@gotcos/glasses-server 6.99.33 → 7.0.7

package/server/routes/agent-sessions.ts

@@ -79,13 +79,22 @@ import {
 } from '../lib/occupancy-probes.js'
 import type { OccupancyDirs } from '../lib/thread-occupancy.js'
 import { parseTurnsParam, readRecentSessionTurns, type RecentTurnsRead } from '../lib/agent-session-turns.js'
+import { redactLocalPathsDeep } from '../lib/local-path-redact.js'
+import { isNativeMacCaller } from '../lib/native-mac-caller.js'
 import { cosSpawnedPids } from '../lib/agent-session-ownership-store.js'
 import { sessionActFactsFor, sessionActFields } from '../lib/session-act-fields.js'
 import { CONTINUE_NOTE_HEADER, continueNoteAcknowledged } from '../lib/continue-plan.js'
 
-import { agentSessionOutputImages } from '../lib/agent-session-output-images.js'
+import { agentSessionOutputImages, sharedFileHeaders } from '../lib/agent-session-output-images.js'
+import { previewErrorCode } from '../lib/preview-error-code.js'
+import { resetPreviewLogThrottle, warnPreviewThrottled } from '../lib/preview-log-throttle.js'
+import { sessionFilesSetting, withoutPreviews } from '../lib/session-files-setting.js'
+import { withoutLinkMarkers } from '../lib/session-links.js'
+import { createSessionPreviewRouter } from './session-preview.js'
 
 export const agentSessionsRouter = Router()
+// Preview engine phase 1: GET /api/preview/agent-sessions/... and /api/preview-folders/settings (routes/session-preview.ts).
+agentSessionsRouter.use(createSessionPreviewRouter())
 
 function boundedInteger(value: unknown, fallback: number, min: number, max: number): number {
   const parsed = Number(value)
@@ -567,7 +576,8 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
     const queuedOf = await allQueuedWaitingLookup(now)
     const codexRoots = codexSessionRootsOf(roots)
     const subagents = await readCodexSubagentsAcross(sessions.filter(row => row.provider === 'codex').map(row => row.session_id), codexRoots, now, codexRoots.length > 1 ? keyedCodexRootOf() : undefined)
-    res.json({
+    // 7.0.4 S1: no absolute Mac path in any string a list row carries (titles, first prompts, summaries).
+    res.json(redactLocalPathsDeep({
       sessions: sessions.map((row, index) => {
         const derived = derivedById.get(row.session_id)
         const signal = signalFor(row.session_id)
@@ -592,7 +602,7 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
       // client ignores this key. Zero means the walk found nothing to hide, not
       // that the caps are off.
       dropped,
-    })
+    }))
   } catch (error) {
     console.error(`[agent-sessions] list failed: ${error instanceof Error ? error.message : error}`)
     res.status(500).json({ error: 'Failed to read agent sessions', reason: 'agent_sessions_read_failed' })
@@ -631,30 +641,59 @@ agentSessionsRouter.get('/agent-sessions/search', async (req, res) => {
         remember: false,
       })
     }
-    res.json({
+    // 7.0.4 S1: search hits carry snippets of the same words.
+    res.json(redactLocalPathsDeep({
       ...result,
       hits: result.hits.map(hit => toSearchHit(hit, queuedOf(hit.provider, hit.session_id), derivedFor(hit))),
-    })
+    }))
   } catch (error) {
     console.error(`[agent-sessions] search failed: ${error instanceof Error ? error.message : error}`)
     res.status(500).json({ error: 'Failed to search agent sessions', reason: 'agent_sessions_search_failed' })
   }
 })
 
+/** 7.0.4 S2: the 403 every local-file route answers for a file whose name says it may hold secrets. */
+export const SECRET_FILE_DENIED = 'secret_file_denied'
+/** 7.0.4 QA: the 503 a preview answers when the Mac is already reading its limit of previews (not unreachable). */
+export const PREVIEWS_BUSY = 'previews_busy'
+
+type PreviewKind = 'output_image' | 'tool_image' | 'sent_file'
+/**
+ * 7.0.4 QA: every preview refusal and failure is logged with its kind and a reason code, never a path or a session's
+ * words. A burst of the same reason (a page of thumbnails while the reader is full) logs once per 10 seconds, with the
+ * count it held back (lib/preview-log-throttle.ts, shared with the preview engine routes since 7.0.7).
+ */
+export function logPreviewOutcome(kind: PreviewKind, reason: string, now = Date.now()): void {
+  warnPreviewThrottled(kind + ':' + reason, `[agent-sessions] preview ${kind} refused reason=${reason}`, now)
+}
+/** Tests only: forget the burst window, so each case logs. */
+export { resetPreviewLogThrottle }
+/** The answer for a preview read that did not succeed, logged (a missing id is ordinary and is not). */
+function previewRefusal(res: import('express').Response, kind: PreviewKind, status: 'not_found' | 'unavailable' | 'too_large' | 'secret' | 'busy'): void {
+  const noun = kind === 'sent_file' ? 'file' : 'image'
+  if (status !== 'not_found') logPreviewOutcome(kind, status === 'secret' ? SECRET_FILE_DENIED : status)
+  if (status === 'secret') { res.status(403).json({ error: SECRET_FILE_DENIED }); return }
+  if (status === 'not_found') { res.status(404).json({ error: `${noun}_not_found` }); return }
+  if (status === 'too_large') { res.status(413).json({ error: `${noun}_too_large` }); return }
+  if (status === 'busy') { res.set('Retry-After', '2'); res.status(503).json({ error: PREVIEWS_BUSY }); return }
+  res.status(503).json({ error: `${noun}_unavailable` })
+}
+
 // Authenticated by index.ts's shared /api gate. Neither the request nor the response
 // carries a filesystem path; the resolver reauthorizes exact transcript membership.
 agentSessionsRouter.get('/agent-sessions/:provider/:sessionId/output-images/:imageId/content', async (req, res) => {
   res.set('Cache-Control', 'private, no-store')
   res.set('X-Content-Type-Options', 'nosniff')
+  // 6.99.35: "Show files and images your sessions make" off answers before anything is read.
+  if (!sessionFilesSetting.read().enabled) { res.status(403).json({ error: 'previews_off' }); return }
   const provider = asProvider(String(req.params.provider ?? '').toLowerCase())
   if (!provider || (req.query.variant !== undefined && req.query.variant !== 'thumb' && req.query.variant !== 'phone')) {
     res.status(404).json({ error: 'image_not_found' }); return
   }
   try {
     const content = await agentSessionOutputImages.content(provider, String(req.params.sessionId), String(req.params.imageId), req.query.variant === 'thumb' ? 'thumb' : 'phone')
-    if (content.status !== 'ok') {
-      res.status(content.status === 'not_found' ? 404 : 503).json({ error: content.status === 'not_found' ? 'image_not_found' : 'image_unavailable' }); return
-    }
+    // 7.0.4 S2: the id was authorized, and the file's name says it may hold secrets (lib/secret-path-guard.ts).
+    if (content.status !== 'ok') { previewRefusal(res, 'output_image', content.status === 'expired' ? 'unavailable' : content.status); return }
     res.type('image/jpeg')
     // `send` defaults to `dotfiles: 'ignore'` and applies it to the WHOLE absolute path
     // when no `root` is given, so a media root under `~/.cos-glasses/data` 404'd on
@@ -666,8 +705,77 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId/output-images/:ima
       if (!res.headersSent) res.status(503).json({ error: 'image_unavailable' })
       else res.destroy()
     })
-  } catch {
-    console.warn('[agent-sessions] output image unavailable')
+  } catch (error) {
+    logPreviewOutcome('output_image', 'error_' + previewErrorCode(error))
+    res.status(503).json({ error: 'image_unavailable' })
+  }
+})
+
+// 6.99.35: "Show files and images your sessions make" (lib/session-files-setting.ts), Control Web Settings, Privacy.
+// Default on; COS_WEB_SESSION_FILES=0 on the Mac forces it off and the answer says so (source: 'env').
+agentSessionsRouter.get('/session-files/settings', (_req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  try { res.json(sessionFilesSetting.read()) } catch { res.status(500).json({ error: 'session_files_settings_unavailable' }) }
+})
+agentSessionsRouter.post('/session-files/settings', (req, res) => {
+  const body = req.body
+  if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(k => k !== 'enabled') || typeof body.enabled !== 'boolean') {
+    res.status(400).json({ error: { code: 'invalid_session_files_settings', message: 'Send { enabled: true } or { enabled: false }.' } }); return
+  }
+  try { res.json(sessionFilesSetting.set(body.enabled)) } catch { res.status(500).json({ error: 'session_files_settings_unavailable' }) }
+})
+
+// 6.99.35: a file a Claude session sent with SendUserFile. Same gate, same re-authorization, no path
+// in the request or the response. HTML is an attachment of type octet-stream with a sandbox CSP, never
+// same-origin HTML; a PDF may open inline.
+agentSessionsRouter.get('/agent-sessions/:provider/:sessionId/output-files/:fileId/content', async (req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  res.set('X-Content-Type-Options', 'nosniff')
+  if (!sessionFilesSetting.read().enabled) { res.status(403).json({ error: 'previews_off' }); return }
+  const provider = asProvider(String(req.params.provider ?? '').toLowerCase())
+  if (!provider) { res.status(404).json({ error: 'file_not_found' }); return }
+  try {
+    const content = await agentSessionOutputImages.fileContent(provider, String(req.params.sessionId), String(req.params.fileId))
+    if (content.status !== 'ok') { previewRefusal(res, 'sent_file', content.status); return }
+    res.set(sharedFileHeaders(content.name, content.kind))
+    res.status(200).end(content.bytes)
+  } catch (error) {
+    logPreviewOutcome('sent_file', 'error_' + previewErrorCode(error))
+    res.status(503).json({ error: 'file_unavailable' })
+  }
+})
+
+// Images a session looked at (tool results such as a Read of a PNG or a browser screenshot) and images attached
+// to its prompts. Same gate and switch as output images, same rule: no path in the request or the response. Embedded
+// bytes are served as the image type they ARE (png, jpeg, webp or gif, sniffed, never the declared type), with a
+// sandbox CSP; a path-only Read comes back through the output-image normalizer as a JPEG.
+export const TOOL_IMAGE_CSP = "sandbox; default-src 'none'"
+agentSessionsRouter.get('/agent-sessions/:provider/:sessionId/tool-images/:imageId/content', async (req, res) => {
+  res.set('Cache-Control', 'private, no-store')
+  res.set('X-Content-Type-Options', 'nosniff')
+  if (!sessionFilesSetting.read().enabled) { res.status(403).json({ error: 'previews_off' }); return }
+  const provider = asProvider(String(req.params.provider ?? '').toLowerCase())
+  if (!provider) { res.status(404).json({ error: 'image_not_found' }); return }
+  try {
+    const content = await agentSessionOutputImages.toolImageContent(provider, String(req.params.sessionId), String(req.params.imageId))
+    if (content.status !== 'ok') { previewRefusal(res, 'tool_image', content.status); return }
+    res.set('Content-Security-Policy', TOOL_IMAGE_CSP)
+    res.set('Cross-Origin-Resource-Policy', 'same-origin')
+    if ('path' in content) {
+      res.type('image/jpeg')
+      // dotfiles 'allow': the media root lives under ~/.cos-glasses/data (see the output-images route above).
+      res.sendFile(content.path, { dotfiles: 'allow' }, err => {
+        if (!err) return
+        if (!res.headersSent) res.status(503).json({ error: 'image_unavailable' })
+        else res.destroy()
+      })
+      return
+    }
+    res.set('Content-Type', content.type)
+    res.set('Content-Disposition', 'inline')
+    res.status(200).end(content.bytes)
+  } catch (error) {
+    logPreviewOutcome('tool_image', 'error_' + previewErrorCode(error))
     res.status(503).json({ error: 'image_unavailable' })
   }
 })
@@ -717,6 +825,8 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
       try {
         const images = await agentSessionOutputImages.context(provider, sessionId, found)
         recentTurns = await readRecentSessionTurns(provider, found, turnsWanted, undefined, images.project)
+        // 6.99.35: previews off sends one mark per message instead of image and file names.
+        if (recentTurns && !sessionFilesSetting.read().enabled) recentTurns = { ...recentTurns, turns: withoutPreviews(recentTurns.turns) }
       } catch (error) {
         console.warn(`[agent-sessions] recent turns failed provider=${provider}: ${error instanceof Error ? error.message : error}`)
       }
@@ -754,7 +864,10 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
     }
     const signal = signalFor(parsed.session_id)
     const hint = runningHintFor(provider, derived, hintClock(signal, derived, rollout), now, activityClockMs(st.mtimeMs, activity))
-    res.json({
+    // 7.0.4 S1: every string the detail sends (the reply, the digest, the first prompt, each turn's words, tool
+    // labels, file and image names) has its absolute local paths turned into base names (lib/local-path-redact.ts).
+    // A walk over the whole value rather than a field list, so a field added later is covered too.
+    const body = redactLocalPathsDeep({
       ...withRunning({ session_id: parsed.session_id }, running, hint),
       ...derivedRowFields(derived),
       ...queuedTurnsFields((await allQueuedWaitingLookup(Date.now()))(provider, parsed.session_id)),
@@ -816,6 +929,28 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
         noteAck: continueNoteAcknowledged(req.headers[CONTINUE_NOTE_HEADER]),
       }))[0]),
     })
+    // 7.0.4 W1: COS Control's helper on this Mac matches a Work prompt it sent against the session's user turns by
+    // their opening words, and it holds the prompt unredacted. Only the user turns' words in `recent_turns` (the one
+    // field it matches on) are sent as written, and only to that privileged local caller: a direct loopback request
+    // that passed the header-token gate with no browser or proxy header (lib/native-mac-caller.ts). Every browser
+    // (cookie or token), phone, LAN, tailnet and proxied request gets the redacted body. The answer is already
+    // `private, no-store`; Vary names every header the choice reads, so no cache can serve one as the other.
+    if (turnsWanted !== null) res.vary('Cookie').vary('X-COS-Token').vary('Origin').vary('Referer').vary('User-Agent').vary('Sec-Fetch-Mode').vary('Sec-Fetch-Site').vary('Sec-Fetch-Dest')
+    // 7.0.7 final QA: link-card markers (`[words](cos-file:N)`) go only to a client that asks for them with `cards=1`
+    // (Control Web from 7.0.7: the reader and Today's session sheet). Everyone else gets each card's words, as 7.0.4
+    // showed them: a Control Web tab opened before the update (it has no reload-on-version), COS Control (no build
+    // renders markers; its own cards come from outputLinks), the lens and any older client. outputLinks is unchanged.
+    const native = recentTurns && Array.isArray(body.recent_turns) ? isNativeMacCaller(req, res) : false
+    const cardsWanted = req.query.cards === '1'
+    // The native helper always gets words, whatever it asks for (no Control build draws markers).
+    if (recentTurns && Array.isArray(body.recent_turns) && (native || !cardsWanted)) {
+      body.recent_turns = body.recent_turns.map((turn, index) => {
+        const original = recentTurns!.turns[index]
+        if (native && original && original.role === 'user' && turn.role === 'user') return { ...turn, text: original.text }
+        return typeof turn.text === 'string' && turn.text.includes('](cos-file:') ? { ...turn, text: withoutLinkMarkers(turn.text) } : turn
+      })
+    }
+    res.json(body)
   } catch (error) {
     console.error(`[agent-sessions] detail failed: ${error instanceof Error ? error.message : error}`)
     res.status(500).json({ error: 'Failed to read agent session', reason: 'agent_sessions_read_failed' })

package/server/routes/ask-work-plan.ts

@@ -99,8 +99,11 @@ export function createAskWorkPlanRouter(given: Partial<AskWorkPlanDeps> = {}) {
         model: output.model ?? `claude:${planner} (requested)`, effort })
     } catch (error) {
       if (error instanceof AskProcessError && error.terminationUnconfirmed) {
-        // Match Meeting Ask's orphan policy: no second process or maintenance drain until recovery.
+        // No second process or maintenance drain until the runner proves that the
+        // original child and group have terminated. Missing/failed proof stays held.
         release = false
+        const heldLease = lease
+        void error.terminationConfirmed?.then(() => { heldLease?.release(); running = false }).catch(() => { /* remain fail-closed */ })
         console.warn('[ask-work-plan] provider termination unconfirmed; admission and maintenance lease retained')
         fail(new AskWorkPlanError('provider_termination_unconfirmed', 503))
       } else fail(error)

package/server/routes/claude-sessions.ts

@@ -95,11 +95,15 @@ export async function readClaudePeerRecords(
   dir: string,
   probes: PeerProbes = realProbes,
   showNames = claudeSessionNamesVisible(),
+  /** 7.0.1 live events: a folder that exists but cannot be read (permissions, a transient error) throws instead of
+   *  answering "nothing alive", so the caller keeps its last good reading. A missing folder is still empty. */
+  throwWhenUnreadable = false,
 ): Promise<ClaudePeerRecord[]> {
   let names: string[]
   try {
     names = await readdir(dir)
-  } catch {
+  } catch (error) {
+    if (throwWhenUnreadable && (error as NodeJS.ErrnoException)?.code !== 'ENOENT') throw error
     // No directory means Claude Code has never run here, or the path is wrong.
     // An empty presence list is the honest answer; the route reports `enabled`
     // separately so this cannot be mistaken for "the feature is off".

package/server/routes/health.ts

@@ -1,4 +1,5 @@
 import { MAX_ATTACHMENTS_PER_PROMPT } from '../../shared/media-attachment.js'
+import { calendarStatus } from '../lib/calendar-source.js'
 import { TURN_FILE_MAX_BYTES } from '../lib/turn-file-store.js'
 import { dropItCapability } from '../lib/drop-settings.js'
 import { PREP_CAPABILITY } from '../../shared/prep.js'
@@ -56,6 +57,10 @@ import {
   isOllamaProviderReady,
 } from '../lib/ollama-catalog.js'
 import { isMediaProcessingReady } from '../lib/image-safety.js'
+import { DEFAULT_MODEL, type ModelPreference } from '../../shared/model-preference.js'
+import { closedEnvDefaultModel } from '../lib/key-profile-routing.js'
+import { getSessionBinding, getSessionModel } from '../lib/conversation.js'
+import { isProfilePreference } from '../../shared/key-preference.js'
 import {
   MAX_OTHER_MEDIA_BYTES,
   MAX_VIDEO_MEDIA_BYTES,
@@ -625,6 +630,32 @@ function crashLoopParkingHealth(): { enabled: boolean; parked: number } {
   }
 }
 
+/**
+ * 7.0.2 (A7): what "Default" in a model picker resolves to, in model-router's own order
+ * (lib/model-router.ts, the resolvedModel line): the request's model, then the session's
+ * preference, then COS_G2_DEFAULT_MODEL, then DEFAULT_MODEL. A picker on "Default" sends no
+ * model, so the request step only names a model a caller passes in. `source` says which step won.
+ * A slot name only: never a key profile (closedEnvDefaultModel and getSessionModel are closed).
+ */
+export type DefaultModelSource = 'request' | 'session' | 'profile' | 'env' | 'built-in'
+/** `preference` is null only for `profile`: the session is bound to a key profile, never named here (plan 5.2). */
+export function resolveDefaultModel(input: { requested?: ModelPreference | null; sessionModel?: ModelPreference | null; sessionProfile?: boolean; env?: string | undefined }): { preference: ModelPreference | null; source: DefaultModelSource } {
+  if (input.requested) return { preference: input.requested, source: 'request' }
+  if (input.sessionModel) return { preference: input.sessionModel, source: 'session' }
+  // model-router routes a session bound to a profile through that profile when the request names no model.
+  if (input.sessionProfile) return { preference: null, source: 'profile' }
+  const env = closedEnvDefaultModel(input.env)
+  if (env) return { preference: env, source: 'env' }
+  return { preference: DEFAULT_MODEL, source: 'built-in' }
+}
+// A session id is only looked up in the in-memory session map (an unknown id reads null), so nothing else is checked.
+function defaultModelField(sessionQuery: unknown): { preference: ModelPreference | null; source: DefaultModelSource } {
+  const sid = typeof sessionQuery === 'string' && sessionQuery.length <= 128 ? sessionQuery : ''
+  const sessionModel = sid ? getSessionModel(sid) : null
+  const sessionProfile = !!sid && !sessionModel && isProfilePreference(getSessionBinding(sid))
+  return resolveDefaultModel({ sessionModel, sessionProfile, env: process.env.COS_G2_DEFAULT_MODEL })
+}
+
 // Stable app slots backed by Codex + Cursor live catalogs. Authenticated by
 // global /api middleware; ?refresh=1 forces discovery.
 healthRouter.get('/models', async (req, res) => {
@@ -656,6 +687,8 @@ healthRouter.get('/models', async (req, res) => {
   res.json({
     ...catalog,
     ...threadAttachHealthFields(threadAttach),
+    // 7.0.2 (A7): what a picker's "Default" resolves to (?sessionId= adds that session's preference).
+    defaultModel: defaultModelField(req.query.sessionId),
     // 6.62.0 (plans 3.5, 3.11): the phone reads THIS surface, so the live-Continue counters
     // and the per-provider action contract are published here too, same helpers as health.
     ...continueLiveHealthFields(),
@@ -680,6 +713,8 @@ healthRouter.get('/models', async (req, res) => {
     ollamaReady: isOllamaProviderReady(),
     // Key lanes (plan v4 3.1): `keyProfiles` only while a profile is active. Absent when off.
     ...keyProfilesModelsField(),
+    // PH plan P1: where the calendar comes from. Counts only, never titles; not on public /api/health.
+    calendar: calendarStatus(),
     serverInstanceId: getServerInstanceId(),
     // Minted here rather than on a route of its own: this response is already
     // authenticated, and the mint is stateless, so it costs nothing and stores