@gotcos/glasses-server 7.0.31 → 7.0.34

package/server/lib/glasses-pairing.ts

@@ -64,7 +64,8 @@ export const PAIRING_REASON_STATUS: Record<PairingReason, number> = {
 }
 
 export const PAIRING_REASON_MESSAGE: Record<PairingReason, string> = {
-  bad_request: 'That pairing request was not understood. Scan the code again.',
+  // 7.0.32 (Miles 11/13 06:34): the glasses pair by the typed code only, so no pairing answer says scan.
+  bad_request: 'That pairing request was not understood. Check the code in COS Control and type it again.',
   not_loopback: 'Pairing codes are made only by COS Control on this Mac.',
   not_allowed_network: 'Connect over Tailscale, or turn on "Allow pairing on this Wi-Fi" in COS Control.',
   denied: 'Pairing was denied on the Mac.',

package/server/lib/permission-broker.ts

@@ -140,7 +140,7 @@ import { randomBytes } from 'node:crypto'
 import { boundForRedaction } from './activity-preview.js'
 import { inferHookProvider, toolFingerprint, SESSION_ID_RE, type HookEnvelope } from './session-hook-events.js'
 import { ASK_USER_QUESTION_TOOL, type SessionSignalStore } from './session-signal-store.js'
-import { WEB_ANSWER_TOUCH_MAX_MS, WEB_CONFIRM_TTL_MS, engineProvenForFullHold, type EngineFacts, type FullHoldSwitches } from './full-hold.js'
+import { FULL_HOLD_QUESTION_WAIT_S, WEB_ANSWER_TOUCH_MAX_MS, WEB_CONFIRM_TTL_MS, defaultHoldTakesStamp, engineProvenForFullHold, type EngineFacts, type FullHoldSwitches } from './full-hold.js'
 
 // ---------------------------------------------------------------------------
 // Configuration
@@ -228,7 +228,7 @@ export const LEGACY_HOOK_WAIT_S = 130
  */
 export const HOOK_REPLY_MARGIN_S = 10
 /** A `hookWaitS` stamp outside this range is not one the installer writes: no stamp. */
-export const HOOK_WAIT_STAMP_MAX_S = 3_600
+export const HOOK_WAIT_STAMP_MAX_S = FULL_HOLD_QUESTION_WAIT_S
 
 /**
  * 6.60.0: the longest a request may be held, in seconds, from the hook's own start.
@@ -748,6 +748,46 @@ export type BrokerItemKind = 'question' | 'approval'
 /** 6.99.27: the door an answer came through: the Even app with the API token, or COS Control Web's browser session. */
 export type AnswerSurface = 'app' | 'web'
 
+/**
+ * X1 (the one queue, 7.0.32 candidate): which surface answered, as the queue says it ("Answered on the glasses").
+ * `web` is the browser door. The token door names its client when it says so (`X-Cos-Client` or `?client=`:
+ * glasses, phone, mac_app); otherwise `cos` (a COS surface that did not say which). `mac` is the Mac's own dialog.
+ */
+export type QueueSurface = 'mac' | 'web' | 'glasses' | 'phone' | 'mac_app' | 'cos'
+const CLIENT_SURFACES: ReadonlySet<string> = new Set(['glasses', 'phone', 'mac_app'])
+
+export function answerSurfaceOf(by: AnswerSurface, client: unknown): QueueSurface {
+  if (by === 'web') return 'web'
+  const said = typeof client === 'string' ? client.trim().toLowerCase().replace(/-/g, '_') : ''
+  return CLIENT_SURFACES.has(said) ? said as QueueSurface : 'cos'
+}
+
+/**
+ * X1: an answered entry stays in the queue this long, saying where it was answered. The same window the waiting list
+ * already keeps an answered question for (WAITING_ANSWERED_KEEP_MS), so a question's answered entry is dropped by the
+ * list's own prune; an approval's by the check in `queueSources`.
+ */
+export const QUEUE_ANSWERED_KEEP_MS = 120_000
+
+/** X1: one waiting thing the broker knows of, for the queue (`lib/question-queue.ts` builds the wire entries). */
+export interface BrokerQueueSource {
+  key: string
+  sessionId: string
+  provider: 'claude' | 'codex'
+  kind: 'question' | 'approval'
+  tool: string
+  questions: BrokerQuestion[]
+  approval: ApprovalCard | null
+  askedAt: number
+  /** `here`: a COS surface can answer it now (`heldId`); `mac`: only the Mac's own dialog can. */
+  where: 'here' | 'mac'
+  heldId: string | null
+  deadlineAt: number | null
+  state: 'waiting' | 'answered'
+  answeredBy: QueueSurface | null
+  answeredAt: number | null
+}
+
 export type BrokerResolution = 'answered' | 'handed_to_desk' | 'expired' | 'hook_gone' | 'retracted' | 'drained' | 'no_client'
 export type BrokerFastPath =
   | 'broker_off' | 'draining' | 'malformed' | 'cursor' | 'approvals_off' | 'unsupported_tool'
@@ -942,7 +982,7 @@ interface BrokerItem {
   deadlineAt: number
   state: 'pending' | BrokerResolution
   settledAt: number | null
-  answer: { clientAnswerId: string; chosen: Chosen } | null
+  answer: { clientAnswerId: string; chosen: Chosen; surface?: QueueSurface } | null
   /** The clientAnswerId of the "Leave for the Mac" that settled it, so its retry replays. */
   handedBackBy: string | null
   channel: HookReplyChannel | null
@@ -1287,20 +1327,31 @@ export class PermissionBroker {
     return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null
   }
 
-  /** X1: the two switches now; both off when absent or unreadable. */
+  /** X1: the two switches now; both off when absent or unreadable. 7.0.34: plus the question default. */
   private fullHoldSwitches(): FullHoldSwitches {
     try {
       const on = this.deps.fullHold?.()
-      return { questions: on?.questions === true, approvals: on?.approvals === true }
+      return { questions: on?.questions === true, approvals: on?.approvals === true, questionsByDefault: on?.questionsByDefault === true }
     } catch {
-      return { questions: false, approvals: false }
+      return { questions: false, approvals: false, questionsByDefault: false }
     }
   }
 
-  /** X1: either switch is on (the web door then needs a touch, and an approval a confirm). */
+  /**
+   * X1: either switch is on (the web door then needs a touch, and an approval a confirm, and the `waiting` view
+   * shows). 7.0.34: under the question DEFAULT this is on only once this Mac's hooks carry the long question block,
+   * the same thing that makes its questions eligible (`defaultHoldTakesStamp` of the installed AskUserQuestion
+   * block). Before that a Mac reads exactly as 7.0.33 with the switch off: no `waiting`, the same web door.
+   */
   private anyFullHoldOn(): boolean {
     const on = this.fullHoldSwitches()
-    return on.questions || on.approvals
+    if (on.questions || on.approvals) return true
+    return on.questionsByDefault === true && defaultHoldTakesStamp(this.installedHookTimeoutS('question'))
+  }
+
+  /** X1, 7.0.34: a question of this kind may be fully held under the switches now: on, or the default with a long stamp. */
+  private questionHoldAllows(on: FullHoldSwitches, hookWaitS: number | null | undefined): boolean {
+    return on.questions || (on.questionsByDefault === true && defaultHoldTakesStamp(hookWaitS))
   }
 
   /**
@@ -1312,7 +1363,7 @@ export class PermissionBroker {
    */
   private fullHoldEligible(isQuestion: boolean, askHold: boolean, background: boolean, facts: Omit<PermissionRequestFacts, 'fingerprint'>): boolean {
     const on = this.fullHoldSwitches()
-    if (isQuestion ? !on.questions : !on.approvals) return false
+    if (isQuestion ? !this.questionHoldAllows(on, facts.hookWaitS) : !on.approvals) return false
     if (background || facts.provider === 'codex') return false
     if (isQuestion && !askHold) return false
     if (facts.hookWaitS === null) return false
@@ -1485,7 +1536,10 @@ export class PermissionBroker {
       ...(webOnly ? { webOnly: true as const, webPresenceAgeMs: Math.round(presence.webAgeMs ?? 0) } : {}),
       ...(full ? { fullHold: true as const } : {}),
     }
-    return { ok: true, request: { facts: { ...facts, fingerprint }, kind, questions, approval, deadlineAt, awayHold, askHold, lensVisible: !askHold || (idle !== null && idle >= this.deskIdleThreshold()), ...(webOnly ? { webOnly: true } : {}), ...(full ? { fullHold: true, enginePid } : {}), hold: holdFacts } }
+    // X1 (Miles 11/12 17:42, "At once, on all three"): a fully held question is on the web and the glasses the moment
+    // it is asked, beside the Mac's own dialog; the first answer wins. Only a full-hold item (its switch on, engine
+    // proven): with the switches off, a stamped question still waits for the desk to be idle, exactly as 7.0.31.
+    return { ok: true, request: { facts: { ...facts, fingerprint }, kind, questions, approval, deadlineAt, awayHold, askHold, lensVisible: !askHold || full || (idle !== null && idle >= this.deskIdleThreshold()), ...(webOnly ? { webOnly: true } : {}), ...(full ? { fullHold: true, enginePid } : {}), hold: holdFacts } }
   }
 
   /** Hold the hook's response until exactly one resolution. Returns the item id. */
@@ -1675,7 +1729,7 @@ export class PermissionBroker {
    * clientAnswerId) replays its 200. `handBack` wins over any answer fields in the same body:
    * it is the safe direction, since it only shows the dialog that would have shown anyway.
    */
-  answer(id: string, body: unknown, by: AnswerSurface = 'app'): AnswerResult {
+  answer(id: string, body: unknown, by: AnswerSurface = 'app', client?: unknown): AnswerResult {
     const item = BROKER_ID_RE.test(id) ? this.items.get(id) : undefined
     if (!item) return { status: 404, body: { error: 'not_found' } }
     const input = isRecord(body) ? body : {}
@@ -1700,7 +1754,9 @@ export class PermissionBroker {
     if (handBack) return this.handBack(item, clientAnswerId)
     // Q1 O1: while a switch is on, an item no device is shown yet (the desk-idle latch has not fired) is
     // not answerable by its id, from any door. A hand-back stays allowed: it only shows the Mac's dialog.
-    if (!item.lensVisible && (this.anyFullHoldOn() || item.fullHold)) {
+    // X1 (at once): a full-hold item is shown the moment it is parked, so only a stamped question the full hold
+    // did not take can be unshown here.
+    if (!item.lensVisible && this.anyFullHoldOn()) {
       this.log(`not_shown ${item.id} kind=${item.kind}`)
       return { status: 409, body: { error: 'not_shown' } }
     }
@@ -1740,7 +1796,7 @@ export class PermissionBroker {
     }
     item.state = 'answered'
     item.settledAt = this.deps.now()
-    item.answer = { clientAnswerId, chosen }
+    item.answer = { clientAnswerId, chosen, surface: answerSurfaceOf(by, client) }
     item.channel = null
     item.toolInput = {}
     item.questions = null
@@ -1918,6 +1974,11 @@ export class PermissionBroker {
 
   waitingList(): WaitingQuestionView[] {
     if (!this.extendedQuestionsView()) return []
+    return this.waitingViews()
+  }
+
+  /** X1: the waiting views, whatever the switches (the queue needs them; `waitingList` is gated as before). */
+  private waitingViews(): WaitingQuestionView[] {
     const now = this.deps.now()
     this.pruneWaiting(now)
     const answerable = (item: BrokerItem): boolean => item.state === 'pending' && item.lensVisible && now < item.deadlineAt
@@ -1962,6 +2023,60 @@ export class PermissionBroker {
     return views.sort((a, b) => a.askedAt.localeCompare(b.askedAt))
   }
 
+  /**
+   * X1 (the one queue): every question and approval a live session waits on that this server knows of, whatever
+   * the switches, plus what was answered in the last QUEUE_ANSWERED_KEEP_MS with where. Questions come from the
+   * waiting entries (held or at the Mac) and from settled questions the Mac still waits on that no entry speaks
+   * for (asked before a restart); approvals from pending items and settled ones the Mac still waits on. Text is
+   * kept only while it waits, as everywhere in this file. Turn-end asks are added by the queue builder.
+   */
+  queueSources(): BrokerQueueSource[] {
+    const now = this.deps.now()
+    this.prune()
+    const out: BrokerQueueSource[] = []
+    const views = this.waitingViews()
+    const settledSurface = (match: (item: BrokerItem) => boolean): QueueSurface | null => {
+      for (const item of this.items.values()) if (item.state === 'answered' && item.answer && item.answer.clientAnswerId !== 'cos-cancel' && match(item)) return item.answer.surface ?? 'cos'
+      return null
+    }
+    for (const v of views) {
+      if (v.state === 'answered') {
+        // `waitingViews` lists an answered question only within WAITING_ANSWERED_KEEP_MS (= QUEUE_ANSWERED_KEEP_MS).
+        const answeredAt = v.answeredAt ? Date.parse(v.answeredAt) : null
+        if (answeredAt === null) continue
+        const by: QueueSurface = v.answeredBy === 'cos'
+          ? settledSurface(item => item.kind === 'question' && item.sessionId === v.sessionId && (!!v.toolUseId && item.toolUseId === v.toolUseId)) ?? 'cos'
+          : 'mac'
+        out.push({ key: v.key, sessionId: v.sessionId, provider: v.provider, kind: 'question', tool: ASK_USER_QUESTION_TOOL, questions: [], approval: null, askedAt: Date.parse(v.askedAt), where: 'mac', heldId: null, deadlineAt: null, state: 'answered', answeredBy: by, answeredAt })
+        continue
+      }
+      out.push({ key: v.key, sessionId: v.sessionId, provider: v.provider, kind: 'question', tool: ASK_USER_QUESTION_TOOL, questions: v.questions, approval: null, askedAt: Date.parse(v.askedAt), where: v.answerable ? 'here' : 'mac', heldId: v.heldId, deadlineAt: v.deadlineAt ? Date.parse(v.deadlineAt) : null, state: 'waiting', answeredBy: null, answeredAt: null })
+    }
+    const listedQuestion = (item: BrokerItem): boolean => views.some(v => v.heldId === item.id || (v.sessionId === item.sessionId && !!v.toolUseId && v.toolUseId === item.toolUseId))
+    for (const item of this.items.values()) {
+      const key = `${item.sessionId}:${item.toolUseId ?? item.id}`
+      const base = { key, sessionId: item.sessionId, provider: item.provider, kind: item.kind, tool: item.toolName, askedAt: item.requestedAt }
+      if (item.kind === 'question') {
+        // A question the Mac still waits on that no waiting entry speaks for (asked before a restart): no words.
+        if (item.state !== 'pending' && item.waitingAtMac && !listedQuestion(item)) {
+          out.push({ ...base, questions: [], approval: null, where: 'mac', heldId: null, deadlineAt: null, state: 'waiting', answeredBy: null, answeredAt: null })
+        }
+        continue
+      }
+      if (item.state === 'pending') {
+        if (!item.lensVisible || now >= item.deadlineAt) continue
+        out.push({ ...base, questions: [], approval: item.approval, where: 'here', heldId: item.id, deadlineAt: item.deadlineAt, state: 'waiting', answeredBy: null, answeredAt: null })
+      } else if (item.waitingAtMac) {
+        out.push({ ...base, questions: [], approval: null, where: 'mac', heldId: null, deadlineAt: null, state: 'waiting', answeredBy: null, answeredAt: null })
+      } else if (item.settledAt !== null && now - item.settledAt <= QUEUE_ANSWERED_KEEP_MS && (item.state === 'answered' || item.state === 'retracted')) {
+        const by: QueueSurface | null = item.state === 'retracted' ? 'mac' : item.answer?.clientAnswerId === 'cos-cancel' ? null : (item.answer?.surface ?? 'cos')
+        if (by === null) continue
+        out.push({ ...base, questions: [], approval: null, where: 'mac', heldId: null, deadlineAt: null, state: 'answered', answeredBy: by, answeredAt: item.settledAt })
+      }
+    }
+    return out
+  }
+
   /** X1: what a web page must send with an answer right now (`webAnswer` on the questions route). */
   webAnswerRules(): { touchRequired: boolean; touchMaxMs: number; confirmApprovals: boolean } {
     const on = this.anyFullHoldOn()
@@ -2102,7 +2217,8 @@ export class PermissionBroker {
     // The switches are read only while one is held, so with both off nothing here runs.
     if ([...this.items.values()].some(item => item.state === 'pending' && item.fullHold)) {
       const on = this.fullHoldSwitches()
-      this.settleAll('handed_to_desk', item => item.fullHold && (item.kind === 'question' ? !on.questions : !on.approvals))
+      // 7.0.34: a question held under the default stays held while the default (or on) still stands; off hands it back.
+      this.settleAll('handed_to_desk', item => item.fullHold && (item.kind === 'question' ? !(on.questions || on.questionsByDefault === true) : !on.approvals))
       if (this.pendingCount() === 0) return
       // X1 round 3: a held item whose settling hook event never arrived (a lost spool event) must not sit
       // to its deadline. Its own engine's registry record says whether the session moved on: the record is

package/server/lib/question-hold-setting.ts

@@ -0,0 +1,38 @@
+// X1, 7.0.34: the server-side question-hold setting that Control's Settings row writes
+// (`PUT /api/session-hooks/question-hold`). One small file in the COS home: `{"mode":"on"}` or `{"mode":"off"}`.
+// No file means the default (lib/full-hold.ts `questionHoldMode`). `COS_QUESTION_FULL_HOLD` in the environment
+// always wins over this file; the route says so (`source: "env"`) rather than writing something that cannot apply.
+//
+// Read on every call, never cached: the broker reads it per question and the status per refresh, and a stale
+// value after a Settings click would be a hold the person just turned off. The file is a few bytes.
+
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { atomicWriteFileSync } from './atomic-fs.js'
+import { cosGlassesHome } from './claude-hooks-installer.js'
+import type { QuestionHoldSetting } from './full-hold.js'
+
+export const QUESTION_HOLD_SETTING_FILE = 'question-hold.json'
+
+export function questionHoldSettingPath(home: string = cosGlassesHome()): string {
+  return join(home, QUESTION_HOLD_SETTING_FILE)
+}
+
+/** `on`, `off`, or null for no setting (the default). An unreadable or malformed file is no setting. */
+export function readQuestionHoldSetting(path: string = questionHoldSettingPath()): QuestionHoldSetting | null {
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as { mode?: unknown }
+    return parsed && (parsed.mode === 'on' || parsed.mode === 'off') ? parsed.mode : null
+  } catch {
+    return null
+  }
+}
+
+/** `on` or `off` writes the file; `default` removes it. */
+export function writeQuestionHoldSetting(mode: QuestionHoldSetting | 'default', path: string = questionHoldSettingPath()): void {
+  if (mode === 'default') {
+    if (existsSync(path)) rmSync(path, { force: true })
+    return
+  }
+  atomicWriteFileSync(path, JSON.stringify({ mode }) + '\n', { mode: 0o600 })
+}

package/server/lib/question-queue.ts

@@ -0,0 +1,111 @@
+// X1 (Miles 2026-11-12 17:31, "a consistent way ... to access active questions that are in waiting and in queue"):
+// ONE list of everything a session waits on him for, oldest first, built here once and served additively on
+// GET /api/session-questions as `queue` and `queueCount`, so Control Web, the glasses and the Mac app list and
+// count the same things. Present whatever the full-hold switches say: it is also how he finds a question that
+// only the Mac's own dialog can answer.
+//
+// WHAT IS IN IT: questions COS holds (answerable here) or that wait at the Mac's dialog; tool approvals held or at
+// the Mac (listed so they are found; answering them keeps every existing rule, `where` says which door); turn-end
+// asks a row shows; and, for QUEUE_ANSWERED_KEEP_MS, what was just answered and on which surface, so a card can say
+// "Answered on the glasses" instead of vanishing.
+//
+// PRIVACY: the only words are `line` (a question's first 80 characters, cleaned; an approval's existing summary;
+// a turn-end ask's 80 characters) and a turn-end ask's reply labels, the same text the questions route, the
+// session rows and the cards already carry to the same authenticated clients (the API token or the paired web
+// session). With COS_WAITING_QUESTION_WORDS=0 a question's line is ''. Nothing here is logged.
+
+import { questionRowText } from './full-hold.js'
+import type { BrokerQueueSource, QueueSurface } from './permission-broker.js'
+import type { AnsweredTurnAsk, QueueTurnAsk } from './turn-end-ask.js'
+
+export const QUEUE_LINE_MAX = 80
+/** Entries past this are dropped, oldest answered first, then oldest waiting. */
+export const QUEUE_MAX = 64
+
+export type QueueKind = 'question' | 'approval' | 'turn_end'
+
+export interface QueueEntry {
+  key: string
+  sessionId: string
+  /** The session's title as the session list last showed it, or null (the client uses its own). */
+  title: string | null
+  provider: 'claude' | 'codex'
+  kind: QueueKind
+  /** One line: the question, the approval's summary, or the turn-end ask. '' when words are off or unknown. */
+  line: string
+  askedAt: string
+  /** `here`: answer it from COS now (`heldId` for questions and approvals; a turn-end ask by a reply). `mac`: only the Mac's dialog. */
+  where: 'here' | 'mac'
+  heldId: string | null
+  deadlineAt: string | null
+  /** A turn-end ask's reply labels (0 to 2); [] otherwise. */
+  choices: string[]
+  state: 'waiting' | 'answered'
+  answeredBy: QueueSurface | null
+  answeredAt: string | null
+}
+
+export interface QuestionQueue { queue: QueueEntry[]; queueCount: number }
+
+export interface QueueInput {
+  broker: readonly BrokerQueueSource[]
+  turnEnd: readonly QueueTurnAsk[]
+  turnEndAnswered: readonly AnsweredTurnAsk[]
+  titleFor(sessionId: string): string | null
+  /** COS_WAITING_QUESTION_WORDS. */
+  words: boolean
+}
+
+function clip(text: string, max = QUEUE_LINE_MAX): string {
+  const t = questionRowText(text).replace(/\s+/g, ' ').trim()
+  return t.length > max ? t.slice(0, max - 1) + '…' : t
+}
+
+const iso = (ms: number | null): string | null => ms === null || !Number.isFinite(ms) ? null : new Date(ms).toISOString()
+
+function safeTitle(titleFor: QueueInput['titleFor'], sessionId: string): string | null {
+  try { return titleFor(sessionId) } catch { return null }
+}
+
+export function buildQuestionQueue(input: QueueInput): QuestionQueue {
+  const entries: QueueEntry[] = []
+  for (const s of input.broker) {
+    const line = s.kind === 'question'
+      ? (input.words && s.questions.length > 0 ? clip(s.questions[0]!.question) : '')
+      : (s.approval ? clip(s.approval.summary) : '')
+    entries.push({
+      key: s.key, sessionId: s.sessionId, title: safeTitle(input.titleFor, s.sessionId), provider: s.provider, kind: s.kind,
+      line, askedAt: iso(s.askedAt)!, where: s.where, heldId: s.heldId, deadlineAt: iso(s.deadlineAt), choices: [],
+      state: s.state, answeredBy: s.answeredBy, answeredAt: iso(s.answeredAt),
+    })
+  }
+  for (const a of input.turnEnd) {
+    entries.push({
+      key: `${a.sessionId}:turn_end:${a.stoppedAt}`, sessionId: a.sessionId, title: safeTitle(input.titleFor, a.sessionId), provider: 'claude',
+      kind: 'turn_end', line: clip(a.ask), askedAt: iso(a.stoppedAt)!, where: 'here', heldId: null, deadlineAt: null,
+      choices: [...a.choices], state: 'waiting', answeredBy: null, answeredAt: null,
+    })
+  }
+  for (const a of input.turnEndAnswered) {
+    entries.push({
+      key: `${a.sessionId}:turn_end:${a.stoppedAt}`, sessionId: a.sessionId, title: safeTitle(input.titleFor, a.sessionId), provider: 'claude',
+      kind: 'turn_end', line: clip(a.ask), askedAt: iso(a.stoppedAt)!, where: 'here', heldId: null, deadlineAt: null,
+      choices: [], state: 'answered', answeredBy: a.by, answeredAt: iso(a.answeredAt),
+    })
+  }
+  // One entry per key (a waiting and an answered copy of the same ask: the answered one wins).
+  const byKey = new Map<string, QueueEntry>()
+  for (const e of entries) {
+    const had = byKey.get(e.key)
+    if (!had || (had.state === 'waiting' && e.state === 'answered')) byKey.set(e.key, e)
+  }
+  let queue = [...byKey.values()].sort((a, b) => a.askedAt.localeCompare(b.askedAt) || a.key.localeCompare(b.key))
+  if (queue.length > QUEUE_MAX) {
+    const waiting = queue.filter(e => e.state === 'waiting')
+    const answered = queue.filter(e => e.state === 'answered')
+    const keepAnswered = Math.max(0, QUEUE_MAX - waiting.length)
+    const keep = new Set([...waiting.slice(-QUEUE_MAX), ...answered.slice(answered.length - keepAnswered)])
+    queue = queue.filter(e => keep.has(e))
+  }
+  return { queue, queueCount: queue.filter(e => e.state === 'waiting').length }
+}

package/server/lib/session-hooks-runtime.ts

@@ -23,7 +23,7 @@ import { ensureHookRuntimeFiles, ensureStableHookScript, hookSpoolDir, hookStatu
 import { codexHooksHealthField, cursorObserverHealthField, type CodexHooksHealth, type CursorObserverHealth } from './provider-observe.js'
 import { readHidIdleSeconds } from './permission-broker.js'
 import { waitingQuestionWordsEnabled } from './full-hold.js'
-import { TurnEndAskTracker, turnEndAsksEnabled, type TurnEndAskCounters } from './turn-end-ask.js'
+import { TURN_ASK_MAX_AGE_MS, TurnEndAskTracker, turnEndAsksEnabled, type AnsweredTurnAsk, type QueueTurnAsk, type TurnEndAskCounters } from './turn-end-ask.js'
 
 export function sessionHooksEnabled(): boolean {
   const raw = process.env.COS_SESSION_HOOKS
@@ -44,6 +44,11 @@ export function deskIdleSeconds(): number {
 /** Replay this much ledger history into the store at boot. */
 export const LEDGER_REPLAY_WINDOW_MS = 6 * 60 * 60_000
 
+/** X1: how much further back than the store the turn-end ask tracker replays: its age-out minus the store's window (2 h). */
+export function turnAskReplayExtraMs(): number {
+  return Math.max(0, TURN_ASK_MAX_AGE_MS - LEDGER_REPLAY_WINDOW_MS)
+}
+
 // A hook's ppid is the claude process itself: macOS `sh -c '<script> <Event>'` execs the
 // single command, and every recorded session (fixtures, 2026-09-15) shows one ppid across all
 // of its events. The `ps` parent lookup below is the fallback for a shell that does not exec;
@@ -288,12 +293,22 @@ export function startSessionHooksRuntime(options: { port: number }): SessionHook
   }) : null
   const tracker = turnEndAskTracker
   const unsubscribeTurnAsk = tracker ? sessionSignalStore.subscribe((signal, env, child) => tracker.observe(env, child, signal)) : () => {}
-  const replay = ledger.replay(since, (env, _key, child, entrypoint) => {
+  // X1: a turn-end ask stays answerable TURN_ASK_MAX_AGE_MS (8 h) but the store replays LEDGER_REPLAY_WINDOW_MS (6 h),
+  // so an ask asked 6 to 8 h before a restart was lost. The tracker alone reads back to its own age-out: rows older
+  // than the store's window go to the tracker only, never into the store, so every other signal replays as before.
+  const trackerSince = tracker ? since - turnAskReplayExtraMs() : since
+  let trackerOnly = 0
+  const replay = ledger.replay(trackerSince, (env, _key, child, entrypoint) => {
     if (!enabled) return
+    if (env.ts < since) {
+      trackerOnly++
+      tracker?.observe(env, child, { entrypoint })
+      return
+    }
     sessionSignalStore.apply(env, child)
     if (entrypoint) sessionSignalStore.setEntrypoint(env.sessionId, entrypoint)
   })
-  replayed = { rows: replay.rows, applied: replay.applied }
+  replayed = { rows: replay.rows, applied: replay.applied - trackerOnly }
   ingester = startSpoolIngester({
     dir,
     ledger,
@@ -359,6 +374,8 @@ export interface SessionHooksHealth {
   /** The install state word; `installed` below is its boolean. */
   state: HookStatus['state']
   installed: boolean
+  /** X1, 7.0.34: the question hold for this Mac (additive). */
+  questionWait?: HookStatus['questionWait']
   scriptSha: string | null
   /**
    * 6.60.0: our PermissionRequest hook's `timeout` in the Claude settings file (630 after
@@ -418,6 +435,8 @@ export function sessionHooksHealthFields(): { sessionHooks: SessionHooksHealth }
       installed: status.installed,
       scriptSha: status.scriptSha,
       permissionHookTimeoutS: status.permissionHookTimeoutS,
+      // X1, 7.0.34: additive. `state` is untouched; Control 0.5.394 and Control Web read this to offer the long wait.
+      ...(status.questionWait ? { questionWait: status.questionWait } : {}),
       priorWaitOnly: status.priorWaitOnly,
       tokenPresent: status.tokenPresent,
       lastEventAt: newest ? new Date(newest).toISOString() : null,
@@ -515,6 +534,12 @@ export function turnEndAskStats(): (TurnEndAskCounters & { tracked: number }) |
   return turnEndAskTracker ? turnEndAskTracker.stats() : null
 }
 
+/** X1 (the one queue): the turn-end asks a row shows now, and those answered in the last two minutes. Empty when off. */
+export function turnEndAsksForQueue(): { asks: QueueTurnAsk[]; answered: AnsweredTurnAsk[] } {
+  if (!turnEndAskTracker) return { asks: [], answered: [] }
+  return { asks: turnEndAskTracker.visibleAsks(), answered: turnEndAskTracker.recentlyAnswered() }
+}
+
 /** Tests only: the tracker the runtime would build, installed directly. */
 export function __setTurnEndAskTrackerForTests(tracker: TurnEndAskTracker | null): void {
   turnEndAskTracker?.stop()

package/server/lib/session-title-cache.ts

@@ -0,0 +1,40 @@
+// X1 (the one queue, 7.0.32 candidate): the last title COS showed for each session, so the questions route can name
+// the asking session without reading a transcript on a 3 s poll. Filled by the session list route from the rows it
+// already built; read by `lib/question-queue.ts`. Memory only, bounded; a session not listed yet reads null and a
+// client falls back to its own list. The titles are the list's own (the same authenticated clients already get them).
+
+/** At most this many sessions are remembered; past it the oldest noted go first. */
+export const SESSION_TITLE_CACHE_MAX = 400
+const TITLE_MAX = 120
+
+const titles = new Map<string, string>()
+
+/** Remember a session's title (lower-cased id). Blank titles are ignored. */
+export function noteSessionTitle(sessionId: unknown, title: unknown): void {
+  if (typeof sessionId !== 'string' || !sessionId || typeof title !== 'string') return
+  const text = title.replace(/\s+/g, ' ').trim()
+  if (!text) return
+  const key = sessionId.toLowerCase()
+  titles.delete(key)
+  titles.set(key, text.length > TITLE_MAX ? text.slice(0, TITLE_MAX - 1) + '…' : text)
+  while (titles.size > SESSION_TITLE_CACHE_MAX) {
+    const oldest = titles.keys().next().value
+    if (oldest === undefined) break
+    titles.delete(oldest)
+  }
+}
+
+/** The last title COS listed for this session, or null. Takes a full id or the registry's eight-character form. */
+export function sessionTitleFor(sessionId: string): string | null {
+  const key = sessionId.toLowerCase()
+  const exact = titles.get(key)
+  if (exact !== undefined) return exact
+  if (key.length >= 8 && key.length < 36) {
+    for (const [id, title] of titles) if (id.startsWith(key)) return title
+  }
+  return null
+}
+
+export function __resetSessionTitlesForTests(): void {
+  titles.clear()
+}

package/server/lib/turn-end-ask.ts

@@ -107,6 +107,28 @@ export function projectedTurnAsk(value: unknown): TurnAskCapture | null {
 /** What a row shows (`deriveSessionState` input). */
 export interface VisibleTurnAsk { ask: string; choices: string[]; stoppedAt: number }
 
+/** X1 (the one queue): a turn-end ask the queue lists, with its session. */
+export interface QueueTurnAsk extends VisibleTurnAsk { sessionId: string }
+
+/** X1: a turn-end ask answered in the last TURN_ASK_ANSWERED_KEEP_MS, and from where (never the reply's words). */
+export interface AnsweredTurnAsk { sessionId: string; ask: string; stoppedAt: number; answeredAt: number; by: TurnAskAnswerSurface }
+export type TurnAskAnswerSurface = 'mac' | 'web' | 'glasses' | 'mac_app' | 'cos'
+export const TURN_ASK_ANSWERED_KEEP_MS = 120_000
+
+/**
+ * X1: where a reply that cleared a turn-end ask came from, read from the words COS itself puts on it (contract
+ * v1.2: "Answer sent from <SURFACE> through COS, not typed in this session"; a dictated reply carries the
+ * `[COS-G2 turn` footer). A COS-spawned Continue child is COS. Anything else was typed at the Mac. Only the
+ * surface is kept.
+ */
+export function turnAskAnswerSurface(prompt: unknown, child: boolean): TurnAskAnswerSurface {
+  const text = typeof prompt === 'string' ? prompt.slice(0, 2_000) : ''
+  if (text.includes('Answer sent from COS Control Web through COS')) return 'web'
+  if (text.includes('Answer sent from COS Control on the Mac through COS')) return 'mac_app'
+  if (text.includes('[COS-G2 turn')) return 'glasses'
+  return child ? 'cos' : 'mac'
+}
+
 interface AskState {
   sessionId: string
   promptId: string | null
@@ -140,6 +162,8 @@ export class TurnEndAskTracker {
   private readonly asks = new Map<string, AskState>()
   /** The newest Stop per session, for a wrap_up whose (async) PostToolUse lands after it. */
   private readonly lastStop = new Map<string, { at: number; promptId: string | null }>()
+  /** X1: asks answered in the last TURN_ASK_ANSWERED_KEEP_MS that a surface had shown, newest last. */
+  private readonly answered: AnsweredTurnAsk[] = []
   private poll: ReturnType<typeof setTimeout> | null = null
   private pollInFlight = false
   private stopped = false
@@ -162,7 +186,14 @@ export class TurnEndAskTracker {
     const current = this.asks.get(sessionId)
     // Any prompt, from the desk or a COS-spawned Continue child, is a reply: the question is answered.
     if (env.event === 'UserPromptSubmit') {
-      if (current) { this.asks.delete(sessionId); this.counters.clearedByReply++ }
+      if (current) {
+        this.asks.delete(sessionId)
+        this.counters.clearedByReply++
+        if (current.stoppedAt !== null && current.visibleAt !== null) {
+          this.answered.push({ sessionId, ask: current.capture.ask, stoppedAt: current.stoppedAt, answeredAt: env.ts, by: turnAskAnswerSurface(p.prompt, child) })
+          if (this.answered.length > MAX_TURN_ASKS) this.answered.splice(0, this.answered.length - MAX_TURN_ASKS)
+        }
+      }
       return
     }
     // A COS-spawned child's other events are not the session's own turn.
@@ -234,6 +265,25 @@ export class TurnEndAskTracker {
     return { ask: state.capture.ask, choices: [...state.capture.choices], stoppedAt: state.stoppedAt }
   }
 
+  /** X1 (the one queue): every ask a row would show now, oldest stop first. */
+  visibleAsks(now = this.deps.now()): QueueTurnAsk[] {
+    if (!this.deps.enabled()) return []
+    const out: QueueTurnAsk[] = []
+    for (const state of [...this.asks.values()]) {
+      const shown = this.visibleAsk(state.sessionId, now)
+      if (shown) out.push({ sessionId: state.sessionId, ...shown })
+    }
+    return out.sort((a, b) => a.stoppedAt - b.stoppedAt)
+  }
+
+  /** X1: asks answered within TURN_ASK_ANSWERED_KEEP_MS (by when the reply arrived), oldest first. */
+  recentlyAnswered(now = this.deps.now()): AnsweredTurnAsk[] {
+    if (!this.deps.enabled()) return []
+    // Kept in the order replies arrived, so dropping from the front drops exactly the ones past the window.
+    while (this.answered.length > 0 && now - this.answered[0]!.answeredAt > TURN_ASK_ANSWERED_KEEP_MS) this.answered.shift()
+    return this.answered.map(a => ({ ...a }))
+  }
+
   /** The session's row ended: nothing it asked can still be answered. */
   sessionRowEnded(sessionId: string): void {
     const key = sessionId.toLowerCase()

package/server/lib/web-session-auth.ts

@@ -444,6 +444,8 @@ export function classifyWebLogin(
   }
   if (codeStore && typeof input.code === 'string' && input.code.trim().length > 0) {
     if (codeStore.consume(input.code)) return { ok: true, kind: 'code' }
+    // The glasses' 14-character code: by shape only, never looked up (see looksLikeGlassesPairingCode).
+    if (looksLikeGlassesPairingCode(input.code)) return { ok: false, reason: 'glasses_code', length: GLASSES_PAIRING_CODE_TYPED_LENGTH }
     const code = normalizeDeviceCode(input.code)
     let glasses = false
     if (code && isGlassesCode) {
@@ -506,6 +508,21 @@ export function normalizeDeviceCode(input: unknown): string | null {
   return clean
 }
 
+/**
+ * 7.0.32 (O1 00:13, fix 4 of round 2): the code the glasses pair with is 14 characters of the same alphabet. Typed into
+ * the browser's sign-in box, it is recognised by its SHAPE only (the same cleaning as normalizeDeviceCode, then exactly
+ * 14 characters of the alphabet), never looked up, so a 14-character guess learns nothing about the live glasses code.
+ * No browser sign-in code has 14 characters, so nothing valid changes meaning. The 8-character lookup stays as it is.
+ */
+export const GLASSES_PAIRING_CODE_TYPED_LENGTH = 14
+export function looksLikeGlassesPairingCode(input: unknown): boolean {
+  if (typeof input !== 'string') return false
+  const clean = input.toUpperCase().replace(/[\s-]/g, '').replace(/O/g, '0').replace(/[IL]/g, '1')
+  if (clean.length !== GLASSES_PAIRING_CODE_TYPED_LENGTH) return false
+  for (const ch of clean) if (!DEVICE_CODE_ALPHABET.includes(ch)) return false
+  return true
+}
+
 /**
  * Short sign-in codes for another device (the phone), minted by a browser or app that is
  * already signed in. Same shape as glasses pairing: 8 Crockford characters (40 bits), five

package/server/routes/agent-sessions.ts

@@ -94,6 +94,7 @@ import { createSessionPreviewRouter } from './session-preview.js'
 import { organizerKey, sessionOrganizer, type OrganizerRowFields } from '../lib/session-organizer.js'
 import { listOlderSessions, shortRowFor, OLDER_DEFAULT_DAYS, OLDER_DEFAULT_LIMIT, OLDER_MAX_DAYS, OLDER_MAX_LIMIT, OLDER_MIN_DAYS } from '../lib/agent-session-older.js'
 import { cachedListModel, warmListModels } from '../lib/list-model-memo.js'
+import { noteSessionTitle } from '../lib/session-title-cache.js'
 import { cosStartedSessionIds } from '../lib/cos-started-sessions.js'
 
 /** Step 2a: the organizer, or null when it is unavailable or empty (the list is then exactly today's). */
@@ -649,6 +650,8 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
     }))
     // Step 2a: read the models this answer lacked, in the background, for a later poll. Never awaited.
     warmListModels(sessions)
+    // X1 (the one queue): the titles this list showed, so the questions route can name a waiting session.
+    for (const entry of sessions) noteSessionTitle(entry.session_id, entry.display_label)
   } catch (error) {
     console.error(`[agent-sessions] list failed: ${error instanceof Error ? error.message : error}`)
     res.status(500).json({ error: 'Failed to read agent sessions', reason: 'agent_sessions_read_failed' })