@gotcos/glasses-server 6.18.6 → 6.18.8

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 6.18.8
+
+- **Prompt draft peeks for live ASR.** `POST /api/prompt-drafts/:draftId/peek`
+  runs Turbo locally, emits `prompt_transcript` with `provisional: true` +
+  `peekGen`, and does **not** advance the recovery ledger. Drop-on-busy,
+  `learnInline=false`, and `affectsCircuit: false` so peeks cannot trip or
+  success-reset the Whisper breaker.
+- **Interactive HQ keeps short utterance heads.** Compose HQ skips light
+  enhance (highpass was truncating "device, just for…") and omits CLI `--vad`
+  as defense-in-depth. Meeting/batch HQ paths unchanged.
+
+## 6.18.7
+
+- **Phone Restart no longer leaves the server Stopped.** Control LaunchAgent
+  KeepAlive is `SuccessfulExit: false`, so the old SIGTERM→exit(0) path never
+  came back — phone showed "Restart requested; reconnect is taking longer than
+  expected" while Control sat at Stopped. Restart now `launchctl kickstart -k`
+  (fallback `exit(1)` so KeepAlive still fires).
+
 ## 6.18.6
 
 - **Phone Restart works on COS Control managed installs.** Recovery status /

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.18.6",
+  "version": "6.18.8",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/archive.ts

@@ -15,6 +15,7 @@ import { secureExistingPrivateFile } from './secure-user-config.js'
 
 import type { Exchange } from './conversation.js'
 import { resolveExchangePairModel } from './conversation.js'
+import type { ModelPreference } from '../../shared/model-preference.js'
 
 import { dataPath } from './data-dir.js'
 const ARCHIVE_DIR = dataPath('archive')
@@ -60,6 +61,8 @@ export interface SessionToArchive {
   contextBreaks: number[]
   createdAt: number
   lastActivity: number
+  /** Optional session-level model fallback for pre-stamp exchange pairs. */
+  modelPreference?: ModelPreference | null
 }
 
 // ── Directory management ────────────────────────────────────

package/server/lib/conversation.ts

@@ -876,6 +876,7 @@ export function getActiveSessions(): SessionToArchive[] {
       contextBreaks: session.contextBreaks,
       createdAt: session.createdAt,
       lastActivity: session.lastActivity,
+      modelPreference: session.modelPreference,
     })
   }
   return result

package/server/lib/maintenance-lifecycle.ts

@@ -46,6 +46,7 @@ export type MaintenanceWorkKind =
   | 'meeting_batch_finalization'
   | 'prompt_draft_write'
   | 'prompt_draft_warm'
+  | 'prompt_draft_peek'
   | 'prompt_draft_finalize'
   // Live Cues pipeline (planner + memory hops + insight). Held for the
   // pipeline's in-flight duration so an Update Server drain cannot unload the

package/server/lib/managed-restart.ts

@@ -0,0 +1,47 @@
+import { spawn } from 'node:child_process'
+import { userInfo } from 'node:os'
+
+/** LaunchAgent label Control installs for the managed glasses server. */
+export const DEFAULT_LAUNCHD_LABEL = 'com.cos.glasses-server'
+
+/**
+ * COS Control's LaunchAgent uses KeepAlive SuccessfulExit:false — a clean
+ * SIGTERM/exit(0) leaves the service STOPPED. Phone Restart must either
+ * kickstart -k (kill + start) or exit non-zero so KeepAlive brings it back.
+ */
+export function scheduleManagedServerRestart(options?: {
+  delayMs?: number
+  label?: string
+  kickstart?: (args: string[]) => void
+  exitProcess?: (code: number) => void
+  onError?: (error: unknown) => void
+}): void {
+  const delayMs = options?.delayMs ?? 350
+  const label = (options?.label ?? process.env.COS_LAUNCHD_LABEL?.trim()) || DEFAULT_LAUNCHD_LABEL
+  const kickstart = options?.kickstart ?? ((args: string[]) => {
+    const child = spawn('launchctl', args, { detached: true, stdio: 'ignore' })
+    child.unref()
+  })
+  const exitProcess = options?.exitProcess ?? ((code: number) => { process.exit(code) })
+  const onError = options?.onError ?? ((error: unknown) => {
+    console.error('[recovery] Failed to schedule managed server restart:', error)
+  })
+
+  const timer = setTimeout(() => {
+    if (process.env.COS_DISABLE_SELF_RESTART === '1') return
+    try {
+      const uid = userInfo().uid
+      kickstart(['kickstart', '-k', `gui/${uid}/${label}`])
+      // If kickstart did not kill us quickly (misconfigured label), force a
+      // non-zero exit so KeepAlive SuccessfulExit:false still restarts.
+      setTimeout(() => {
+        if (process.env.COS_DISABLE_SELF_RESTART === '1') return
+        try { exitProcess(1) } catch (error) { onError(error) }
+      }, 2_000).unref?.()
+    } catch (error) {
+      onError(error)
+      try { exitProcess(1) } catch (exitError) { onError(exitError) }
+    }
+  }, delayMs)
+  timer.unref?.()
+}

package/server/lib/query-job-runtime.ts

@@ -114,7 +114,7 @@ async function projectPublicConversationTerminal(
     request.globalMsgNum,
     request.attachmentRefs,
     request.messageEra,
-    request.model,
+    normalizeModelPreference(request.model),
   )
   reconcileExchangeByJobIdentity(
     request.sessionId,
@@ -124,7 +124,7 @@ async function projectPublicConversationTerminal(
     request.globalMsgNum,
     mergeMediaAttachmentRefs(outputAttachments, existingOutputAttachments),
     request.messageEra,
-    request.model,
+    normalizeModelPreference(request.model),
   )
   flushConversationToDisk()
 }

package/server/lib/transcribe-audio.ts

@@ -13,7 +13,6 @@ import {
   estimateAudioSeconds,
   OpenAIWhisperBudgetExhaustedError,
 } from './openai-whisper-budget.js'
-import { enhanceAudio } from './audio-enhance.js'
 import {
   stripInlineHallucinationsOneShot,
   isFullHallucination,
@@ -63,12 +62,6 @@ export class NoSpeechDetectedError extends Error {
 // ceiling (anything longer is a dictation, not a query — use meetings instead).
 const HQ_MAX_SECONDS = 60
 
-/** Short interactive clips use light enhance (highpass only). Override via env. */
-function hqEnhanceLightMaxSeconds(): number {
-  const value = Number.parseInt(process.env.COS_HQ_ENHANCE_LIGHT_MAX_SEC || '15', 10)
-  return Number.isFinite(value) && value >= 0 ? value : 15
-}
-
 function unavailableAfterLocalFailure(): TranscriptionUnavailableError | null {
   const fallback = getTranscriptionPolicySnapshot()
   if (fallback.openaiFallbackReady) return null
@@ -146,10 +139,16 @@ export function resolveTranscribeMode(raw: unknown): TranscribeMode {
 
 export async function transcribeAudioBuffer(
   audioBuffer: Buffer,
-  opts: { mode?: TranscribeMode; policy?: TranscriptionBackendPolicy } = {},
+  opts: {
+    mode?: TranscribeMode
+    policy?: TranscriptionBackendPolicy
+    /** When false, turbo/server failures do not move the shared meeting circuit breaker. */
+    affectsCircuit?: boolean
+  } = {},
 ): Promise<TranscribeAudioResult> {
   const requestedMode = opts.mode ?? 'hq'
   const policy = opts.policy ?? 'automatic'
+  const affectsCircuit = opts.affectsCircuit !== false
   const audioSeconds = estimateAudioSeconds(audioBuffer)
   const effectiveMode: TranscribeMode =
     requestedMode === 'hq' && audioSeconds > HQ_MAX_SECONDS ? 'fast' : requestedMode
@@ -166,14 +165,14 @@ export async function transcribeAudioBuffer(
 
   if (effectiveMode === 'hq') {
     try {
-      const lightMax = hqEnhanceLightMaxSeconds()
-      const enhanceProfile = audioSeconds < lightMax ? 'light' as const : 'full' as const
-      const enhanced = await enhanceAudio(audioBuffer, { profile: enhanceProfile })
-      const result = await transcribeHighQuality(enhanced)
+      // A0 (2026-07-30): ffmpeg enhance light (highpass=f=80) was measured dropping
+      // leading speech on compose ("device just for your awareness"). Meeting batch
+      // still enhances in meeting-batch-transcribe.ts — this path is prompt/interactive only.
+      const result = await transcribeHighQuality(audioBuffer, undefined, { priority: 'interactive' })
       text = result.text
       actualQuality = result.actualQuality
       if (result.actualQuality === 'hq') {
-        backend = enhanceProfile === 'light' ? 'hq-large-v3-light' : 'hq-large-v3'
+        backend = 'hq-large-v3'
       } else {
         backend = result.backend === 'whisper-cli' ? 'fast-cli-turbo' : 'fast-local-server'
         degradationReason = result.degradationReason ?? 'hq_unavailable'
@@ -182,7 +181,7 @@ export async function transcribeAudioBuffer(
       console.warn(`[transcribe] HQ path failed, falling back to fast: ${hqErr.message}`)
       degradationReason = 'hq_decode_failed'
       try {
-        const result = await transcribeLocal(audioBuffer)
+        const result = await transcribeLocal(audioBuffer, undefined, undefined, { affectsCircuit })
         text = result.text
         backend = `fast-local-${result.backend}`
         actualQuality = 'fast'
@@ -202,7 +201,7 @@ export async function transcribeAudioBuffer(
     }
   } else if (effectiveMode === 'fast') {
     try {
-      const result = await transcribeLocal(audioBuffer)
+      const result = await transcribeLocal(audioBuffer, undefined, undefined, { affectsCircuit })
       text = result.text
       backend = `fast-local-${result.backend}`
       actualQuality = 'fast'

package/server/lib/whisper-local.ts

@@ -137,6 +137,12 @@ const BATCH_LARGE_V3_ENABLED = process.env.COS_BATCH_LARGE_V3 !== '0'
 const VAD_MODEL_PATH = join(process.env.HOME ?? homedir(), '.local/share/whisper-models/ggml-silero-v5.1.2.bin')
 const VAD_ENABLED = process.env.COS_WHISPER_VAD !== '0'
 
+/** Batch meeting HQ keeps CLI --vad. Interactive/prompt HQ must not — VAD was
+ *  measured dropping leading speech on compose ("device just for your awareness"). */
+export function hqCliVadEnabled(priority?: 'interactive' | 'batch'): boolean {
+  return priority === 'batch' && VAD_ENABLED && existsSync(VAD_MODEL_PATH)
+}
+
 /** Pick the batch model path. Prefer large-v3 when enabled + on disk; fall
  *  back to turbo otherwise. Logged once per process so we know which decoder
  *  actually ran when reviewing a meeting later. */
@@ -732,7 +738,6 @@ export async function transcribeHighQuality(
 
   const modelPath = resolveBatchModel()
   const useLargeV3 = modelPath === BATCH_MODEL_LARGE_V3
-  const useVad = VAD_ENABLED && existsSync(VAD_MODEL_PATH)
 
   try {
     writeFileSync(tmpWav, audioBuffer)
@@ -741,6 +746,9 @@ export async function transcribeHighQuality(
     // that is explicitly OUT of batch device policy. Only the long post-meeting
     // batch is admission-controlled against live ASR.
     const isBatch = opts.priority === 'batch'
+    // A0 (2026-07-30): CLI --vad on interactive/prompt HQ can drop leading speech
+    // (measured: "device just for your awareness"). Keep VAD for meeting batch only.
+    const useVad = hqCliVadEnabled(opts.priority)
     const decision: { device: 'metal' | 'cpu'; reason: string; metalEnabled: boolean } = isBatch
       ? (opts.forceCpu
           ? { device: 'cpu', reason: 'preempt_retry', metalEnabled: batchHqMetalEnabled() }
@@ -774,9 +782,8 @@ export async function transcribeHighQuality(
         args.push('-ojf', '-of', outBase)
       }
       if (useVad) {
-        // Same VAD model the streaming path uses. Strips silence windows
-        // before the decoder sees them — prevents the silence-hallucination
-        // failure mode even with large-v3's more permissive decoder.
+        // Batch-only: strips silence windows before decode. Interactive/prompt HQ
+        // omits this — VAD was measured dropping real leading speech on compose.
         args.push('--vad', '--vad-model', VAD_MODEL_PATH)
       }
       const proc = spawn(WHISPER_CLI, args, {
@@ -1076,8 +1083,14 @@ export function resetDecoderCaches(): void {
  * auto-restart the server process in the background and throw immediately so the
  * caller can use cloud while the server recovers (~20s model load).
  */
-export async function transcribeLocal(audioBuffer: Buffer, context?: string, isQuiet?: boolean): Promise<{ text: string; backend: 'server' | 'cli'; words?: WhisperWord[] }> {
+export async function transcribeLocal(
+  audioBuffer: Buffer,
+  context?: string,
+  isQuiet?: boolean,
+  opts?: { affectsCircuit?: boolean },
+): Promise<{ text: string; backend: 'server' | 'cli'; words?: WhisperWord[] }> {
   const start = Date.now()
+  const affectsCircuit = opts?.affectsCircuit !== false
 
   if (!serverAvailable) {
     await reconcileWhisperServerHealth()
@@ -1094,34 +1107,38 @@ export async function transcribeLocal(audioBuffer: Buffer, context?: string, isQ
       const text = applyCorrections(result.text)
       const words = result.words?.map(w => ({ ...w, word: applyCorrections(w.word) }))
       const elapsed = Date.now() - start
-      // Reset circuit breaker on success
-      if (serverConsecutiveFailures > 0) {
+      // Reset circuit breaker on success (skip for peek / non-circuit callers)
+      if (affectsCircuit && serverConsecutiveFailures > 0) {
         console.log(`[whisper-local] Server recovered after ${serverConsecutiveFailures} consecutive failure(s)`)
         serverConsecutiveFailures = 0
       }
       console.log(`[whisper-local] Server transcribed in ${elapsed}ms (${words?.length ?? 0} words): "${text.slice(0, 80)}${text.length > 80 ? '...' : ''}"`)
       return { text, backend: 'server', words }
     } catch (err: any) {
-      serverConsecutiveFailures++
-      const isTimeout = err.message.includes('timeout') || err.message.includes('aborted')
-      const isDead = err.message.includes('ECONNREFUSED') || err.message.includes('fetch failed')
-
-      if (isDead) {
-        serverAvailable = false
-        console.error(`[whisper-local] Server DEAD (ECONNREFUSED) — marked unavailable. Consecutive failures: ${serverConsecutiveFailures}`)
-      } else if (isTimeout) {
-        // Server process exists but is hung — mark unavailable so we stop trying
-        serverAvailable = false
-        console.error(`[whisper-local] Server HUNG (timeout) — marked unavailable. Consecutive failures: ${serverConsecutiveFailures}`)
-      }
+      if (affectsCircuit) {
+        serverConsecutiveFailures++
+        const isTimeout = err.message.includes('timeout') || err.message.includes('aborted')
+        const isDead = err.message.includes('ECONNREFUSED') || err.message.includes('fetch failed')
+
+        if (isDead) {
+          serverAvailable = false
+          console.error(`[whisper-local] Server DEAD (ECONNREFUSED) — marked unavailable. Consecutive failures: ${serverConsecutiveFailures}`)
+        } else if (isTimeout) {
+          // Server process exists but is hung — mark unavailable so we stop trying
+          serverAvailable = false
+          console.error(`[whisper-local] Server HUNG (timeout) — marked unavailable. Consecutive failures: ${serverConsecutiveFailures}`)
+        }
 
-      // Circuit breaker: auto-restart after threshold
-      if (serverConsecutiveFailures >= SERVER_FAILURE_THRESHOLD && !serverRestarting) {
-        console.error(`[whisper-local] ⚠ CIRCUIT BREAKER OPEN — ${serverConsecutiveFailures} consecutive failures. Auto-restarting server...`)
-        // Non-blocking restart in background
-        void restartWhisperServer()
-      } else if (serverConsecutiveFailures < SERVER_FAILURE_THRESHOLD) {
-        console.warn(`[whisper-local] Server failed (${serverConsecutiveFailures}/${SERVER_FAILURE_THRESHOLD} before restart): ${err.message}`)
+        // Circuit breaker: auto-restart after threshold
+        if (serverConsecutiveFailures >= SERVER_FAILURE_THRESHOLD && !serverRestarting) {
+          console.error(`[whisper-local] ⚠ CIRCUIT BREAKER OPEN — ${serverConsecutiveFailures} consecutive failures. Auto-restarting server...`)
+          // Non-blocking restart in background
+          void restartWhisperServer()
+        } else if (serverConsecutiveFailures < SERVER_FAILURE_THRESHOLD) {
+          console.warn(`[whisper-local] Server failed (${serverConsecutiveFailures}/${SERVER_FAILURE_THRESHOLD} before restart): ${err.message}`)
+        }
+      } else {
+        console.warn(`[whisper-local] Peek/non-circuit server failure (breaker untouched): ${err.message}`)
       }
 
       // Throw to let caller fall to OpenAI cloud (1-3s) — much faster than CLI cold-start (11s)
@@ -1132,10 +1149,12 @@ export async function transcribeLocal(audioBuffer: Buffer, context?: string, isQ
   // Server not available — still count toward circuit breaker so auto-restart can fire.
   // Without this, the counter stalls after the first failure marks serverAvailable=false
   // and subsequent calls never increment, so restart never triggers.
-  serverConsecutiveFailures++
-  if (serverConsecutiveFailures >= SERVER_FAILURE_THRESHOLD && !serverRestarting) {
-    console.error(`[whisper-local] CIRCUIT BREAKER OPEN — ${serverConsecutiveFailures} consecutive failures (server unavailable). Auto-restarting...`)
-    void restartWhisperServer()
+  if (affectsCircuit) {
+    serverConsecutiveFailures++
+    if (serverConsecutiveFailures >= SERVER_FAILURE_THRESHOLD && !serverRestarting) {
+      console.error(`[whisper-local] CIRCUIT BREAKER OPEN — ${serverConsecutiveFailures} consecutive failures (server unavailable). Auto-restarting...`)
+      void restartWhisperServer()
+    }
   }
 
   // Throw so the caller applies the configured recovery policy. CLI is

package/server/routes/prompt-drafts.ts

@@ -61,6 +61,9 @@ const modeQualityJobs = new Map<string, Promise<string>>()
 const finalizeJobs = new Map<string, Promise<any>>()
 let warmTail: Promise<void> = Promise.resolve()
 let hqWarmTail: Promise<void> = Promise.resolve()
+/** Peek decodes — drop-while-busy; never chained onto warmTail (HOL vs HQ). */
+let peekTail: Promise<void> = Promise.resolve()
+let peekBusy = false
 
 /** Speculative HQ warm while speaking. Set COS_HQ_SPECULATIVE_WARM=0 to restore Fast-only warm. */
 function speculativeHqWarmEnabled(): boolean {
@@ -372,6 +375,80 @@ promptDraftsRouter.post('/prompt-drafts/start', (req, res) => {
   }
 })
 
+/**
+ * Provisional Turbo peek — cosmetic lens UX only.
+ * Does NOT save chunks, advance the recovery ledger, or write warm/final transcripts.
+ * Drop-while-busy: overlapping peeks return 204 without queueing behind HQ warm.
+ */
+promptDraftsRouter.post('/prompt-drafts/:draftId/peek', async (req, res) => {
+  try {
+    const meta = loadPromptDraftMeta(req.params.draftId)
+    if (!meta) return void res.status(404).json({ error: 'draft not found' })
+
+    const rawIndex = Array.isArray(req.query.chunkIndex) ? req.query.chunkIndex[0] : req.query.chunkIndex
+    const chunkIndex = Number(rawIndex)
+    if (!Number.isInteger(chunkIndex) || chunkIndex < 0) {
+      return void res.status(400).json({ error: 'chunkIndex required' })
+    }
+    const rawGen = Array.isArray(req.query.peekGen) ? req.query.peekGen[0] : req.query.peekGen
+    const peekGen = Number(rawGen)
+    if (!Number.isInteger(peekGen) || peekGen < 0) {
+      return void res.status(400).json({ error: 'peekGen required' })
+    }
+
+    if (peekBusy) {
+      return void res.status(204).send()
+    }
+
+    const audio = await readRawBody(req)
+    if (!audio.length) return void res.status(400).json({ error: 'empty audio' })
+    if (audio.length > MAX_CHUNK_BYTES) return void res.status(413).json({ error: 'audio chunk too large' })
+
+    const lease = acquireMaintenanceWork('prompt_draft_peek', {
+      allowDuringDrain: true,
+      phase: 'queued',
+    })
+
+    peekBusy = true
+    const draftId = req.params.draftId
+    peekTail = peekTail.then(async () => {
+      lease.setPhase('active')
+      try {
+        const result = await transcribeAudioBuffer(audio, {
+          mode: 'fast',
+          policy: 'local-only',
+          affectsCircuit: false,
+        })
+        const text = sanitizeTranscript(draftId, result.text, false)
+        if (!text) return
+        if (!loadPromptDraftMeta(draftId)) return
+        emitDisplay({
+          type: 'prompt_transcript',
+          data: { draftId, chunkIndex, text, provisional: true, peekGen },
+        })
+      } catch (err: any) {
+        if (!(err instanceof NoSpeechDetectedError)) {
+          console.warn(`[prompt-draft] peek failed ${draftId}/${chunkIndex}: ${err?.message ?? err}`)
+        }
+      } finally {
+        peekBusy = false
+        lease.release()
+      }
+    }).catch(() => {
+      peekBusy = false
+      lease.release()
+    })
+
+    res.json({ draftId, chunkIndex, peekGen, accepted: true })
+  } catch (err: any) {
+    if (err instanceof MaintenanceLifecycleError) {
+      if (err.retryAfterSeconds != null) res.setHeader('Retry-After', String(err.retryAfterSeconds))
+      return void res.status(err.status).json({ ...maintenanceErrorPayload(err), draftPreserved: true })
+    }
+    res.status(err.status ?? (err.message === 'draft not found' ? 404 : 500)).json({ error: err.message })
+  }
+})
+
 promptDraftsRouter.post('/prompt-drafts/:draftId/chunks', async (req, res) => {
   let maintenanceLease: MaintenanceWorkLease | undefined
   try {

package/server/routes/recovery.ts

@@ -2,6 +2,7 @@ import { Router } from 'express'
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { atomicWriteFileSync } from '../lib/atomic-fs.js'
+import { scheduleManagedServerRestart } from '../lib/managed-restart.js'
 import { isManagedRuntime } from '../lib/managed-runtime.js'
 import { acquireMaintenance, getRecoveryActivityStatus } from '../lib/recovery-activity.js'
 import { getWhisperHealth, restartWhisperServer } from '../lib/whisper-local.js'
@@ -65,15 +66,15 @@ recoveryRouter.post('/recovery/server/restart', (_req, res) => {
   res.status(202).json({ accepted: true, oldBootId: serverMetrics.bootId })
   // Schedule independently of the response socket. The phone may change
   // network/close the sheet immediately after receiving 202; that must not
-  // cancel an accepted restart or strand maintenance forever.
-  const timer = setTimeout(() => {
-    if (process.env.COS_DISABLE_SELF_RESTART === '1') { gate.release(); return }
-    try {
-      process.kill(process.pid, 'SIGTERM')
-    } catch (error) {
+  // cancel an accepted restart. Maintenance is in-process only — it dies with us.
+  //
+  // Do NOT SIGTERM→exit(0): Control's LaunchAgent KeepAlive is
+  // SuccessfulExit:false, so a clean exit leaves the service STOPPED and the
+  // phone shows "Restart requested; reconnect is taking longer than expected."
+  scheduleManagedServerRestart({
+    onError: (error) => {
       gate.release()
-      console.error('[recovery] Failed to signal managed server restart:', error)
-    }
-  }, 350)
-  timer.unref?.()
+      console.error('[recovery] Failed to schedule managed server restart:', error)
+    },
+  })
 })