@gotcos/glasses-server 6.18.5 → 6.18.7

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 6.18.7
+
+- **Phone Restart no longer leaves the server Stopped.** Control LaunchAgent
+  KeepAlive is `SuccessfulExit: false`, so the old SIGTERM→exit(0) path never
+  came back — phone showed "Restart requested; reconnect is taking longer than
+  expected" while Control sat at Stopped. Restart now `launchctl kickstart -k`
+  (fallback `exit(1)` so KeepAlive still fires).
+
+## 6.18.6
+
+- **Phone Restart works on COS Control managed installs.** Recovery status /
+  `/api/recovery/server/restart` previously required `COS_HARNESS=daemon`, but
+  Control's LaunchAgent sets `COS_MANAGED=1` with `COS_HARNESS=foreground`.
+  Health correctly advertised `managed: true` while the restart route returned
+  409 "Server is not managed by the COS LaunchAgent". Gate now uses
+  `COS_MANAGED=1` (`isManagedRuntime()`), matching capabilities.
+
 ## 6.18.5
 
 - **Codex workspace-write now includes outbound network.** `workspace-write`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.18.5",
+  "version": "6.18.7",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/managed-restart.ts

@@ -0,0 +1,47 @@
+import { spawn } from 'node:child_process'
+import { userInfo } from 'node:os'
+
+/** LaunchAgent label Control installs for the managed glasses server. */
+export const DEFAULT_LAUNCHD_LABEL = 'com.cos.glasses-server'
+
+/**
+ * COS Control's LaunchAgent uses KeepAlive SuccessfulExit:false — a clean
+ * SIGTERM/exit(0) leaves the service STOPPED. Phone Restart must either
+ * kickstart -k (kill + start) or exit non-zero so KeepAlive brings it back.
+ */
+export function scheduleManagedServerRestart(options?: {
+  delayMs?: number
+  label?: string
+  kickstart?: (args: string[]) => void
+  exitProcess?: (code: number) => void
+  onError?: (error: unknown) => void
+}): void {
+  const delayMs = options?.delayMs ?? 350
+  const label = (options?.label ?? process.env.COS_LAUNCHD_LABEL?.trim()) || DEFAULT_LAUNCHD_LABEL
+  const kickstart = options?.kickstart ?? ((args: string[]) => {
+    const child = spawn('launchctl', args, { detached: true, stdio: 'ignore' })
+    child.unref()
+  })
+  const exitProcess = options?.exitProcess ?? ((code: number) => { process.exit(code) })
+  const onError = options?.onError ?? ((error: unknown) => {
+    console.error('[recovery] Failed to schedule managed server restart:', error)
+  })
+
+  const timer = setTimeout(() => {
+    if (process.env.COS_DISABLE_SELF_RESTART === '1') return
+    try {
+      const uid = userInfo().uid
+      kickstart(['kickstart', '-k', `gui/${uid}/${label}`])
+      // If kickstart did not kill us quickly (misconfigured label), force a
+      // non-zero exit so KeepAlive SuccessfulExit:false still restarts.
+      setTimeout(() => {
+        if (process.env.COS_DISABLE_SELF_RESTART === '1') return
+        try { exitProcess(1) } catch (error) { onError(error) }
+      }, 2_000).unref?.()
+    } catch (error) {
+      onError(error)
+      try { exitProcess(1) } catch (exitError) { onError(exitError) }
+    }
+  }, delayMs)
+  timer.unref?.()
+}

package/server/lib/managed-runtime.ts

@@ -21,9 +21,9 @@ export function managedRuntimeCapability(): ManagedRuntimeCapability {
     // Whisper lifecycle is private to the local controller. It is never
     // exposed as a network-reachable mutation capability.
     restartWhisper: false,
-    // Server restart is performed by the trusted local helper through launchd,
-    // never by an HTTP endpoint. This flag tells clients that managed recovery
-    // exists without widening the network attack surface.
+    // Phone/companion may POST /api/recovery/server/restart when managed.
+    // launchd KeepAlive brings the process back after SIGTERM. Unmanaged
+    // foreground installs reject that route (restart_unmanaged).
     restartServer: managed,
     maintenanceDrain: managed,
     lifecycleProof: managed,

package/server/routes/recovery.ts

@@ -2,6 +2,8 @@ import { Router } from 'express'
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { atomicWriteFileSync } from '../lib/atomic-fs.js'
+import { scheduleManagedServerRestart } from '../lib/managed-restart.js'
+import { isManagedRuntime } from '../lib/managed-runtime.js'
 import { acquireMaintenance, getRecoveryActivityStatus } from '../lib/recovery-activity.js'
 import { getWhisperHealth, restartWhisperServer } from '../lib/whisper-local.js'
 import { serverMetrics } from '../lib/server-metrics.js'
@@ -19,14 +21,16 @@ recoveryRouter.get('/live', (_req, res) => {
   res.json({
     status: 'ok', bootId: serverMetrics.bootId, pid: process.pid,
     uptimeSeconds: Math.round((Date.now() - serverMetrics.startedAt) / 1000),
-    managed: process.env.COS_HARNESS === 'daemon',
+    // COS Control LaunchAgent sets COS_MANAGED=1 with COS_HARNESS=foreground.
+    // Do not require COS_HARNESS=daemon — that false-negative blocked phone Restart.
+    managed: isManagedRuntime(),
   })
 })
 
 recoveryRouter.get('/recovery/status', (_req, res) => {
   res.json({
     bootId: serverMetrics.bootId,
-    managed: process.env.COS_HARNESS === 'daemon',
+    managed: isManagedRuntime(),
     whisper: getWhisperHealth(),
     asr: { hqActive: false, hqQueued: 0, fastRestarting: false }, // public build: no HQ/fast ASR scheduler in this server
     activity: getRecoveryActivityStatus(),
@@ -46,7 +50,7 @@ recoveryRouter.post('/recovery/whisper/restart', async (_req, res) => {
 })
 
 recoveryRouter.post('/recovery/server/restart', (_req, res) => {
-  if (process.env.COS_HARNESS !== 'daemon') {
+  if (!isManagedRuntime()) {
     return res.status(409).json({ error: 'Server is not managed by the COS LaunchAgent', reason: 'restart_unmanaged' })
   }
   const elapsed = Date.now() - lastRestartAt()
@@ -62,15 +66,15 @@ recoveryRouter.post('/recovery/server/restart', (_req, res) => {
   res.status(202).json({ accepted: true, oldBootId: serverMetrics.bootId })
   // Schedule independently of the response socket. The phone may change
   // network/close the sheet immediately after receiving 202; that must not
-  // cancel an accepted restart or strand maintenance forever.
-  const timer = setTimeout(() => {
-    if (process.env.COS_DISABLE_SELF_RESTART === '1') { gate.release(); return }
-    try {
-      process.kill(process.pid, 'SIGTERM')
-    } catch (error) {
+  // cancel an accepted restart. Maintenance is in-process only — it dies with us.
+  //
+  // Do NOT SIGTERM→exit(0): Control's LaunchAgent KeepAlive is
+  // SuccessfulExit:false, so a clean exit leaves the service STOPPED and the
+  // phone shows "Restart requested; reconnect is taking longer than expected."
+  scheduleManagedServerRestart({
+    onError: (error) => {
       gate.release()
-      console.error('[recovery] Failed to signal managed server restart:', error)
-    }
-  }, 350)
-  timer.unref?.()
+      console.error('[recovery] Failed to schedule managed server restart:', error)
+    },
+  })
 })