@gotcos/glasses-server 6.21.3 → 6.21.4

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 6.21.4
+
+- Preserve validated phone-photo references on Claude and Codex conversation
+  exchanges so Recent Glasses and message-history clients can recover the
+  original visual context instead of receiving a text-only marker.
+- Recover validated refs at read time from the durable media association index,
+  keyed by exact session ID, global message number, and message era. Pre-6.21.4
+  unversioned refs are recovered only for the active era when both creation and
+  association occurred after its boundary; ambiguous historical refs fail
+  closed rather than risking the wrong photo.
+
 ## 6.21.3
 
 - Route Max-tier provisional dictation preview through the resident Turbo

package/README.md

@@ -112,6 +112,10 @@ range is the exact Tailscale/CGNAT allocation (`100.64.0.0/10`), not all of
   authenticated query that requested it
 - Message History + cross-day "reference message N" — your chats are archived by day
   and every message keeps a permanent number you can recall (`/api/archive`, `/api/message/:num`)
+- Recent/history responses preserve validated photo references. Recovery uses
+  exact session + global-message + message-era identity without exposing storage
+  paths. Ambiguous pre-version historical refs fail closed; unversioned refs are
+  recovered only inside the active era when created and associated after its boundary.
 - Send phone photos with queued prompts, and review assistant-selected generated,
   research, or explicitly used email images in Messages and on the G2 lens
 - Recover long voice prompts after phone, network, or server interruptions. Audio

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.3",
+  "version": "6.21.4",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/claude-bridge.ts

@@ -428,6 +428,7 @@ export async function callClaudeStreaming(
       outputImagePublisher = createRunOutputImagePublisher({
         sessionId: sid,
         globalMsgNum,
+        messageEra: options?.messageEra,
         maxImages: outputImageBudget,
       })
     } catch (err) {
@@ -473,6 +474,7 @@ export async function callClaudeStreaming(
   // Record user message (with [Photo]/[N Photos] prefix for vision queries)
   const photoPrefix = imagePaths.length === 1 ? '[Photo]' : imagePaths.length > 1 ? `[${imagePaths.length} Photos]` : ''
   const historyQuery = photoPrefix ? `${photoPrefix} ${query || 'What do you see?'}` : query
+  const inboundAttachments = imageInputs.length > 0 ? imageInputs.map(input => input.attachment) : undefined
   const exchangeProvenance = {
     clientJobId: options?.clientJobId,
     generation: options?.generation,
@@ -482,7 +484,7 @@ export async function callClaudeStreaming(
     'user',
     historyQuery,
     globalMsgNum,
-    undefined,
+    inboundAttachments,
     exchangeProvenance,
     resolvedModel,
   )

package/server/lib/codex-bridge.ts

@@ -321,6 +321,7 @@ export async function callCodexStreaming(
         sessionId: sid,
         globalMsgNum,
         runId: run.runId,
+        messageEra: options?.messageEra,
         maxImages: outputImageBudget,
       })
     } catch (err) {
@@ -363,6 +364,7 @@ export async function callCodexStreaming(
   const isFirstQuery = isNewSession(sid)
   const photoPrefix = imagePaths.length === 1 ? '[Photo]' : imagePaths.length > 1 ? `[${imagePaths.length} Photos]` : ''
   const historyQuery = photoPrefix ? `${photoPrefix} ${query || 'What do you see?'}` : query
+  const inboundAttachments = imageInputs.length > 0 ? imageInputs.map(input => input.attachment) : undefined
   const exchangeProvenance = {
     clientJobId: options?.clientJobId,
     generation: options?.generation,
@@ -372,7 +374,7 @@ export async function callCodexStreaming(
     'user',
     historyQuery,
     globalMsgNum,
-    undefined,
+    inboundAttachments,
     exchangeProvenance,
     model,
   )

package/server/lib/cursor-bridge.ts

@@ -262,6 +262,7 @@ export async function callCursorStreaming(
         sessionId: sid,
         globalMsgNum,
         runId: run.runId,
+        messageEra: options?.messageEra,
         maxImages: outputImageBudget,
       })
     } catch (err) {

package/server/lib/media-store.ts

@@ -33,6 +33,7 @@ import { atomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
 import { dataPath } from './data-dir.js'
 import {
   isValidMediaId,
+  mergeMediaAttachmentRefs,
   parseMediaAttachmentRef,
   type MediaAttachmentRef,
   type MediaKind,
@@ -131,6 +132,7 @@ export interface MediaRecord {
   clientQueueItemId?: string
   runId?: string
   globalMsgNum?: number
+  messageEra?: string
   createdAtMs: number
   updatedAtMs: number
   reservedAtMs?: number
@@ -197,6 +199,9 @@ function sanitizeRecord(raw: unknown): MediaRecord | null {
     ...(typeof r.clientQueueItemId === 'string' ? { clientQueueItemId: r.clientQueueItemId } : {}),
     ...(typeof r.runId === 'string' ? { runId: r.runId } : {}),
     ...(typeof r.globalMsgNum === 'number' ? { globalMsgNum: r.globalMsgNum } : {}),
+    ...(typeof r.messageEra === 'string' && /^[a-z0-9][a-z0-9._-]{0,79}$/i.test(r.messageEra)
+      ? { messageEra: r.messageEra }
+      : {}),
     createdAtMs: typeof r.createdAtMs === 'number' ? r.createdAtMs : Date.now(),
     updatedAtMs: typeof r.updatedAtMs === 'number' ? r.updatedAtMs : Date.now(),
     ...(typeof r.reservedAtMs === 'number' ? { reservedAtMs: r.reservedAtMs } : {}),
@@ -464,6 +469,51 @@ export class MediaStore {
     return this.getRecord(id)?.ref ?? null
   }
 
+  /** Recover the public refs associated with one exact conversation turn.
+   *
+   * The media index is already the durable lifecycle authority for uploaded
+   * and generated images. Older/legacy query paths associated the media here
+   * but failed to copy the refs onto the conversation exchange. Readers may
+   * use this exact session + message key to repair that projection without
+   * exposing storage paths or inventing a second attachment database.
+   */
+  getAssociatedRefs(target: {
+    sessionId: string
+    globalMsgNum: number
+    messageEra?: string
+    activeMessageEra: string
+    activeEraStartedAt: number
+  }): MediaAttachmentRef[] {
+    if (!target.sessionId || !Number.isSafeInteger(target.globalMsgNum) || target.globalMsgNum < 1) return []
+    const validEra = (value: unknown): value is string =>
+      typeof value === 'string' && /^[a-z0-9][a-z0-9._-]{0,79}$/i.test(value)
+    if (!validEra(target.activeMessageEra) || !Number.isFinite(target.activeEraStartedAt)) return []
+    const targetEra = validEra(target.messageEra) ? target.messageEra : undefined
+    const eraMatches = (rec: MediaRecord): boolean => {
+      if (rec.messageEra) return targetEra != null && rec.messageEra === targetEra
+
+      // Pre-6.21.4 associations did not persist an era. Recover them only for
+      // the active era when both creation and association are on/after its
+      // boundary. Requiring both closes the race where a pre-reset upload was
+      // associated only after the reset. Anything older may belong to legacy
+      // or any prior named era and fails closed.
+      const associatedAt = rec.associatedAtMs ?? rec.createdAtMs
+      if (target.activeMessageEra === 'legacy') return targetEra == null || targetEra === 'legacy'
+      if (targetEra === target.activeMessageEra) {
+        return rec.createdAtMs >= target.activeEraStartedAt && associatedAt >= target.activeEraStartedAt
+      }
+      return false
+    }
+    const matching = [...this.records.values()]
+      .filter(rec => rec.lifecycle === 'associated'
+        && rec.sessionId === target.sessionId
+        && rec.globalMsgNum === target.globalMsgNum
+        && eraMatches(rec))
+      .sort((a, b) => a.createdAtMs - b.createdAtMs)
+      .map(rec => rec.ref)
+    return mergeMediaAttachmentRefs(matching)
+  }
+
   /** Resolve content for serving/model input, honoring lifecycle + TTLs. */
   getContent(id: string, variant: 'phone' | 'thumb' | 'g2' = 'phone'): MediaContentResult {
     const rec = this.getRecord(id)
@@ -667,7 +717,7 @@ export class MediaStore {
 
   /** Bind media to its final run/message. Safe to replay; wins over a
    *  delayed release. */
-  associate(ids: string[], target: { sessionId?: string; runId?: string; globalMsgNum?: number }): Promise<void> {
+  associate(ids: string[], target: { sessionId?: string; runId?: string; globalMsgNum?: number; messageEra?: string }): Promise<void> {
     return this.withLock(() => {
       const now = Date.now()
       let dirty = false
@@ -684,6 +734,8 @@ export class MediaStore {
         if (target.sessionId && rec.sessionId !== target.sessionId) { rec.sessionId = target.sessionId; recDirty = true }
         if (target.runId && rec.runId !== target.runId) { rec.runId = target.runId; recDirty = true }
         if (target.globalMsgNum != null && rec.globalMsgNum !== target.globalMsgNum) { rec.globalMsgNum = target.globalMsgNum; recDirty = true }
+        if (target.messageEra && /^[a-z0-9][a-z0-9._-]{0,79}$/i.test(target.messageEra)
+            && rec.messageEra !== target.messageEra) { rec.messageEra = target.messageEra; recDirty = true }
         if (recDirty) {
           rec.updatedAtMs = now
           dirty = true

package/server/lib/query-job-runtime.ts

@@ -227,6 +227,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
             await getMediaStore().associate(resolvedAttachments.ids, {
               sessionId: request.sessionId,
               ...(request.globalMsgNum ? { globalMsgNum: request.globalMsgNum } : {}),
+              messageEra: request.messageEra,
             }).catch(error => console.error('[query-jobs] attachment association failed:', error))
           }
           const { outputAttachments: _outputAttachments, ...runMetadata } = metadata ?? {}

package/server/lib/run-output-images.ts

@@ -41,6 +41,7 @@ export interface RunOutputImageTarget {
   sessionId: string
   globalMsgNum?: number
   runId?: string
+  messageEra?: string
 }
 
 export interface CreateRunOutputImagePublisherOptions extends RunOutputImageTarget {
@@ -223,7 +224,15 @@ function safeTarget(options: CreateRunOutputImagePublisherOptions): RunOutputIma
   const runId = typeof options.runId === 'string' && options.runId.trim()
     ? options.runId.trim().slice(0, 120)
     : undefined
-  return { sessionId, ...(globalMsgNum ? { globalMsgNum } : {}), ...(runId ? { runId } : {}) }
+  const messageEra = typeof options.messageEra === 'string' && /^[a-z0-9][a-z0-9._-]{0,79}$/i.test(options.messageEra)
+    ? options.messageEra
+    : undefined
+  return {
+    sessionId,
+    ...(globalMsgNum ? { globalMsgNum } : {}),
+    ...(runId ? { runId } : {}),
+    ...(messageEra ? { messageEra } : {}),
+  }
 }
 
 function assertTempRoot(rawRoot: string): string {

package/server/routes/media.ts

@@ -28,6 +28,7 @@ import {
   getMediaStore,
   MediaStoreError,
 } from '../lib/media-store.js'
+import { currentMessageEra } from '../lib/message-era.js'
 import {
   ImageSafetyError,
   MAX_BATCH_BYTES,
@@ -175,6 +176,9 @@ mediaRouter.post('/media/associate', async (req: Request, res: Response) => {
       sessionId: safeString(req.body?.sessionId, 64),
       runId: safeString(req.body?.runId, 120),
       globalMsgNum,
+      // Association always belongs to the server's active message era. Never
+      // trust a client-supplied era to make media visible in historical turns.
+      messageEra: currentMessageEra(),
     })
     res.json({ ok: true })
   } catch (err) {

package/server/routes/query.ts

@@ -160,6 +160,7 @@ queryRouter.post('/query', async (req, res) => {
             await getMediaStore().associate(resolvedAttachments.ids, {
               sessionId: sid,
               ...(validGlobalMsgNum ? { globalMsgNum: validGlobalMsgNum } : {}),
+              messageEra: activeMessageEra,
             }).catch((err) => console.error('[query] attachment association failed:', err))
           }
           if (!done) {
@@ -199,6 +200,7 @@ queryRouter.post('/query', async (req, res) => {
       {
         abortSignal: abortController.signal,
         effort: validEffort,
+        messageEra: activeMessageEra,
         ...(validModel && isCursorModel(validModel) ? { cursorExecutionMode } : {}),
       },
     )

package/server/routes/sessions.ts

@@ -8,9 +8,46 @@ import { getArchiveDayMessages } from '../lib/archive.js'
 import { localDay } from '../lib/local-day.js'
 import { clearCodexEngineSession } from '../lib/codex-engine-sessions.js'
 import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
-import { currentMessageEra, exchangeBelongsToEra } from '../lib/message-era.js'
+import { currentMessageEraState, exchangeBelongsToEra, type MessageEraState } from '../lib/message-era.js'
+import { getMediaStore } from '../lib/media-store.js'
 
 export const sessionsRouter = Router()
+let mediaAssociationLookupWarned = false
+
+/** Conversation exchanges are the normal attachment projection. The media
+ * store fallback repairs turns created by the legacy query path, which did
+ * durably associate media to session + message but did not stamp the refs on
+ * the exchange. Both sources contain public refs only and remain capped by the
+ * shared merge validator. */
+function turnAttachments(
+  sessionId: string,
+  globalMsgNum: number | undefined,
+  messageEra: string | undefined,
+  activeEra: MessageEraState,
+  ...sources: unknown[]
+): MediaAttachmentRef[] {
+  let associated: MediaAttachmentRef[] = []
+  if (globalMsgNum != null) {
+    try {
+      associated = getMediaStore().getAssociatedRefs({
+        sessionId,
+        globalMsgNum,
+        messageEra,
+        activeMessageEra: activeEra.era,
+        activeEraStartedAt: activeEra.startedAt,
+      })
+    } catch (error) {
+      // Conversation history remains useful when optional media recovery is
+      // unavailable. Warn once per process instead of turning a text endpoint
+      // into a 500 or flooding logs once per turn.
+      if (!mediaAssociationLookupWarned) {
+        mediaAssociationLookupWarned = true
+        console.warn(`[sessions] media association lookup unavailable; serving text-only history: ${String(error)}`)
+      }
+    }
+  }
+  return mergeMediaAttachmentRefs(...sources, associated)
+}
 
 sessionsRouter.get('/sessions/recent', (_req, res) => {
   const sessions = getRecentSessions(24 * 60 * 60_000)
@@ -62,19 +99,22 @@ sessionsRouter.get('/sessions/:id/messages', (req, res) => {
     attachments?: MediaAttachmentRef[]
   }> = []
   const session = getSessionRaw(req.params.id)
+  const activeEra = currentMessageEraState()
   for (let i = 0; i < exchanges.length; i++) {
     const ex = exchanges[i]
     if (ex.role === 'user') {
       const next = exchanges[i + 1]
       if (next && next.role === 'assistant') {
-        const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
+        const globalMsgNum = ex.globalMsgNum ?? next.globalMsgNum
+        const messageEra = ex.messageEra ?? next.messageEra
+        const attachments = turnAttachments(req.params.id, globalMsgNum, messageEra, activeEra, ex.attachments, next.attachments)
         const modelPreference = resolveExchangePairModel(ex, next, session?.modelPreference)
         messages.push({
           query: ex.content,
           text: next.content,
           timestamp: next.timestamp,
           sessionId: req.params.id,
-          ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+          ...(globalMsgNum != null ? { no: globalMsgNum } : {}),
           ...(modelPreference ? { modelPreference } : {}),
           ...(attachments.length > 0 ? { attachments } : {}),
         })
@@ -246,14 +286,23 @@ sessionsRouter.get('/sessions/today/live-chats', (_req, res) => {
 // back to the archived chat's sessionId via getArchiveDayMessages.
 sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
   const todayDate = localDay()
-  const era = currentMessageEra()
+  const activeEra = currentMessageEraState()
+  const era = activeEra.era
 
   const archivedMessages = getArchiveDayMessages(todayDate)
     .filter(m => exchangeBelongsToEra(m, era))
-    .map(m => ({
-      ...m,
-      source: 'archive' as const,
-    }))
+    .map(m => {
+      const globalMsgNum = m.globalMsgNum ?? m.no
+      const attachments = turnAttachments(m.sessionId, globalMsgNum, m.messageEra, activeEra, m.attachments)
+      // Never pass an unvalidated archive attachment array through the object
+      // spread when the merge rejects it.
+      const { attachments: _rawAttachments, ...message } = m
+      return {
+        ...message,
+        source: 'archive' as const,
+        ...(attachments.length > 0 ? { attachments } : {}),
+      }
+    })
 
   const liveMessages: Array<{
     query: string
@@ -278,9 +327,9 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
         if (!exchangeBelongsToEra(ex, era)) continue
         const next = session.exchanges[i + 1]
         if (next && next.role === 'assistant') {
-          const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
           const globalMsgNum = ex.globalMsgNum ?? next.globalMsgNum
           const messageEra = ex.messageEra ?? next.messageEra
+          const attachments = turnAttachments(session.id, globalMsgNum, messageEra, activeEra, ex.attachments, next.attachments)
           const modelPreference = resolveExchangePairModel(ex, next, session.modelPreference)
           liveMessages.push({
             query: ex.content,