+  if (query >= 0) value = value.slice(0, query)
+  const plain = decoded(value)
+  // The home folder itself names the person: it reads `~`, never its base name.
+  if (/^\/+users\/[^/]+\/?$/i.test(plain)) return '~' + anchor
+  const parts = plain.split('/').filter(Boolean)
+  const last = parts.pop() || '~'
+  return /:\d+$/.test(last) ? last : last + anchor
+}
+
+/** A path that may be carried across spaces: it ends at a real file extension or at a folder separator. */
+function endsAtFileOrFolder(path: string): boolean {
+  const core = path.replace(TRAILING_PUNCTUATION, '')
+  return core.endsWith('/') || HAS_EXTENSION.test(core)
+}
+
+function redactBare(text: string): string {
+  // Find the matches and their spaced tails first, then rebuild the string once.
+  const pieces: string[] = []
+  let cursor = 0
+  BARE.lastIndex = 0
+  for (let m = BARE.exec(text); m; m = BARE.exec(text)) {
+    const [match, before, head, body] = m
+    const start = m.index
+    if (start < cursor) continue
+    let path = head + body
+    let end = start + match.length
+    // A folder name with spaces is followed only when the continuation ends at a file extension or a `/`.
+    // A path that already ends that way, or that ends a sentence, is never extended.
+    if (!endsAtFileOrFolder(path) && !TRAILING_PUNCTUATION.test(path)) {
+      let probe = path
+      let probeEnd = end
+      for (let guard = 0; guard < 8; guard++) {
+        const tail = SPACED_TAIL.exec(text.slice(probeEnd))
+        if (!tail) break
+        probe += tail[1]
+        probeEnd += tail[1].length
+        if (endsAtFileOrFolder(probe)) { path = probe; end = probeEnd; break }
+        if (TRAILING_PUNCTUATION.test(probe)) break
+      }
+    }
+    const punctuation = TRAILING_PUNCTUATION.exec(path)?.[0] ?? ''
+    const core = punctuation ? path.slice(0, -punctuation.length) : path
+    pieces.push(text.slice(cursor, start), before, baseName(core), punctuation)
+    cursor = end
+    BARE.lastIndex = Math.max(end, start + 1)
+  }
+  pieces.push(text.slice(cursor))
+  return pieces.join('')
+}
+
+/** URL query values can look exactly like local paths; redact only the text between whole web tokens. */
+function redactOutsideWebURLs(text: string): string {
+  const redact = (part: string) => redactBare(part.replace(SCHEME_URL,
+    url => baseName(url.replace(LOCAL_SCHEME_DEST, '').replace(/^[^/]*\//, '/'))))
+  const pieces: string[] = []
+  let cursor = 0
+  WEB_URL.lastIndex = 0
+  for (let match = WEB_URL.exec(text); match; match = WEB_URL.exec(text)) {
+    let token = match[0]
+    // A prose/Markdown closing parenthesis ends the token; balanced URL path
+    // parentheses remain part of it. Explicit angle/quote wrapping supplies its own end.
+    if (!/[<"'`“‘]/.test(text[match.index - 1] ?? '')) {
+      let depth = 0
+      for (let i = 0; i < token.length; i++) {
+        if (token[i] === '(') depth++
+        else if (token[i] === ')' && depth-- === 0) { token = token.slice(0, i); break }
+      }
+    }
+    try { new URL(token) } catch { continue }
+    pieces.push(redact(text.slice(cursor, match.index)), hideHomeInUrl(token))
+    cursor = match.index + token.length
+    WEB_URL.lastIndex = cursor
+  }
+  pieces.push(redact(text.slice(cursor)))
+  return pieces.join('')
+}
+
+/**
+ * `/Users/<name>` (any letter case, any number of leading slashes). In code spans, code blocks and command fields it
+ * reads as the visible marker `[home]`, keeping the rest of the path, so a reader sees where the path was and that it
+ * was changed. The result is a display, not a runnable command: `~` was not used because a quoted `'~/x'` does not
+ * expand, so it would read as exact while meaning something else. In a web URL's query it reads `~`, which keeps the
+ * URL well formed. `/Users/Shared` is not a person's home and stays.
+ */
+const HOME_FOLDER = new RegExp(`(^|[^\\p{L}\\p{N}_.-])/+${USERS}/(?!Shared(?:/|$|[${STOP}]))[^${STOP}/&?#=]+`, 'gu')
+/** The same inside a URL query, percent-encoded: `%2FUsers%2Fjane` is `~`. */
+const ENCODED_HOME_FOLDER = /(?:%2F)+users%2F(?!shared(?:%2F|[&#\s]|$))[^%&?#=\s/]+/gi
+/** What a hidden home folder reads as in code and commands. */
+export const HOME_MARKER = '[home]'
+
+/** Every `/Users/<name>` in this text as the visible `[home]` marker; nothing else changes. */
+export function markHomeFolder(text: string): string {
+  if (typeof text !== 'string' || !text) return text
+  return text.replace(HOME_FOLDER, (_match, before: string) => before + HOME_MARKER)
+}
+
+/** A web URL exactly as written, except a home folder in its query or fragment (`?path=/Users/jane/a.pdf`). */
+function hideHomeInUrl(url: string): string {
+  const at = url.search(/[?#]/)
+  if (at < 0) return url
+  return url.slice(0, at) + url.slice(at).replace(HOME_FOLDER, (_match, before: string) => before + '~').replace(ENCODED_HOME_FOLDER, '~')
+}
+
+/**
+ * Code in Markdown: fenced blocks (``` or ~~~, closed by a fence of the same kind at least as long, or by the end of the
+ * text) and inline code spans (a run of backticks closed by a run of the same length, within one paragraph).
+ */
+function codeRanges(text: string): Array<[number, number]> {
+  const ranges: Array<[number, number]> = []
+  let open: { start: number; mark: string; length: number } | null = null
+  for (let pos = 0; pos <= text.length;) {
+    const newline = text.indexOf('\n', pos)
+    const end = newline < 0 ? text.length : newline
+    const line = text.slice(pos, end)
+    if (!open) {
+      const fence = /^ {0,3}(`{3,}|~{3,})/.exec(line)
+      if (fence && !(fence[1][0] === '`' && line.slice(fence[0].length).includes('`'))) open = { start: pos, mark: fence[1][0]!, length: fence[1].length }
+    } else {
+      const close = /^ {0,3}(`{3,}|~{3,})[ \t]*$/.exec(line)
+      if (close && close[1][0] === open.mark && close[1].length >= open.length) { ranges.push([open.start, end]); open = null }
+    }
+    if (newline < 0) break
+    pos = newline + 1
+  }
+  if (open) ranges.push([open.start, text.length])
+  const inFence = (at: number) => ranges.some(([s, e]) => at >= s && at < e)
+  const INLINE = /(?<!`)(`+)(?!`)([\s\S]*?[^`])\1(?!`)/g
+  const spans: Array<[number, number]> = []
+  for (let m = INLINE.exec(text); m; m = INLINE.exec(text)) {
+    if (inFence(m.index)) { INLINE.lastIndex = m.index + 1; continue }
+    if (/\n[ \t]*\n/.test(m[2]!)) { INLINE.lastIndex = m.index + m[1]!.length; continue }
+    spans.push([m.index, m.index + m[0].length])
+  }
+  return [...ranges, ...spans].sort((x, y) => x[0] - y[0])
+}
+
+/**
+ * Every private local path in this text. In prose a path becomes its base name (Markdown links to a local file become
+ * their words). In code spans and code blocks the path is kept and only the home folder is replaced, by the visible
+ * `[home]` marker: the code is then a display of the command, not the command. Web URLs are untouched except a home folder in their query; relative paths, site
+ * paths and system paths (`/dev/null`, `/usr/bin/env`, `/tmp/x`) stay as written.
+ */
+export function redactLocalPaths(text: string): string {
+  if (typeof text !== 'string' || !text) return text
+  const before = codeRanges(text)
+  const inCode = (at: number) => before.some(([s, e]) => at >= s && at < e)
+  const linked = text.replace(LINK, (match: string, _bang: string, words: string, rawDest: string, offset: number) => {
+    if (inCode(offset)) return match // a link written inside code is code
+    const dest = rawDest.startsWith('<') ? rawDest.slice(1, -1).trim() : rawDest.trim()
+    let target: string | null = null
+    if (LOCAL_SCHEME_DEST.test(dest)) target = dest.replace(LOCAL_SCHEME_DEST, '').replace(/^[^/]*\//, '/')
+    else if (LOCAL_DEST.test(dest)) target = dest
+    if (target === null) return match // a web URL, a relative path or a site path: left exactly as written
+    const name = baseName(target)
+    const label = words.trim()
+    if (!label) return name
+    // `[app.ts](/abs/app.ts#L42)` keeps its line: the words named the file, the anchor was in the link.
+    const anchor = /:\d+$/.exec(name)?.[0] ?? ''
+    return anchor && !/:\d+$/.test(label) && label.split('/').pop() === name.slice(0, -anchor.length) ? label + anchor : label
+  })
+  const pieces: string[] = []
+  let cursor = 0
+  for (const [start, end] of codeRanges(linked)) {
+    if (start < cursor) continue
+    pieces.push(redactOutsideWebURLs(linked.slice(cursor, start)), markHomeFolder(linked.slice(start, end)))
+    cursor = end
+  }
+  pieces.push(redactOutsideWebURLs(linked.slice(cursor)))
+  return pieces.join('')
+}
+
+/**
+ * Fields whose words are a command or a reason (a waiting permission's command, a failure): the path is kept and only
+ * the home folder reads `[home]`, so `rm -rf /Users/<name>/Documents` reads `rm -rf [home]/Documents`, never the
+ * harmless-looking `rm -rf Documents`. Control Web labels that line as a display. The exact command is on the approval
+ * card (`/api/session-questions`), which is not redacted.
+ */
+export const COMMAND_KEYS: ReadonlySet<string> = new Set(['waiting_detail', 'failure'])
+
+/** A copy of this JSON value with every string redacted (keys are left alone). Command fields keep their paths. */
+export function redactLocalPathsDeep<T>(value: T): T {
+  const walk = (item: unknown, command: boolean): unknown => {
+    if (typeof item === 'string') return command ? markHomeFolder(item) : redactLocalPaths(item)
+    if (Array.isArray(item)) return item.map(entry => walk(entry, command))
+    if (item && typeof item === 'object') {
+      const out: Record<string, unknown> = {}
+      for (const [key, entry] of Object.entries(item as Record<string, unknown>)) out[key] = walk(entry, command || COMMAND_KEYS.has(key))
+      return out
+    }
+    return item
+  }
+  return walk(value, false) as T
+}

package/server/lib/meeting-ask-orientation.ts

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto'
-import { callPython } from './python-bridge.js'
+import { countsAsMeeting, readCalendar } from './calendar-source.js'
+import { callPython, pythonBridgeAvailable } from './python-bridge.js'
 import { redactSecrets } from './lens-gist-engines.js'
 import { type MeetingAskCalendarMatch, type MeetingAskOrientation } from '../../shared/meeting-ask.js'
 import { domainNames, isSafeDomainName } from './domains.js'
@@ -8,13 +9,19 @@ import { domainLabel } from './domain-label.js'
 import { AskError } from './live-cos-ask.js'
 export const meetingDomains = () => domainNames(resolveCosOperationsDir()).map(id => ({id,label:domainLabel(id)}))
 export const emptyOrientation = (): MeetingAskOrientation => ({ revision: 0, domain: null, calendar: null })
+type CandidateEvent = { match: MeetingAskCalendarMatch; event: any }
 export function calendarCandidates(raw: unknown, startedAt: number | null): MeetingAskCalendarMatch[] {
+  return candidateEvents(raw, startedAt).map(c => c.match)
+}
+// QA W23: the same prep filter as Next up and Today (countsAsMeeting), so a declined meeting or a family flight that
+// covers the recording's start is never offered as "this meeting".
+function candidateEvents(raw: unknown, startedAt: number | null): CandidateEvent[] {
   if (startedAt === null || !Number.isFinite(startedAt)) return []
   const data = raw as any
   if (!data || data.is_stale || !Array.isArray(data.today_events)) return []
   const seen = new Set<string>()
-  return data.today_events.slice(0, 200).flatMap((event: any) => {
-    if (!event || event.is_all_day || typeof event.title !== 'string' || event.title.length > 500) return []
+  return data.today_events.slice(0, 200).flatMap((event: any): CandidateEvent[] => {
+    if (!event || !countsAsMeeting(event) || typeof event.title !== 'string' || event.title.length > 500) return []
     const start = Date.parse(event.start_time), end = Date.parse(event.end_time)
     // Match the recording's start, never whichever event happens to be current when Ask runs.
     if (!Number.isFinite(start) || !Number.isFinite(end) || end <= start || end - start > 24 * 3600000 || startedAt < start - 5 * 60000 || startedAt >= end) return []
@@ -22,14 +29,41 @@ export function calendarCandidates(raw: unknown, startedAt: number | null): Meet
     if (!title || /\booo\b|out of office|vacation|\bpto\b/i.test(title)) return []
     const match: MeetingAskCalendarMatch = { id: createHash('sha256').update(JSON.stringify([title, start, end])).digest('hex').slice(0, 24), title, start: new Date(start).toISOString(), end: new Date(end).toISOString(), ...(typeof event.domain === 'string' && isSafeDomainName(event.domain) ? { suggestedDomain: event.domain } : {}) }
     if (seen.has(match.id)) return []
-    seen.add(match.id); return [match]
+    seen.add(match.id); return [{ match, event }]
   }).slice(0, 5)
 }
+/**
+ * QA W21: snapshot rows carry domain: null (the bridge's classifier is Python people context), so ask the bridge's
+ * `calendar-classify` for the candidates that lack one: the exact rule its own calendar answer uses
+ * (classify_event_by_attendees on title, attendee names and calendar name). Names only over stdin, never addresses or
+ * domains. No bridge, an old bridge, a slow one or a bad answer: no suggestion, as before.
+ */
+export async function classifyWithBridge(rows: Array<{ title: string; attendees: string[]; calendar_name: string | null }>): Promise<Array<string | null> | null> {
+  if (!rows.length || !pythonBridgeAvailable()) return null
+  const out = await callPython(['calendar-classify'], 3000, JSON.stringify({ events: rows })) as any
+  if (!out || !Array.isArray(out.results) || out.results.length !== rows.length) return null
+  return out.results.map((r: any) => (r && typeof r.domain === 'string' ? r.domain : null))
+}
+async function withSuggestedDomains(found: CandidateEvent[], classify = classifyWithBridge): Promise<MeetingAskCalendarMatch[]> {
+  const need = found.filter(f => !f.match.suggestedDomain)
+  if (!need.length) return found.map(f => f.match)
+  let domains: Array<string | null> | null = null
+  try {
+    domains = await classify(need.map(f => ({
+      title: f.match.title,
+      attendees: Array.isArray(f.event.attendees) ? f.event.attendees.filter((n: unknown): n is string => typeof n === 'string' && !n.includes('@')).slice(0, 50) : [],
+      calendar_name: typeof f.event.calendar_name === 'string' ? f.event.calendar_name : null,
+    })))
+  } catch { domains = null }
+  if (!domains) return found.map(f => f.match)
+  need.forEach((f, i) => { const d = domains![i]; if (typeof d === 'string' && isSafeDomainName(d)) f.match.suggestedDomain = d })
+  return found.map(f => f.match)
+}
 export async function meetingCalendar(startedAt: number | null): Promise<{ candidates: MeetingAskCalendarMatch[]; notices: string[] }> {
   if (startedAt === null) return { candidates: [], notices: ['Calendar matching is available for a live recording. Choose a domain for this meeting.'] }
   try {
-    const raw = await callPython(['calendar'], 5000) as any
-    const candidates = calendarCandidates(raw, startedAt)
+    const raw = (await readCalendar(5000)).data as any
+    const candidates = await withSuggestedDomains(candidateEvents(raw, startedAt))
     return { candidates, notices: candidates.length ? [] : [raw?.error || raw?.is_stale ? 'Calendar context is unavailable or stale. Choose a domain manually.' : 'No calendar event matches this recording. Choose a domain manually.'] }
   } catch { return { candidates: [], notices: ['Calendar context is unavailable. Choose a domain manually.'] } }
 }

package/server/lib/meeting-ask-runner.ts

@@ -21,6 +21,8 @@ export interface MeetingAskRunBudget {
     deadlineMs?: number;
 }
 export const MEETING_ASK_DEFAULT_BUDGET = { maxOutputTokens: 1400, maxThinkingTokens: 0, deadlineMs: 45000 } as const;
+export const MEETING_ASK_TERMINATION_PROOF_MS = 4500;
+export const MEETING_ASK_LATE_PROOF_POLL_MS = 250;
 /** The child environment's token limits for a budget; the default is exactly '1400' and '0'. */
 export function meetingAskTokenEnv(budget?: MeetingAskRunBudget): { CLAUDE_CODE_MAX_OUTPUT_TOKENS: string; MAX_THINKING_TOKENS: string } {
     const output = budget?.maxOutputTokens ?? MEETING_ASK_DEFAULT_BUDGET.maxOutputTokens;
@@ -28,7 +30,9 @@ export function meetingAskTokenEnv(budget?: MeetingAskRunBudget): { CLAUDE_CODE_
     return { CLAUDE_CODE_MAX_OUTPUT_TOKENS: String(output + thinking), MAX_THINKING_TOKENS: String(thinking) };
 }
 export class AskProcessError extends Error {
-    constructor(message: string, readonly terminationUnconfirmed = false) { super(message); }
+    constructor(message: string, readonly terminationUnconfirmed = false,
+        /** Runner-issued proof: resolves only after the original child closed and its group is absent. Never an expiry. */
+        readonly terminationConfirmed?: Promise<void>) { super(message); }
 }
 export function runMeetingAskModel(model: MeetingAskModel, prompt: string, system: string, signal?: AbortSignal, adapter?: {
     workspace: string;
@@ -57,16 +61,17 @@ budget?: MeetingAskRunBudget): Promise<{
     const stdin = adapter?.stdin ?? (provider === 'claude' ? prompt : `${system}\n\n${prompt}`);
     return new Promise((resolve, reject) => {
         const child = spawn(binary.path, args, { cwd: workspace, detached: true, stdio: ['pipe', 'pipe', 'pipe'], env: { ...lensGistChildEnv(binary.path), ...meetingAskTokenEnv(budget) } });
+        const processGroupId = child.pid;
         let stdout = '', failure: string | null = null, done = false, closeSeen = false, code: number | null = null;
         let killTimer: NodeJS.Timeout | undefined, proofTimer: NodeJS.Timeout | undefined;
-        const kill = (sig: NodeJS.Signals) => { if (child.pid)
+        const kill = (sig: NodeJS.Signals) => { if (processGroupId)
             try {
-                process.kill(-child.pid, sig);
+                process.kill(-processGroupId, sig);
             }
             catch { } };
-        const alive = () => { if (!child.pid)
+        const alive = () => { if (!processGroupId)
             return false; try {
-            process.kill(-child.pid, 0);
+            process.kill(-processGroupId, 0);
             return true;
         }
         catch (e) {
@@ -99,8 +104,23 @@ budget?: MeetingAskRunBudget): Promise<{
             signal?.removeEventListener('abort', abort);
             if (!unconfirmed && !adapter)
                 rmSync(workspace, { recursive: true, force: true });
-            if (unconfirmed)
-                return reject(new AskProcessError('child_exit_unconfirmed', true));
+            if (unconfirmed) {
+                // Answer the request within its shutdown budget, but keep observing the
+                // original child. An unconfirmed exit is not permission to admit another
+                // provider. This watcher is passive: no later signal can hit a reused PID.
+                let prove!: () => void;
+                const terminationConfirmed = new Promise<void>(resolve => { prove = resolve; });
+                const proof = setInterval(() => {
+                    // A missing/reused/permission-denied group alone is not enough: the
+                    // close event belongs to this original child, and ESRCH proves absence.
+                    if (!closeSeen || !processGroupId || alive()) return;
+                    clearInterval(proof);
+                    if (!adapter) try { rmSync(workspace, { recursive: true, force: true }); } catch { /* proof does not depend on scratch cleanup */ }
+                    prove();
+                }, MEETING_ASK_LATE_PROOF_POLL_MS);
+                proof.unref();
+                return reject(new AskProcessError('child_exit_unconfirmed', true, terminationConfirmed));
+            }
             if (failure || code !== 0)
                 return reject(new AskProcessError(failure ?? 'provider_failed'));
             try {
@@ -135,7 +155,7 @@ budget?: MeetingAskRunBudget): Promise<{
             const start = Date.now();
             proofTimer = setInterval(() => { if (closeSeen && !alive())
                 finish();
-            else if (Date.now() - start > 4500)
+            else if (Date.now() - start > MEETING_ASK_TERMINATION_PROOF_MS)
                 finish(true); }, 50);
         };
         const abort = () => stop('cancelled');
@@ -143,11 +163,11 @@ budget?: MeetingAskRunBudget): Promise<{
         signal?.addEventListener('abort', abort, { once: true });
         if (signal?.aborted)
             abort();
-        child.stdout.on('data', (b: Buffer) => { stdout += b.toString(); if (stdout.length > 1000000)
+        child.stdout.on('data', (b: Buffer) => { if (done) return; stdout += b.toString(); if (stdout.length > 1000000)
             stop('output_limit'); });
         child.stderr.on('data', () => { }); // Never surface provider credentials/raw errors.
         child.stdin.on('error', () => stop('provider_input_failed'));
-        child.on('error', () => { failure = 'provider_unavailable'; closeSeen = true; finish(); });
+        child.on('error', () => { failure = 'provider_unavailable'; finish(); });
         child.on('close', exit => { closeSeen = true; code = exit; if (failure) {
             if (!alive())
                 finish();

package/server/lib/meeting-batch-transcribe.ts

@@ -16,6 +16,7 @@ import {
   transcribeHighQuality,
   type HighQualityTranscriptionResult,
   type WhisperWord,
+  isWhisperHqTimeout,
 } from './whisper-local.js'
 import { asrFrontEnd } from './stt-live.js'
 import { measureSpeechSeconds } from './vad-silero.js'
@@ -412,6 +413,7 @@ export const __progressiveHqTesting = {
   segmentRangeIsComplete,
   nextMissingSealedSegment,
   progressiveFailureIdentity,
+  recordProgressiveFailure,
   resolveProgressiveHqPolicy,
   progressiveSessionIsIdle,
   yieldIdleProgressiveSessions,
@@ -1091,6 +1093,30 @@ function yieldIdleProgressiveSessions(activeSessionId: string, now = Date.now())
   }
 }
 
+/** Attempts a progressive checkpoint gets before it waits for the save-time job. */
+const PROGRESSIVE_MAX_ATTEMPTS = 3
+const PROGRESSIVE_RETRY_BACKOFF_MS = [60_000, 120_000, 300_000]
+
+/** S1 (2026-11-09): what one failed checkpoint decode means for its retries.
+ * A timeout is not retried. The retry would run the same audio on the same CPU lane at the
+ * same background QoS against the same 240 s ceiling: 10/26 to 11/09, 112 segments timed out
+ * and 85 of them timed out on all three attempts, so 178 of 290 timeouts (about 12 h of
+ * CPU during meetings) were retries. The checkpoint is disposable; the save-time job decodes
+ * that window. Any other failure keeps the 60/120/300 s backoff. Returns whether it is terminal. */
+function recordProgressiveFailure(
+  state: Pick<ProgressiveSessionState, 'failedIdentity' | 'failedAttempts' | 'retryAfter'>,
+  identity: string,
+  error: unknown,
+  now = Date.now(),
+): { terminal: boolean; timedOut: boolean } {
+  const timedOut = isWhisperHqTimeout(error)
+  const attempts = state.failedIdentity === identity ? state.failedAttempts + 1 : 1
+  state.failedAttempts = timedOut ? Math.max(attempts, PROGRESSIVE_MAX_ATTEMPTS) : attempts
+  state.failedIdentity = identity
+  state.retryAfter = now + PROGRESSIVE_RETRY_BACKOFF_MS[Math.min(PROGRESSIVE_RETRY_BACKOFF_MS.length - 1, state.failedAttempts - 1)]
+  return { terminal: state.failedAttempts >= PROGRESSIVE_MAX_ATTEMPTS, timedOut }
+}
+
 function segmentRangeIsComplete(segment: BatchSegment, completedIndices: number[]): boolean {
   const completed = new Set(completedIndices)
   for (let index = segment.startChunkIdx; index <= segment.endChunkIdx; index++) {
@@ -1111,7 +1137,7 @@ function nextMissingSealedSegment(
     if (!cached) {
       const identity = progressiveFailureIdentity(state.audioDir, segment, previousText)
       if (!identity) return null
-      if (state.failedIdentity === identity && (state.failedAttempts >= 3 || Date.now() < state.retryAfter)) return null
+      if (state.failedIdentity === identity && (state.failedAttempts >= PROGRESSIVE_MAX_ATTEMPTS || Date.now() < state.retryAfter)) return null
       return { segment, previousText }
     }
     previousText = cached.text
@@ -1191,12 +1217,13 @@ function queueProgressiveWork(sessionId: string, state: ProgressiveSessionState)
       if ((error as Error)?.name !== 'AbortError') {
         const identity = progressiveFailureIdentity(state.audioDir, pending.segment, pending.previousText)
         if (!identity) return
-        state.failedAttempts = state.failedIdentity === identity ? state.failedAttempts + 1 : 1
-        state.failedIdentity = identity
-        state.retryAfter = Date.now() + [60_000, 120_000, 300_000][Math.min(2, state.failedAttempts - 1)]
+        const outcome = recordProgressiveFailure(state, identity, error)
         console.warn(
           `[meeting-hq-checkpoint] ${sessionId} ${pending.segment.startChunkIdx}-${pending.segment.endChunkIdx}: `
-          + `${error instanceof Error ? error.message : String(error)}`,
+          + `${error instanceof Error ? error.message : String(error)}`
+          + (outcome.terminal
+            ? (outcome.timedOut ? ' (timeout: not retried; the save-time job decodes this window)' : ' (attempts exhausted; the save-time job decodes this window)')
+            : ` (attempt ${state.failedAttempts} of ${PROGRESSIVE_MAX_ATTEMPTS})`),
         )
       }
     } finally {

package/server/lib/morning-brief-runtime.ts

@@ -42,6 +42,7 @@ import {
 import { importedLibraryMonths, supersededDayCounts } from './imported-library-rows.js'
 import { getMeetingStore } from './meeting-store.js'
 import { COS_SCRIPTS_DIR, callPython, contextSourceAvailable, pythonBridgeAvailable } from './python-bridge.js'
+import { readCalendar } from './calendar-source.js'
 import { resolveProviderWorkDir } from './launch-dir.js'
 
 /** Highest stamped message number in the active era: live sessions, the day
@@ -113,8 +114,9 @@ export async function probeContext(): Promise<ContextProbe | null> {
 }
 
 export async function probeCalendar(): Promise<CalendarProbe | null> {
-  if (!pythonBridgeAvailable()) return null
-  const data = await callPython(['calendar'], 8_000) as { meetings_today_count?: unknown; today_events?: unknown; data_source?: unknown } | null
+  const read = await readCalendar(8_000)
+  if (read.source === 'none' || (read.source === 'bridge' && !pythonBridgeAvailable())) return null
+  const data = read.data as { meetings_today_count?: unknown; today_events?: unknown; data_source?: unknown } | null
   if (!data || typeof data !== 'object') return null
   const today = typeof data.meetings_today_count === 'number'
     ? data.meetings_today_count

package/server/lib/native-mac-caller.ts

@@ -0,0 +1,29 @@
+// 7.0.4 W1: is this request COS Control's own helper on this Mac, rather than a browser?
+//
+// WHY. S1 redaction turns paths in a session's words into base names before they leave the Mac. COS Control
+// (0.5.378 and 0.5.379, unchanged) recognises that a Work prompt it sent has ARRIVED by comparing the first 60
+// letters and digits of its own, unredacted prompt with the user turns of `GET /api/agent-sessions/:p/:id?turns=N`
+// (WorkProgress.promptArrival, through the helper's `session-recent-replies`). A prompt that opens with a path then
+// never matched: no replies shown, Continue refused, a Cursor note stuck at queued.
+//
+// WHO. The helper calls `http://127.0.0.1:<port>` with the X-COS-Token header, from URLSession: no Origin, no
+// Referer, no Sec-Fetch-* metadata, and a CFNetwork user agent. A browser always sends fetch metadata
+// (Chrome 76, Firefox 90, Safari 16.4 and later) and a `Mozilla/` user agent; Control Web signs in with a cookie,
+// not the header; a phone is never on loopback; a `tailscale serve` hop arrives on loopback but carries proxy
+// headers (isLoopbackSocket refuses it). Any other local process holding the token can already read the files.
+import type { Request, Response } from 'express'
+import { API_AUTH_BY_LOCAL } from './api-auth.js'
+import { isLoopbackSocket } from './network-policy.js'
+
+const BROWSER_HEADERS = ['origin', 'referer', 'sec-fetch-site', 'sec-fetch-mode', 'sec-fetch-dest', 'sec-fetch-user'] as const
+
+/** True only for a header-token request on this Mac's loopback, not proxied, carrying nothing a browser sends. */
+export function isNativeMacCaller(req: Pick<Request, 'headers' | 'socket'>, res: Pick<Response, 'locals'>): boolean {
+  if (res.locals?.[API_AUTH_BY_LOCAL] !== 'token') return false
+  if (!isLoopbackSocket(req)) return false
+  const headers = req.headers ?? {}
+  for (const name of BROWSER_HEADERS) if (headers[name] !== undefined) return false
+  const agent = headers['user-agent']
+  if (typeof agent === 'string' && /\bMozilla\//.test(agent)) return false
+  return true
+}