@gotcos/glasses-server 7.0.7 → 7.0.27

package/server/index.ts

@@ -18,12 +18,20 @@ import { createClientInstanceRouter, isMeetingChunkPost, pairedInstanceFrom } fr
 import type { ClientInstanceOwner } from './lib/client-instance-claim.js'
 import { G2TurnLedger, G2TurnProvenance, G2_TURN_LEDGER_FILE, type OriginRequest } from './lib/g2-turn-provenance.js'
 import { createG2TurnsRouter } from './routes/g2-turns.js'
+import { WebKeyAuthority, webKeyAuthorityEnabled } from './lib/web-key-authority.js'
+import { deviceAllowlistFrom, WEB_KEY_AUDIT_FILE, WEB_KEY_NONCES_FILE, WEB_KEYS_FILE, WebKeyEnrollments, WebKeyNonces, WebKeyPackets, WebKeyRegistry } from './lib/web-key-registry.js'
+import { WEB_KEY_SIGNER_PORT, webKeySignerOrigin } from './lib/web-key-origin.js'
+import { createWebKeyRouter } from './routes/web-key.js'
+import { WebKeySignHandoffs } from './lib/web-key-handoff.js'
+import { combinedIntegrityReport, createWebKeySignerHandler } from './lib/web-key-signer-app.js'
+import { WebControlIntegrity, webControlIntegrityEnabled } from './lib/web-control-integrity.js'
 import { getTailscaleNudger, installTailscaleNudger } from './lib/tailscale-nudge.js'
 import { queryRouter } from './routes/query.js'
 import { providerProofRouter } from './routes/provider-proof.js'
 import { transcribeRouter } from './routes/transcribe.js'
 import { sessionIndexRouter } from './routes/session-index.js'
 import { agentSessionsRouter } from './routes/agent-sessions.js'
+import { createSessionOrganizerRouter } from './routes/session-organizer.js'
 import { agentSessionStreamRouter } from './routes/agent-session-stream.js'
 import { createLiveEventsRouter, liveEventsEnabled, realLiveSources } from './routes/live-events.js'
 import { LiveEventsHub } from './lib/live-events.js'
@@ -48,6 +56,9 @@ import {
   wirePermissionBrokerToSignals,
 } from './lib/permission-broker.js'
 import { createPermissionBrokerHookRouter, createSessionQuestionsRouter } from './routes/permission-broker.js'
+// X1: the full hold's switches and the engine gate's registry read (kept on their own lines, apart from other lanes' imports).
+import { fullHoldSwitches } from './lib/full-hold.js'
+import { engineForHookProcess, registryStatusForPid } from './lib/full-hold-engine.js'
 import { lastHoldQuestionsPollAt, lastLegacyQuestionsPollAt, lastQuestionsPollAt, presenceAgeMs, webPresenceAgeMs } from './lib/client-liveness.js'
 import {
   createAgentSessionBindingsRouter,
@@ -124,7 +135,8 @@ import { findPinnedCli, killParakeetChildren, sweepParakeetStaging, sweepStalePa
 import { handoffsRouter } from './routes/handoffs.js'
 import { recoveryRouter } from './routes/recovery.js'
 import { promptEditRouter } from './routes/prompt-edit.js'
-import { createTodayBriefRouter, defaultTodayBrief, readSubagentsFor } from './routes/today-brief.js'
+import { createTodayBriefRouter, defaultTodayBrief, readSessionContext } from './routes/today-brief.js'
+import { calendarToday } from './lib/calendar-source.js'
 import { liveCosAskRouter } from './routes/live-cos-ask.js'
 import { meetingAskRouter } from './routes/meeting-ask.js'
 import { meetingAskRuntime } from './lib/meeting-ask-runtime.js'
@@ -147,6 +159,7 @@ import {
   stopCodexModelCatalogRefresh,
 } from './lib/codex-model-catalog.js'
 import { startWhisperServer, stopWhisperServer } from './lib/whisper-local.js'
+import { noteCorsRejection } from './lib/cors-reject-log.js'
 import { startWhisperPreviewServer, stopWhisperPreviewServer } from './lib/whisper-preview.js'
 import { startLocalTtsServer, stopLocalTtsServer } from './lib/tts-local.js'
 import { initSileroVAD } from './lib/vad-silero.js'
@@ -157,7 +170,7 @@ import { killNemotronChildren } from './lib/nemotron-cli.js'
 import { getSessionRaw, logActiveSessionsOnShutdown, startAutoSnapshot } from './lib/conversation.js'
 import { getMediaStore } from './lib/media-store.js'
 import { getTurnFileStore } from './lib/turn-file-store.js'
-import { listenRequiredServers, type RequiredListener } from './lib/listener-startup.js'
+import { listenerPlan, listenRequiredServers, type RequiredListener } from './lib/listener-startup.js'
 import { serverMetrics } from './lib/server-metrics.js'
 import { initializeServerInstanceId } from './lib/server-instance-id.js'
 import { appendPrivateEnvBlock, UnsafeUserConfigPathError } from './lib/secure-user-config.js'
@@ -206,7 +219,7 @@ import { BOOT_RESUME_LEDGER_FILE, createBootResumeGate, installBootResumeGate }
 import { WorkIntakeStore, createOptionalWorkIntakeStore } from './lib/work-intake-store.js'
 import { WorkHandoffRequestStore, createOptionalWorkHandoffRequestStore, handoffRequestCapabilities } from './lib/work-handoff-requests.js'
 import { createWorkBoardReader } from './lib/work-board-reader.js'
-import { listBoard } from './lib/task-store.js'
+import { listBoard, listBoardWithDates } from './lib/task-store.js'
 import { createDefaultWorkReviewRuntime } from './lib/work-review-backend.js'
 import { createMorningBriefRouter } from './routes/morning-brief.js'
 import { getMorningBriefScheduler, startMorningBriefScheduler, stopMorningBriefScheduler } from './lib/morning-brief-runtime.js'
@@ -228,6 +241,7 @@ import { isPublicApiRequest, requireApiToken } from './lib/api-auth.js'
 import { PairingState, pairingHostsFrom } from './lib/glasses-pairing.js'
 import { createPairingRouter } from './routes/pairing.js'
 import { createWebControlRouter, isAllowedCorsOrigin, webControlCsp, webControlEnabled } from './routes/web-control.js'
+import { webControlOffnetResponse } from './lib/web-control-offnet-page.js'
 import { createWebControlStatic } from './lib/web-control-static.js'
 import { isWebControlSocketAllowed, isWebSessionAuthorized, setWebSessionEpochFile } from './lib/web-session-auth.js'
 import { getTailnetSelfName, installTailnetSelfName } from './lib/tailnet-self-name.js'
@@ -311,9 +325,10 @@ app.use(cors({
     if (!origin || origin === 'null') return cb(null, true)
     // Async only for an unrecognised *.ts.net origin (see isAllowedCorsOrigin); every other
     // origin is decided from cached state, as before.
+    // S1 (2026-11-09): the rejected origin is logged (origin only, once per origin per hour).
     isAllowedCorsOrigin(origin, getTailnetSelfName()).then(
-      ok => ok ? cb(null, true) : cb(new Error('CORS blocked')),
-      () => cb(new Error('CORS blocked')),
+      ok => { if (ok) return cb(null, true); noteCorsRejection(origin, 'not_allowed'); cb(new Error('CORS blocked')) },
+      () => { noteCorsRejection(origin, 'check_failed'); cb(new Error('CORS blocked')) },
     )
   },
   // Without this, a cross-origin reader sees only the CORS-safelisted response
@@ -361,6 +376,17 @@ const permissionBroker = new PermissionBroker({
     return !!signal && !signal.ended && signal.waiting?.fingerprint === fingerprint
   },
   signals: brokerSignalSink(sessionSignalStore),
+  // X1: the full hold (lib/full-hold.ts). Both switches default OFF; the registry is read only while one is on.
+  fullHold: () => fullHoldSwitches(process.env),
+  engineFor: (sessionId, ppid) => engineForHookProcess(sessionId, ppid),
+  // X1 round 3: the asking engine's own status, read each tick for full-hold items only.
+  engineStatus: (sessionId, pid) => registryStatusForPid(pid, sessionId),
+  // X1: per kind once the PermissionRequest hook is split; the one number while it is not. Read only by the full hold.
+  installedHookTimeoutForKindS: kind => {
+    const status = cachedHookStatus()
+    const perKind = status.permissionHookTimeouts ? status.permissionHookTimeouts[kind] : undefined
+    return perKind === undefined ? status.permissionHookTimeoutS : perKind
+  },
 })
 registerPermissionBroker(permissionBroker)
 wirePermissionBrokerToSignals(permissionBroker, sessionSignalStore)
@@ -384,6 +410,40 @@ app.use(createPermissionBrokerHookRouter({ hookToken: readHookToken, broker: per
 // it (tailnetSelf and HTTPS_PORT are read at request time, after they are set below). It is
 // recorded, never vouched: the cookie is an HMAC of API_TOKEN, so any token holder can mint one.
 const clientInstanceOwners = new Map<string, ClientInstanceOwner>()
+// 6.99.31: the enrolled phone key (lib/web-key-authority.ts), behind COS_WEB_KEY_AUTHORITY (default
+// off, read at call time). Off, no envelope is read and no /api/web-key route exists. The stores only
+// read their files here (none exist until the feature is used); nothing is written while it is off.
+const webKeySelfDnsName = (): string | null => {
+  const name = tailnetSelf.currentSelfDnsName()
+  return typeof name === 'string' && name.trim() ? name.trim().toLowerCase().replace(/\.$/, '') : null
+}
+const webKeyRegistry = new WebKeyRegistry(dataPath(WEB_KEYS_FILE), dataPath(WEB_KEY_AUDIT_FILE))
+const webKeyAuthority = new WebKeyAuthority({
+  registry: webKeyRegistry,
+  nonces: new WebKeyNonces(dataPath(WEB_KEY_NONCES_FILE)),
+  packets: new WebKeyPackets(),
+  selfDnsName: webKeySelfDnsName,
+  // The ONE origin a phone signs from (review B2/W2): the signer listener on 3144 under this Mac's
+  // MagicDNS name. The passkey's clientDataJSON.origin and the cookie gate's extra port use it too.
+  expectedOrigin: () => webKeySignerOrigin(webKeySelfDnsName()),
+  // Review W1: no vouch unless served-asset integrity is running AND its last check passed.
+  // (webControlIntegrity is declared further down; this runs at request time, after it is set.)
+  integrity: () => {
+    // Phase 3: the signer page on 3144 holds the key, so its own manifest must pass too.
+    return combinedIntegrityReport(webControlIntegrity, webKeySignerIntegrity)
+  },
+})
+// Phase 3 (review W2): the 3143 to 3144 handoff. In memory, two minutes, claimed once. Unused while the flag is off.
+const webKeySignHandoffs = new WebKeySignHandoffs()
+// Phase 3: the signer page's own integrity check (server/web-signer/.manifest.json). Built only with the
+// flag on at boot, as the 3144 listener is (listenerPlan); off, the directory is never read.
+const webKeySignerIntegrity: WebControlIntegrity | null = webKeyAuthorityEnabled()
+  ? new WebControlIntegrity(path.join(path.dirname(fileURLToPath(import.meta.url)), 'web-signer'), { log: line => console.error(line.replace('[web-control-integrity]', '[web-signer-integrity]').replace('/control is', 'the 3144 signer is')) })
+  : null
+// Review W6: enrollment starts only from a device on COS_WEB_KEY_DEVICES (empty: none).
+const webKeyEnrollments = new WebKeyEnrollments(webKeyRegistry, { deviceAllowed: deviceAllowlistFrom() })
+// The ports a COS Control Web cookie is honoured on. Flag off: exactly 6.99.29's [3141, 3143].
+const webCookiePorts = (): number[] => (webKeyAuthorityEnabled() ? [PORT, HTTPS_PORT, WEB_KEY_SIGNER_PORT] : [PORT, HTTPS_PORT])
 const g2Provenance = new G2TurnProvenance({
   ledger: new G2TurnLedger(dataPath(G2_TURN_LEDGER_FILE)),
   pairedInstance: (device, now, freshMs) => pairedInstanceFrom(clientInstanceOwners, device, now, freshMs),
@@ -393,8 +453,9 @@ const g2Provenance = new G2TurnProvenance({
     socket: { remoteAddress: req.socket?.remoteAddress ?? undefined },
   }, API_TOKEN, {
     selfDnsName: tailnetSelf.currentSelfDnsName(),
-    allowedPorts: [PORT, HTTPS_PORT],
+    allowedPorts: webCookiePorts(),
   }),
+  webKey: webKeyAuthority,
 })
 
 if (threadAttachEnabled()) {
@@ -443,7 +504,7 @@ const HTTPS_PORT = parseInt(process.env.HTTPS_PORT ?? '3143', 10)
 app.use('/api', requireApiToken(API_TOKEN, {
   onAuthenticated: req => pairingState.noteAuthenticated(req.socket?.remoteAddress),
   selfDnsName: () => tailnetSelf.currentSelfDnsName(),
-  allowedPorts: () => [PORT, HTTPS_PORT],
+  allowedPorts: () => webCookiePorts(),
 }))
 // Past the token gate, a request on a non-public path carried the token: mark a paired phone.
 // Only the X-Cos-Token header counts: a browser signed in to COS Control Web passed the gate
@@ -932,6 +993,25 @@ app.use('/api', diagRouter)
 app.use('/api', createClientInstanceRouter({ owners: clientInstanceOwners }))
 // G2 authority Tier 1: read-only provenance for one delivered turn (verify_g2_turn.py asks it).
 app.use('/api', createG2TurnsRouter({ provenance: g2Provenance, apiToken: () => API_TOKEN }))
+// 6.99.31: the enrolled phone key registry and ceremony. Not a route at all while COS_WEB_KEY_AUTHORITY is off,
+// except (7.0.9) the anchor status and registration routes with COS_WEB_KEY_ANCHOR_BOOTSTRAP on (routes/web-key.ts).
+// Nothing else in this file reads that switch: the 3144 listener, its integrity and the cookie ports stay on the authority.
+app.use('/api', createWebKeyRouter({
+  authority: webKeyAuthority,
+  enrollments: webKeyEnrollments,
+  isWebRequest: req => g2Provenance.originOf(req).origin.client === 'web',
+  apiToken: () => API_TOKEN,
+  selfDnsName: webKeySelfDnsName,
+  expectedOrigin: () => webKeyAuthority.deps.expectedOrigin(),
+  integrityStatus: () => ({ ...(webControlIntegrity?.status() ?? { enabled: false }), signer: webKeySignerIntegrity?.status() ?? null }),
+  // Phase 3: the phone's key steps and the handoff claim answer only on the 3144 signer listener.
+  isSignerRequest: req => req.socket?.localPort === WEB_KEY_SIGNER_PORT,
+  handoffs: webKeySignHandoffs,
+  resolveBinding: bindingId => {
+    const b = agentSessionBindingRegistry.get(bindingId)
+    return b ? { provider: b.provider, sessionId: b.nativeThreadId, epoch: b.epoch, targetKey: b.targetKey } : null
+  },
+}))
 app.use('/api', createQueryJobsRouter(queryJobCoordinator, {
   prepareAdmission: preparePublicDurableQueryAdmission,
 }))
@@ -960,7 +1040,9 @@ app.use(['/api/work-board', '/api/tasks'], (req, res, next) => {
 app.use('/api', createWorkBoardRouter({ readBoard: workBoardReader, requests: () => handoffRequestCapabilities(workHandoffRequestStore, Date.now()) }))
 app.use('/api', createWorkHandoffRequestsRouter({ store: workHandoffRequestStore, readBoard: workBoardReader }))
 // The Today summary for COS Control Web (6.99.26 candidate): Haiku, off unless switched on, with its own caps and breaker.
-app.use('/api', createTodayBriefRouter({ brief: defaultTodayBrief(), board: () => workBoardReader.read(60_000, 3_000).catch(() => null), subagents: keys => readSubagentsFor(keys) }))
+// 2026-11-09: the brief reads the DATED board (when each card last moved), through its own bounded, shared reader.
+const datedWorkBoardReader = createWorkBoardReader(() => listBoardWithDates())
+app.use('/api', createTodayBriefRouter({ brief: defaultTodayBrief(), board: () => datedWorkBoardReader.read(60_000, 3_000).catch(() => null), context: (keys, into) => readSessionContext(keys, into), calendar: () => calendarToday() }))
 // Work intake (6.57.0): meeting-derived suggestions, asks and review items. Optional: a bad journal never blocks boot.
 const workIntakeStore = createOptionalWorkIntakeStore(() => new WorkIntakeStore(dataPath('work-intake')))
 app.use('/api', createWorkIntakeRouter({ store: workIntakeStore }))
@@ -1073,6 +1155,8 @@ app.use('/api', transcribeRouter)
 app.use('/api', sessionIndexRouter)
 // Claude + Codex + Cursor transcripts from this Mac. Same 7-day window as Control.
 app.use('/api', agentSessionsRouter)
+// Step 2a (Sessions chat-style layout): COS folders, COS pins and renamed titles. Additive; an older server 404s these.
+app.use('/api', createSessionOrganizerRouter())
 // The live view of one of those sessions. Four segments ending in a literal `stream`,
 // so it cannot shadow the three-segment transcript route above or the bindings
 // router's `/attachability` below. READ-ONLY, and deliberately NOT behind
@@ -1551,8 +1635,13 @@ async function gracefulShutdown(): Promise<void> {
     if (parakeet.killed || parakeet.removed) console.log(`[stt] shutdown: killed ${parakeet.killed} Parakeet run(s), removed ${parakeet.removed} temp dir(s)`)
   } catch { /* best effort */ }
   stopCodexModelCatalogRefresh()
-  stopWhisperServer()
-  await stopWhisperPreviewServer({ final: true })
+  // S1 (2026-11-09): both whisper-server children are stopped with SIGKILL and waited for
+  // (about 2 s at most each, inside the 8 s force exit), so an update restart leaves no
+  // Metal-teardown crash report and no orphan reparented to launchd.
+  await Promise.all([
+    stopWhisperServer().catch(err => console.error('[shutdown] whisper-server stop:', err)),
+    stopWhisperPreviewServer({ final: true }),
+  ])
   stopLocalTtsServer()
   clearTimeout(forceExit)
   process.exit(0)
@@ -1574,19 +1663,33 @@ process.on('unhandledRejection', (reason: any) => {
 // Start HTTPS alongside HTTP — Even Hub WebView prefers HTTPS (iOS ATS).
 // Optional: drop cert.pem + key.pem in server/certs/ (e.g. via mkcert) to enable.
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
+// 6.99.31 (Phase 6): served-asset integrity, OFF by default (lib/web-control-integrity.ts). On, /control
+// serves only bytes that matched the pack-time manifest, from memory, re-checked every 60 s, with no
+// disk server behind it. Read once at boot.
+const webControlIntegrity = webControlEnabled() && webControlIntegrityEnabled()
+  ? new WebControlIntegrity(path.join(path.dirname(fileURLToPath(import.meta.url)), 'web-control'))
+  : null
 if (webControlEnabled()) {
   const webControlDir = path.join(__dirname, 'web-control')
+  const webControlServers = webControlIntegrity
+    ? [createWebControlStatic(webControlDir, { integrity: webControlIntegrity })]
+    : [createWebControlStatic(webControlDir), express.static(webControlDir)]
   app.use('/control', (req, res, next) => {
     // Loopback and Tailscale only, unless COS_WEB_CONTROL_LAN=1 (review W2).
     if (!isWebControlSocketAllowed(req.socket?.remoteAddress, process.env, req.headers)) {
-      res.status(403).type('text').send('COS Control Web is available on this Mac and over Tailscale.')
+      // W1 (audit 02 F1): still 403, but a browser gets a short page that says to use Tailscale (lib/web-control-offnet-page.ts).
+      const offnet = webControlOffnetResponse(/\btext\/html\b/i.test(String(req.headers.accept ?? '')))
+      res.setHeader('Cache-Control', 'no-store')
+      if (offnet.csp) res.setHeader('Content-Security-Policy', offnet.csp)
+      res.setHeader('X-Content-Type-Options', 'nosniff')
+      res.status(403).type(offnet.type).send(offnet.body)
       return
     }
     res.setHeader('Content-Security-Policy', webControlCsp(req.path))
     res.setHeader('X-Content-Type-Options', 'nosniff')
     res.setHeader('Referrer-Policy', 'no-referrer')
     next()
-  }, createWebControlStatic(webControlDir), express.static(webControlDir))
+  }, ...webControlServers)
   app.use('/api', createWebControlRouter({
     apiToken: () => API_TOKEN,
     serverVersion: () => managedServerVersion() ?? 'unknown',
@@ -1632,19 +1735,22 @@ function withRequestTimeout<T extends { requestTimeout: number }>(server: T): T
 
 const certDir = path.join(__dirname, 'certs')
 const listeners: RequiredListener[] = []
-if (existsSync(path.join(certDir, 'cert.pem'))) {
-  const httpsServer = withRequestTimeout(createHttpsServer({
-    cert: readFileSync(path.join(certDir, 'cert.pem')),
-    key: readFileSync(path.join(certDir, 'key.pem')),
-  }, app))
-  listeners.push({ server: httpsServer, port: HTTPS_PORT, host: BIND_HOST, label: 'HTTPS' })
-} else {
-  console.log('[COS API] No certs found — HTTPS disabled (drop cert.pem/key.pem in server/certs to enable)')
+const httpsAvailable = existsSync(path.join(certDir, 'cert.pem'))
+if (!httpsAvailable) console.log('[COS API] No certs found — HTTPS disabled (drop cert.pem/key.pem in server/certs to enable)')
+// 6.99.31: with COS_WEB_KEY_AUTHORITY on, the phone key's signer origin (https on 3144, same cert)
+// joins the REQUIRED set like 3143 (lib/listener-startup.ts listenerPlan). Flag off: 6.99.29's set.
+for (const entry of listenerPlan({ httpsAvailable, webKeyAuthority: webKeyAuthorityEnabled(), httpPort: PORT, httpsPort: HTTPS_PORT, signerPort: WEB_KEY_SIGNER_PORT })) {
+  // Phase 3: 3144 serves the signer page (verified bytes only) and an allowlist of /api routes,
+  // never the big app (lib/web-key-signer-app.ts). It exists only with the flag on.
+  const handler = entry.label === 'HTTPS signer'
+    ? createWebKeySignerHandler({ integrity: webKeySignerIntegrity, api: app, origin: () => webKeySignerOrigin(webKeySelfDnsName()) })
+    : app
+  const server = entry.tls
+    ? withRequestTimeout(createHttpsServer({ cert: readFileSync(path.join(certDir, 'cert.pem')), key: readFileSync(path.join(certDir, 'key.pem')) }, handler))
+    : withRequestTimeout(createHttpServer(app))
+  listeners.push({ server, port: entry.port, host: BIND_HOST, label: entry.label })
 }
 
-const httpServer = withRequestTimeout(createHttpServer(app))
-listeners.push({ server: httpServer, port: PORT, host: BIND_HOST, label: 'HTTP' })
-
 listenRequiredServers(listeners).then(() => {
   const serverInstanceId = initializeServerInstanceId()
   const startupAdmissionsOpen = maintenanceAdmissionsOpen()

package/server/lib/agent-session-older.ts

@@ -0,0 +1,218 @@
+/**
+ * Older sessions in a short form (Sessions chat-style layout, step 2a; S1_CONTRACT_step2a.md, B2).
+ *
+ * The main list (listAgentSessions) keeps its 7-day window and its per-agent cap of 20, so its 5-second poll stays the
+ * size it is. On Miles's Mac that cap shows only the newest ~4 hours of Claude sessions (333 transcripts in 7 days,
+ * measured 2026-11-10). This walk answers the rest of the last `days` days as SHORT rows: id, agent, title, project,
+ * dates. No state, activity or model: those come from the detail route when a session is opened.
+ *
+ * - Paged newest first across all agents by `before` (exclusive) and `limit`; `nextBefore` is null on the last page.
+ * - Leaves out the ids in `exclude` (live rows, passed by the route) and each agent's own pins. A row may still also be
+ *   in the main list; the client keeps the main row.
+ * - Includes the ids in `keep` (COS pins, folder members, COS-started sessions) AT ANY AGE (Q1 FIX 1, lead ruling
+ *   2026-11-10): the main list holds at most KEPT_LIST_MAX of them, so a kept row past that ceiling comes back here as
+ *   a short row and is never silently dropped. The ones the main list does have are repeats the client drops.
+ * - Leaves out keep-warm sessions and Codex subagent rollouts, as the main list does.
+ * - Titles are read with the main list's own rules and memoized on file mtime and size. These files are days old and
+ *   rarely change, so a repeat call re-reads almost nothing.
+ * - `olderThanWindow` counts sessions past `days` that are not kept or pinned: the "N older through search" line.
+ */
+import { join } from 'node:path'
+import {
+  AGENT_SESSION_MAX_FILE_BYTES,
+  CLAUDE_UUID_JSONL,
+  codexSessionRootsOf,
+  createdFromCodexFilename,
+  dirents,
+  fileStat,
+  firstClaudeUserTitle,
+  firstCursorUserTitle,
+  idFromCodexFilename,
+  isKeepWarmSessionTitle,
+  isoFromMtime,
+  listCodexJsonlFiles,
+  loadClaudeDesktopAliases,
+  loadClaudeStarredIds,
+  loadCodexPinnedIdsAll,
+  loadCodexThreadNamesAll,
+  loadCursorComposerNames,
+  loadCursorPinnedIds,
+  peekClaudeDiscussion,
+  peekCodexMeta,
+  peekCursorDiscussion,
+  workspaceLabel,
+  type AgentProvider,
+  type AgentSessionRoots,
+  type ClaudeAliasMap,
+} from './agent-session-store.js'
+
+export const OLDER_DEFAULT_DAYS = 30
+export const OLDER_MIN_DAYS = 2
+export const OLDER_MAX_DAYS = 30
+export const OLDER_DEFAULT_LIMIT = 100
+export const OLDER_MAX_LIMIT = 200
+
+export interface OlderSessionRow {
+  session_id: string
+  provider: AgentProvider
+  display_label: string
+  project: string
+  modified: string
+  created: string
+  form: 'short'
+}
+
+interface Candidate { provider: AgentProvider; id: string; file: string; mtimeMs: number; birthtimeMs: number; size: number; folder: string }
+interface Resolved { title: string; project: string; created: string; id: string; skip: boolean }
+
+/** file -> what was read for this exact mtime and size. Bounded; cleared oldest-first. */
+const titleMemo = new Map<string, { mtimeMs: number; size: number; resolved: Resolved }>()
+const TITLE_MEMO_MAX = 5_000
+export const olderTitleStats = { reads: 0, memoHits: 0 }
+export function __resetOlderTitleMemoForTests(): void { titleMemo.clear(); olderTitleStats.reads = 0; olderTitleStats.memoHits = 0 }
+
+async function memoized(candidate: Candidate, read: () => Promise<Resolved>): Promise<Resolved> {
+  const hit = titleMemo.get(candidate.file)
+  if (hit && hit.mtimeMs === candidate.mtimeMs && hit.size === candidate.size) { olderTitleStats.memoHits++; return hit.resolved }
+  olderTitleStats.reads++
+  const resolved = await read()
+  titleMemo.delete(candidate.file)
+  titleMemo.set(candidate.file, { mtimeMs: candidate.mtimeMs, size: candidate.size, resolved })
+  while (titleMemo.size > TITLE_MEMO_MAX) titleMemo.delete(titleMemo.keys().next().value!)
+  return resolved
+}
+
+export async function listOlderSessions(roots: AgentSessionRoots, now: Date, options: {
+  days?: number
+  before?: number
+  limit?: number
+  exclude?: Partial<Record<AgentProvider, ReadonlySet<string>>>
+  /** Listed at any age, outside `days` (see the header). */
+  keep?: Partial<Record<AgentProvider, ReadonlySet<string>>>
+  aliases?: ClaudeAliasMap
+} = {}): Promise<{ rows: OlderSessionRow[]; nextBefore: string | null; olderThanWindow: number }> {
+  const days = Math.min(OLDER_MAX_DAYS, Math.max(OLDER_MIN_DAYS, Math.floor(options.days ?? OLDER_DEFAULT_DAYS)))
+  const limit = Math.min(OLDER_MAX_LIMIT, Math.max(1, Math.floor(options.limit ?? OLDER_DEFAULT_LIMIT)))
+  const cutoff = now.getTime() - days * 24 * 3600 * 1000
+  const before = Number.isFinite(options.before) ? options.before! : Number.POSITIVE_INFINITY
+  const excluded = (provider: AgentProvider, id: string) => options.exclude?.[provider]?.has(id.toLowerCase()) ?? false
+  const kept = (provider: AgentProvider, id: string) => options.keep?.[provider]?.has(id.toLowerCase()) ?? false
+
+  const aliases = options.aliases ?? await loadClaudeDesktopAliases(roots.claudeCodeSessions)
+  const canonical = (id: string) => { const cli = aliases.get(id)?.cliSessionId; return cli && CLAUDE_UUID_JSONL.test(cli + '.jsonl') ? cli : id }
+  const claudeStars = new Set([...await loadClaudeStarredIds(roots.claudeDesktopConfig)].map(id => canonical(id).toLowerCase()))
+  const codexPinned = await loadCodexPinnedIdsAll(roots)
+  const cursorPinned = await loadCursorPinnedIds(roots.cursorWorkspaceStorage)
+
+  let olderThanWindow = 0
+  const candidates: Candidate[] = []
+  const consider = (c: Candidate, pinned: boolean) => {
+    if (pinned || excluded(c.provider, c.id)) return
+    if (c.mtimeMs < cutoff && !kept(c.provider, c.id)) { olderThanWindow++; return }
+    candidates.push(c)
+  }
+
+  for (const folder of await dirents(roots.claudeProjects)) {
+    const dir = join(roots.claudeProjects, folder)
+    for (const name of await dirents(dir)) {
+      if (!CLAUDE_UUID_JSONL.test(name)) continue
+      const id = name.slice(0, -6).toLowerCase()
+      const st = await fileStat(join(dir, name))
+      if (!st?.isFile) continue
+      consider({ provider: 'claude', id, file: join(dir, name), mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs, size: st.size, folder }, claudeStars.has(id))
+    }
+  }
+  for (const root of codexSessionRootsOf(roots)) {
+    for (const file of await listCodexJsonlFiles(root)) {
+      const id = idFromCodexFilename(file.split('/').pop() || '')
+      if (!id) continue
+      const st = await fileStat(file)
+      if (!st?.isFile) continue
+      consider({ provider: 'codex', id, file, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs, size: st.size, folder: '' }, codexPinned.has(id))
+    }
+  }
+  const cursorById = new Map<string, Candidate>()
+  for (const folder of await dirents(roots.cursorProjects)) {
+    if (folder.includes('var-folders') || folder.includes('private-var') || folder === 'empty-window') continue
+    const transcripts = join(roots.cursorProjects, folder, 'agent-transcripts')
+    for (const sessionDir of await dirents(transcripts)) {
+      if (sessionDir === 'subagents') continue
+      const file = join(transcripts, sessionDir, `${sessionDir}.jsonl`)
+      const st = await fileStat(file)
+      if (!st?.isFile || st.size > AGENT_SESSION_MAX_FILE_BYTES) continue
+      const id = sessionDir.toLowerCase()
+      const next: Candidate = { provider: 'cursor', id, file, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs, size: st.size, folder }
+      const prev = cursorById.get(id)
+      if (!prev || next.mtimeMs > prev.mtimeMs) cursorById.set(id, next)
+    }
+  }
+  for (const c of cursorById.values()) consider(c, cursorPinned.has(c.id))
+
+  const page = candidates.filter(c => c.mtimeMs < before).sort((a, b) => b.mtimeMs - a.mtimeMs)
+  const codexNames = page.some(c => c.provider === 'codex') ? await loadCodexThreadNamesAll(roots) : new Map<string, string>()
+  const cursorNames = page.some(c => c.provider === 'cursor') && roots.cursorComposerDb
+    ? await loadCursorComposerNames(roots.cursorComposerDb) : new Map<string, string>()
+  const desktopTitles = new Map<string, string>()
+  for (const [id, head] of aliases) if (head?.title) desktopTitles.set(canonical(id).toLowerCase(), head.title)
+
+  const rows: OlderSessionRow[] = []
+  let consumed = 0
+  for (const c of page) {
+    if (rows.length >= limit) break
+    consumed++
+    const r = await memoized(c, () => resolve(c, codexNames, cursorNames, desktopTitles))
+    if (r.skip) continue
+    rows.push({ session_id: r.id, provider: c.provider, display_label: r.title, project: r.project, modified: isoFromMtime(c.mtimeMs), created: r.created, form: 'short' })
+  }
+  const more = consumed < page.length
+  return {
+    rows,
+    nextBefore: more && consumed > 0 ? isoFromMtime(page[consumed - 1].mtimeMs) : null,
+    olderThanWindow,
+  }
+}
+
+async function resolve(c: Candidate, codexNames: Map<string, string>, cursorNames: Map<string, string>, desktopTitles: Map<string, string>): Promise<Resolved> {
+  const created = isoFromMtime(c.birthtimeMs)
+  if (c.provider === 'claude') {
+    const peek = await peekClaudeDiscussion(c.file)
+    const title = peek.customTitle ?? await firstClaudeUserTitle(c.file) ?? desktopTitles.get(c.id) ?? 'Claude session'
+    return { id: c.id, title, project: workspaceLabel(c.folder), created, skip: isKeepWarmSessionTitle(title) }
+  }
+  if (c.provider === 'codex') {
+    const meta = await peekCodexMeta(c.file)
+    if (!meta || meta.subagent) return { id: c.id, title: '', project: '', created, skip: true }
+    // The main list's rule: the filename wins when the meta id disagrees (a cloned rollout copies its parent's meta).
+    const metaId = (meta.id || '').trim().toLowerCase()
+    const id = metaId && metaId !== c.id ? c.id : (metaId || c.id)
+    const title = codexNames.get(id) || meta.title || 'Codex session'
+    const name = c.file.split('/').pop() || ''
+    return { id, title, project: workspaceLabel(meta.cwd), created: meta.created || createdFromCodexFilename(name) || created, skip: isKeepWarmSessionTitle(title) }
+  }
+  const peek = await peekCursorDiscussion(c.file)
+  const title = cursorNames.get(c.id) || await firstCursorUserTitle(c.file) || peek.lastUser || 'Cursor session'
+  return { id: c.id, title, project: workspaceLabel(c.folder), created, skip: isKeepWarmSessionTitle(title) }
+}
+
+
+/** One session's short row from its transcript file (renamed-title search hits). Null when it cannot be read or is a
+ *  keep-warm or subagent session. Uses the same title rules and memo as the older walk. */
+export async function shortRowFor(provider: AgentProvider, file: string, aliases?: ClaudeAliasMap, roots?: AgentSessionRoots): Promise<OlderSessionRow | null> {
+  const st = await fileStat(file)
+  if (!st?.isFile) return null
+  const parts = file.split('/')
+  const name = parts.pop() || ''
+  const id = provider === 'claude' ? name.replace(/\.jsonl$/, '').toLowerCase()
+    : provider === 'codex' ? (idFromCodexFilename(name) ?? '')
+      : (parts[parts.length - 1] || '').toLowerCase()
+  if (!id) return null
+  const folder = provider === 'claude' ? parts[parts.length - 1] || '' : provider === 'cursor' ? parts[parts.length - 3] || '' : ''
+  const c: Candidate = { provider, id, file, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs, size: st.size, folder }
+  const codexNames = provider === 'codex' && roots ? await loadCodexThreadNamesAll(roots) : new Map<string, string>()
+  const cursorNames = provider === 'cursor' && roots?.cursorComposerDb ? await loadCursorComposerNames(roots.cursorComposerDb) : new Map<string, string>()
+  const desktopTitles = new Map<string, string>()
+  for (const head of (aliases ?? new Map()).values()) if (head?.title && head.cliSessionId?.toLowerCase() === id) desktopTitles.set(id, head.title)
+  const r = await memoized(c, () => resolve(c, codexNames, cursorNames, desktopTitles))
+  if (r.skip) return null
+  return { session_id: r.id, provider, display_label: r.title, project: r.project, modified: isoFromMtime(c.mtimeMs), created: r.created, form: 'short' }
+}