@gotcos/glasses-server 7.0.7 → 7.0.27

package/server/lib/api-auth.ts

@@ -1,7 +1,7 @@
 import type { RequestHandler } from 'express'
 import { timingSafeTokenEqual } from './token-auth.js'
 import { PAIRING_NONCE_BODY } from './glasses-pairing.js'
-import { isWebSessionAuthorized } from './web-session-auth.js'
+import { formatSetWebSessionCookie, isWebSessionAuthorized, renewWebSessionCookieValue, verifyWebSessionCookieValue, webSessionCookieFrom } from './web-session-auth.js'
 
 // Recovery/setup clients need these availability surfaces before they have a
 // usable token. Keep private provider state and every mutation route out.
@@ -44,9 +44,31 @@ const DISPLAY_STREAM_CAPABILITY_PATH = /^\/display-stream\/\d{1,15}\.[0-9a-f]{64
 // Minting, status and decisions stay behind the token AND a loopback socket.
 const PAIRING_POLL_PATH = new RegExp(`^/pairing/claim/${PAIRING_NONCE_BODY}$`)
 
+/** Set on a response whose request renewed its browser sign-in: `<new expiry ISO> <30-day cap ISO>`. The page reads it. */
+export const WEB_SESSION_RENEWED_HEADER = 'X-COS-Web-Session'
+
 /** `res.locals` key the gate sets to `'token'` when the X-COS-Token header matched. */
 export const API_AUTH_BY_LOCAL = 'cosApiAuthBy'
 
+/**
+ * Final review S1 (lead 2026-11-10 02:09): `res.locals` key the gate sets ONLY for a request it let in by the browser's
+ * sign-in cookie: a check that the same cookie still verifies now (its expiry, the epoch "Sign out every browser" bumps,
+ * the 30-day cap). A stream that outlives its opening request calls it on every heartbeat (`streamSignInHolds`).
+ */
+export const WEB_SESSION_RECHECK_LOCAL = 'cosWebSessionRecheck'
+
+/**
+ * For a long-lived stream, on each heartbeat: false once the browser sign-in that opened it no longer verifies, so the
+ * stream tears down. A request the API token let in has no re-check and always holds, as does one that never passed
+ * the gate (a route mounted without it in a test). The browser reconnects with whatever cookie it holds now; a renewed
+ * one verifies there.
+ */
+export function streamSignInHolds(res: { locals?: Record<string, unknown> }): boolean {
+  const recheck = res.locals?.[WEB_SESSION_RECHECK_LOCAL]
+  if (typeof recheck !== 'function') return true
+  try { return recheck() === true } catch { return false }
+}
+
 export function isPublicApiRequest(method: string, path: string): boolean {
   if (PUBLIC_API_PATHS.has(path)) return true
   if (method === 'POST' && path === '/pairing/claim') return true
@@ -92,6 +114,20 @@ export function requireApiToken(apiToken: string, options: RequireApiTokenOption
       allowedPorts: options.allowedPorts?.(),
     })
     if (cookieAuth) {
+      // Final review S1: the cookie this request came in with, checked again by any stream it opens (above).
+      const opened = webSessionCookieFrom(req.headers.cookie)
+      res.locals[WEB_SESSION_RECHECK_LOCAL] = (): boolean => verifyWebSessionCookieValue(opened, apiToken, Date.now())
+      // 7.0.x (Miles 2026-11-09, "Renew while in use, 30-day cap"): only here, after the socket, cookie, CSRF and Origin
+      // checks above all passed, a cookie in its last 2 days gets a fresh one, never past 30 days from its first sign-in.
+      // Appended, so a route's own Set-Cookie (none today on gated routes) is never overwritten. A renewal that cannot
+      // be made (outside the window, at the cap) changes nothing.
+      try {
+        const renewed = renewWebSessionCookieValue(webSessionCookieFrom(req.headers.cookie), apiToken)
+        if (renewed) {
+          res.append('Set-Cookie', formatSetWebSessionCookie(renewed.value, Math.floor((renewed.expiresAtMs - Date.now()) / 1000), req.secure))
+          res.setHeader(WEB_SESSION_RENEWED_HEADER, new Date(renewed.expiresAtMs).toISOString() + ' ' + new Date(renewed.capAtMs).toISOString())
+        }
+      } catch { /* a failed renewal leaves the request and the old cookie as they were */ }
       return next()
     }
     return res.status(401).json({

package/server/lib/calendar-meetings.ts

@@ -0,0 +1,70 @@
+/**
+ * Today round 2 (2026-11-09): which calendar rows are distinct, real meetings. ONE helper for the calendar API
+ * (calendar-source.ts calendarToday: next, remainingCount, endedRecently) and the Today summary (today-brief.ts
+ * withCalendar), so the two never disagree.
+ *
+ * - Canceled: a title that starts "Canceled:" or "Cancelled:" (how Exchange and Google rename a canceled occurrence),
+ *   or a row whose `status` says canceled, or `canceled: true` (the snapshot's EventKit status, when it carries one;
+ *   the 11/09 snapshot had no status field on any of its 154 events).
+ * - Distinct: the same title (trimmed, case-folded, spaces collapsed) at the same start is one meeting, whichever
+ *   calendar it is on. The 11/09 live snapshot had 13 such pairs or triples, 12 of them on ONE Exchange calendar with
+ *   different external ids (the same invite delivered twice), so "across calendars" alone would have left 12 of them.
+ *   The first row of each wins, so callers keep their own order.
+ * No dependencies: the summary imports it without the calendar reader.
+ */
+export const CANCELED_TITLE = /^\s*(?:canceled|cancelled)\s*:/i
+const CANCELED_STATUS = new Set(['canceled', 'cancelled'])
+
+export interface MeetingFields { title: unknown; start: unknown; status?: unknown; canceled?: unknown }
+
+export function isCanceledMeeting(row: MeetingFields): boolean {
+  if (row.canceled === true) return true
+  if (typeof row.status === 'string' && CANCELED_STATUS.has(row.status.trim().toLowerCase())) return true
+  return typeof row.title === 'string' && CANCELED_TITLE.test(row.title)
+}
+
+/** The identity of one meeting: its title and its start instant. */
+export function meetingKey(row: MeetingFields): string {
+  const title = typeof row.title === 'string' ? row.title.trim().toLowerCase().replace(/\s+/g, ' ') : ''
+  const start = typeof row.start === 'number' ? row.start : Date.parse(String(row.start ?? ''))
+  return `${title}|${Number.isFinite(start) ? start : String(row.start ?? '')}`
+}
+
+/** The rows that are real meetings, one per meeting, in the order given. */
+export function distinctMeetings<T>(rows: readonly T[], fields: (row: T) => MeetingFields): T[] {
+  const seen = new Set<string>()
+  const out: T[] = []
+  for (const row of rows) {
+    const f = fields(row)
+    if (isCanceledMeeting(f)) continue
+    const key = meetingKey(f)
+    if (seen.has(key)) continue
+    seen.add(key)
+    out.push(row)
+  }
+  return out
+}
+
+/**
+ * Prep on every Next up row (Miles typed 2026-11-09 13:00 CST): a calendar hold or status block is not a meeting to
+ * prep for. ONE list for the server: /api/calendar/today marks each row `hold`, /api/welcome-context marks nextEvent
+ * `hold`, and Control Web and desktop Control read that flag instead of keeping their own copy of the words.
+ *
+ * A title is a hold when, after leading punctuation ("[Hold] ...", "* Busy"), it starts with one of these words or
+ * phrases as a whole word, and it does not name someone with "with" ("Lunch with Jeremy" and "Focus group with the
+ * Jewel360 board" are meetings). Case and repeated spaces do not matter. A false "not a hold" only offers Prep on a hold;
+ * a false "hold" would hide Prep on a real meeting, so the rule stays narrow.
+ */
+export const CALENDAR_HOLD_WORDS: readonly string[] = Object.freeze([
+  'blocked', 'block', 'busy', 'hold', 'holds', 'focus', 'travel', 'personal', 'private', 'ooo', 'out of office', 'lunch',
+  'pto', 'vacation', 'commute', 'dnd', 'do not book', 'do not schedule',
+])
+// Letters and single spaces only, so the words need no escaping.
+const HOLD_START = new RegExp(`^(?:${CALENDAR_HOLD_WORDS.join('|')})(?![a-z0-9])`)
+
+export function isCalendarHold(title: unknown): boolean {
+  if (typeof title !== 'string') return false
+  const t = title.trim().toLowerCase().replace(/\s+/g, ' ').replace(/^[^a-z0-9]+/, '')
+  if (!t || !HOLD_START.test(t)) return false
+  return !/(?:^|[^a-z0-9])with(?![a-z0-9])/.test(t)
+}

package/server/lib/calendar-source.ts

@@ -22,6 +22,7 @@
 import { lstatSync, readFileSync } from 'node:fs'
 import { dataPath } from './data-dir.js'
 import { callPython, pythonBridgeAvailable } from './python-bridge.js'
+import { distinctMeetings, isCalendarHold, type MeetingFields } from './calendar-meetings.js'
 
 export const SNAPSHOT_FRESH_MS = 2 * 3600_000
 export const SNAPSHOT_MAX_AGE_MS = 24 * 3600_000
@@ -61,6 +62,8 @@ export interface SnapshotEvent {
   attendees: SnapshotAttendee[]
   /** Allowlisted hosts only (zoom.us, teams.microsoft.com, meet.google.com). */
   meetingUrl: string | null
+  /** Today round 2: EventKit's status said canceled (only when the writer sends `status: "canceled"`). */
+  canceled?: boolean
 }
 
 export interface CalendarSnapshot {
@@ -159,6 +162,7 @@ export function parseSnapshot(raw: unknown): CalendarSnapshot | null {
       isOrganizer: r.isOrganizer === true,
       attendees,
       meetingUrl: url,
+      ...(typeof r.status === 'string' && /^cancel+ed$/i.test(r.status.trim()) ? { canceled: true } : {}),
     })
   }
   return { version: 1, writtenAt, windowStart, windowEnd, access, calendars, events }
@@ -340,6 +344,7 @@ export function bridgeEvent(e: SnapshotEvent, calendar: SnapshotCalendar | undef
     event_id: e.eventId,
     external_id: e.externalId,
     occurrence_start: e.occurrenceStart,
+    ...(e.canceled ? { canceled: true } : {}),
   }
 }
 
@@ -454,32 +459,52 @@ export function countsAsMeeting(row: Record<string, unknown> | null | undefined)
 }
 
 /**
- * Today for Control Web and desktop: selected calendars only, the next 3 timed meetings that count. QA 7.0.0: all-day
- * and non-prep events (declined, holidays, attendee-less shared events) are filtered out BEFORE the 3 are taken, so they
- * never use up the slots Today's "Later" shows. QA W23: remainingCount counts the same rows, so a declined meeting or
- * a family flight is not "remaining".
+ * Today for Control Web and desktop: selected calendars only, the next 5 timed meetings that count (Today round 2,
+ * Miles 2026-11-09: was 3). QA 7.0.0: all-day and non-prep events (declined, holidays, attendee-less shared events) are
+ * filtered out BEFORE the 5 are taken, so they never use up the slots Today's "Later" shows. QA W23: remainingCount
+ * counts the same rows, so a declined meeting or a family flight is not "remaining".
+ *
+ * Today round 2: `endedRecently` lists the meetings that count which ended within the last CALENDAR_ENDED_RECENT_MS
+ * (2 h), newest end first, at most CALENDAR_ENDED_MAX. They come from `today_events` (the snapshot's and the bridge's
+ * own list of every event today, past ones included), with the same end rule the snapshot uses (no end: an hour after
+ * the start). The Today summary uses it to know a meeting is over, so its prep is past. Additive: the older fields keep
+ * their names and meaning (desktop Control 0.5.384 reads next, remainingCount, stale and asOf).
+ *
+ * Today round 2 follow-up: canceled events and duplicates (the same title at the same start) are dropped BEFORE next,
+ * remainingCount and endedRecently are taken (calendar-meetings.ts, the helper the Today summary uses too), so
+ * remainingCount counts real, distinct meetings and no slot is spent twice on one.
  */
-export async function calendarToday(now = Date.now()): Promise<{
+export const CALENDAR_NEXT_MAX = 5
+export const CALENDAR_ENDED_RECENT_MS = 2 * 3600_000
+export const CALENDAR_ENDED_MAX = 5
+/** `hold` (Prep on every Next up row, 11/09): a hold or status block by its title (calendar-meetings.ts isCalendarHold). */
+export interface CalendarTodayRow { title: string; start: string; end: string | null; allDay: boolean; calendar: string | null; meetingUrl: string | null; hold: boolean }
+export interface CalendarEndedRow { title: string; start: string; end: string }
+export interface CalendarTodayView {
   connected: boolean
   source: CalendarSourceName
   asOf: string | null
   stale: boolean
   remainingCount: number
-  next: Array<{ title: string; start: string; end: string | null; allDay: boolean; calendar: string | null; meetingUrl: string | null }>
-}> {
+  next: CalendarTodayRow[]
+  endedRecently: CalendarEndedRow[]
+}
+export async function calendarToday(now = Date.now()): Promise<CalendarTodayView> {
   const read = await readCalendar(8_000, now)
   const data = read.data as Record<string, unknown> | null
   const connected = !!data && typeof data === 'object' && !('error' in data) && (read.source !== 'bridge' || pythonBridgeAvailable())
   const rows = connected && Array.isArray(data!.today_remaining) ? data!.today_remaining as Array<Record<string, unknown>> : []
-  const counted = rows.filter(countsAsMeeting)
-  const next = counted.slice(0, 3).map(r => ({
+  const counted = distinctMeetings(rows.filter(countsAsMeeting), bridgeMeetingFields)
+  const next = counted.slice(0, CALENDAR_NEXT_MAX).map(r => ({
     title: typeof r.title === 'string' ? r.title : 'Event',
     start: String(r.start_time ?? ''),
     end: typeof r.end_time === 'string' ? r.end_time : null,
     allDay: r.is_all_day === true,
     calendar: typeof r.calendar_name === 'string' ? r.calendar_name : null,
     meetingUrl: typeof r.meeting_url === 'string' ? r.meeting_url : null,
+    hold: isCalendarHold(r.title),
   }))
+  const all = connected && Array.isArray(data!.today_events) ? data!.today_events as Array<Record<string, unknown>> : []
   return {
     connected,
     source: read.source,
@@ -487,5 +512,25 @@ export async function calendarToday(now = Date.now()): Promise<{
     stale: data?.is_stale === true,
     remainingCount: connected ? counted.length : 0,
     next,
+    endedRecently: endedRecently(all, now),
+  }
+}
+
+/** A bridge-shaped row's meeting identity, for calendar-meetings.ts. */
+export function bridgeMeetingFields(r: Record<string, unknown>): MeetingFields {
+  return { title: r.title, start: r.start_time, status: r.status, canceled: r.canceled }
+}
+
+/** Distinct, not canceled meetings that count and ended within CALENDAR_ENDED_RECENT_MS of `now`, newest end first. */
+export function endedRecently(rows: Array<Record<string, unknown>>, now: number): CalendarEndedRow[] {
+  const out: Array<CalendarEndedRow & { endMs: number }> = []
+  for (const r of distinctMeetings(rows.filter(countsAsMeeting), bridgeMeetingFields)) {
+    const startMs = Date.parse(String(r.start_time ?? ''))
+    if (!Number.isFinite(startMs)) continue
+    const endRaw = typeof r.end_time === 'string' && r.end_time ? Date.parse(r.end_time) : NaN
+    const endMs = Number.isFinite(endRaw) ? endRaw : startMs + 3600_000
+    if (endMs > now || now - endMs > CALENDAR_ENDED_RECENT_MS) continue
+    out.push({ title: typeof r.title === 'string' ? r.title : 'Event', start: new Date(startMs).toISOString(), end: new Date(endMs).toISOString(), endMs })
   }
+  return out.sort((a, b) => b.endMs - a.endMs).slice(0, CALENDAR_ENDED_MAX).map(({ endMs: _e, ...r }) => r)
 }

package/server/lib/claude-hooks-installer.ts

@@ -24,6 +24,7 @@ import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { atomicWriteFileSync } from './atomic-fs.js'
+import { FULL_HOLD_HOOK_WAIT_S, NON_QUESTION_MATCHER, QUESTION_MATCHER, fullHoldSwitches } from './full-hold.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 
@@ -187,6 +188,93 @@ function priorWaitBlock(scriptPath: string, sub: HookSubscription, paths: HookPa
   return canonicalBlock(scriptPath, { event: sub.event, async: sub.async, timeout: LEGACY_PERMISSION_HOOK_TIMEOUT_S }, paths)
 }
 
+/**
+ * X1 (2026-11-09): how the PermissionRequest hook is written. With `COS_QUESTION_FULL_HOLD` and
+ * `COS_APPROVAL_FULL_HOLD` both off (the default) it is the ONE block every release since 6.60.0
+ * writes, byte for byte (`split: false`). With either on it is TWO blocks of ours, split by matcher
+ * (canary C9, both engines): `AskUserQuestion` waits `questionWaitS`, everything else `otherWaitS`;
+ * a kind whose switch is on waits FULL_HOLD_HOOK_WAIT_S, the other keeps 630. Each block passes its
+ * own wait to the script, so the stamp a request carries is its own block's. Reinstall hooks is what
+ * writes it: until then the file reads `drift` (`priorWaitOnly`, still halt-ready).
+ */
+export interface PermissionHookPlan { split: boolean; questionWaitS: number; otherWaitS: number }
+
+export function permissionHookPlan(env: NodeJS.ProcessEnv = process.env): PermissionHookPlan {
+  const on = fullHoldSwitches(env)
+  if (!on.questions && !on.approvals) return { split: false, questionWaitS: PERMISSION_HOOK_TIMEOUT_S, otherWaitS: PERMISSION_HOOK_TIMEOUT_S }
+  return {
+    split: true,
+    questionWaitS: on.questions ? FULL_HOLD_HOOK_WAIT_S : PERMISSION_HOOK_TIMEOUT_S,
+    otherWaitS: on.approvals ? FULL_HOLD_HOOK_WAIT_S : PERMISSION_HOOK_TIMEOUT_S,
+  }
+}
+
+const UNSPLIT_PLAN: PermissionHookPlan = { split: false, questionWaitS: PERMISSION_HOOK_TIMEOUT_S, otherWaitS: PERMISSION_HOOK_TIMEOUT_S }
+
+/** The two blocks of a split PermissionRequest, question block first. */
+function splitPermissionBlocks(scriptPath: string, sub: HookSubscription, paths: HookPaths, questionWaitS: number, otherWaitS: number): Record<string, unknown>[] {
+  return [
+    canonicalBlock(scriptPath, { ...sub, matcher: QUESTION_MATCHER, timeout: questionWaitS }, paths),
+    canonicalBlock(scriptPath, { ...sub, matcher: NON_QUESTION_MATCHER, timeout: otherWaitS }, paths),
+  ]
+}
+
+/** Our blocks for one event under a plan. Every event but a split PermissionRequest: exactly `[canonicalBlock]`. */
+export function canonicalBlocks(scriptPath: string, sub: HookSubscription, paths: HookPaths, plan: PermissionHookPlan = UNSPLIT_PLAN): Record<string, unknown>[] {
+  if (sub.event === 'PermissionRequest' && plan.split) return splitPermissionBlocks(scriptPath, sub, paths, plan.questionWaitS, plan.otherWaitS)
+  return [canonicalBlock(scriptPath, sub, paths)]
+}
+
+/**
+ * Earlier shapes of our PermissionRequest blocks that differ from the plan only by the wait: the
+ * pre-6.60.0 block (`priorWaitBlock`); with a split plan, the one unsplit block; with an unsplit
+ * plan, every split pair this file can write (a flag turned off after Reinstall hooks).
+ */
+function priorWaitVariants(scriptPath: string, sub: HookSubscription, paths: HookPaths, plan: PermissionHookPlan): Record<string, unknown>[][] {
+  const prior = priorWaitBlock(scriptPath, sub, paths)
+  if (!prior) return []
+  const out: Record<string, unknown>[][] = [[prior]]
+  if (plan.split) out.push([canonicalBlock(scriptPath, sub, paths)])
+  const waits = [PERMISSION_HOOK_TIMEOUT_S, FULL_HOLD_HOOK_WAIT_S]
+  for (const q of waits) for (const o of waits) {
+    if (plan.split && q === plan.questionWaitS && o === plan.otherWaitS) continue
+    if (q === PERMISSION_HOOK_TIMEOUT_S && o === PERMISSION_HOOK_TIMEOUT_S) continue
+    out.push(splitPermissionBlocks(scriptPath, sub, paths, q, o))
+  }
+  return out
+}
+
+/** Whether a hook block's `matcher` selects this tool, as Claude Code reads it: no matcher, `*` or an empty one is every tool, else a regex. */
+function matcherSelects(matcher: unknown, toolName: string): boolean {
+  if (matcher === undefined || matcher === null || matcher === '' || matcher === '*') return true
+  if (typeof matcher !== 'string') return false
+  if (matcher === toolName) return true
+  try { return new RegExp(`^(?:${matcher})$`).test(toolName) } catch { return false }
+}
+
+/**
+ * X1: how long Claude Code waits on our PermissionRequest hook FOR THIS TOOL: the smallest timeout
+ * among our blocks whose matcher selects it. With the one unsplit block, the same number as
+ * `permissionHookTimeoutS`. Null when none of ours selects it or one has no usable number.
+ */
+export function permissionHookTimeoutForToolS(settings: unknown, toolName: string): number | null {
+  const hooks = settings && typeof settings === 'object' ? (settings as Record<string, unknown>).hooks : null
+  const blocks = hooks && typeof hooks === 'object' ? (hooks as Record<string, unknown>).PermissionRequest : null
+  if (!Array.isArray(blocks)) return null
+  let least: number | null = null
+  for (const block of blocks) {
+    if (!blockIsOurs(block)) continue
+    if (!matcherSelects((block as HookBlock).matcher, toolName)) continue
+    for (const h of (block as HookBlock).hooks as unknown[]) {
+      if (!hookIsOurs(h)) continue
+      const timeout = (h as { timeout?: unknown }).timeout
+      if (typeof timeout !== 'number' || !Number.isFinite(timeout) || timeout <= 0) return null
+      least = least === null ? timeout : Math.min(least, timeout)
+    }
+  }
+  return least
+}
+
 /**
  * 6.60.0: how long Claude Code waits on OUR PermissionRequest hook, read from a settings
  * object: the smallest `timeout` among our entries (Claude runs each, so the first to give up
@@ -220,7 +308,7 @@ export type MergeResult =
  * `hooks` key that is not an object, or an event whose value is not an array, is refused
  * rather than replaced: "preserving every existing hook block" is the contract.
  */
-export function mergeHookSettings(current: unknown, scriptPath: string, paths: HookPaths = currentHookPaths()): MergeResult {
+export function mergeHookSettings(current: unknown, scriptPath: string, paths: HookPaths = currentHookPaths(), plan: PermissionHookPlan = permissionHookPlan()): MergeResult {
   const settings: Record<string, unknown> = current && typeof current === 'object' && !Array.isArray(current) ? { ...(current as Record<string, unknown>) } : {}
   const before = JSON.stringify(settings)
   if (settings.hooks !== undefined && (!settings.hooks || typeof settings.hooks !== 'object' || Array.isArray(settings.hooks))) return { ok: false, reason: 'settings_hooks_invalid' }
@@ -231,7 +319,7 @@ export function mergeHookSettings(current: unknown, scriptPath: string, paths: H
     if (value !== undefined && !Array.isArray(value)) return { ok: false, reason: 'settings_hooks_invalid' }
     const existing = Array.isArray(value) ? value : []
     const foreign = existing.filter(b => !blockIsOurs(b))
-    hooks[sub.event] = [...foreign, canonicalBlock(scriptPath, sub, paths)]
+    hooks[sub.event] = [...foreign, ...canonicalBlocks(scriptPath, sub, paths, plan)]
   }
   settings.hooks = hooks
   return { ok: true, settings, changed: JSON.stringify(settings) !== before }
@@ -258,7 +346,7 @@ export function stripHookSettings(current: unknown): MergeResult {
  * (6.60.0) names the drifted events whose one block of ours is exactly the block an earlier
  * release wrote, differing only by the wait (`priorWaitBlock`).
  */
-export function subscribedEvents(current: unknown, scriptPath: string, paths: HookPaths = currentHookPaths()): { subscribed: string[]; missing: string[]; drifted: string[]; priorWait: string[] } {
+export function subscribedEvents(current: unknown, scriptPath: string, paths: HookPaths = currentHookPaths(), plan: PermissionHookPlan = permissionHookPlan()): { subscribed: string[]; missing: string[]; drifted: string[]; priorWait: string[] } {
   const hooks = current && typeof current === 'object' && (current as Record<string, unknown>).hooks
   const table = hooks && typeof hooks === 'object' ? hooks as Record<string, unknown> : {}
   const subscribed: string[] = []
@@ -269,11 +357,10 @@ export function subscribedEvents(current: unknown, scriptPath: string, paths: Ho
     const blocks = Array.isArray(table[sub.event]) ? table[sub.event] as unknown[] : []
     const ours = blocks.filter(blockIsOurs)
     if (ours.length === 0) { missing.push(sub.event); continue }
-    const canonical = JSON.stringify(canonicalBlock(scriptPath, sub, paths))
-    if (ours.length === 1 && JSON.stringify(ours[0]) === canonical) { subscribed.push(sub.event); continue }
+    const canonical = JSON.stringify(canonicalBlocks(scriptPath, sub, paths, plan))
+    if (JSON.stringify(ours) === canonical) { subscribed.push(sub.event); continue }
     drifted.push(sub.event)
-    const prior = priorWaitBlock(scriptPath, sub, paths)
-    if (prior && ours.length === 1 && JSON.stringify(ours[0]) === JSON.stringify(prior)) priorWait.push(sub.event)
+    if (priorWaitVariants(scriptPath, sub, paths, plan).some(variant => JSON.stringify(variant) === JSON.stringify(ours))) priorWait.push(sub.event)
   }
   return { subscribed, missing, drifted, priorWait }
 }
@@ -312,6 +399,11 @@ export interface HookStatus {
   observerOnlyDrift?: boolean
   /** 6.60.0: our PermissionRequest hook's `timeout` in the settings file, or null (`permissionHookTimeoutS`). */
   permissionHookTimeoutS: number | null
+  /**
+   * X1: the same, per kind (`permissionHookTimeoutForToolS` for AskUserQuestion and for any other
+   * tool). Equal to `permissionHookTimeoutS` while the block is not split.
+   */
+  permissionHookTimeouts?: { question: number | null; approval: number | null }
   tokenPresent: boolean
 }
 
@@ -343,7 +435,7 @@ function hooksDisabled(settings: unknown): boolean {
   return !!settings && typeof settings === 'object' && (settings as { disableAllHooks?: unknown }).disableAllHooks === true
 }
 
-export function hookStatus(paths: { settingsPath?: string; scriptPath?: string; packageScriptPath?: string; hookPaths?: HookPaths } = {}): HookStatus {
+export function hookStatus(paths: { settingsPath?: string; scriptPath?: string; packageScriptPath?: string; hookPaths?: HookPaths; plan?: PermissionHookPlan } = {}): HookStatus {
   const settingsPath = paths.settingsPath ?? claudeSettingsPath()
   const scriptPath = paths.scriptPath ?? stableHookScriptPath()
   const packageScriptPath = paths.packageScriptPath ?? packagedHookScriptPath()
@@ -355,8 +447,12 @@ export function hookStatus(paths: { settingsPath?: string; scriptPath?: string;
   if (!read.ok) {
     return { state: read.reason, installed: false, settingsPath, scriptPath, scriptSha, packageScriptSha, subscribed: [], missing: HOOK_SUBSCRIPTIONS.map(s => s.event), drifted: [], priorWait: [], priorWaitOnly: false, permissionHookTimeoutS: null, tokenPresent }
   }
-  const events = subscribedEvents(read.settings, scriptPath, hookPaths)
+  const events = subscribedEvents(read.settings, scriptPath, hookPaths, paths.plan ?? permissionHookPlan())
   const permissionWaitS = permissionHookTimeoutS(read.settings)
+  const permissionHookTimeouts = {
+    question: permissionHookTimeoutForToolS(read.settings, 'AskUserQuestion'),
+    approval: permissionHookTimeoutForToolS(read.settings, 'Bash'),
+  }
   let state: HookInstallState
   if (hooksDisabled(read.settings)) state = 'disabled_by_settings'
   else if (events.subscribed.length === 0 && events.drifted.length === 0) state = 'missing'
@@ -366,7 +462,7 @@ export function hookStatus(paths: { settingsPath?: string; scriptPath?: string;
   const priorWaitOnly = state === 'drift' && events.missing.length === 0 && events.drifted.length > 0
     && events.drifted.every(event => events.priorWait.includes(event))
   const observerOnlyDrift = state === 'drift' && events.missing.length > 0 && events.missing.every(event => event === 'PreCompact') && events.drifted.every(event => events.priorWait.includes(event))
-  return { observerOnlyDrift, state, installed: state === 'installed', settingsPath, scriptPath, scriptSha, packageScriptSha, ...events, priorWaitOnly, permissionHookTimeoutS: permissionWaitS, tokenPresent }
+  return { observerOnlyDrift, state, installed: state === 'installed', settingsPath, scriptPath, scriptSha, packageScriptSha, ...events, priorWaitOnly, permissionHookTimeoutS: permissionWaitS, ...(paths.plan?.split || permissionHookPlan().split || permissionHookTimeouts.question !== permissionHookTimeouts.approval ? { permissionHookTimeouts } : {}), tokenPresent }
 }
 
 /**
@@ -476,6 +572,8 @@ export interface InstallOptions {
   port?: number
   deskIdleSeconds?: number
   dryRun?: boolean
+  /** X1: how the PermissionRequest hook is written. Default: from the two full-hold switches (`permissionHookPlan`). */
+  plan?: PermissionHookPlan
 }
 
 export interface InstallResult {
@@ -548,10 +646,11 @@ export function installClaudeHooks(options: InstallOptions = {}): InstallResult
   const packageScriptPath = options.packageScriptPath ?? packagedHookScriptPath()
   const hookPaths = options.hookPaths ?? currentHookPaths()
   const read = readSettings(settingsPath)
-  const statusNow = () => hookStatus({ settingsPath, scriptPath, packageScriptPath, hookPaths })
+  const plan = options.plan ?? permissionHookPlan()
+  const statusNow = () => hookStatus({ settingsPath, scriptPath, packageScriptPath, hookPaths, plan })
   const refuse = (reason: string, scriptCopied = false): InstallResult => ({ ok: false, reason, changed: false, scriptCopied, backupPath: null, status: statusNow() })
   if (!read.ok) return refuse(read.reason)
-  const merged = mergeHookSettings(read.settings, scriptPath, hookPaths)
+  const merged = mergeHookSettings(read.settings, scriptPath, hookPaths, plan)
   if (!merged.ok) return refuse(merged.reason)
   if (options.dryRun) {
     return { ok: true, changed: merged.changed, scriptCopied: false, backupPath: null, status: statusNow(), merged: merged.settings }

package/server/lib/conversation.ts

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url'
 import { notifySessionStart, notifySessionEnd } from './telegram-notify.js'
 import { appendToArchive, type SessionToArchive } from './archive.js'
 import { updateGlassesSessionCache, scheduleCacheUpdate, setSessionProvider } from './session-cache-writer.js'
-import { logSessionEnd, buildSessionLogEntry, writeSessionLog } from './session-log.js'
+import { logSessionEnd, buildSessionLogEntry, writeSessionLogIfChanged, flushSessionLogState } from './session-log.js'
 import { atomicWriteFileSync, durableAtomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
 import { localDay } from './local-day.js'
 import { normalizeModelPreference, type ModelPreference } from '../../shared/model-preference.js'
@@ -966,11 +966,14 @@ export async function endSession(sessionId: string): Promise<{ logged: boolean;
   return { logged: exchangeCount > 0, exchangeCount, durationMin }
 }
 
-/** Log all active sessions on server shutdown — prevents data loss on restart */
-export function logActiveSessionsOnShutdown(): void {
+/** Log active sessions on server shutdown — prevents data loss on restart.
+ * S1 (2026-11-09): a session whose content was already written (by a snapshot or an
+ * earlier shutdown, in this boot or a previous one) is not appended again. */
+export function logActiveSessionsOnShutdown(): { written: number; unchanged: number; unconfigured: number; failed: number } {
+  const counts = { written: 0, unchanged: 0, unconfigured: 0, failed: 0 }
   for (const session of sessions.values()) {
     if (session.exchanges.length === 0) continue
-    logSessionEnd({
+    const entry = buildSessionLogEntry({
       id: session.id,
       exchanges: session.exchanges,
       createdAt: session.createdAt,
@@ -978,40 +981,65 @@ export function logActiveSessionsOnShutdown(): void {
       modelPreference: session.modelPreference,
       endReason: 'server_shutdown',
     })
+    counts[writeSessionLogIfChanged(entry, 'shutdown')]++
+  }
+  flushSessionLogState()
+  // No ledger configured (the new-install default): nothing to report.
+  if (counts.written || counts.unchanged || counts.failed) {
+    console.log(`[session-log] shutdown: ${counts.written} written, ${counts.unchanged} unchanged, ${counts.failed} failed`)
   }
+  return counts
 }
 
-// ── Auto-snapshot: periodically write active sessions to .glasses_sessions.jsonl ──
-// Runs every 5 minutes. No LLM calls, no network — just JSON serialize + file append.
-// Cost: ~0 CPU, ~0 RAM, ~50KB disk per snapshot.
+// ── Auto-snapshot: periodically write changed active sessions to .glasses_sessions.jsonl ──
+// Runs every 5 minutes. No LLM calls, no network. A session is appended only when its
+// content changed since the last write for it, and that memory survives restarts
+// (session-log.ts). Before 2026-11-09 the memory was this module's own map, empty after
+// every boot, so the first tick after a restart re-appended every session (about 300 entries,
+// roughly 5 MB, per boot on Miles's Mac; not the "~50KB per snapshot" once written here).
 let snapshotTimer: ReturnType<typeof setInterval> | null = null
-let lastSnapshotCounts: Record<string, number> = {} // track exchange counts to skip unchanged sessions
+let lastSnapshotCounts: Record<string, number> = {} // cheap in-process pre-check before hashing
+
+/** One auto-snapshot pass. Exported for tests. */
+export function runAutoSnapshotOnce(): { written: number; unchanged: number; unconfigured: number; failed: number } {
+  const counts = { written: 0, unchanged: 0, unconfigured: 0, failed: 0 }
+  for (const session of sessions.values()) {
+    if (session.exchanges.length === 0) continue
+    // Skip if exchange count hasn't changed since this process last looked
+    const prevCount = lastSnapshotCounts[session.id]
+    if (prevCount !== undefined && session.exchanges.length === prevCount) continue
+
+    const entry = buildSessionLogEntry({
+      id: session.id,
+      exchanges: session.exchanges,
+      createdAt: session.createdAt,
+      lastActivity: Date.now(), // Use NOW, not lastActivity — ensures lookup covers up to this moment
+      modelPreference: session.modelPreference,
+      endReason: 'explicit_end',
+      slug: `[LIVE] ${(session.exchanges.find(e => e.role === 'user')?.content ?? '').slice(0, 50)}`,
+    })
+    counts[writeSessionLogIfChanged(entry, 'snapshot')]++
+    // Recorded whatever the result, as before S1: a failed or unconfigured write is not retried
+    // every 5 minutes (Q1 review M2), only after the session changes again.
+    lastSnapshotCounts[session.id] = session.exchanges.length
+  }
+  if (counts.written) flushSessionLogState()
+  return counts
+}
 
 export function startAutoSnapshot(intervalMs = 5 * 60_000): void {
   if (snapshotTimer) return
-  snapshotTimer = setInterval(() => {
-    for (const session of sessions.values()) {
-      if (session.exchanges.length === 0) continue
-      // Skip if exchange count hasn't changed since last snapshot
-      const prevCount = lastSnapshotCounts[session.id] ?? 0
-      if (session.exchanges.length === prevCount) continue
-
-      const entry = buildSessionLogEntry({
-        id: session.id,
-        exchanges: session.exchanges,
-        createdAt: session.createdAt,
-        lastActivity: Date.now(), // Use NOW, not lastActivity — ensures lookup covers up to this moment
-        modelPreference: session.modelPreference,
-        endReason: 'explicit_end',
-        slug: `[LIVE] ${(session.exchanges.find(e => e.role === 'user')?.content ?? '').slice(0, 50)}`,
-      })
-      writeSessionLog(entry)
-      lastSnapshotCounts[session.id] = session.exchanges.length
-    }
-  }, intervalMs)
+  snapshotTimer = setInterval(() => { runAutoSnapshotOnce() }, intervalMs)
   console.log(`[conversation] Auto-snapshot started (every ${intervalMs / 1000}s)`)
 }
 
+/** Tests only. */
+export function __resetAutoSnapshotForTests(): void {
+  if (snapshotTimer) clearInterval(snapshotTimer)
+  snapshotTimer = null
+  lastSnapshotCounts = {}
+}
+
 /** Return all active sessions with exchanges, shaped for archiving */
 export function getActiveSessions(): SessionToArchive[] {
   const result: SessionToArchive[] = []

package/server/lib/cors-reject-log.ts

@@ -0,0 +1,51 @@
+/**
+ * Log a rejected CORS origin (S1, 2026-11-09).
+ *
+ * The scan of 10/26 to 11/09 found 22 "Error: CORS blocked" lines with nothing else, so no one
+ * could tell a COS client bug from a probe. This logs the ORIGIN only (an Origin header is a
+ * scheme, host and port; never a header dump, cookie or token), once per origin per hour, with a
+ * running count, and caps how many distinct origins it remembers so a scanner cannot grow it.
+ */
+const ONE_HOUR_MS = 60 * 60_000
+export const CORS_REJECT_ORIGIN_CAP = 200
+const seen = new Map<string, { count: number; lastLoggedAt: number }>()
+let overflow = 0
+
+/** An origin made safe for one log line: printable ASCII, no spaces, at most 200 characters. */
+export function sanitizeOrigin(origin: string): string {
+  const clean = origin.replace(/[^\x21-\x7e]/g, '?')
+  return clean.length > 200 ? `${clean.slice(0, 200)}…(${clean.length} chars)` : clean
+}
+
+export type CorsRejectReason = 'not_allowed' | 'check_failed'
+
+export function noteCorsRejection(
+  origin: string,
+  reason: CorsRejectReason,
+  now = Date.now(),
+  log: (line: string) => void = line => console.warn(line),
+): boolean {
+  const key = sanitizeOrigin(origin)
+  let entry = seen.get(key)
+  if (!entry) {
+    if (seen.size >= CORS_REJECT_ORIGIN_CAP) {
+      overflow++
+      if (overflow === 1 || overflow % 100 === 0) {
+        log(`[cors] blocked ${overflow} request(s) from origins beyond the first ${CORS_REJECT_ORIGIN_CAP} distinct ones (not listed)`)
+      }
+      return false
+    }
+    entry = { count: 0, lastLoggedAt: 0 }
+    seen.set(key, entry)
+  }
+  entry.count++
+  if (entry.lastLoggedAt && now - entry.lastLoggedAt < ONE_HOUR_MS) return false
+  entry.lastLoggedAt = now
+  log(`[cors] blocked origin=${key} reason=${reason} (${entry.count} from this origin since boot)`)
+  return true
+}
+
+export function __resetCorsRejectLogForTests(): void {
+  seen.clear()
+  overflow = 0
+}