@gotcos/glasses-server 7.0.7 → 7.0.18

package/server/routes/web-control.ts

@@ -24,6 +24,10 @@ import {
   type WebLoginFailure,
   WebGlassesCodeProbeBudget,
   WEB_SESSION_TTL_MS,
+  WEB_SESSION_COOKIE_NAME,
+  WEB_SESSION_MAX_LIFE_MS,
+  readWebSessionCookie,
+  webSessionCookieFrom,
   WebHandoffStore,
   WebLoginLimiter,
   WebDeviceCodeStore,
@@ -199,6 +203,18 @@ export function webControlCsp(_requestPath: string): string {
   ].join('; ')
 }
 
+/**
+ * The expiry (ISO) of the cos_web_session cookie on a request, read from the SAME value the verifier reads (Q1 S1:
+ * `parseCookies` keeps the last of several; another app on this host name can plant an earlier one). Read only after
+ * verification. Shapes: `<exp>.<epoch>.<sig>`, or a renewed `<exp>.<epoch>.<orig>.<sig>`.
+ */
+export function webSessionCookieExpiry(cookieHeader: unknown): string | null {
+  const value = webSessionCookieFrom(cookieHeader)
+  const exp = typeof value === 'string' ? /^(\d{1,15})\./.exec(value) : null
+  const ms = exp ? Number(exp[1]) * 1000 : NaN
+  return Number.isSafeInteger(ms) && ms > 0 ? new Date(ms).toISOString() : null
+}
+
 export function createWebControlRouter(deps: WebControlRouterDeps): Router {
   const router = Router()
   const handoffStore = deps.handoffStore ?? new WebHandoffStore()
@@ -287,11 +303,20 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
         ? { authenticated: false, mode: 'none' }
         : { authenticated: false, mode: 'none', network: 'tailscale_only' })
     }
+    // W1 (audit 02 F2): a signed-in browser learns when ITS OWN cookie ends, so the page can say so before it does.
+    // Only after the cookie verified (its signature covers the expiry), only for cookie mode, and nothing a caller without
+    // that cookie can read. The 7-day lifetime itself is unchanged.
+    const expiresAt = cookieOk && !headerOk ? webSessionCookieExpiry(req.headers.cookie) : null
+    // Renewal (Miles 2026-11-09): the latest this sign-in can last while in use, 30 days from its first sign-in.
+    const read = cookieOk && !headerOk ? readWebSessionCookie(webSessionCookieFrom(req.headers.cookie), token) : null
+    const renewUntil = read ? new Date((read.origUnixSec + Math.floor(WEB_SESSION_MAX_LIFE_MS / 1000)) * 1000).toISOString() : null
     res.json({
       authenticated: true,
       mode: headerOk ? 'header' : 'cookie',
       serverName: hostname().replace(/\.local$/i, ''),
       ownerName: getOwnerName(),
+      ...(expiresAt ? { expiresAt } : {}),
+      ...(renewUntil ? { renewUntil } : {}),
     })
   })
 
@@ -322,10 +347,13 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
     const token = deps.apiToken()
     const result = classifyWebLogin(body, token, handoffStore, deviceCodes, glassesCheck)
     if (!result.ok) {
-      // Every failure counts, the glasses-code one included, so that check cannot be used to
-      // probe codes faster than the limiter allows.
-      loginLimiter.fail(ip, result.reason)
-      log(`[web-login] fail kind=${result.reason} len=${result.length} ip=${ip}`)
+      // Every failure counts toward the per-IP limit, the glasses-code one included, so that check cannot be used to
+      // probe codes faster than the limiter allows. Except a failed sign-in LINK (Miles 2026-11-09 20:00, "Yes, stop
+      // counting stale links"): a ticket is 192 random bits, so guessing one is not a risk, and a person reopening an old
+      // QR or link should not lock themselves out of typing a code. It still fails with the same message.
+      if (result.reason !== 'handoff_expired') loginLimiter.fail(ip, result.reason)
+      // S1 item 7: why a handoff link failed (expired, used, evicted, unknown). The log only; the message is unchanged.
+      log(`[web-login] fail kind=${result.reason}${result.handoff ? ` sub=${result.handoff}` : ''} len=${result.length} ip=${ip}`)
       return res.status(401).json({
         ok: false,
         error: 'invalid_credentials',
@@ -340,6 +368,8 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
     return res.json({
       ok: true,
       expiresAt: new Date(minted.expiresAtMs).toISOString(),
+      // Renewal (Miles 2026-11-09): while in use this sign-in renews up to 30 days from now (lib/web-session-auth.ts).
+      renewUntil: new Date((Math.floor(minted.expiresAtMs / 1000) - Math.floor(WEB_SESSION_TTL_MS / 1000) + Math.floor(WEB_SESSION_MAX_LIFE_MS / 1000)) * 1000).toISOString(),
       serverName: hostname().replace(/\.local$/i, ''),
       ownerName: getOwnerName(),
     })
@@ -357,6 +387,9 @@ export function createWebControlRouter(deps: WebControlRouterDeps): Router {
   router.post('/web-session/revoke-all', (req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')
     const epoch = bumpWebSessionEpoch()
+    // Final review V7: a sign-in link or code made before the sign-out no longer signs a browser in after it.
+    handoffStore.revokeAll()
+    deviceCodes.revokeAll()
     res.setHeader('Set-Cookie', formatClearWebSessionCookie(req.secure))
     res.json({ ok: true, epoch })
   })

package/server/routes/web-key.ts

@@ -0,0 +1,284 @@
+// /api/web-key/*: the enrolled phone key registry and enrollment ceremony (6.99.31, plan §4.3,
+// §4.7). Behind COS_WEB_KEY_AUTHORITY (default off). Off, none of these is a route (each falls
+// through to next(), exactly as on 6.99.29).
+//
+// WHO MAY CALL WHAT:
+//   - The phone's steps (enroll start, prove, status, nonce) need the WEB path: the signed cookie,
+//     no X-Cos-Token header, and a socket that is not this Mac (the same judgment as a web turn).
+//     A token-bearing, loopback or own-address request is refused: an agent on this Mac cannot
+//     start an enrollment for a key it made.
+//   - COS Control's steps (pending, approve) need X-Cos-Token, and approve ALSO needs the anchor's
+//     Secure Enclave signature over the frozen approval (Touch ID). The token alone approves nothing.
+//   - Revoke, revoke-all and the key list take either the token or the web path. Revocation never
+//     needs the anchor, so a lost phone can always be revoked (by a token holder too: denial of
+//     service only, logged in web-key-audit.jsonl).
+//   - Anchor registration (review B1) is COS Control's bootstrap: loopback socket only, no proxy
+//     headers, X-Cos-Token, and the anchor's own signature over its `cos-web-anchor/1` statement. A
+//     new anchor vouches nothing for 24 hours; the turn answer exposes its fingerprint and age so
+//     the verifier compares it with Miles's committed pin.
+//   - Approval packets name their creating session from the request context (`x-cos-provider`,
+//     `x-cos-session-id`), never from body text (review B4).
+//   - Phase 3: the phone's key steps (enroll start and prove, nonce) answer only on the 3144 signer
+//     listener when `isSignerRequest` is wired (index.ts), so a page on 3143 cannot make a key.
+//   - Phase 3 handoff: the composer creates one on the web path (the destination comes from the
+//     binding, never the body); only the signer page claims it, once, on 3144, naming its origin.
+//   - 7.0.9 anchor bootstrap (COS_WEB_KEY_ANCHOR_BOOTSTRAP on, COS_WEB_KEY_AUTHORITY off): ONLY
+//     GET status (X-Cos-Token only, reply `enabled: false, mode: 'bootstrap'`) and POST anchor (as
+//     above) answer. Every other route falls through exactly as with both switches off.
+
+import { Router, type Request, type Response, type NextFunction } from 'express'
+import { timingSafeTokenEqual } from '../lib/token-auth.js'
+import { hasProxyForwardedHeaders, isLoopbackAddress, normalizeRemoteIp } from '../lib/network-policy.js'
+import { WEB_KEY_ENABLED_APPROVE_ACTIONS, type WebKeyAuthority } from '../lib/web-key-authority.js'
+import { WEB_ANCHOR_MATURITY_MS, type WebKeyEnrollments } from '../lib/web-key-registry.js'
+import { parseHandoffRequest, type WebKeySignHandoffs } from '../lib/web-key-handoff.js'
+import type { WebApprovalPacket, WebTurnScope } from '../../shared/web-turn-envelope.js'
+
+export const ANCHOR_REGISTRATION_LOOPBACK_COPY = 'The COS Control anchor key can only be registered by COS Control on this Mac.'
+
+export interface WebKeyRouterDeps {
+  authority: WebKeyAuthority
+  enrollments: WebKeyEnrollments
+  /** The web path in full: cookie, no token, a socket that is not this Mac (G2TurnProvenance.originOf). */
+  isWebRequest: (req: Request) => boolean
+  apiToken: () => string
+  selfDnsName: () => string | null
+  expectedOrigin: () => string | null
+  /** Served-asset integrity (Phase 6) for Control's audit; absent: not reported. */
+  integrityStatus?: () => Record<string, unknown>
+  /**
+   * Phase 3: whether this request reached the 3144 signer listener (index.ts: the socket's local
+   * port). Given, the phone's key steps (enroll start and prove, nonce) and the handoff claim answer
+   * only there, so a page on 3143 can neither make a key nor fetch a handoff. Absent (tests that
+   * predate the signer): not checked, exactly as before.
+   */
+  isSignerRequest?: (req: Request) => boolean
+  /** Phase 3: the 3143 to 3144 handoff store. Absent: the handoff routes answer 404 `handoff_unavailable`. */
+  handoffs?: WebKeySignHandoffs
+  /** Phase 3: the binding's real destination, as the turn route will resolve it. Null: no such binding. */
+  resolveBinding?: (bindingId: string) => { provider: string; sessionId: string; epoch: number; targetKey: string } | null
+}
+
+export const SIGNER_ORIGIN_REQUIRED = 'signer_origin_required'
+
+export function createWebKeyRouter(deps: WebKeyRouterDeps): Router {
+  const router = Router()
+
+  const on = (req: Request, res: Response, next: NextFunction): void => {
+    if (!deps.authority.enabled()) { next('router'); return }
+    res.set('Cache-Control', 'private, no-store')
+    next()
+  }
+  const hasToken = (req: Request): boolean => {
+    let expected = ''
+    try { expected = deps.apiToken() } catch { expected = '' }
+    return expected.length > 0 && timingSafeTokenEqual(req.headers['x-cos-token'], expected)
+  }
+  const web = (req: Request): boolean => {
+    try { return deps.isWebRequest(req) === true } catch { return false }
+  }
+  const refuse = (res: Response, status: number, error: string, extra: Record<string, unknown> = {}): void => {
+    res.status(status).json({ ok: false, error, ...extra })
+  }
+  const by = (req: Request): string => (hasToken(req) ? 'token' : 'web')
+  const body = (req: Request): Record<string, unknown> => (req.body && typeof req.body === 'object' ? req.body as Record<string, unknown> : {})
+  /** On the 3144 listener, when the deployment can tell (Phase 3). Never throws. */
+  const onSigner = (req: Request): boolean => {
+    if (!deps.isSignerRequest) return true
+    try { return deps.isSignerRequest(req) === true } catch { return false }
+  }
+
+  // 7.0.9: status and anchor registration answer in either mode; with both switches off they fall
+  // through like every other route. They sit BEFORE `on`, which still gates everything else on the
+  // authority alone.
+  const anchorRoutes = (req: Request, res: Response, next: NextFunction): void => {
+    if (deps.authority.mode() === 'off') { next('router'); return }
+    res.set('Cache-Control', 'private, no-store')
+    next()
+  }
+
+  router.get('/web-key/status', anchorRoutes, (req, res) => {
+    const registry = deps.authority.registry
+    const selfDns = deps.selfDnsName()
+    if (deps.authority.mode() !== 'authority') {
+      // Bootstrap only: COS Control's anchor state, nothing that suggests approvals. Token only:
+      // no web page needs it while no phone can enroll. `enabled: false` keeps older Controls hidden.
+      if (!hasToken(req)) return refuse(res, 401, 'unauthorized')
+      const anchor = registry.anchor()
+      return void res.json({
+        ok: true,
+        enabled: false,
+        mode: 'bootstrap',
+        anchorRegistered: anchor !== null,
+        anchorMature: registry.anchorMature(),
+        anchorSetAt: anchor ? anchor.setAt : null,
+        aud: registry.aud(selfDns),
+        origin: deps.expectedOrigin(),
+        epoch: registry.epoch(),
+      })
+    }
+    if (!hasToken(req) && !web(req)) return refuse(res, 401, 'unauthorized')
+    res.json({
+      ok: true,
+      enabled: true,
+      anchorRegistered: registry.anchor() !== null,
+      anchorRefusal: registry.anchorRefusal(),
+      anchorMature: registry.anchorMature(),
+      registryReadable: !registry.unreadable,
+      nonceStoreReadable: !deps.authority.nonces.unavailable,
+      aud: registry.aud(selfDns),
+      origin: deps.expectedOrigin(),
+      epoch: registry.epoch(),
+      activeKeys: registry.activeCount(selfDns),
+      ...(deps.integrityStatus ? { integrity: deps.integrityStatus() } : {}),
+    })
+  })
+
+  router.post('/web-key/anchor', anchorRoutes, (req, res) => {
+    // Loopback socket, no forwarding headers (a local proxy makes every caller loopback), and the token.
+    const addr = normalizeRemoteIp(req.socket?.remoteAddress ?? '')
+    if (!addr || !isLoopbackAddress(addr) || hasProxyForwardedHeaders(req.headers)) return refuse(res, 403, 'loopback_required', { reasonCopy: ANCHOR_REGISTRATION_LOOPBACK_COPY })
+    if (!hasToken(req)) return refuse(res, 401, 'token_required')
+    const b = body(req)
+    const result = deps.authority.registry.registerAnchor({ anchorPub: b.anchorPub, statement: b.statement, signature: b.signature }, 'control')
+    if (!result.ok) return refuse(res, result.reason === 'registry_write_failed' || result.reason === 'registry_unreadable' ? 503 : result.reason === 'anchor_signature_invalid' ? 403 : 400, result.reason)
+    res.status(201).json({ ...result, maturesAt: result.setAt + WEB_ANCHOR_MATURITY_MS })
+  })
+
+  // Everything below: the authority only (bootstrap mode falls through here, as with both off).
+  router.use('/web-key', on)
+
+  router.post('/web-key/enroll/start', (req, res) => {
+    if (!web(req)) return refuse(res, 403, 'web_origin_required')
+    if (!onSigner(req)) return refuse(res, 403, SIGNER_ORIGIN_REQUIRED)
+    const b = body(req)
+    const result = deps.enrollments.start({
+      spki: b.spki,
+      label: b.label,
+      rotates: b.rotates,
+      sasCommit: b.sasCommit,
+      userAgent: typeof req.headers['user-agent'] === 'string' ? req.headers['user-agent'] : '',
+      remote: req.socket?.remoteAddress ?? 'unknown',
+    }, { selfDnsName: deps.selfDnsName(), origin: deps.expectedOrigin() })
+    if (!result.ok) return refuse(res, result.reason === 'device_not_allowed' ? 403 : result.reason === 'enrollment_pending' || result.reason === 'key_cap_reached' || result.reason === 'key_already_enrolled' ? 409 : 400, result.reason)
+    res.status(201).json(result)
+  })
+
+  router.post('/web-key/enroll/prove', (req, res) => {
+    if (!web(req)) return refuse(res, 403, 'web_origin_required')
+    if (!onSigner(req)) return refuse(res, 403, SIGNER_ORIGIN_REQUIRED)
+    const b = body(req)
+    const result = deps.enrollments.prove({ enrollId: b.enrollId, signature: b.signature, phoneNonce: b.phoneNonce, passkey: b.passkey })
+    if (!result.ok) return refuse(res, result.reason === 'enroll_unknown' ? 404 : 400, result.reason)
+    res.json(result)
+  })
+
+  router.get('/web-key/enroll/status', (req, res) => {
+    if (!web(req) && !hasToken(req)) return refuse(res, 401, 'unauthorized')
+    res.json({ ok: true, status: deps.enrollments.status(req.query.enrollId) })
+  })
+
+  router.get('/web-key/enroll/pending', (req, res) => {
+    if (!hasToken(req)) return refuse(res, 401, 'token_required')
+    res.json({ ok: true, pending: deps.enrollments.pendingView() })
+  })
+
+  router.post('/web-key/enroll/approve', (req, res) => {
+    if (!hasToken(req)) return refuse(res, 401, 'token_required')
+    const b = body(req)
+    const result = deps.enrollments.approve(b.enrollId, b.anchorSig, deps.selfDnsName())
+    if (!result.ok) return refuse(res, result.reason === 'enroll_unknown' ? 404 : result.reason === 'anchor_signature_invalid' ? 403 : 409, result.reason)
+    res.json(result)
+  })
+
+  router.get('/web-key/keys', (req, res) => {
+    if (!hasToken(req) && !web(req)) return refuse(res, 401, 'unauthorized')
+    res.json({ ok: true, epoch: deps.authority.registry.epoch(), keys: deps.authority.registry.list(deps.selfDnsName()) })
+  })
+
+  router.post('/web-key/revoke', (req, res) => {
+    if (!hasToken(req) && !web(req)) return refuse(res, 401, 'unauthorized')
+    const b = body(req)
+    if (typeof b.kid !== 'string') return refuse(res, 400, 'invalid_request')
+    const reason = typeof b.reason === 'string' && b.reason.trim() ? b.reason.trim() : 'revoked'
+    if (!deps.authority.registry.revoke(b.kid, reason, by(req))) return refuse(res, 404, 'key_unknown')
+    res.json({ ok: true, kid: b.kid, revoked: true })
+  })
+
+  router.post('/web-key/revoke-all', (req, res) => {
+    if (!hasToken(req) && !web(req)) return refuse(res, 401, 'unauthorized')
+    res.json({ ok: true, epoch: deps.authority.registry.revokeAll(by(req)) })
+  })
+
+  router.post('/web-key/nonce', (req, res) => {
+    if (!web(req)) return refuse(res, 403, 'web_origin_required')
+    if (!onSigner(req)) return refuse(res, 403, SIGNER_ORIGIN_REQUIRED)
+    const issued = deps.authority.nonces.issue()
+    if (!issued.ok) return refuse(res, 503, issued.reason)
+    res.status(201).json({ ok: true, nonce: issued.nonce, exp: issued.exp, aud: deps.authority.registry.aud(deps.selfDnsName()), epoch: deps.authority.registry.epoch() })
+  })
+
+  router.post('/web-key/packets', (req, res) => {
+    // A packet is only a request (a receiving session asks Miles to approve one exact action).
+    if (!hasToken(req)) return refuse(res, 401, 'token_required')
+    // The creating session comes from the request context, never the body (review B4).
+    const header = (name: string): string | null => { const v = req.headers[name]; return typeof v === 'string' && v.trim() ? v.trim() : null }
+    const created = deps.authority.packets.create(body(req), { provider: header('x-cos-provider'), sessionId: header('x-cos-session-id') })
+    if (!created.ok) return refuse(res, created.reason === 'packet_cap_reached' ? 409 : created.reason === 'creator_unknown' ? 401 : 400, created.reason)
+    res.status(201).json({ ok: true, packet: created.packet, packetSha256: created.packetSha256 })
+  })
+
+  router.get('/web-key/packets', (req, res) => {
+    if (!hasToken(req) && !web(req)) return refuse(res, 401, 'unauthorized')
+    const provider = req.query.provider, sessionId = req.query.sessionId
+    if ((provider !== undefined || sessionId !== undefined) && (typeof provider !== 'string' || !['claude', 'codex', 'cursor'].includes(provider) || typeof sessionId !== 'string' || !sessionId || sessionId.length > 128)) return refuse(res, 400, 'invalid_target')
+    const packets = deps.authority.packets.list().filter(row => WEB_KEY_ENABLED_APPROVE_ACTIONS.has(row.packet.action)
+      && (provider === undefined || (row.packet.provider === provider && row.packet.sessionId === sessionId)))
+    res.json({ ok: true, packets })
+  })
+
+  // ── Phase 3: the handoff from the Control Web composer (3143) to the signer page (3144) ──
+  // Create: the composer, on the web path. The destination is the binding's, never the body's.
+  router.post('/web-key/handoff', (req, res) => {
+    if (!web(req)) return refuse(res, 403, 'web_origin_required')
+    if (!deps.handoffs || !deps.resolveBinding) return refuse(res, 404, 'handoff_unavailable')
+    const signerOrigin = deps.expectedOrigin()
+    if (!signerOrigin) return refuse(res, 503, 'origin_unavailable')
+    if (deps.authority.registry.activeCount(deps.selfDnsName()) < 1) return refuse(res, 409, 'no_phone_key')
+    const parsed = parseHandoffRequest(req.body)
+    if (!parsed.ok) return refuse(res, 400, parsed.reason)
+    const { request } = parsed
+    let target: ReturnType<NonNullable<WebKeyRouterDeps['resolveBinding']>> = null
+    try { target = deps.resolveBinding(request.turn.bindingId) } catch { target = null }
+    if (!target) return refuse(res, 404, 'unknown_binding')
+    if (target.epoch !== request.turn.epoch || target.targetKey !== request.turn.targetKey) return refuse(res, 409, 'binding_changed')
+    let scope: WebTurnScope = { kind: 'message' }
+    let approvalPacket: WebApprovalPacket | null = null
+    if (request.packetSha256) {
+      const packet = deps.authority.packets.get(request.packetSha256)
+      if (!packet) return refuse(res, 404, 'packet_unknown')
+      if (!WEB_KEY_ENABLED_APPROVE_ACTIONS.has(packet.action)) return refuse(res, 400, 'approve_action_not_enabled')
+      // A packet is signable only for the session that asked for it (review B4).
+      if (packet.provider !== target.provider || packet.sessionId !== target.sessionId) return refuse(res, 409, 'packet_session_mismatch')
+      scope = { kind: 'approve', action: packet.action, artifact: packet.artifact, version: packet.version, digest: packet.digest, channel: packet.channel, packetSha256: request.packetSha256 }
+      approvalPacket = packet
+    }
+    const created = deps.handoffs.create(request, { provider: target.provider, sessionId: target.sessionId }, scope, approvalPacket)
+    if (!created.ok) return refuse(res, created.reason === 'handoff_cap_reached' ? 409 : 400, created.reason)
+    // The id rides in the fragment: never sent to a server, never in a Referer. The words are not in it.
+    res.status(201).json({ ok: true, handoffId: created.handoffId, exp: created.exp, signerUrl: `${signerOrigin}/#h=${created.handoffId}` })
+  })
+
+  // Claim: the signer page, once, on its own listener and naming its own origin.
+  router.post('/web-key/handoff/claim', (req, res) => {
+    if (!web(req)) return refuse(res, 403, 'web_origin_required')
+    if (!deps.handoffs) return refuse(res, 404, 'handoff_unavailable')
+    const signerOrigin = deps.expectedOrigin()
+    if (!deps.isSignerRequest || !onSigner(req) || !signerOrigin || req.headers.origin !== signerOrigin) return refuse(res, 403, SIGNER_ORIGIN_REQUIRED)
+    const claimed = deps.handoffs.claim(body(req).handoffId)
+    if (!claimed.ok) return refuse(res, claimed.reason === 'handoff_unknown' ? 404 : claimed.reason === 'handoff_expired' ? 410 : 409, claimed.reason)
+    res.json({ ok: true, handoff: claimed.handoff })
+  })
+
+  return router
+}

package/server/routes/welcome-context.ts

@@ -5,6 +5,7 @@
 import { Router } from 'express'
 import { callPython, pythonBridgeAvailable } from '../lib/python-bridge.js'
 import { calendarToday, readCalendar } from '../lib/calendar-source.js'
+import { isCalendarHold } from '../lib/calendar-meetings.js'
 import { parsePrepOccurrence } from '../lib/prep-store.js'
 import type { PrepOccurrence } from '../../shared/prep.js'
 
@@ -22,7 +23,8 @@ type WeatherPayload = { temp: string; desc: string; location: string }
  * provider, calendar id, event id or external id, and start. The bridge sends no event ids today, so it is absent.
  * It lets a client find a Prep draft for this exact event; it never binds one, and nothing is inferred from the title.
  */
-type NextEventPayload = { title: string; time: string; inMinutes?: number; occurrence?: PrepOccurrence }
+// `hold` (11/09): present, true, only when the title is a hold or status block (calendar-meetings.ts isCalendarHold).
+type NextEventPayload = { title: string; time: string; inMinutes?: number; occurrence?: PrepOccurrence; hold?: true }
 
 /** The bridge event's provider identity, or undefined. snake_case (calendar_context.py) or camelCase is accepted. */
 export function bridgeOccurrence(evt: Record<string, unknown> | null | undefined): PrepOccurrence | undefined {
@@ -364,6 +366,7 @@ export async function fetchNextEvent(): Promise<{ event: NextEventPayload | null
         time: meaningful.start_time || meaningful.start || '',
         ...(minsUntil != null ? { inMinutes: minsUntil } : {}),
         ...(occurrence ? { occurrence } : {}),
+        ...(isCalendarHold(meaningful.title) ? { hold: true as const } : {}),
       }
     } else if (cal?.next_event && !isGenericNoiseEvent(cal.next_event.title || '')) {
       const occurrence = bridgeOccurrence(cal.next_event as Record<string, unknown>)
@@ -372,6 +375,7 @@ export async function fetchNextEvent(): Promise<{ event: NextEventPayload | null
         time: cal.next_event.start_time || '',
         ...(cal.minutes_until_next != null ? { inMinutes: cal.minutes_until_next } : {}),
         ...(occurrence ? { occurrence } : {}),
+        ...(isCalendarHold(cal.next_event.title) ? { hold: true as const } : {}),
       }
     } else {
       cachedNextEvent = null
@@ -403,7 +407,7 @@ export function _resetWelcomeContextCachesForTests(): void {
 
 /**
  * PH plan P1: Today's calendar for Control Web and desktop. Behind the /api token gate. Selected calendars only, the
- * next 3 events. `connected: false` means "Calendar not connected", never an empty day.
+ * next 5 events (Today round 2, was 3), plus `endedRecently` (ended within 2 h). `connected: false` means "Calendar not connected", never an empty day.
  */
 welcomeContextRouter.get('/calendar/today', async (_req, res) => {
   try {

package/server/routes/work-orchestrator.ts

@@ -13,7 +13,7 @@
  *        10 minutes (`refresh=1`: 2 minutes). No timer reads usage unless COS_WORK_USAGE_POLL=1.
  */
 import { Router } from 'express'
-import { parseSnapshot, type ControlSnapshot } from '../lib/work-orchestrator/snapshot.js'
+import { parseSnapshotReport, type ControlSnapshot } from '../lib/work-orchestrator/snapshot.js'
 import type { OrchestratorInput } from '../lib/work-orchestrator/input.js'
 import type { UsageMonitor, UsageView } from '../lib/work-orchestrator/usage.js'
 import { orchestratorInputFor, orchestratorSnapshots, orchestratorUsage } from '../lib/work-orchestrator/runtime.js'
@@ -67,8 +67,8 @@ export function createWorkOrchestratorRouter(given: Partial<WorkOrchestratorDeps
       return res.status(400).json({ error: 'invalid_snapshot_binding' })
     }
     if (Buffer.byteLength(JSON.stringify(body)) > ORCHESTRATOR_BODY_BYTES) return res.status(413).json({ error: 'snapshot_too_large' })
-    let snapshot: ControlSnapshot
-    try { snapshot = parseSnapshot(body.snapshot, deps.now()) }
+    let snapshot: ControlSnapshot, droppedLiveRows: number
+    try { ({ snapshot, droppedLiveRows } = parseSnapshotReport(body.snapshot, deps.now())) }
     catch { return res.status(400).json({ error: 'invalid_snapshot' }) }
     const binding = () => {
       const id = deps.serverInstanceId()
@@ -90,7 +90,9 @@ export function createWorkOrchestratorRouter(given: Partial<WorkOrchestratorDeps
       // This is the same paired-client evidence cache as /input, not execution authority. parseSnapshot
       // retains only its known fields; arbitrary automatic/forkable/capability fields never enter the cache.
       deps.putSnapshot(snapshot)
-      return res.json({ protocolVersion: 1, accepted: true, workID: body.workID, revision: body.revision, serverInstanceId })
+      if (droppedLiveRows) console.warn(`[work-orchestrator] snapshot work=${body.workID} droppedLiveRows=${droppedLiveRows}`)
+      return res.json({ protocolVersion: 1, accepted: true, workID: body.workID, revision: body.revision, serverInstanceId,
+        ...(droppedLiveRows ? { droppedLiveRows } : {}) })
     } catch (error) {
       if (res.destroyed) return
       const known = error instanceof AskWorkPlanError
@@ -105,16 +107,19 @@ export function createWorkOrchestratorRouter(given: Partial<WorkOrchestratorDeps
       || !Array.isArray(meetings) || meetings.length > 20 || !meetings.every(m => typeof m === 'string' && MEETING_ID.test(m))) {
       return res.status(400).json({ error: 'invalid_orchestrator_input' })
     }
+    // 7.0.13: live rows the snapshot left out (a short or malformed session id, or text over a bound). Reported in the
+    // answer and the log line only when a snapshot came with this request and something was left out.
+    let droppedLiveRows = 0
     if ('snapshot' in body) {
       if (Buffer.byteLength(JSON.stringify(body.snapshot)) > ORCHESTRATOR_BODY_BYTES) return res.status(413).json({ error: 'snapshot_too_large' })
       let snapshot: ControlSnapshot
-      try { snapshot = parseSnapshot(body.snapshot, deps.now()) } catch (e) { return res.status(400).json({ error: 'invalid_snapshot', reason: (e as Error).message }) }
+      try { ({ snapshot, droppedLiveRows } = parseSnapshotReport(body.snapshot, deps.now())) } catch (e) { return res.status(400).json({ error: 'invalid_snapshot', reason: (e as Error).message }) }
       deps.putSnapshot(snapshot)
     }
     try {
       const input = await deps.input(body.workID, meetings as string[])
-      console.log(`[work-orchestrator] input work=${body.workID} rows=${input.rows.length} discovered=${input.discovered} leftOut=${input.leftOut.length} snapshotAge=${input.snapshotAgeSec ?? '-'}s liveAge=${input.liveListAgeSec ?? '-'}s scan=${input.logScanComplete ? 'complete' : 'partial'}`)
-      return res.json(input)
+      console.log(`[work-orchestrator] input work=${body.workID} rows=${input.rows.length} discovered=${input.discovered} leftOut=${input.leftOut.length} snapshotAge=${input.snapshotAgeSec ?? '-'}s liveAge=${input.liveListAgeSec ?? '-'}s scan=${input.logScanComplete ? 'complete' : 'partial'}${droppedLiveRows ? ` droppedLiveRows=${droppedLiveRows}` : ''}`)
+      return res.json(droppedLiveRows ? { ...input, droppedLiveRows } : input)
     } catch (e) {
       console.warn(`[work-orchestrator] input failed for ${body.workID}: ${(e as Error).message}`)
       return res.status(503).json({ error: 'orchestrator_input_unavailable' })

package/server/scripts/write-web-control-manifest.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+// 6.99.31 (Phase 6): the pack step. Writes server/web-control/.manifest.json, the sha256 of every
+// file COS Control Web ships (every regular non-dot file except *.test.ts, which never ship). With
+// COS_WEB_CONTROL_INTEGRITY on, the server serves /control only while the files match it
+// (server/lib/web-control-integrity.ts, whose computeWebControlManifest must agree with this byte
+// for byte; web-control-integrity.test.ts pins that). Run by `npm pack` / `npm publish` (prepack).
+// Writes one file, prints its path and the file count. Never reads anything outside web-control/.
+import { createHash } from 'node:crypto'
+import { readdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+export function manifestFor(dir) {
+  const files = {}
+  const walk = (d, base) => {
+    let names
+    try { names = readdirSync(d) } catch { return }
+    for (const name of names.sort()) {
+      if (name.startsWith('.')) continue
+      const file = join(d, name)
+      let st
+      try { st = statSync(file) } catch { continue }
+      const urlPath = `${base}/${name}`
+      if (st.isDirectory()) walk(file, urlPath)
+      else if (st.isFile() && !name.endsWith('.test.ts')) files[urlPath] = createHash('sha256').update(readFileSync(file)).digest('hex')
+    }
+  }
+  walk(dir, '')
+  return { v: 1, algorithm: 'sha256', files }
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]
+if (isMain) {
+  const dir = process.argv[2] ?? join(dirname(fileURLToPath(import.meta.url)), '..', 'web-control')
+  const manifest = manifestFor(dir)
+  const out = join(dir, '.manifest.json')
+  const tmp = `${out}.tmp`
+  writeFileSync(tmp, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o644 })
+  renameSync(tmp, out)
+  // stderr, never stdout: it runs as `prepack`, and `npm pack --json` callers (the release packager, package-contents and
+  // launcher-contract tests) parse stdout as JSON (7.0.9 full suite).
+  console.error(`[web-control-manifest] ${out} (${Object.keys(manifest.files).length} files)`)
+}

package/server/web-control/.manifest.json

@@ -0,0 +1,44 @@
+{
+  "v": 1,
+  "algorithm": "sha256",
+  "files": {
+    "/app.css": "0d3ebbf2ca167bc9ef6ab8efef41618f514cc4f505ae588642d36935249697af",
+    "/app.js": "3c489b154588908178de5b70b18ee8184ec9256e99f774177b9e35ceb27eb362",
+    "/apple-touch-icon.png": "04ec7eca0bf6f53d89900d146ac32d4826759d6258bcdbd1ccdcc517f26f532c",
+    "/control.css": "e7b287aa4acc1b3895a9ce61512fe449c555b6335a7145684fd78108ae008c75",
+    "/fonts/DMSans.ttf": "8cd08d97e89c24d0aa92edd2f0f4c8ee6195eee9b7c9f154865a58b02f0c1c0d",
+    "/fonts/Fraunces.ttf": "177ff6c0f14e5550a3c624247cd1189611d4eb65d000b14944c63d967958abbb",
+    "/fonts/JetBrainsMono.ttf": "48715a42ec242c21e9f02692891e147d022299a52e48d5e413e1a942193ffeda",
+    "/index.html": "26ee9cd1f68829ae5f47dcc7a0c2e45a40d28c4ee65d0537f0677b13ea727267",
+    "/mark.svg": "8e380d33d393027df192eb1afa08f15a380c2070c72d68f27311b49d9e94ca18",
+    "/memories/d3.min.js": "f2094bbf6141b359722c4fe454eb6c4b0f0e42cc10cc7af921fc158fceb86539",
+    "/memories/graph-explorer.css": "ec128de59811f45c71b6bededd737989309205e903951eb8211ade7664f87486",
+    "/memories/graph-explorer.js": "98bde3df25f42022b098d047d2c8e7a22b972c1d817a18a24a0ab075d77871d3",
+    "/memories/memory-workspace.js": "013f6c8c72c3474768f8c374edccde0e3656fc243e56528e258c3c29acca64f5",
+    "/memory-review.js": "f27fe519f7ad7eccc3b44124fae724aa51e2eb3cb060d2f1795600e0e41b074f",
+    "/panes/cos-chat.css": "29a5d22d0f02d0707e65711d151ad7c8ac0ab4bfeb30ab04b1f9d9fcf7d457b8",
+    "/panes/cos-chat.js": "0005562525cab6353ef8fc002d7960b30a8bf9fc9a9a1059c0123c6cf343366e",
+    "/panes/dictation.js": "e9434b353a1a3ab3f21d4cef5b2d5f927a733f6af5f58285fda6a78472761f91",
+    "/panes/meetings.css": "3ad4d0c5d59bd9f21c5ac9e234437cc0c81b381bd98ca4634b147efba5105a53",
+    "/panes/meetings.js": "e3839cd7d52c98510ca232e41d3a336806d740b4a1381eab1a367d56a765f925",
+    "/panes/memories.css": "36731d6fd21ad1516dfeccf34fe5b2d3d267d21e40b47704055a0685334b579e",
+    "/panes/memories.js": "28461f953ad0bf9d13287039594f2ce7ea29a46366e249240fa50f4b0f3b8c31",
+    "/panes/messages.js": "be7a7b294f67a43fcb4cc518da987d2da2990484cb677ada810afa93af25a8a5",
+    "/panes/preview.js": "79f1aecb27f48d584ed4cf37c7f4f423f0f9b45dd6c2fb24a9d88c72625d8680",
+    "/panes/questions.css": "5c5a9b32ce32386b508ce326b17d40ecacbb0f2e049df7f4fe2a0009bd3b7908",
+    "/panes/questions.js": "228e8cd0a9651a290cbb380db487af677a2fc7e93a64b1e33c9411cd8b013478",
+    "/panes/reader-media.js": "4cf892a855aa2d0dce6978e69296cd49b8036d8fc62f12773b3fcadc210b2ef0",
+    "/panes/sessions.css": "fa2e714e7b03459e12407f7125ab0e1eb7d12a4cc9341a2442dc73900f5a3081",
+    "/panes/settings.js": "5c46c951fdcc2fc942486ec4b468b7e0bb0350a0a56a38d429948fc5147ab2f4",
+    "/panes/speakers.css": "49e70dae4266151b14b0057f2e43de169de225b8f3ac30343c81cf532735a487",
+    "/panes/speakers.js": "8132c9244fb3965de802680840d2985978571988b9b4462b347d079330251bc5",
+    "/panes/threads.js": "45fd7b56480be53225e91193cfa4c41a4ee7167890f10560e439bc7d2461747f",
+    "/panes/today-actions.css": "c82f95b2aaf09802b15d47b24eccdb5c974afcab38ff5f861b3a8d8630b60869",
+    "/panes/today-actions.js": "4fbc51dc624f9e4cdc85db89905f019a8a5961e4984e8733e0525c71cf0e8657",
+    "/panes/work.css": "da50355dac690f712d1f6331f70ee5eadbf5982d37508648ae7786afc99ac7b1",
+    "/panes/work.js": "0425f53fba98ca34496486d914c3b03f95de3c2a651dc0c88a2a20bc4f6407cd",
+    "/shell.js": "f1cc6a52c78e01ddba89ff27c6bd0e8f8bd8f29bdfcbb5150ee4ed66a8128d9d",
+    "/theme.js": "700453683539c9efcde014ef1eb088c39478dad54f1ef53fa5e2dee9b36f0a3f",
+    "/vendor/qrcode-encoder.js": "61d87cc7445cc66b862cff913de4571634746ea62bcd50d0f592be14f6d1ce46"
+  }
+}

package/server/web-control/app.css

@@ -254,6 +254,8 @@ select.field {
 .story { font: 400 24px/1.28 var(--display); letter-spacing: -0.005em; margin: 26px 2px; text-wrap: pretty; }
 /* The Today summary's quiet age line (app.js briefWhen). */
 .story-when { display: block; margin-top: 10px; font: 400 14px/1.35 var(--body); letter-spacing: 0; color: var(--sub); }
+/* Today round 2: "Ask about this" under the summary, the COS chat composer (panes/cos-chat.css) laid flat in the page. */
+.today-ask.cc-composer { position: static; background: transparent; border-top: 0; padding: 0 0 14px; }
 .story-skel { display: grid; gap: 12px; margin: 30px 0; }
 .story-skel .skeleton { height: 22px; }
 
@@ -298,6 +300,7 @@ select.field {
 .next-later .later-when { color: var(--sub); font-variant-numeric: tabular-nums; white-space: nowrap; min-width: 4.5em; }
 .next-later .later-what { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .next-later .later-asof { color: var(--sub); margin-top: 4px; }
+.next-later .later-more { margin-top: 4px; padding: 3px 0; }
 
 /* ── Lists (sessions, meetings, messages) ────────────────── */
 .list { background: var(--panel); border: 1px solid var(--panel-border); border-radius: var(--radius-lg); overflow: hidden; box-shadow: var(--shadow); }
@@ -415,6 +418,11 @@ select.field {
 .menu-host { display: flex; align-items: center; gap: 8px; color: var(--sub); font-size: 14px; margin: 6px 4px 12px; }
 .sheet-head { display: flex; gap: 10px; align-items: center; }
 .sheet-head .field { flex: 1; }
+/* W1 (Miles 2026-11-09 21:24, closed Duo): the Ask field sat beside the camera, the clip and Cancel and its placeholder
+   was cut off. It needs at least 15rem; when the buttons do not fit beside that, they go to the row below, at its right. */
+#ask-form { flex-wrap: wrap; }
+#ask-form > .field { flex: 1 1 15rem; min-width: 0; }
+#ask-form > .ask-clip { margin-left: auto; }
 @keyframes fade { from { opacity: 0; } }
 @keyframes drop { from { transform: translateY(-24px); opacity: 0.5; } }
 
@@ -582,7 +590,15 @@ select.field {
 @media (any-pointer: coarse) {
   input:not([type='checkbox']):not([type='radio']):not([type='range']):not([type='color']):not([type='file']):not([type='button']):not([type='submit']):not([type='reset']):not([type='image']):not([type='hidden']),
   select, textarea { font-size: 16px !important; }
+  /* 7.0.17 (Miles 2026-11-10, Duo web app zooming): the same floor for any element that types without being a field.
+     None exists in Control Web today (work.js only names the selector); this keeps a future editor from zooming. */
+  [contenteditable]:not([contenteditable='false']) { font-size: 16px !important; }
 }
+/* 7.0.17 (Miles 2026-11-10: "a lot of zooming in and out as I'm opening and closing keyboard"; the Duo's own breadcrumb
+   showed vvs=2.12 with the keyboard down, a double-tap zoom fitting a column). manipulation keeps pan and pinch and
+   turns off double-tap zoom. On the root only: touch-action is the intersection down the tree, so the splitter's
+   none and the charts' pan-y stay exactly as strict as they were. */
+html { touch-action: manipulation; }
 /* Folded phones: every button and field is at least 44 px tall (design QA: .cx-btn came in six heights from 30 px). A
    minimum only, so it grows the compact ones and leaves the taller ones; the per-pane phone heights that fought it are
    gone. */
@@ -608,3 +624,23 @@ select.field {
 /* 6.99.30 (QA): an element with the hidden attribute is hidden, whatever display its classes give it ("Retry image"
    showed under loaded images: .link-btn's inline-flex beat [hidden]). */
 [hidden] { display: none !important; }
+
+/* W1: the Mac not answering, and the sign-in ending soon (app.js "Mac reachability and sign-in lifetime"). */
+.conn-notice { display: grid; gap: 8px; margin: 0 0 12px; }
+.conn-notice[hidden] { display: none; }
+.conn-line { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 12px; padding: 12px 14px; border-radius: var(--radius-sm); border: 1px solid var(--panel-border); background: var(--panel); color: var(--ink); font-size: 15px; line-height: 1.4; }
+.conn-line strong { font-weight: 600; }
+.conn-line .conn-sub { color: var(--sub); flex: 1 1 220px; min-width: 0; }
+.conn-line .btn { margin: 0; }
+.auth-offline p { color: var(--sub); }
+.meaning-consent .row-actions { padding: 0 16px 14px; }
+/* W1 A5: a question waiting on the Mac's own prompt, at the top of the session reader. */
+.sx-mac-q { margin: 8px 0 12px; padding: 12px 14px; border-radius: var(--radius-sm); border: 1px solid var(--panel-border); background: var(--panel); }
+.sx-mac-q[hidden] { display: none; }
+.sx-mac-q .sx-mac-q-title { margin: 0 0 6px; }
+/* 7.0.18: a turn that ended asking him: the choices as buttons in a row that wraps under its own width (at most two,
+   each label at most 40 characters), so the closed Duo stacks them and the open Duo keeps them side by side. Labels wrap
+   inside a button rather than cut. */
+.sx-te-choices, .ta-te-choices { display: flex; flex-wrap: wrap; gap: 8px; margin: 8px 0 6px; }
+.sx-te-choices .cx-btn, .ta-te-choices .cx-btn { flex: 1 1 12rem; min-height: 44px; white-space: normal; text-align: center; line-height: 1.25; }
+.sx-mac-q .sx-note { margin: 6px 0 0; }