@gotcos/glasses-server 6.21.19 → 6.21.20

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 6.21.20
+
+- Audio playback works at all. Every play button in the Control speaker review
+  returned a 404 and made no sound, on every default install, since playback
+  shipped. `res.sendFile` delegates to `send`, which defaults to
+  `dotfiles: 'ignore'` and — with no `root` set — applies that policy to the
+  WHOLE absolute path rather than to anything the request supplied. The default
+  data home is `~/.cos-glasses/data`, and `.cos-glasses` is a dot component, so
+  the file was found, confirmed to exist, then refused on the way out the door.
+  All three audio routes were affected: meeting chunks, speaker-profile samples,
+  and ext-audio samples.
+
+  The tests could not have caught this. They point `COS_DATA_DIR` at
+  `mktemp -d` — `/var/folders/...` — which cannot contain a dot component, so
+  the suite was structurally incapable of reproducing a default install and
+  stayed green while the feature was dead. The three routes now share
+  `sendAudioFile`, and `send-audio.test.ts` serves from a dot-directory on
+  purpose, over a real listener, asserting on the returned bytes.
+
 ## 6.21.19
 
 - Review playback falls back to ext-audio. The 7-day archive introduced in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.19",
+  "version": "6.21.20",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/send-audio.ts

@@ -0,0 +1,42 @@
+// Serving a retained WAV back to a reviewer.
+//
+// WHY THIS EXISTS AT ALL, because `res.sendFile(path)` looks like it would do.
+//
+// `send` (what Express delegates to) defaults to `dotfiles: 'ignore'`, and when
+// no `root` option is given it applies that policy to the ENTIRE absolute path,
+// not to the part a request supplied:
+//
+//   parts = normalize(path).split(sep)      // send/index.js — the whole path
+//   if (containsDotFile(parts)) ... error(404)
+//
+// The COS data home is `~/.cos-glasses/data` by default. `.cos-glasses` is a
+// dot component, so every audio route 404'd on every default install — the play
+// button rendered, the fetch failed, and nothing was heard. Verified directly
+// against the installed module: `{}` -> 404, `{dotfiles:'allow'}` -> resolves.
+//
+// The tests never caught it because they point `COS_DATA_DIR` at
+// `mktemp -d` (`/var/folders/...`), which structurally CANNOT contain a dot
+// component. The suite was green and the feature was dead. `send-audio.test.ts`
+// serves from a dot-directory on purpose.
+//
+// 'allow' is safe here rather than merely convenient: the dot component is ours
+// (the data home), and nothing a caller supplies can introduce one. Every route
+// resolves its path through a validator first — `sessionId` and speaker names
+// match `[A-Za-z0-9:_-]`, chunk indices are integers, and the archive helpers
+// re-check containment before returning. The path handed to this function is
+// already known to exist and to live under the data dir.
+
+import type { Response } from 'express'
+
+/**
+ * Send a WAV that has already been resolved and containment-checked.
+ *
+ * Callers must have verified the file exists; a missing file here surfaces as
+ * send's own 404 HTML rather than the route's JSON, which is exactly the
+ * confusing failure this module documents.
+ */
+export function sendAudioFile(res: Response, path: string): void {
+  res.type('audio/wav')
+  // See the file header: without this, any data home under a dot-directory 404s.
+  res.sendFile(path, { dotfiles: 'allow' })
+}

package/server/routes/meeting.ts

@@ -10,6 +10,7 @@ import { cleanTranscriptLines } from '../lib/hallucination-filter.js'
 import { durableAtomicWriteFileSync } from '../lib/atomic-fs.js'
 import { appendCorrection, pendingCorrections } from '../lib/meeting-corrections.js'
 import { isSampleFromSession, untraceableSampleCount } from '../lib/training-audio-provenance.js'
+import { sendAudioFile } from '../lib/send-audio.js'
 import {
   extAudioChunkPath,
   listExtAudioChunks,
@@ -1178,8 +1179,7 @@ export function createMeetingRouter(deps: MeetingRouteDependencies = {}): Router
       })
       return
     }
-    res.type('audio/wav')
-    res.sendFile(path)
+    sendAudioFile(res, path)
   })
 
   /** What audio a meeting still has, so the panel can show play buttons only

package/server/routes/voice.ts

@@ -11,6 +11,7 @@ import { getOwnerSpeakerLabel } from '../lib/profile.js'
 import { dataPath } from '../lib/data-dir.js'
 import { purgeSpeakerCalibrationRows, relabelSpeakerCalibrationRows } from '../lib/speaker-calibration-log.js'
 import { trainingSourceFor } from '../lib/training-audio-provenance.js'
+import { sendAudioFile } from '../lib/send-audio.js'
 
 // These MUST match the writer in transcribe-stream.ts, which saves under
 // dataPath(). They previously resolved relative to __dirname — i.e. inside the
@@ -471,8 +472,7 @@ voiceRouter.get('/voice/profiles/:name/sample', (req, res) => {
     })
     return
   }
-  res.type('audio/wav')
-  res.sendFile(wav)
+  sendAudioFile(res, wav)
 })
 
 // GET /api/voice/ext-audio/:sessionId/sample — hear an unidentified voice.
@@ -492,8 +492,7 @@ voiceRouter.get('/voice/ext-audio/:sessionId/sample', (req, res) => {
     })
     return
   }
-  res.type('audio/wav')
-  res.sendFile(wav)
+  sendAudioFile(res, wav)
 })
 
 // GET /api/voice/profiles — enrolled people with sample counts and provenance.