@gotcos/glasses-server 6.18.4 → 6.18.6

package/.env.example

@@ -53,9 +53,13 @@ BIND_HOST=0.0.0.0
 # COS_CODEX_MODEL=
 # COS_CODEX_REASONING_EFFORT=high   # low | medium | high | xhigh | max | ultra
 #
-# Codex remains read-only by default. This is the only broader trust opt-in:
+# Codex remains read-only by default. Broader trust opt-in (workdir writes +
+# outbound network inside that sandbox — needed for Gmail API / HTTPS):
 # COS_CODEX_SANDBOX=workspace-write
-#
+# Pair with ~/.codex/config.toml [sandbox_workspace_write] network_access = true
+# for interactive Codex CLI; the managed glasses server also passes
+# -c sandbox_workspace_write.network_access=true when workspace-write is set.
+
 # Claude preserves COS's established trusted-machine behavior by default.
 # Security-conscious installs can remove the permission bypass and restrict
 # Claude to COS's explicit per-query tool allowlist. Undeclared tools fail

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## 6.18.6
+
+- **Phone Restart works on COS Control managed installs.** Recovery status /
+  `/api/recovery/server/restart` previously required `COS_HARNESS=daemon`, but
+  Control's LaunchAgent sets `COS_MANAGED=1` with `COS_HARNESS=foreground`.
+  Health correctly advertised `managed: true` while the restart route returned
+  409 "Server is not managed by the COS LaunchAgent". Gate now uses
+  `COS_MANAGED=1` (`isManagedRuntime()`), matching capabilities.
+
+## 6.18.5
+
+- **Codex workspace-write now includes outbound network.** `workspace-write`
+  alone still blocked HTTPS (Gmail API, etc.) because Codex defaults
+  `sandbox_workspace_write.network_access` to off. When
+  `COS_CODEX_SANDBOX=workspace-write`, the managed server now passes
+  `-c sandbox_workspace_write.network_access=true` and the capability header
+  states HTTPS is available. Pair with the same key in `~/.codex/config.toml`
+  for interactive Codex CLI. Still not `danger-full-access` — writes stay
+  inside the workdir. Prefer COS `email_cache` / `email_gmail_api` over
+  approval-gated Google Workspace connector sends from glasses.
+
 ## 6.18.4
 
 - **Meeting sync progress on `/api/health`.** Post-meeting HQ polish writes

package/README.md

@@ -70,7 +70,10 @@ without silently losing completed replies.
 > omit the execution mode default to Ask.
 > Existing `COS_CODEX_MODEL` / `COS_CODEX_REASONING_EFFORT` settings remain
 > supported on the migrated Frontier slot; leave them blank for auto-latest.
-> Codex runs **sandboxed read-only** by default (`COS_CODEX_SANDBOX` to adjust).
+> Codex runs **sandboxed read-only** by default. Set
+> `COS_CODEX_SANDBOX=workspace-write` for workdir writes + outbound network
+> (`sandbox_workspace_write.network_access=true` is passed by the managed server
+> and should also be set in `~/.codex/config.toml` for interactive Codex).
 > **Claude is the most permissive provider by default.** It runs with
 > `--dangerously-skip-permissions`, so a glasses query on the Claude/Opus path can
 > run shell commands and read, edit, and write files on this Mac without prompting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.18.4",
+  "version": "6.18.6",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/codex-bridge.ts

@@ -83,14 +83,24 @@ const PHASE_LABELS: Record<Phase, string> = {
 // Sandbox policy for `codex exec`. This public server NEVER runs codex
 // unsandboxed — that would let a remote glasses query execute arbitrary commands
 // on the host. Default: read-only (safe for chat). COS_CODEX_SANDBOX=workspace-write
-// permits writes within the working directory only. Full host access is
+// permits writes within the working directory only, and enables outbound network
+// inside that sandbox (Gmail API, HTTPS fetches) via
+// `sandbox_workspace_write.network_access=true`. Full host filesystem access is
 // intentionally not exposed by this server.
 function codexSandboxMode(): 'workspace-write' | 'read-only' {
   return process.env.COS_CODEX_SANDBOX === 'workspace-write' ? 'workspace-write' : 'read-only'
 }
 
 function codexSandboxArgs(): string[] {
-  return ['--sandbox', codexSandboxMode(), '--skip-git-repo-check']
+  const args = ['--sandbox', codexSandboxMode(), '--skip-git-repo-check']
+  // workspace-write keeps the filesystem boundary but leaves network OFF by
+  // default in Codex. Glasses outbound Gmail (and similar HTTPS) needs this
+  // explicit opt-in — without it agents correctly report "cannot reach
+  // gmail.googleapis.com" even when workspace writes work.
+  if (codexSandboxMode() === 'workspace-write') {
+    args.push('-c', 'sandbox_workspace_write.network_access=true')
+  }
+  return args
 }
 
 /**
@@ -101,7 +111,7 @@ function codexSandboxArgs(): string[] {
 function codexCapabilityPrompt(): string {
   if (codexSandboxMode() === 'workspace-write') {
     return `TOOL CAPABILITY CONTRACT:
-You are an AGENT model running \`codex exec --sandbox workspace-write\`. Reads, searches, shell commands, and writes inside the working directory are available to you whether or not any list names them. Never claim a tool is unavailable based on that list or on any header — PROBE first with one real call; only an attempted call that actually failed is evidence a capability is missing. Writes outside the working directory are denied by the sandbox; say that plainly if you hit it.
+You are an AGENT model running \`codex exec --sandbox workspace-write\` with \`sandbox_workspace_write.network_access=true\`. Reads, searches, shell commands, outbound HTTPS (including Gmail API / cos_python network calls), and writes inside the working directory are available to you whether or not any list names them. Never claim a tool is unavailable based on that list or on any header — PROBE first with one real call; only an attempted call that actually failed is evidence a capability is missing. Writes outside the working directory are denied by the sandbox; say that plainly if you hit it. Prefer the COS Gmail API script path (\`email_cache\` / \`email_gmail_api\` with confirm=True) over approval-gated Google Workspace connector sends.
 ${TOOL_HONESTY_CLAUSE}
 ${UNTRUSTED_CONTENT_CLAUSE}`
   }

package/server/lib/managed-runtime.ts

@@ -21,9 +21,9 @@ export function managedRuntimeCapability(): ManagedRuntimeCapability {
     // Whisper lifecycle is private to the local controller. It is never
     // exposed as a network-reachable mutation capability.
     restartWhisper: false,
-    // Server restart is performed by the trusted local helper through launchd,
-    // never by an HTTP endpoint. This flag tells clients that managed recovery
-    // exists without widening the network attack surface.
+    // Phone/companion may POST /api/recovery/server/restart when managed.
+    // launchd KeepAlive brings the process back after SIGTERM. Unmanaged
+    // foreground installs reject that route (restart_unmanaged).
     restartServer: managed,
     maintenanceDrain: managed,
     lifecycleProof: managed,

package/server/routes/recovery.ts

@@ -2,6 +2,7 @@ import { Router } from 'express'
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { atomicWriteFileSync } from '../lib/atomic-fs.js'
+import { isManagedRuntime } from '../lib/managed-runtime.js'
 import { acquireMaintenance, getRecoveryActivityStatus } from '../lib/recovery-activity.js'
 import { getWhisperHealth, restartWhisperServer } from '../lib/whisper-local.js'
 import { serverMetrics } from '../lib/server-metrics.js'
@@ -19,14 +20,16 @@ recoveryRouter.get('/live', (_req, res) => {
   res.json({
     status: 'ok', bootId: serverMetrics.bootId, pid: process.pid,
     uptimeSeconds: Math.round((Date.now() - serverMetrics.startedAt) / 1000),
-    managed: process.env.COS_HARNESS === 'daemon',
+    // COS Control LaunchAgent sets COS_MANAGED=1 with COS_HARNESS=foreground.
+    // Do not require COS_HARNESS=daemon — that false-negative blocked phone Restart.
+    managed: isManagedRuntime(),
   })
 })
 
 recoveryRouter.get('/recovery/status', (_req, res) => {
   res.json({
     bootId: serverMetrics.bootId,
-    managed: process.env.COS_HARNESS === 'daemon',
+    managed: isManagedRuntime(),
     whisper: getWhisperHealth(),
     asr: { hqActive: false, hqQueued: 0, fastRestarting: false }, // public build: no HQ/fast ASR scheduler in this server
     activity: getRecoveryActivityStatus(),
@@ -46,7 +49,7 @@ recoveryRouter.post('/recovery/whisper/restart', async (_req, res) => {
 })
 
 recoveryRouter.post('/recovery/server/restart', (_req, res) => {
-  if (process.env.COS_HARNESS !== 'daemon') {
+  if (!isManagedRuntime()) {
     return res.status(409).json({ error: 'Server is not managed by the COS LaunchAgent', reason: 'restart_unmanaged' })
   }
   const elapsed = Date.now() - lastRestartAt()