@gotcos/glasses-server 6.21.5 → 6.21.7

package/.env.example

@@ -28,13 +28,13 @@ BIND_HOST=0.0.0.0
 # server after Wi-Fi/Tailscale changes and process restarts.
 # COS_SERVER_INSTANCE_ID_PATH=/path/to/server-instance-id
 
-# Build 204+ can opt into server-owned durable query jobs. The server fsyncs an
+# Build 204+ uses server-owned durable query jobs by default. The server fsyncs an
 # accepted prompt before returning 202, then keeps provider work running if the
 # phone backgrounds, reloads, or changes networks. Reopening COS reattaches to
-# the same job. Set to 0 (or remove) to send NEW prompts through the legacy
+# the same job. Set to 0 to send NEW prompts through the legacy
 # streaming route; already accepted durable jobs remain readable/cancellable
 # and drain safely.
-# COS_DURABLE_QUERY_JOBS=1
+# COS_DURABLE_QUERY_JOBS=0
 
 # ── THE LLM (chat) ──────────────────────────────────────────────────────
 # Chat runs through your LOCAL agent CLI — NOT an API key:

package/CHANGELOG.md

@@ -1,3 +1,26 @@
+## 6.21.7
+
+- Add a default-off, authenticated meeting-preview endpoint for private canaries.
+  It accepts bounded, server-pinned audio snapshots and returns disposable
+  Large-v3-Turbo text without creating or mutating meeting sessions.
+- Keep canonical Large-v3 transcription, speaker attribution, recovery, save, HQ
+  polish, and indexing unchanged. Preview never falls back to the canonical worker
+  and drops under canonical Metal contention.
+- Reject stale server pins and oversized bodies before inference, recheck
+  maintenance admission after slow uploads, and drop concurrent preview work rather
+  than building a latency queue. `COS_WHISPER_MEETING_PREVIEW=1` is required.
+
+## 6.21.6
+
+- Make server-owned durable query jobs the default so accepted replies keep
+  running through phone backgrounding, WebView reloads, and network handoffs.
+- Preserve `COS_DURABLE_QUERY_JOBS=0` as the machine-wide rollback. Existing
+  accepted jobs remain recoverable and cancellable while new prompts use the
+  legacy streaming path.
+- Publish the capability truth through authenticated health/model surfaces so
+  COS Control and the companion can independently enforce machine and device
+  preferences without changing the proven two-step cancel gesture.
+
 ## 6.21.5
 
 - Drop the narrow Large-v3 stock-caption artifact family beginning with

package/README.md

@@ -102,8 +102,8 @@ range is the exact Tailscale/CGNAT allocation (`100.64.0.0/10`), not all of
 ## What it does
 
 - Ask anything, get a streamed answer on the lens (`/api/query`, `/v1/chat/completions`)
-- With COS Glasses build 204+, opt into server-owned durable queries with
-  `COS_DURABLE_QUERY_JOBS=1`: accepted work survives phone backgrounding,
+- With COS Glasses build 204+, server-owned durable queries are on by default:
+  accepted work survives phone backgrounding,
   WebView reloads, and network handoffs, then reattaches without duplicate work
   or duplicate replies
 - Choose Opus, Fable, Sonnet, GPT Frontier, GPT Balanced, Composer 2.5 Fast, or
@@ -174,8 +174,8 @@ in the managed CLI working directory),
 `COS_CURSOR_PERSIST_SESSIONS=0` (disable Cursor session resume),
 `COS_WEATHER_DEFAULT_LAT` / `COS_WEATHER_DEFAULT_LON` /
 `COS_WEATHER_DEFAULT_CITY` (optional home fallback when phone GPS is denied),
-`COS_SCRIPTS_DIR` (full pipeline), `COS_DURABLE_QUERY_JOBS=1` (build 204+
-server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
+`COS_SCRIPTS_DIR` (full pipeline), `COS_DURABLE_QUERY_JOBS=0` (optional
+machine-wide rollback for build 204+ server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
 location; default `~/.cos-glasses/data/media`). Your name + transcription vocabulary live in
 `~/.cos-glasses/.cos-profile.json` (see `.cos-profile.example.json`).
 Factory example values are ignored; add the real names, companies, acronyms,
@@ -338,10 +338,10 @@ BIND_HOST=0.0.0.0 npm run start:server
   only when OpenAI playback is intentionally configured.
 - *Photos unavailable?* — install `ffmpeg`, restart the server, and confirm `/api/health` reports `features.mediaProcessingReady: true`.
 - *Prompt recovery unavailable?* — update with `npx --yes @gotcos/glasses-server@latest`, then confirm `/api/health` reports `features.promptRecovery: true`.
-- *Durable query recovery unavailable?* — build 204+ requires server 6.10.0+ and
-  `COS_DURABLE_QUERY_JOBS=1`. Restart once, then confirm `/api/health` reports
+- *Durable query recovery unavailable?* — build 204+ requires server 6.10.0+.
+  Restart once, then confirm `/api/health` reports
   `features.durableQueryJobs: true`, protocol `1`, and state `ready`. To roll
-  back, remove the flag; accepted jobs still drain while new prompts use legacy streaming.
+  back, set `COS_DURABLE_QUERY_JOBS=0`; accepted jobs still drain while new prompts use legacy streaming.
 - *Offline meeting recovery unavailable?* — build 209+ requires server 6.11.0+.
   Restart once, then confirm `/api/health` reports
   `features.localFirstMeetings: true` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.21.5",
+  "version": "6.21.7",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -432,23 +432,22 @@ listenRequiredServers(listeners).then(() => {
     console.log(`[startup] Silero VAD: ${vadOk ? 'active' : 'disabled (model not found)'}`)
   }
 
-  // Durable recovery and state-mutating background work remain closed until an
-  // authenticated controller release. The lifecycle callback is delivered for
-  // both an already-open fresh boot and a later cross-boot release.
+  // Durable recovery starts with the admitted runtime by default. A literal
+  // COS_DURABLE_QUERY_JOBS=0 is the machine-wide rollback.
   let admittedRuntimeStarted = false
   const startAdmittedRuntime = () => {
     if (admittedRuntimeStarted) return
     admittedRuntimeStarted = true
 
     void initQueryJobRuntime().then(health => {
-      if (process.env.COS_DURABLE_QUERY_JOBS === '1') {
+      if (process.env.COS_DURABLE_QUERY_JOBS !== '0') {
         console.log(`[COS API] Durable query jobs: ${health.store.state} · ${health.store.retainedIdentities} retained`)
       } else {
-        console.log('[COS API] Durable query jobs: disabled (set COS_DURABLE_QUERY_JOBS=1 to enable)')
+        console.log('[COS API] Durable query jobs: disabled by COS_DURABLE_QUERY_JOBS=0')
       }
     }).catch(error => {
       // The store remains degraded and rejects admission. Legacy /api/query is
-      // still mounted, so disabling the feature flag is an immediate rollback.
+      // still mounted, so the kill switch is an immediate rollback.
       console.error('[COS API] Durable query-job store unavailable:', error)
     })
 

package/server/lib/query-job-feature.ts

@@ -1,12 +1,12 @@
 import { QUERY_JOB_PROTOCOL_VERSION } from './query-job-types.js'
 
 /**
- * Durable jobs ship dark. The private canary enables them explicitly with
- * COS_DURABLE_QUERY_JOBS=1; removing the flag is an immediate server-side
- * rollback that leaves the legacy /api/query path untouched.
+ * Durable jobs are the public default. COS_DURABLE_QUERY_JOBS=0 is the
+ * machine-wide rollback; every other value (including unset) keeps the
+ * capability available. COS Control owns the user-facing policy switch.
  */
 export function durableQueryJobsEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
-  return env.COS_DURABLE_QUERY_JOBS === '1'
+  return env.COS_DURABLE_QUERY_JOBS !== '0'
 }
 
 export function durableQueryJobsCapability(): {

package/server/lib/whisper-preview.ts

@@ -434,3 +434,37 @@ export async function transcribeWhisperPreview(audioBuffer: Buffer): Promise<{
     throw error
   }
 }
+
+/**
+ * Meeting-preview canary: use only the isolated Turbo sidecar.
+ *
+ * Unlike prompt preview, this path never falls through to the canonical
+ * Large-v3 worker. A missing, busy, preempted, or failed sidecar is a silent
+ * cosmetic miss; durable meeting transcription continues on its unchanged
+ * canonical path.
+ */
+export async function transcribeWhisperMeetingPreview(audioBuffer: Buffer): Promise<{
+  text: string
+  model: 'large-v3-turbo'
+  backend: 'whisper-preview-server'
+} | null> {
+  if (!previewAvailable || previewWorkerModel !== 'large-v3-turbo') return null
+  const previewLease = tryAcquireMetalPreview()
+  if (!previewLease) return null
+  try {
+    return {
+      text: await transcribeViaPreviewServer(audioBuffer, previewLease.signal),
+      model: 'large-v3-turbo',
+      backend: 'whisper-preview-server',
+    }
+  } catch (error) {
+    if (previewLease.signal.aborted) return null
+    previewAvailable = false
+    previewWorkerModel = null
+    previewFailure = 'preview_sidecar_unavailable'
+    console.warn(`[whisper-preview] meeting Turbo preview failed; canonical meeting ASR was not affected: ${error instanceof Error ? error.message : error}`)
+    return null
+  } finally {
+    previewLease.release()
+  }
+}

package/server/routes/transcribe-stream.ts

@@ -29,11 +29,13 @@ import {
 } from '../lib/openai-whisper-budget.js'
 import {
   stripInlineHallucinations as sharedStripInlineHallucinations,
+  stripInlineHallucinationsOneShot,
   isFullHallucination as sharedIsFullHallucination,
   clearSessionHallucinationState,
   streamSilenceDropReason,
   isVocabEchoOnly,
 } from '../lib/hallucination-filter.js'
+import { transcribeWhisperMeetingPreview } from '../lib/whisper-preview.js'
 import { dataPath } from '../lib/data-dir.js'
 import {
   countChunkWavs,
@@ -101,6 +103,12 @@ function ensurePrivateDirectory(path: string): void {
 // Rollback: COS_WHISPER_STRIP_BRAND_URLS=0 (URL drops), COS_WHISPER_THANKYOU_FILTER=0.
 const STRIP_BRAND_URLS = process.env.COS_WHISPER_STRIP_BRAND_URLS !== '0'
 const THANKYOU_FILTER = process.env.COS_WHISPER_THANKYOU_FILTER !== '0'
+const MEETING_PREVIEW_MAX_BYTES = 512 * 1024
+let meetingPreviewBusy = false
+
+function meetingTurboPreviewEnabled(): boolean {
+  return process.env.COS_WHISPER_MEETING_PREVIEW === '1'
+}
 
 // Audio persistence: save G2-mic chunks for speakers who need more training data
 const AUDIO_SAVE_DIR = dataPath('training-audio')
@@ -1180,6 +1188,21 @@ async function readRawBody(req: AsyncIterable<Buffer | Uint8Array | string>): Pr
   return Buffer.concat(buffers)
 }
 
+async function readBoundedRawBody(
+  req: AsyncIterable<Buffer | Uint8Array | string>,
+  maxBytes: number,
+): Promise<Buffer> {
+  const buffers: Buffer[] = []
+  let total = 0
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    total += buffer.length
+    if (total > maxBytes) throw makeHttpError(413, 'audio chunk too large', 'chunk_too_large')
+    buffers.push(buffer)
+  }
+  return Buffer.concat(buffers)
+}
+
 async function persistRawSessionAudioChunk(sessionId: string, chunkIndex: number, audioBuffer: Buffer): Promise<void> {
   const sessionDir = resolve(SESSION_AUDIO_DIR, sessionId)
   ensurePrivateDirectory(sessionDir)
@@ -1664,6 +1687,70 @@ function sendStreamError(res: { status: (code: number) => { json: (body: unknown
   return res.status(status).json({ error: errMsg(err), reason: (err as any)?.reason })
 }
 
+/**
+ * Default-off meeting preview canary.
+ *
+ * This route deliberately owns no meeting session, recovery ledger, speaker
+ * attribution, or persistence. It accepts a pinned copy of the still-open
+ * phrase and returns provisional Turbo text. Any contention or failure is a
+ * 204 cosmetic miss; the canonical /transcribe-stream upload remains the only
+ * durable and speaker-attributed result.
+ */
+transcribeStreamRouter.post('/transcribe-stream/preview', async (req, res) => {
+  try {
+    if (!meetingTurboPreviewEnabled() || !maintenanceAdmissionsOpen()) {
+      return void res.status(204).send()
+    }
+
+    const headerPin = req.get('X-COS-Server-Instance')?.trim() ?? ''
+    const queryPin = typeof req.query.serverInstanceId === 'string'
+      ? req.query.serverInstanceId.trim()
+      : ''
+    if (!headerPin && !queryPin) {
+      throw makeHttpError(400, 'server identity pin required', 'server_identity_pin_required')
+    }
+    const serverInstanceId = assertPinnedServerIdentity(headerPin, queryPin)
+    const sessionId = String(req.query.sessionId ?? '')
+    validateSessionId(sessionId)
+    const chunkIndex = Number(req.query.chunkIndex)
+    validateChunkIndex(chunkIndex)
+    const previewGen = Number(req.query.previewGen)
+    if (!Number.isInteger(previewGen) || previewGen < 0 || previewGen > 1_000_000_000) {
+      throw makeHttpError(400, 'invalid previewGen', 'invalid_preview_generation')
+    }
+
+    const audio = await readBoundedRawBody(req, MEETING_PREVIEW_MAX_BYTES)
+    if (audio.length < 100) throw makeHttpError(400, 'audio too short', 'audio_too_short')
+    if (!maintenanceAdmissionsOpen() || meetingPreviewBusy) {
+      return void res.status(204).send()
+    }
+
+    meetingPreviewBusy = true
+    try {
+      const result = await transcribeWhisperMeetingPreview(audio)
+      if (!result) return void res.status(204).send()
+      const cleaned = stripInlineHallucinationsOneShot(result.text.trim()).trim()
+      if (!cleaned || sharedIsFullHallucination(cleaned)) {
+        return void res.status(204).send()
+      }
+      return void res.json({
+        sessionId,
+        chunkIndex,
+        previewGen,
+        text: cleaned,
+        provisional: true,
+        model: result.model,
+        backend: result.backend,
+        serverInstanceId,
+      })
+    } finally {
+      meetingPreviewBusy = false
+    }
+  } catch (err: unknown) {
+    sendStreamError(res, err)
+  }
+})
+
 transcribeStreamRouter.post('/transcribe-stream', async (req, res) => {
   let maintenanceLease: MaintenanceWorkLease | undefined
   try {