@gotcos/glasses-server 6.99.33 → 7.0.18

package/server/index.ts

@@ -18,6 +18,13 @@ import { createClientInstanceRouter, isMeetingChunkPost, pairedInstanceFrom } fr
 import type { ClientInstanceOwner } from './lib/client-instance-claim.js'
 import { G2TurnLedger, G2TurnProvenance, G2_TURN_LEDGER_FILE, type OriginRequest } from './lib/g2-turn-provenance.js'
 import { createG2TurnsRouter } from './routes/g2-turns.js'
+import { WebKeyAuthority, webKeyAuthorityEnabled } from './lib/web-key-authority.js'
+import { deviceAllowlistFrom, WEB_KEY_AUDIT_FILE, WEB_KEY_NONCES_FILE, WEB_KEYS_FILE, WebKeyEnrollments, WebKeyNonces, WebKeyPackets, WebKeyRegistry } from './lib/web-key-registry.js'
+import { WEB_KEY_SIGNER_PORT, webKeySignerOrigin } from './lib/web-key-origin.js'
+import { createWebKeyRouter } from './routes/web-key.js'
+import { WebKeySignHandoffs } from './lib/web-key-handoff.js'
+import { combinedIntegrityReport, createWebKeySignerHandler } from './lib/web-key-signer-app.js'
+import { WebControlIntegrity, webControlIntegrityEnabled } from './lib/web-control-integrity.js'
 import { getTailscaleNudger, installTailscaleNudger } from './lib/tailscale-nudge.js'
 import { queryRouter } from './routes/query.js'
 import { providerProofRouter } from './routes/provider-proof.js'
@@ -25,6 +32,8 @@ import { transcribeRouter } from './routes/transcribe.js'
 import { sessionIndexRouter } from './routes/session-index.js'
 import { agentSessionsRouter } from './routes/agent-sessions.js'
 import { agentSessionStreamRouter } from './routes/agent-session-stream.js'
+import { createLiveEventsRouter, liveEventsEnabled, realLiveSources } from './routes/live-events.js'
+import { LiveEventsHub } from './lib/live-events.js'
 import { createAttachedTurnStream } from './lib/session-stream-producer.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
 import { createSessionHooksRouter } from './routes/session-hooks.js'
@@ -46,6 +55,9 @@ import {
   wirePermissionBrokerToSignals,
 } from './lib/permission-broker.js'
 import { createPermissionBrokerHookRouter, createSessionQuestionsRouter } from './routes/permission-broker.js'
+// X1: the full hold's switches and the engine gate's registry read (kept on their own lines, apart from other lanes' imports).
+import { fullHoldSwitches } from './lib/full-hold.js'
+import { engineForHookProcess, registryStatusForPid } from './lib/full-hold-engine.js'
 import { lastHoldQuestionsPollAt, lastLegacyQuestionsPollAt, lastQuestionsPollAt, presenceAgeMs, webPresenceAgeMs } from './lib/client-liveness.js'
 import {
   createAgentSessionBindingsRouter,
@@ -122,7 +134,8 @@ import { findPinnedCli, killParakeetChildren, sweepParakeetStaging, sweepStalePa
 import { handoffsRouter } from './routes/handoffs.js'
 import { recoveryRouter } from './routes/recovery.js'
 import { promptEditRouter } from './routes/prompt-edit.js'
-import { createTodayBriefRouter, defaultTodayBrief, readSubagentsFor } from './routes/today-brief.js'
+import { createTodayBriefRouter, defaultTodayBrief, readSessionContext } from './routes/today-brief.js'
+import { calendarToday } from './lib/calendar-source.js'
 import { liveCosAskRouter } from './routes/live-cos-ask.js'
 import { meetingAskRouter } from './routes/meeting-ask.js'
 import { meetingAskRuntime } from './lib/meeting-ask-runtime.js'
@@ -145,6 +158,7 @@ import {
   stopCodexModelCatalogRefresh,
 } from './lib/codex-model-catalog.js'
 import { startWhisperServer, stopWhisperServer } from './lib/whisper-local.js'
+import { noteCorsRejection } from './lib/cors-reject-log.js'
 import { startWhisperPreviewServer, stopWhisperPreviewServer } from './lib/whisper-preview.js'
 import { startLocalTtsServer, stopLocalTtsServer } from './lib/tts-local.js'
 import { initSileroVAD } from './lib/vad-silero.js'
@@ -155,7 +169,7 @@ import { killNemotronChildren } from './lib/nemotron-cli.js'
 import { getSessionRaw, logActiveSessionsOnShutdown, startAutoSnapshot } from './lib/conversation.js'
 import { getMediaStore } from './lib/media-store.js'
 import { getTurnFileStore } from './lib/turn-file-store.js'
-import { listenRequiredServers, type RequiredListener } from './lib/listener-startup.js'
+import { listenerPlan, listenRequiredServers, type RequiredListener } from './lib/listener-startup.js'
 import { serverMetrics } from './lib/server-metrics.js'
 import { initializeServerInstanceId } from './lib/server-instance-id.js'
 import { appendPrivateEnvBlock, UnsafeUserConfigPathError } from './lib/secure-user-config.js'
@@ -187,6 +201,7 @@ import { createBridgeDropWriters } from './lib/drop-destinations.js'
 import { dropItEnabled } from './lib/drop-settings.js'
 import { serverTimezone } from './lib/morning-brief-config.js'
 import { createYourMoveCounter } from './lib/your-move-count.js'
+import { workSessionActivity } from './lib/work-session-activity.js'
 import { readWorkJournal } from './lib/work-activity.js'
 import { createDropP2Boot } from './lib/drop-p2-boot.js'
 import { createP2SettingsReader } from './lib/drop-p2-settings.js'
@@ -203,7 +218,7 @@ import { BOOT_RESUME_LEDGER_FILE, createBootResumeGate, installBootResumeGate }
 import { WorkIntakeStore, createOptionalWorkIntakeStore } from './lib/work-intake-store.js'
 import { WorkHandoffRequestStore, createOptionalWorkHandoffRequestStore, handoffRequestCapabilities } from './lib/work-handoff-requests.js'
 import { createWorkBoardReader } from './lib/work-board-reader.js'
-import { listBoard } from './lib/task-store.js'
+import { listBoard, listBoardWithDates } from './lib/task-store.js'
 import { createDefaultWorkReviewRuntime } from './lib/work-review-backend.js'
 import { createMorningBriefRouter } from './routes/morning-brief.js'
 import { getMorningBriefScheduler, startMorningBriefScheduler, stopMorningBriefScheduler } from './lib/morning-brief-runtime.js'
@@ -225,6 +240,7 @@ import { isPublicApiRequest, requireApiToken } from './lib/api-auth.js'
 import { PairingState, pairingHostsFrom } from './lib/glasses-pairing.js'
 import { createPairingRouter } from './routes/pairing.js'
 import { createWebControlRouter, isAllowedCorsOrigin, webControlCsp, webControlEnabled } from './routes/web-control.js'
+import { webControlOffnetResponse } from './lib/web-control-offnet-page.js'
 import { createWebControlStatic } from './lib/web-control-static.js'
 import { isWebControlSocketAllowed, isWebSessionAuthorized, setWebSessionEpochFile } from './lib/web-session-auth.js'
 import { getTailnetSelfName, installTailnetSelfName } from './lib/tailnet-self-name.js'
@@ -240,7 +256,7 @@ import {
 } from './lib/maintenance-lifecycle.js'
 
 const app = express()
-import { createThreadTurnQueueRouter, drainAllThreads, steerAvailabilityFor } from './routes/thread-turn-queue.js'
+import { createThreadTurnQueueRouter, drainAllThreads, midTurnAvailabilityFor, steerAvailabilityFor } from './routes/thread-turn-queue.js'
 import { createCursorStopFollowupRouter } from './routes/cursor-stop-followup.js'
 import { queuedThreadKeys, readQueue, readTranscriptTailLines, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
 import { cursorDeskHaltReady, hookHaltReady, readHookToken } from './lib/claude-hooks-installer.js'
@@ -308,9 +324,10 @@ app.use(cors({
     if (!origin || origin === 'null') return cb(null, true)
     // Async only for an unrecognised *.ts.net origin (see isAllowedCorsOrigin); every other
     // origin is decided from cached state, as before.
+    // S1 (2026-11-09): the rejected origin is logged (origin only, once per origin per hour).
     isAllowedCorsOrigin(origin, getTailnetSelfName()).then(
-      ok => ok ? cb(null, true) : cb(new Error('CORS blocked')),
-      () => cb(new Error('CORS blocked')),
+      ok => { if (ok) return cb(null, true); noteCorsRejection(origin, 'not_allowed'); cb(new Error('CORS blocked')) },
+      () => { noteCorsRejection(origin, 'check_failed'); cb(new Error('CORS blocked')) },
     )
   },
   // Without this, a cross-origin reader sees only the CORS-safelisted response
@@ -358,6 +375,17 @@ const permissionBroker = new PermissionBroker({
     return !!signal && !signal.ended && signal.waiting?.fingerprint === fingerprint
   },
   signals: brokerSignalSink(sessionSignalStore),
+  // X1: the full hold (lib/full-hold.ts). Both switches default OFF; the registry is read only while one is on.
+  fullHold: () => fullHoldSwitches(process.env),
+  engineFor: (sessionId, ppid) => engineForHookProcess(sessionId, ppid),
+  // X1 round 3: the asking engine's own status, read each tick for full-hold items only.
+  engineStatus: (sessionId, pid) => registryStatusForPid(pid, sessionId),
+  // X1: per kind once the PermissionRequest hook is split; the one number while it is not. Read only by the full hold.
+  installedHookTimeoutForKindS: kind => {
+    const status = cachedHookStatus()
+    const perKind = status.permissionHookTimeouts ? status.permissionHookTimeouts[kind] : undefined
+    return perKind === undefined ? status.permissionHookTimeoutS : perKind
+  },
 })
 registerPermissionBroker(permissionBroker)
 wirePermissionBrokerToSignals(permissionBroker, sessionSignalStore)
@@ -381,6 +409,40 @@ app.use(createPermissionBrokerHookRouter({ hookToken: readHookToken, broker: per
 // it (tailnetSelf and HTTPS_PORT are read at request time, after they are set below). It is
 // recorded, never vouched: the cookie is an HMAC of API_TOKEN, so any token holder can mint one.
 const clientInstanceOwners = new Map<string, ClientInstanceOwner>()
+// 6.99.31: the enrolled phone key (lib/web-key-authority.ts), behind COS_WEB_KEY_AUTHORITY (default
+// off, read at call time). Off, no envelope is read and no /api/web-key route exists. The stores only
+// read their files here (none exist until the feature is used); nothing is written while it is off.
+const webKeySelfDnsName = (): string | null => {
+  const name = tailnetSelf.currentSelfDnsName()
+  return typeof name === 'string' && name.trim() ? name.trim().toLowerCase().replace(/\.$/, '') : null
+}
+const webKeyRegistry = new WebKeyRegistry(dataPath(WEB_KEYS_FILE), dataPath(WEB_KEY_AUDIT_FILE))
+const webKeyAuthority = new WebKeyAuthority({
+  registry: webKeyRegistry,
+  nonces: new WebKeyNonces(dataPath(WEB_KEY_NONCES_FILE)),
+  packets: new WebKeyPackets(),
+  selfDnsName: webKeySelfDnsName,
+  // The ONE origin a phone signs from (review B2/W2): the signer listener on 3144 under this Mac's
+  // MagicDNS name. The passkey's clientDataJSON.origin and the cookie gate's extra port use it too.
+  expectedOrigin: () => webKeySignerOrigin(webKeySelfDnsName()),
+  // Review W1: no vouch unless served-asset integrity is running AND its last check passed.
+  // (webControlIntegrity is declared further down; this runs at request time, after it is set.)
+  integrity: () => {
+    // Phase 3: the signer page on 3144 holds the key, so its own manifest must pass too.
+    return combinedIntegrityReport(webControlIntegrity, webKeySignerIntegrity)
+  },
+})
+// Phase 3 (review W2): the 3143 to 3144 handoff. In memory, two minutes, claimed once. Unused while the flag is off.
+const webKeySignHandoffs = new WebKeySignHandoffs()
+// Phase 3: the signer page's own integrity check (server/web-signer/.manifest.json). Built only with the
+// flag on at boot, as the 3144 listener is (listenerPlan); off, the directory is never read.
+const webKeySignerIntegrity: WebControlIntegrity | null = webKeyAuthorityEnabled()
+  ? new WebControlIntegrity(path.join(path.dirname(fileURLToPath(import.meta.url)), 'web-signer'), { log: line => console.error(line.replace('[web-control-integrity]', '[web-signer-integrity]').replace('/control is', 'the 3144 signer is')) })
+  : null
+// Review W6: enrollment starts only from a device on COS_WEB_KEY_DEVICES (empty: none).
+const webKeyEnrollments = new WebKeyEnrollments(webKeyRegistry, { deviceAllowed: deviceAllowlistFrom() })
+// The ports a COS Control Web cookie is honoured on. Flag off: exactly 6.99.29's [3141, 3143].
+const webCookiePorts = (): number[] => (webKeyAuthorityEnabled() ? [PORT, HTTPS_PORT, WEB_KEY_SIGNER_PORT] : [PORT, HTTPS_PORT])
 const g2Provenance = new G2TurnProvenance({
   ledger: new G2TurnLedger(dataPath(G2_TURN_LEDGER_FILE)),
   pairedInstance: (device, now, freshMs) => pairedInstanceFrom(clientInstanceOwners, device, now, freshMs),
@@ -390,8 +452,9 @@ const g2Provenance = new G2TurnProvenance({
     socket: { remoteAddress: req.socket?.remoteAddress ?? undefined },
   }, API_TOKEN, {
     selfDnsName: tailnetSelf.currentSelfDnsName(),
-    allowedPorts: [PORT, HTTPS_PORT],
+    allowedPorts: webCookiePorts(),
   }),
+  webKey: webKeyAuthority,
 })
 
 if (threadAttachEnabled()) {
@@ -440,7 +503,7 @@ const HTTPS_PORT = parseInt(process.env.HTTPS_PORT ?? '3143', 10)
 app.use('/api', requireApiToken(API_TOKEN, {
   onAuthenticated: req => pairingState.noteAuthenticated(req.socket?.remoteAddress),
   selfDnsName: () => tailnetSelf.currentSelfDnsName(),
-  allowedPorts: () => [PORT, HTTPS_PORT],
+  allowedPorts: () => webCookiePorts(),
 }))
 // Past the token gate, a request on a non-public path carried the token: mark a paired phone.
 // Only the X-Cos-Token header counts: a browser signed in to COS Control Web passed the gate
@@ -929,6 +992,25 @@ app.use('/api', diagRouter)
 app.use('/api', createClientInstanceRouter({ owners: clientInstanceOwners }))
 // G2 authority Tier 1: read-only provenance for one delivered turn (verify_g2_turn.py asks it).
 app.use('/api', createG2TurnsRouter({ provenance: g2Provenance, apiToken: () => API_TOKEN }))
+// 6.99.31: the enrolled phone key registry and ceremony. Not a route at all while COS_WEB_KEY_AUTHORITY is off,
+// except (7.0.9) the anchor status and registration routes with COS_WEB_KEY_ANCHOR_BOOTSTRAP on (routes/web-key.ts).
+// Nothing else in this file reads that switch: the 3144 listener, its integrity and the cookie ports stay on the authority.
+app.use('/api', createWebKeyRouter({
+  authority: webKeyAuthority,
+  enrollments: webKeyEnrollments,
+  isWebRequest: req => g2Provenance.originOf(req).origin.client === 'web',
+  apiToken: () => API_TOKEN,
+  selfDnsName: webKeySelfDnsName,
+  expectedOrigin: () => webKeyAuthority.deps.expectedOrigin(),
+  integrityStatus: () => ({ ...(webControlIntegrity?.status() ?? { enabled: false }), signer: webKeySignerIntegrity?.status() ?? null }),
+  // Phase 3: the phone's key steps and the handoff claim answer only on the 3144 signer listener.
+  isSignerRequest: req => req.socket?.localPort === WEB_KEY_SIGNER_PORT,
+  handoffs: webKeySignHandoffs,
+  resolveBinding: bindingId => {
+    const b = agentSessionBindingRegistry.get(bindingId)
+    return b ? { provider: b.provider, sessionId: b.nativeThreadId, epoch: b.epoch, targetKey: b.targetKey } : null
+  },
+}))
 app.use('/api', createQueryJobsRouter(queryJobCoordinator, {
   prepareAdmission: preparePublicDurableQueryAdmission,
 }))
@@ -957,7 +1039,9 @@ app.use(['/api/work-board', '/api/tasks'], (req, res, next) => {
 app.use('/api', createWorkBoardRouter({ readBoard: workBoardReader, requests: () => handoffRequestCapabilities(workHandoffRequestStore, Date.now()) }))
 app.use('/api', createWorkHandoffRequestsRouter({ store: workHandoffRequestStore, readBoard: workBoardReader }))
 // The Today summary for COS Control Web (6.99.26 candidate): Haiku, off unless switched on, with its own caps and breaker.
-app.use('/api', createTodayBriefRouter({ brief: defaultTodayBrief(), board: () => workBoardReader.read(60_000, 3_000).catch(() => null), subagents: keys => readSubagentsFor(keys) }))
+// 2026-11-09: the brief reads the DATED board (when each card last moved), through its own bounded, shared reader.
+const datedWorkBoardReader = createWorkBoardReader(() => listBoardWithDates())
+app.use('/api', createTodayBriefRouter({ brief: defaultTodayBrief(), board: () => datedWorkBoardReader.read(60_000, 3_000).catch(() => null), context: (keys, into) => readSessionContext(keys, into), calendar: () => calendarToday() }))
 // Work intake (6.57.0): meeting-derived suggestions, asks and review items. Optional: a bad journal never blocks boot.
 const workIntakeStore = createOptionalWorkIntakeStore(() => new WorkIntakeStore(dataPath('work-intake')))
 app.use('/api', createWorkIntakeRouter({ store: workIntakeStore }))
@@ -1029,6 +1113,7 @@ app.use('/api', createDropsRouter({
   yourMove: createYourMoveCounter({
     journal: () => readWorkJournal(),
     rows: () => workBoardReader.read(10_000, 3_000).catch(() => null),
+    sessionActivity: ids => workSessionActivity(ids),
   }),
 }))
 // 6.99.16: the COS thread (routes/cos-thread.ts): one size-capped conversation behind the COS chat's Ask, with a
@@ -1074,6 +1159,13 @@ app.use('/api', agentSessionsRouter)
 // router's `/attachability` below. READ-ONLY, and deliberately NOT behind
 // COS_THREAD_ATTACH_ENABLED -- see the header of the route for why.
 app.use('/api', agentSessionStreamRouter)
+// 7.0.1 live state: ONE change feed per open Control Web page (docs/live-events-contract.md). Ids, states, counts
+// and times only. COS_WEB_LIVE_EVENTS=0 registers no route (404), so the page polls exactly as before. The hub reads
+// nothing and ticks never while no stream is open; its reply counter is one Map increment per Stop.
+if (liveEventsEnabled()) {
+  const liveEventsHub = new LiveEventsHub({ sources: realLiveSources({ broker: () => permissionBroker }) })
+  app.use('/api', createLiveEventsRouter({ hub: liveEventsHub }))
+}
 // Presence view of Claude Code sessions on this Mac. Dark unless
 // COS_CLAUDE_SESSIONS_ENABLED=1 — it projects another product's 0700 state dir.
 app.use('/api', claudeSessionsRouter)
@@ -1132,6 +1224,13 @@ const steerDeps = {
     waitingOnPrompt: sessionHooksEnabled() ? (signalFor(threadId)?.waiting ?? null) !== null : false,
   }),
 }
+/** The attempt journal (the binding registry): Sessions steer, steer mid-turn and the drain stamp. */
+const queueAttemptJournal = {
+  begin: (provider: string, threadId: string, clientTurnId: string, mode: 'turn' | 'steer', now: number) =>
+    agentSessionBindingRegistry.beginAttempt(provider, threadId, clientTurnId, mode, now),
+  settle: (provider: string, threadId: string, clientTurnId: string, exit: 'sent' | 'not_sent' | 'unknown', now: number) =>
+    agentSessionBindingRegistry.settleAttempt(provider, threadId, clientTurnId, exit, now),
+}
 /** The bounded transcript tail the reconcile and the receipts read evidence from. */
 const QUEUE_EVIDENCE_TAIL_BYTES = 4 * 1024 * 1024
 const queueEvidenceLines = (provider: string, threadId: string): readonly string[] | null =>
@@ -1157,6 +1256,10 @@ const queueTurnEvidence = makeQueueTurnEvidence({
   now: () => Date.now(),
 })
 
+// Steer mid-turn (COS_STEER_MIDTURN): the park route asks for a drain pass at once. The kick is
+// made below, after the deps it drains with; until then (and with attach off) this does nothing.
+let kickQueueDrain: ((threadId: string) => void) | null = null
+
 if (threadAttachEnabled()) {
   const queueDeps = {
     // TWO GATES, ONE ANSWER. `threadOccupancy` sees FOREIGN holders -- another app on
@@ -1235,16 +1338,12 @@ if (threadAttachEnabled()) {
         .filter((text): text is string => typeof text === 'string'),
     }),
     ...steerDeps,
-    attempts: {
-      begin: (provider: string, threadId: string, clientTurnId: string, mode: 'turn' | 'steer', now: number) =>
-        agentSessionBindingRegistry.beginAttempt(provider, threadId, clientTurnId, mode, now),
-      settle: (provider: string, threadId: string, clientTurnId: string, exit: 'sent' | 'not_sent' | 'unknown', now: number) =>
-        agentSessionBindingRegistry.settleAttempt(provider, threadId, clientTurnId, exit, now),
-    },
+    attempts: queueAttemptJournal,
     // 6.53.0: parked turns hold for two minutes after a cancel on their thread.
     cancelHoldUntil: (provider: string, threadId: string) => cancelHoldUntilFor(provider, threadId),
     // 6.62.0 (W14): a busy Agent CLI chat's parked turn drains here (no Stop hook fires for `-p`).
     cursorCliChat: (threadId: string) => continueFactsDeps.cursorChatDir(threadId) !== null,
+    kickDrain: (threadId: string) => { kickQueueDrain?.(threadId) },
     now: () => Date.now(),
   }
   app.use('/api', createThreadTurnQueueRouter(queueDeps))
@@ -1266,6 +1365,8 @@ if (threadAttachEnabled()) {
     queuedThreadIds: () => queuedThreadKeys().map(k => k.threadId),
   })
   registerDrainKickStats(() => drainKick.stats())
+  // The same in-flight guard as the timer and the Stop hooks: a park never starts a second pass.
+  kickQueueDrain = threadId => { drainKick.kick(threadId) }
   const queueDrainTimer = setInterval(() => { void drainKick.sweep() }, 20_000)
   queueDrainTimer.unref()
   if (sessionHooksEnabled()) {
@@ -1375,6 +1476,8 @@ app.use('/api', createAgentSessionBindingsRouter({
     bootId: serverMetrics.bootId,
   }),
   sessionSteer: (provider, threadId, gateReason) => (sessionSteerEnabled() ? steerAvailabilityFor(steerDeps, provider, threadId, gateReason) : null),
+  // Steer mid-turn: the attachability answer's `midTurn` (null, and absent, with COS_STEER_MIDTURN off).
+  sessionMidTurn: (provider, threadId, gateReason) => midTurnAvailabilityFor({ ...steerDeps, attempts: queueAttemptJournal }, provider, threadId, gateReason),
   // 6.53.0: cancel a session run from the lens. The route's own in-flight map answers for
   // a COS turn; these answer for a run at the desk. Read per request, so Install hooks in
   // Control flips `hooks_outdated` to `desk_run` within the status cache's five seconds.
@@ -1529,8 +1632,13 @@ async function gracefulShutdown(): Promise<void> {
     if (parakeet.killed || parakeet.removed) console.log(`[stt] shutdown: killed ${parakeet.killed} Parakeet run(s), removed ${parakeet.removed} temp dir(s)`)
   } catch { /* best effort */ }
   stopCodexModelCatalogRefresh()
-  stopWhisperServer()
-  await stopWhisperPreviewServer({ final: true })
+  // S1 (2026-11-09): both whisper-server children are stopped with SIGKILL and waited for
+  // (about 2 s at most each, inside the 8 s force exit), so an update restart leaves no
+  // Metal-teardown crash report and no orphan reparented to launchd.
+  await Promise.all([
+    stopWhisperServer().catch(err => console.error('[shutdown] whisper-server stop:', err)),
+    stopWhisperPreviewServer({ final: true }),
+  ])
   stopLocalTtsServer()
   clearTimeout(forceExit)
   process.exit(0)
@@ -1552,19 +1660,33 @@ process.on('unhandledRejection', (reason: any) => {
 // Start HTTPS alongside HTTP — Even Hub WebView prefers HTTPS (iOS ATS).
 // Optional: drop cert.pem + key.pem in server/certs/ (e.g. via mkcert) to enable.
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
+// 6.99.31 (Phase 6): served-asset integrity, OFF by default (lib/web-control-integrity.ts). On, /control
+// serves only bytes that matched the pack-time manifest, from memory, re-checked every 60 s, with no
+// disk server behind it. Read once at boot.
+const webControlIntegrity = webControlEnabled() && webControlIntegrityEnabled()
+  ? new WebControlIntegrity(path.join(path.dirname(fileURLToPath(import.meta.url)), 'web-control'))
+  : null
 if (webControlEnabled()) {
   const webControlDir = path.join(__dirname, 'web-control')
+  const webControlServers = webControlIntegrity
+    ? [createWebControlStatic(webControlDir, { integrity: webControlIntegrity })]
+    : [createWebControlStatic(webControlDir), express.static(webControlDir)]
   app.use('/control', (req, res, next) => {
     // Loopback and Tailscale only, unless COS_WEB_CONTROL_LAN=1 (review W2).
     if (!isWebControlSocketAllowed(req.socket?.remoteAddress, process.env, req.headers)) {
-      res.status(403).type('text').send('COS Control Web is available on this Mac and over Tailscale.')
+      // W1 (audit 02 F1): still 403, but a browser gets a short page that says to use Tailscale (lib/web-control-offnet-page.ts).
+      const offnet = webControlOffnetResponse(/\btext\/html\b/i.test(String(req.headers.accept ?? '')))
+      res.setHeader('Cache-Control', 'no-store')
+      if (offnet.csp) res.setHeader('Content-Security-Policy', offnet.csp)
+      res.setHeader('X-Content-Type-Options', 'nosniff')
+      res.status(403).type(offnet.type).send(offnet.body)
       return
     }
     res.setHeader('Content-Security-Policy', webControlCsp(req.path))
     res.setHeader('X-Content-Type-Options', 'nosniff')
     res.setHeader('Referrer-Policy', 'no-referrer')
     next()
-  }, createWebControlStatic(webControlDir), express.static(webControlDir))
+  }, ...webControlServers)
   app.use('/api', createWebControlRouter({
     apiToken: () => API_TOKEN,
     serverVersion: () => managedServerVersion() ?? 'unknown',
@@ -1610,19 +1732,22 @@ function withRequestTimeout<T extends { requestTimeout: number }>(server: T): T
 
 const certDir = path.join(__dirname, 'certs')
 const listeners: RequiredListener[] = []
-if (existsSync(path.join(certDir, 'cert.pem'))) {
-  const httpsServer = withRequestTimeout(createHttpsServer({
-    cert: readFileSync(path.join(certDir, 'cert.pem')),
-    key: readFileSync(path.join(certDir, 'key.pem')),
-  }, app))
-  listeners.push({ server: httpsServer, port: HTTPS_PORT, host: BIND_HOST, label: 'HTTPS' })
-} else {
-  console.log('[COS API] No certs found — HTTPS disabled (drop cert.pem/key.pem in server/certs to enable)')
+const httpsAvailable = existsSync(path.join(certDir, 'cert.pem'))
+if (!httpsAvailable) console.log('[COS API] No certs found — HTTPS disabled (drop cert.pem/key.pem in server/certs to enable)')
+// 6.99.31: with COS_WEB_KEY_AUTHORITY on, the phone key's signer origin (https on 3144, same cert)
+// joins the REQUIRED set like 3143 (lib/listener-startup.ts listenerPlan). Flag off: 6.99.29's set.
+for (const entry of listenerPlan({ httpsAvailable, webKeyAuthority: webKeyAuthorityEnabled(), httpPort: PORT, httpsPort: HTTPS_PORT, signerPort: WEB_KEY_SIGNER_PORT })) {
+  // Phase 3: 3144 serves the signer page (verified bytes only) and an allowlist of /api routes,
+  // never the big app (lib/web-key-signer-app.ts). It exists only with the flag on.
+  const handler = entry.label === 'HTTPS signer'
+    ? createWebKeySignerHandler({ integrity: webKeySignerIntegrity, api: app, origin: () => webKeySignerOrigin(webKeySelfDnsName()) })
+    : app
+  const server = entry.tls
+    ? withRequestTimeout(createHttpsServer({ cert: readFileSync(path.join(certDir, 'cert.pem')), key: readFileSync(path.join(certDir, 'key.pem')) }, handler))
+    : withRequestTimeout(createHttpServer(app))
+  listeners.push({ server, port: entry.port, host: BIND_HOST, label: entry.label })
 }
 
-const httpServer = withRequestTimeout(createHttpServer(app))
-listeners.push({ server: httpServer, port: PORT, host: BIND_HOST, label: 'HTTP' })
-
 listenRequiredServers(listeners).then(() => {
   const serverInstanceId = initializeServerInstanceId()
   const startupAdmissionsOpen = maintenanceAdmissionsOpen()