@gotcos/glasses-server 7.0.7 → 7.0.18

package/server/lib/agent-session-recent.ts

@@ -0,0 +1,321 @@
+/**
+ * "Recent activity first" for the Today summary (Miles, 2026-11-09): what was said INTO a session lately and where its
+ * latest reply left off, with when, so the summary describes what a session is doing now instead of its first prompt.
+ *
+ * Why: each session's list `line` (composeDiscussionSummary) is its FIRST prompt plus the latest reply, cut at 180
+ * characters. On 11/09 the Codex orchestrator's line led with an ask from 10/11, 29 days old, and the model wrote
+ * "following up a transcription bakeoff" about a session that had just confirmed a release was live.
+ *
+ * readRecentActivity(provider, file, now) answers the last few asks (each with when and how it arrived), the latest
+ * reply and when the session last moved. Read-only display evidence: never imported by an attach, queue or write gate.
+ *
+ * - Claude: the last 8 MB of the transcript, memoized on mtime and size like readClaudeSubagents. User turns follow
+ *   parseAgentSession's rules: sidechains, `isMeta` and `isCompactSummary` rows are not asks (a peer row is, unwrapped
+ *   by unwrapPeerMessage), the verify footer comes off (withoutTurnFooter), wrapper tags go (STRIPPABLE_TAG_RE) and a
+ *   pasted JSON block becomes "[pasted data]". A peer row, or a row that carried a COS verify footer, arrived from
+ *   another screen or session: `via: 'peer'`, never attributed to the person. A peer row that is agent-to-agent
+ *   protocol (a cross-session or agent-message envelope) is not an ask at all.
+ * - Codex: rollouts reach 32 GB with single lines of 44 MB (measured 11/09). An incremental forward scan keeps its byte
+ *   offset in memory; the first pass reads at most the last 256 MB; a line over 1 MB is skipped without being decoded
+ *   or parsed; reads are async, 4 MB at a time, and the scan yields between chunks. One scan per file at a time: a
+ *   second caller waits on the first, and a scan the Today route stopped waiting for still finishes and fills the memo.
+ *   Codex rows carry no sender marker, so only a COS verify footer marks one as sent in from another screen.
+ * - Cursor: the existing tail peek (the last user query and reply); its transcript has no timestamps, so every time is
+ *   the file's mtime.
+ *
+ * `startedAt` and `firstAsk` are set only for a session whose file was created within the last day, for the
+ * "started today as" note. Opens refuse symlinks and non-regular files. Never throws: null when unreadable.
+ */
+import { constants } from 'node:fs'
+import { open, stat } from 'node:fs/promises'
+import {
+  STRIPPABLE_TAG_RE, createdFromCodexFilename, firstClaudeUserTitle, firstCursorUserTitle, isWrapperPrompt, parseJsonLine,
+  payloadText, codexUserText, peekCodexMeta, peekCursorDiscussion, proseSnippet, type AgentProvider,
+} from './agent-session-store.js'
+import { unwrapPeerMessage } from './session-stream-events.js'
+import { stripG2TurnFooter } from './turn-footer.js'
+
+export type RecentVia = 'typed' | 'peer'
+export interface RecentAsk { at: number; text: string; via: RecentVia }
+export interface RecentReply { at: number; text: string }
+export interface RecentActivity {
+  /** The newest asks into the session, oldest first, at most RECENT_ASKS_KEPT. */
+  asks: RecentAsk[]
+  /** The newest assistant reply (Codex: its newest final answer, not commentary). */
+  reply: RecentReply | null
+  /** The newest record's time (ms), 0 when none was seen. */
+  movedAt: number
+  /** Only for a session created within the last day: when, and its first ask. */
+  startedAt?: number
+  firstAsk?: string
+}
+
+export const RECENT_ASKS_KEPT = 3
+export const CLAUDE_RECENT_TAIL_BYTES = 8 * 1024 * 1024
+export const CODEX_FIRST_PASS_BYTES = 256 * 1024 * 1024
+/** A line longer than this is skipped unparsed (a 44 MB Codex line holds tool output, never an ask). */
+export const RECENT_LINE_MAX_BYTES = 1024 * 1024
+export const RECENT_CHUNK_BYTES = 4 * 1024 * 1024
+const TEXT_KEEP = 1000
+const MEMO_MAX = 64
+const DAY_MS = 24 * 60 * 60 * 1000
+
+// ── text ───────────────────────────────────────────────────────────────────
+
+const PASTED = /<pasted_content\b[^>]*>([\s\S]*?)<\/pasted_content\b[^>]*>/gi
+const WRAPPER_BLOCKS = /<(task-notification|system-reminder|relevant-memories|cache-health|daily-bulletin|cos-alarms|device-handoff|now|memory-stored|local-command-stdout|local-command-stderr|command-name|command-message|command-args|user_query)\b[^>]*>[\s\S]*?<\/\1>/gi
+/** A peer row that is agent-to-agent protocol, not words for the session. */
+const AGENT_ENVELOPE = /^\s*(?:<(?:cross-session-message|agent-message)\b|Message Type:|Subagent hand-?back\b)/i
+/** A paragraph that is pasted data: it opens with { or [ and holds a "key": pair. */
+const JSON_PARAGRAPH = /^\s*[[{][\s\S]*"\s*:/
+
+/** One ask's words: pasted data replaced, wrapper blocks and tags out, one line, bounded. '' when nothing is left. */
+export function cleanAskText(raw: string): string {
+  // Whole wrapper blocks go first (a background task's notification, a reminder, a slash command's parts). What is left
+  // is then judged as parseAgentSession's collectTurn judges a turn: still a wrapper (it opens with a tag the block list
+  // does not know), it is not an ask, and no tag is taken off so that its insides could read as words.
+  let s = raw.replace(WRAPPER_BLOCKS, ' ').replace(PASTED, (_m, inner: string) => {
+    const t = String(inner).trim()
+    return t.startsWith('{') || t.startsWith('[') ? '\n\n[pasted data]\n\n' : ` ${t} `
+  })
+  if (!s.trim() || isWrapperPrompt(s)) return ''
+  s = s.split(/\n\s*\n/).map(p => (JSON_PARAGRAPH.test(p) ? '[pasted data]' : p)).join('\n\n')
+  s = s.replace(STRIPPABLE_TAG_RE, ' ').replace(/\s+/g, ' ').trim()
+  if (!s || isWrapperPrompt(s) || s.startsWith('[Request interrupted') || s.startsWith('[image: source')) return ''
+  return s.slice(0, TEXT_KEEP)
+}
+
+/** An ask's words and how it arrived: a footer means another screen (glasses, phone or web) sent it. */
+function footerVia(text: string, peer: boolean): { text: string; via: RecentVia } {
+  const f = stripG2TurnFooter(text)
+  return { text: f.text, via: peer || f.turnId ? 'peer' : 'typed' }
+}
+
+const tsOf = (v: unknown): number => (typeof v === 'string' ? Date.parse(v) || 0 : 0)
+
+interface Collector { asks: RecentAsk[]; reply: RecentReply | null; movedAt: number }
+const emptyCollector = (): Collector => ({ asks: [], reply: null, movedAt: 0 })
+function addAsk(c: Collector, ask: RecentAsk) {
+  c.asks.push(ask)
+  if (c.asks.length > RECENT_ASKS_KEPT) c.asks.shift()
+}
+const moved = (c: Collector, at: number) => { if (at > c.movedAt) c.movedAt = at }
+
+/** One Claude record into the collector (parseAgentSession's user-turn rules). */
+export function collectClaudeRecord(c: Collector, obj: Record<string, unknown>): void {
+  if (obj.isSidechain === true) return
+  const at = tsOf(obj.timestamp)
+  if (at && (obj.type === 'user' || obj.type === 'assistant' || obj.type === 'system')) moved(c, at)
+  if (obj.type !== 'user' && obj.type !== 'assistant') return
+  if (obj.type === 'user' && obj.toolUseResult) return
+  const message = obj.message && typeof obj.message === 'object' ? obj.message as Record<string, unknown> : null
+  const text = message ? payloadText(message) : null
+  if (!text) return
+  if (obj.type === 'assistant') {
+    const prose = proseSnippet(text, TEXT_KEEP)
+    if (prose) c.reply = { at, text: prose }
+    return
+  }
+  const isPeer = (obj.origin as { kind?: unknown } | undefined)?.kind === 'peer'
+  const peerWords = isPeer ? unwrapPeerMessage(text) : null
+  // Injected rows (a slash-command body, a compaction preamble) are not asks; a peer row is, once unwrapped.
+  if (peerWords === null && (obj.isMeta === true || obj.isCompactSummary === true)) return
+  if (peerWords !== null && AGENT_ENVELOPE.test(peerWords)) return
+  const { text: words, via } = footerVia(peerWords ?? text, peerWords !== null)
+  const clean = cleanAskText(words)
+  if (clean) addAsk(c, { at, text: clean, via })
+}
+
+/** One Codex rollout line into the collector. The caller has already checked its size. */
+export function collectCodexLine(c: Collector, line: Buffer): void {
+  const head = line.subarray(0, 512).toString('utf8')
+  const stamp = /"timestamp":"([^"]{10,40})"/.exec(head)
+  const at = stamp ? Date.parse(stamp[1]!) || 0 : 0
+  if (at) moved(c, at)
+  // Role and type sit before the content in a rollout line, so the head decides without decoding the rest.
+  if (!head.includes('"type":"message"') || !(head.includes('"role":"user"') || head.includes('"role":"assistant"'))) return
+  const obj = parseJsonLine(line.toString('utf8'))
+  if (!obj || obj.type !== 'response_item' || !obj.payload || typeof obj.payload !== 'object') return
+  const p = obj.payload as Record<string, unknown>
+  if (p.type !== 'message') return
+  if (p.role === 'assistant') {
+    if (p.phase === 'commentary') return
+    const text = payloadText(p)
+    const prose = text ? proseSnippet(text, TEXT_KEEP) : ''
+    if (prose) c.reply = { at, text: prose }
+    return
+  }
+  if (p.role !== 'user') return
+  const text = codexUserText(p)
+  if (!text || isWrapperPrompt(text)) return
+  const { text: words, via } = footerVia(text, false)
+  const clean = cleanAskText(words)
+  if (clean) addAsk(c, { at, text: clean, via })
+}
+
+// ── reads ──────────────────────────────────────────────────────────────────
+
+type Handle = Awaited<ReturnType<typeof open>>
+async function openRegular(file: string): Promise<{ handle: Handle; size: number; mtimeMs: number; birthtimeMs: number; ino: number } | null> {
+  let handle: Handle | null = null
+  try {
+    handle = await open(file, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | (constants.O_NOFOLLOW ?? 0))
+    const st = await handle.stat()
+    if (!st.isFile()) { await handle.close().catch(() => {}); return null }
+    return { handle, size: st.size, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs, ino: st.ino }
+  } catch {
+    await handle?.close().catch(() => {})
+    return null
+  }
+}
+const yieldLoop = () => new Promise<void>(resolve => setImmediate(resolve))
+
+const claudeMemo = new Map<string, { mtimeMs: number; size: number; value: Collector }>()
+const remember = <V>(memo: Map<string, V>, key: string, value: V) => {
+  if (!memo.has(key) && memo.size >= MEMO_MAX) memo.delete(memo.keys().next().value!)
+  memo.set(key, value)
+}
+
+/** A Claude transcript's tail (8 MB), memoized on mtime and size. */
+async function readClaude(file: string, tailBytes = CLAUDE_RECENT_TAIL_BYTES): Promise<{ c: Collector; birthtimeMs: number } | null> {
+  const opened = await openRegular(file)
+  if (!opened) return null
+  const { handle, size, mtimeMs, birthtimeMs } = opened
+  try {
+    const hit = claudeMemo.get(file)
+    if (hit && hit.mtimeMs === mtimeMs && hit.size === size) return { c: hit.value, birthtimeMs }
+    const length = Math.min(size, tailBytes), start = size - length
+    const buffer = Buffer.alloc(length)
+    const read = await handle.read(buffer, 0, length, start)
+    const data = buffer.subarray(0, read.bytesRead)
+    const c = emptyCollector()
+    let pos = 0, n = 0
+    // A tail that starts mid-file has a cut first line: it fails to parse and is skipped like any bad line.
+    while (pos < data.length) {
+      let end = data.indexOf(0x0a, pos)
+      if (end < 0) end = data.length
+      if (end - pos > 0 && end - pos <= RECENT_LINE_MAX_BYTES) {
+        const obj = parseJsonLine(data.subarray(pos, end).toString('utf8'))
+        if (obj) collectClaudeRecord(c, obj)
+      }
+      pos = end + 1
+      if (++n % 2000 === 0) await yieldLoop()
+    }
+    remember(claudeMemo, file, { mtimeMs, size, value: c })
+    return { c, birthtimeMs }
+  } catch {
+    return null
+  } finally {
+    await handle.close().catch(() => {})
+  }
+}
+
+interface CodexScan { offset: number; size: number; partial: Buffer | null; skipping: boolean; c: Collector; running: Promise<void> | null; ino: number }
+const codexMemo = new Map<string, CodexScan>()
+
+/** Test seam: forget every memo (a new server process starts with none). */
+export function resetRecentActivityMemo(): void { claudeMemo.clear(); codexMemo.clear() }
+/** Test seam: the bytes of an unfinished line a Codex scan holds for its next read (never more than the line bound). */
+export function codexScanHeldBytes(file: string): number { return codexMemo.get(file)?.partial?.length ?? 0 }
+
+/**
+ * Scan a Codex rollout forward from where the last scan stopped. A first pass, or a gap past `firstPassBytes`, starts
+ * that far from the end and drops the line it lands inside.
+ */
+async function scanCodex(file: string, firstPassBytes: number, chunkBytes: number): Promise<CodexScan | null> {
+  const opened = await openRegular(file)
+  if (!opened) return null
+  const { handle, size, ino } = opened
+  try {
+    let scan = codexMemo.get(file)
+    if (scan && (scan.ino !== ino || size < scan.offset)) scan = undefined   // replaced or truncated: start over
+    if (!scan) {
+      scan = { offset: 0, size: 0, partial: null, skipping: false, c: emptyCollector(), running: null, ino }
+      remember(codexMemo, file, scan)
+    }
+    if (scan.running) { await scan.running; return scan }
+    const s = scan
+    const run = (async () => {
+      if (size - s.offset > firstPassBytes) {
+        s.offset = size - firstPassBytes
+        s.partial = null
+        s.skipping = s.offset > 0   // landed mid-line: that line is not whole
+      }
+      while (s.offset < size) {
+        const length = Math.min(chunkBytes, size - s.offset)
+        const chunk = Buffer.alloc(length)
+        const { bytesRead } = await handle.read(chunk, 0, length, s.offset)
+        if (bytesRead <= 0) break
+        s.offset += bytesRead
+        let buf = chunk.subarray(0, bytesRead)
+        if (s.partial) { buf = Buffer.concat([s.partial, buf]); s.partial = null }
+        let pos = 0
+        for (let nl = buf.indexOf(0x0a, pos); nl >= 0; nl = buf.indexOf(0x0a, pos)) {
+          if (s.skipping) s.skipping = false
+          else if (nl - pos > 0 && nl - pos <= RECENT_LINE_MAX_BYTES) collectCodexLine(s.c, buf.subarray(pos, nl))
+          pos = nl + 1
+        }
+        const rest = buf.subarray(pos)
+        // An unfinished line past the bound is never kept: the rest of it is skipped up to its newline. While skipping
+        // (no newline in this chunk at all), nothing is kept either.
+        if (!s.skipping) {
+          if (rest.length > RECENT_LINE_MAX_BYTES) s.skipping = true
+          else if (rest.length) s.partial = Buffer.from(rest)
+        }
+        await yieldLoop()
+      }
+      s.size = size
+    })()
+    s.running = run
+    try { await run } finally { s.running = null }
+    return s
+  } catch {
+    return null
+  } finally {
+    await handle.close().catch(() => {})
+  }
+}
+
+export interface RecentReadOptions { claudeTailBytes?: number; codexFirstPassBytes?: number; chunkBytes?: number }
+
+/** What was said into one session lately, its latest reply and when it last moved, or null when it cannot be read. */
+export async function readRecentActivity(provider: AgentProvider, file: string, now = Date.now(), opts: RecentReadOptions = {}): Promise<RecentActivity | null> {
+  try {
+    let c: Collector, createdAt = 0, firstAsk = ''
+    if (provider === 'claude') {
+      const r = await readClaude(file, opts.claudeTailBytes)
+      if (!r) return null
+      c = r.c
+      createdAt = r.birthtimeMs
+      if (createdAt && now - createdAt < DAY_MS) firstAsk = (await firstClaudeUserTitle(file)) ?? ''
+    } else if (provider === 'codex') {
+      const s = await scanCodex(file, opts.codexFirstPassBytes ?? CODEX_FIRST_PASS_BYTES, opts.chunkBytes ?? RECENT_CHUNK_BYTES)
+      if (!s) return null
+      c = s.c
+      createdAt = Date.parse(createdFromCodexFilename(file.split('/').pop() ?? '') ?? '') || 0
+      if (createdAt && now - createdAt < DAY_MS) firstAsk = (await peekCodexMeta(file))?.title ?? ''
+    } else {
+      const st = await stat(file).catch(() => null)
+      if (!st?.isFile()) return null
+      const peek = await peekCursorDiscussion(file)
+      const at = st.mtimeMs
+      c = { asks: [], reply: null, movedAt: at }
+      const ask = peek.lastUser ? cleanAskText(peek.lastUser) : ''
+      if (ask) c.asks.push({ at, text: ask, via: 'typed' })
+      const reply = peek.latestAssistant ? proseSnippet(peek.latestAssistant, TEXT_KEEP) : ''
+      if (reply) c.reply = { at, text: reply }
+      createdAt = st.birthtimeMs
+      if (createdAt && now - createdAt < DAY_MS) firstAsk = (await firstCursorUserTitle(file)) ?? ''
+    }
+    // Copies, so a caller can never edit the memo.
+    const out: RecentActivity = {
+      asks: c.asks.filter(a => a.at <= now).map(a => ({ ...a })),
+      reply: c.reply && c.reply.at <= now ? { ...c.reply } : null,
+      movedAt: c.movedAt,
+    }
+    if (firstAsk && createdAt) { out.startedAt = createdAt; out.firstAsk = firstAsk }
+    return out
+  } catch {
+    return null
+  }
+}

package/server/lib/agent-session-store.ts

@@ -250,7 +250,7 @@ const STRIPPABLE_TAGS = [
   'local-command-stdout', 'local-command-stderr', 'thinking',
 ]
 
-const STRIPPABLE_TAG_RE = new RegExp(`</?(?:${STRIPPABLE_TAGS.join('|')})(?:\\s[^>]*)?/?>`, 'gi')
+export const STRIPPABLE_TAG_RE = new RegExp(`</?(?:${STRIPPABLE_TAGS.join('|')})(?:\\s[^>]*)?/?>`, 'gi')
 
 /**
  * Fenced code and known tags out. Shared so `proseSnippet` and `latestAssistantReply`
@@ -995,7 +995,7 @@ export async function peekCodexMeta(path: string): Promise<{ id: string; cwd: st
   return { id, cwd, title, subagent, created }
 }
 
-async function peekCursorDiscussion(path: string): Promise<{ lastUser: string | null; latestAssistant: string }> {
+export async function peekCursorDiscussion(path: string): Promise<{ lastUser: string | null; latestAssistant: string }> {
   const text = await readWindow(path, true)
   let lastUser: string | null = null
   for (const line of text.split('\n')) {
@@ -1010,7 +1010,7 @@ async function peekCursorDiscussion(path: string): Promise<{ lastUser: string |
   return { lastUser, latestAssistant: latestAssistantFromWindow(text) }
 }
 
-async function firstCursorUserTitle(path: string): Promise<string | null> {
+export async function firstCursorUserTitle(path: string): Promise<string | null> {
   const text = await readWindow(path, false)
   let fallback: string | null = null
   for (const line of text.split('\n')) {

package/server/lib/api-auth.ts

@@ -1,7 +1,7 @@
 import type { RequestHandler } from 'express'
 import { timingSafeTokenEqual } from './token-auth.js'
 import { PAIRING_NONCE_BODY } from './glasses-pairing.js'
-import { isWebSessionAuthorized } from './web-session-auth.js'
+import { formatSetWebSessionCookie, isWebSessionAuthorized, renewWebSessionCookieValue, verifyWebSessionCookieValue, webSessionCookieFrom } from './web-session-auth.js'
 
 // Recovery/setup clients need these availability surfaces before they have a
 // usable token. Keep private provider state and every mutation route out.
@@ -44,9 +44,31 @@ const DISPLAY_STREAM_CAPABILITY_PATH = /^\/display-stream\/\d{1,15}\.[0-9a-f]{64
 // Minting, status and decisions stay behind the token AND a loopback socket.
 const PAIRING_POLL_PATH = new RegExp(`^/pairing/claim/${PAIRING_NONCE_BODY}$`)
 
+/** Set on a response whose request renewed its browser sign-in: `<new expiry ISO> <30-day cap ISO>`. The page reads it. */
+export const WEB_SESSION_RENEWED_HEADER = 'X-COS-Web-Session'
+
 /** `res.locals` key the gate sets to `'token'` when the X-COS-Token header matched. */
 export const API_AUTH_BY_LOCAL = 'cosApiAuthBy'
 
+/**
+ * Final review S1 (lead 2026-11-10 02:09): `res.locals` key the gate sets ONLY for a request it let in by the browser's
+ * sign-in cookie: a check that the same cookie still verifies now (its expiry, the epoch "Sign out every browser" bumps,
+ * the 30-day cap). A stream that outlives its opening request calls it on every heartbeat (`streamSignInHolds`).
+ */
+export const WEB_SESSION_RECHECK_LOCAL = 'cosWebSessionRecheck'
+
+/**
+ * For a long-lived stream, on each heartbeat: false once the browser sign-in that opened it no longer verifies, so the
+ * stream tears down. A request the API token let in has no re-check and always holds, as does one that never passed
+ * the gate (a route mounted without it in a test). The browser reconnects with whatever cookie it holds now; a renewed
+ * one verifies there.
+ */
+export function streamSignInHolds(res: { locals?: Record<string, unknown> }): boolean {
+  const recheck = res.locals?.[WEB_SESSION_RECHECK_LOCAL]
+  if (typeof recheck !== 'function') return true
+  try { return recheck() === true } catch { return false }
+}
+
 export function isPublicApiRequest(method: string, path: string): boolean {
   if (PUBLIC_API_PATHS.has(path)) return true
   if (method === 'POST' && path === '/pairing/claim') return true
@@ -92,6 +114,20 @@ export function requireApiToken(apiToken: string, options: RequireApiTokenOption
       allowedPorts: options.allowedPorts?.(),
     })
     if (cookieAuth) {
+      // Final review S1: the cookie this request came in with, checked again by any stream it opens (above).
+      const opened = webSessionCookieFrom(req.headers.cookie)
+      res.locals[WEB_SESSION_RECHECK_LOCAL] = (): boolean => verifyWebSessionCookieValue(opened, apiToken, Date.now())
+      // 7.0.x (Miles 2026-11-09, "Renew while in use, 30-day cap"): only here, after the socket, cookie, CSRF and Origin
+      // checks above all passed, a cookie in its last 2 days gets a fresh one, never past 30 days from its first sign-in.
+      // Appended, so a route's own Set-Cookie (none today on gated routes) is never overwritten. A renewal that cannot
+      // be made (outside the window, at the cap) changes nothing.
+      try {
+        const renewed = renewWebSessionCookieValue(webSessionCookieFrom(req.headers.cookie), apiToken)
+        if (renewed) {
+          res.append('Set-Cookie', formatSetWebSessionCookie(renewed.value, Math.floor((renewed.expiresAtMs - Date.now()) / 1000), req.secure))
+          res.setHeader(WEB_SESSION_RENEWED_HEADER, new Date(renewed.expiresAtMs).toISOString() + ' ' + new Date(renewed.capAtMs).toISOString())
+        }
+      } catch { /* a failed renewal leaves the request and the old cookie as they were */ }
       return next()
     }
     return res.status(401).json({

package/server/lib/calendar-meetings.ts

@@ -0,0 +1,70 @@
+/**
+ * Today round 2 (2026-11-09): which calendar rows are distinct, real meetings. ONE helper for the calendar API
+ * (calendar-source.ts calendarToday: next, remainingCount, endedRecently) and the Today summary (today-brief.ts
+ * withCalendar), so the two never disagree.
+ *
+ * - Canceled: a title that starts "Canceled:" or "Cancelled:" (how Exchange and Google rename a canceled occurrence),
+ *   or a row whose `status` says canceled, or `canceled: true` (the snapshot's EventKit status, when it carries one;
+ *   the 11/09 snapshot had no status field on any of its 154 events).
+ * - Distinct: the same title (trimmed, case-folded, spaces collapsed) at the same start is one meeting, whichever
+ *   calendar it is on. The 11/09 live snapshot had 13 such pairs or triples, 12 of them on ONE Exchange calendar with
+ *   different external ids (the same invite delivered twice), so "across calendars" alone would have left 12 of them.
+ *   The first row of each wins, so callers keep their own order.
+ * No dependencies: the summary imports it without the calendar reader.
+ */
+export const CANCELED_TITLE = /^\s*(?:canceled|cancelled)\s*:/i
+const CANCELED_STATUS = new Set(['canceled', 'cancelled'])
+
+export interface MeetingFields { title: unknown; start: unknown; status?: unknown; canceled?: unknown }
+
+export function isCanceledMeeting(row: MeetingFields): boolean {
+  if (row.canceled === true) return true
+  if (typeof row.status === 'string' && CANCELED_STATUS.has(row.status.trim().toLowerCase())) return true
+  return typeof row.title === 'string' && CANCELED_TITLE.test(row.title)
+}
+
+/** The identity of one meeting: its title and its start instant. */
+export function meetingKey(row: MeetingFields): string {
+  const title = typeof row.title === 'string' ? row.title.trim().toLowerCase().replace(/\s+/g, ' ') : ''
+  const start = typeof row.start === 'number' ? row.start : Date.parse(String(row.start ?? ''))
+  return `${title}|${Number.isFinite(start) ? start : String(row.start ?? '')}`
+}
+
+/** The rows that are real meetings, one per meeting, in the order given. */
+export function distinctMeetings<T>(rows: readonly T[], fields: (row: T) => MeetingFields): T[] {
+  const seen = new Set<string>()
+  const out: T[] = []
+  for (const row of rows) {
+    const f = fields(row)
+    if (isCanceledMeeting(f)) continue
+    const key = meetingKey(f)
+    if (seen.has(key)) continue
+    seen.add(key)
+    out.push(row)
+  }
+  return out
+}
+
+/**
+ * Prep on every Next up row (Miles typed 2026-11-09 13:00 CST): a calendar hold or status block is not a meeting to
+ * prep for. ONE list for the server: /api/calendar/today marks each row `hold`, /api/welcome-context marks nextEvent
+ * `hold`, and Control Web and desktop Control read that flag instead of keeping their own copy of the words.
+ *
+ * A title is a hold when, after leading punctuation ("[Hold] ...", "* Busy"), it starts with one of these words or
+ * phrases as a whole word, and it does not name someone with "with" ("Lunch with Jeremy" and "Focus group with the
+ * Jewel360 board" are meetings). Case and repeated spaces do not matter. A false "not a hold" only offers Prep on a hold;
+ * a false "hold" would hide Prep on a real meeting, so the rule stays narrow.
+ */
+export const CALENDAR_HOLD_WORDS: readonly string[] = Object.freeze([
+  'blocked', 'block', 'busy', 'hold', 'holds', 'focus', 'travel', 'personal', 'private', 'ooo', 'out of office', 'lunch',
+  'pto', 'vacation', 'commute', 'dnd', 'do not book', 'do not schedule',
+])
+// Letters and single spaces only, so the words need no escaping.
+const HOLD_START = new RegExp(`^(?:${CALENDAR_HOLD_WORDS.join('|')})(?![a-z0-9])`)
+
+export function isCalendarHold(title: unknown): boolean {
+  if (typeof title !== 'string') return false
+  const t = title.trim().toLowerCase().replace(/\s+/g, ' ').replace(/^[^a-z0-9]+/, '')
+  if (!t || !HOLD_START.test(t)) return false
+  return !/(?:^|[^a-z0-9])with(?![a-z0-9])/.test(t)
+}

package/server/lib/calendar-source.ts

@@ -22,6 +22,7 @@
 import { lstatSync, readFileSync } from 'node:fs'
 import { dataPath } from './data-dir.js'
 import { callPython, pythonBridgeAvailable } from './python-bridge.js'
+import { distinctMeetings, isCalendarHold, type MeetingFields } from './calendar-meetings.js'
 
 export const SNAPSHOT_FRESH_MS = 2 * 3600_000
 export const SNAPSHOT_MAX_AGE_MS = 24 * 3600_000
@@ -61,6 +62,8 @@ export interface SnapshotEvent {
   attendees: SnapshotAttendee[]
   /** Allowlisted hosts only (zoom.us, teams.microsoft.com, meet.google.com). */
   meetingUrl: string | null
+  /** Today round 2: EventKit's status said canceled (only when the writer sends `status: "canceled"`). */
+  canceled?: boolean
 }
 
 export interface CalendarSnapshot {
@@ -159,6 +162,7 @@ export function parseSnapshot(raw: unknown): CalendarSnapshot | null {
       isOrganizer: r.isOrganizer === true,
       attendees,
       meetingUrl: url,
+      ...(typeof r.status === 'string' && /^cancel+ed$/i.test(r.status.trim()) ? { canceled: true } : {}),
     })
   }
   return { version: 1, writtenAt, windowStart, windowEnd, access, calendars, events }
@@ -340,6 +344,7 @@ export function bridgeEvent(e: SnapshotEvent, calendar: SnapshotCalendar | undef
     event_id: e.eventId,
     external_id: e.externalId,
     occurrence_start: e.occurrenceStart,
+    ...(e.canceled ? { canceled: true } : {}),
   }
 }
 
@@ -454,32 +459,52 @@ export function countsAsMeeting(row: Record<string, unknown> | null | undefined)
 }
 
 /**
- * Today for Control Web and desktop: selected calendars only, the next 3 timed meetings that count. QA 7.0.0: all-day
- * and non-prep events (declined, holidays, attendee-less shared events) are filtered out BEFORE the 3 are taken, so they
- * never use up the slots Today's "Later" shows. QA W23: remainingCount counts the same rows, so a declined meeting or
- * a family flight is not "remaining".
+ * Today for Control Web and desktop: selected calendars only, the next 5 timed meetings that count (Today round 2,
+ * Miles 2026-11-09: was 3). QA 7.0.0: all-day and non-prep events (declined, holidays, attendee-less shared events) are
+ * filtered out BEFORE the 5 are taken, so they never use up the slots Today's "Later" shows. QA W23: remainingCount
+ * counts the same rows, so a declined meeting or a family flight is not "remaining".
+ *
+ * Today round 2: `endedRecently` lists the meetings that count which ended within the last CALENDAR_ENDED_RECENT_MS
+ * (2 h), newest end first, at most CALENDAR_ENDED_MAX. They come from `today_events` (the snapshot's and the bridge's
+ * own list of every event today, past ones included), with the same end rule the snapshot uses (no end: an hour after
+ * the start). The Today summary uses it to know a meeting is over, so its prep is past. Additive: the older fields keep
+ * their names and meaning (desktop Control 0.5.384 reads next, remainingCount, stale and asOf).
+ *
+ * Today round 2 follow-up: canceled events and duplicates (the same title at the same start) are dropped BEFORE next,
+ * remainingCount and endedRecently are taken (calendar-meetings.ts, the helper the Today summary uses too), so
+ * remainingCount counts real, distinct meetings and no slot is spent twice on one.
  */
-export async function calendarToday(now = Date.now()): Promise<{
+export const CALENDAR_NEXT_MAX = 5
+export const CALENDAR_ENDED_RECENT_MS = 2 * 3600_000
+export const CALENDAR_ENDED_MAX = 5
+/** `hold` (Prep on every Next up row, 11/09): a hold or status block by its title (calendar-meetings.ts isCalendarHold). */
+export interface CalendarTodayRow { title: string; start: string; end: string | null; allDay: boolean; calendar: string | null; meetingUrl: string | null; hold: boolean }
+export interface CalendarEndedRow { title: string; start: string; end: string }
+export interface CalendarTodayView {
   connected: boolean
   source: CalendarSourceName
   asOf: string | null
   stale: boolean
   remainingCount: number
-  next: Array<{ title: string; start: string; end: string | null; allDay: boolean; calendar: string | null; meetingUrl: string | null }>
-}> {
+  next: CalendarTodayRow[]
+  endedRecently: CalendarEndedRow[]
+}
+export async function calendarToday(now = Date.now()): Promise<CalendarTodayView> {
   const read = await readCalendar(8_000, now)
   const data = read.data as Record<string, unknown> | null
   const connected = !!data && typeof data === 'object' && !('error' in data) && (read.source !== 'bridge' || pythonBridgeAvailable())
   const rows = connected && Array.isArray(data!.today_remaining) ? data!.today_remaining as Array<Record<string, unknown>> : []
-  const counted = rows.filter(countsAsMeeting)
-  const next = counted.slice(0, 3).map(r => ({
+  const counted = distinctMeetings(rows.filter(countsAsMeeting), bridgeMeetingFields)
+  const next = counted.slice(0, CALENDAR_NEXT_MAX).map(r => ({
     title: typeof r.title === 'string' ? r.title : 'Event',
     start: String(r.start_time ?? ''),
     end: typeof r.end_time === 'string' ? r.end_time : null,
     allDay: r.is_all_day === true,
     calendar: typeof r.calendar_name === 'string' ? r.calendar_name : null,
     meetingUrl: typeof r.meeting_url === 'string' ? r.meeting_url : null,
+    hold: isCalendarHold(r.title),
   }))
+  const all = connected && Array.isArray(data!.today_events) ? data!.today_events as Array<Record<string, unknown>> : []
   return {
     connected,
     source: read.source,
@@ -487,5 +512,25 @@ export async function calendarToday(now = Date.now()): Promise<{
     stale: data?.is_stale === true,
     remainingCount: connected ? counted.length : 0,
     next,
+    endedRecently: endedRecently(all, now),
+  }
+}
+
+/** A bridge-shaped row's meeting identity, for calendar-meetings.ts. */
+export function bridgeMeetingFields(r: Record<string, unknown>): MeetingFields {
+  return { title: r.title, start: r.start_time, status: r.status, canceled: r.canceled }
+}
+
+/** Distinct, not canceled meetings that count and ended within CALENDAR_ENDED_RECENT_MS of `now`, newest end first. */
+export function endedRecently(rows: Array<Record<string, unknown>>, now: number): CalendarEndedRow[] {
+  const out: Array<CalendarEndedRow & { endMs: number }> = []
+  for (const r of distinctMeetings(rows.filter(countsAsMeeting), bridgeMeetingFields)) {
+    const startMs = Date.parse(String(r.start_time ?? ''))
+    if (!Number.isFinite(startMs)) continue
+    const endRaw = typeof r.end_time === 'string' && r.end_time ? Date.parse(r.end_time) : NaN
+    const endMs = Number.isFinite(endRaw) ? endRaw : startMs + 3600_000
+    if (endMs > now || now - endMs > CALENDAR_ENDED_RECENT_MS) continue
+    out.push({ title: typeof r.title === 'string' ? r.title : 'Event', start: new Date(startMs).toISOString(), end: new Date(endMs).toISOString(), endMs })
   }
+  return out.sort((a, b) => b.endMs - a.endMs).slice(0, CALENDAR_ENDED_MAX).map(({ endMs: _e, ...r }) => r)
 }