@gotcos/glasses-server 6.27.1 → 6.27.3

package/.env.example

@@ -23,6 +23,13 @@ BIND_HOST=0.0.0.0
 # ~/.cos-glasses/data/media alongside the standalone conversation/archive data.
 # COS_MEDIA_ROOT=/path/on-a-local-volume/media
 
+# Private canary for server 6.27.3 + companion 6.8.343. When enabled, every
+# MP4/MOV uses a durable, resumable 256 KiB upload draft instead of one long
+# WebView request. Accepted chunks and finalize receipts survive server
+# restarts. Leave off for the released transport; COS Control 0.5.20 manages
+# this setting and prevents unsafe binary rollback while V2 state exists.
+# COS_VIDEO_UPLOAD_V2=0
+
 # Optional logical server identity location. Most installs should keep the
 # default (~/.cos-glasses/server-instance-id) so reconnects can verify the same
 # server after Wi-Fi/Tailscale changes and process restarts.

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+## 6.27.3
+
+### Durable, resumable video transport (private canary)
+
+- Replaces fragile single-request phone video uploads with a generation-pinned,
+  resumable 256 KiB protocol whose accepted chunks survive server restarts.
+- Adds idempotent init/finalize receipts, explicit acknowledgement and cancel,
+  bounded draft retention, and maintenance status so updates cannot erase a
+  video draft that is still being transferred or whose receipt is not stored.
+- Keeps the published media record byte-compatible with 6.27.2: the original
+  MP4/MOV remains required and the existing validated ffprobe/ffmpeg path stays
+  the fallback. Phone frame extraction is separately gated until its physical
+  iPhone decoder/canvas acceptance test executes.
+- New V2 admission is disabled by default (`COS_VIDEO_UPLOAD_V2=0`). Existing
+  V2 drafts remain observable, cancellable, and finalizable after the flag is
+  turned off so rollback never strands accepted bytes.
+
+## 6.27.2
+
+### One finalizer for phone and Mac dictation
+
+- Added authenticated `POST /api/dictation/finalize` for already-transcribed
+  Moonshine text. It reuses the exact glossary, negative rules, Haiku/Sonnet
+  polish, circuit breaker, token audit, and daily cap already used by recovered
+  server prompt drafts.
+- The route accepts bounded text only. Phone-local audio and rolling preview
+  audio do not leave the iPhone, and a finalizer failure falls back to the
+  deterministic glossary result instead of losing the transcription.
+- Both Message commits and sealed Meeting preview phrases can use the same
+  final quality pass while canonical Large-v3 meeting transcription remains
+  unchanged.
+
 ## 6.27.1
 
 ### The 16-frame video from 6.27.0 now actually works end to end

package/README.md

@@ -176,8 +176,12 @@ in the managed CLI working directory),
 `COS_WEATHER_DEFAULT_LAT` / `COS_WEATHER_DEFAULT_LON` /
 `COS_WEATHER_DEFAULT_CITY` (optional home fallback when phone GPS is denied),
 `COS_SCRIPTS_DIR` (full pipeline), `COS_DURABLE_QUERY_JOBS=0` (optional
-machine-wide rollback for build 204+ server-owned query recovery), and `COS_MEDIA_ROOT` (optional image-store
-location; default `~/.cos-glasses/data/media`). Your name + transcription vocabulary live in
+machine-wide rollback for build 204+ server-owned query recovery),
+`COS_MEDIA_ROOT` (optional image/video store location; default
+`~/.cos-glasses/data/media`), and `COS_VIDEO_UPLOAD_V2=1` (private 6.27.3+
+resumable-video canary, managed by COS Control 0.5.20). The V2 canary retains
+accepted 256 KiB chunks and finalize receipts across restarts; keep it off when
+using an older companion. Your name + transcription vocabulary live in
 `~/.cos-glasses/.cos-profile.json` (see `.cos-profile.example.json`).
 Factory example values are ignored; add the real names, companies, acronyms,
 and specialist terms you say often. Guided Setup writes a safe empty profile

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.27.1",
+  "version": "6.27.3",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -162,6 +162,20 @@ app.use('/api', requireApiToken(API_TOKEN))
 // through their true terminal boundary.
 app.use('/api', (req, res, next) => {
   if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next()
+  // V2 video chunks are bounded to 256 KiB and commit through the upload
+  // registry's own generation lock. Holding the global mutation lease while
+  // the phone transfers the body recreated the exact 90-second drain failure
+  // this protocol exists to remove. Admission is checked by the route before
+  // bytes are committed; in-flight bounded bodies finish or are discarded.
+  const videoUploadBody = req.method === 'PUT'
+    && /^\/media\/video-upload\/vu_[0-9a-f]{24}\/(?:original|frame)\/\d+$/.test(req.path)
+  // Finalize may run ffmpeg for a long clip. Its durable registry state is the
+  // restart/rollback gate, so holding the global request lease as well would
+  // recreate Control's 90-second drain timeout. The route performs its own
+  // fail-closed admission immediately before claiming `finalizing`.
+  const videoUploadFinalize = req.method === 'POST'
+    && /^\/media\/video-upload\/vu_[0-9a-f]{24}\/finalize$/.test(req.path)
+  if (videoUploadBody || videoUploadFinalize) return next()
   const lifecycleOwned = (req.path === '/query-jobs' && req.method === 'POST')
     || req.path === '/query'
     || req.path === '/diagnostics/provider-proof'
@@ -190,6 +204,14 @@ app.use('/api', (req, res, next) => {
       nonce: typeof req.headers['x-cos-maintenance-nonce'] === 'string'
         ? req.headers['x-cos-maintenance-nonce'] : undefined,
     })
+  // Cleanup and receipt acknowledgement only reduce rollback blockers. They
+  // remain available during a drain so Control is never forced to wait for a
+  // four-hour upload TTL after the phone already cancelled or persisted the
+  // terminal receipt.
+  const videoUploadCleanup = /^\/media\/video-upload\/vu_[0-9a-f]{24}$/.test(req.path)
+    && req.method === 'DELETE'
+    || /^\/media\/video-upload\/vu_[0-9a-f]{24}\/ack$/.test(req.path)
+      && req.method === 'POST'
 
   try {
     // KNOWN HAZARD, deliberately not fixed here (2026-08-11). This lease is held for
@@ -207,7 +229,7 @@ app.use('/api', (req, res, next) => {
     // of the network transfer, which means changing a fail-closed middleware that
     // guards every mutation. That needs its own pass and its own tests.
     const lease = acquireMaintenanceWork('api_mutation', {
-      allowDuringDrain: controllerProof,
+      allowDuringDrain: controllerProof || videoUploadCleanup,
     })
     let released = false
     const release = () => {

package/server/lib/media-store.ts

@@ -31,7 +31,7 @@ import {
   writeFileSync,
 } from 'node:fs'
 import { join, resolve, sep } from 'node:path'
-import { atomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
+import { atomicWriteFileSync, durableAtomicWriteFileSync, loadJsonOrQuarantine } from './atomic-fs.js'
 import { dataPath } from './data-dir.js'
 import {
   isValidMediaId,
@@ -183,6 +183,10 @@ export interface MediaRecord {
   updatedAtMs: number
   reservedAtMs?: number
   associatedAtMs?: number
+  /** Durable provenance for resumable video uploads. It is never exposed in
+   * the public attachment ref; it lets a lost finalize response or server
+   * restart rediscover the one record that upload already published. */
+  videoUploadId?: string
 }
 
 interface MediaIndexFile {
@@ -236,6 +240,10 @@ export interface IngestRichMediaFileInput {
    *  existing ceiling; chunked finalize passes 'chunked' so a multi-hundred-MB video
    *  is judged against the chunked cap instead of being refused AFTER transfer. */
   transfer?: MediaTransferMode
+  /** Preallocated by the durable video-upload manifest before publication. */
+  mediaId?: string
+  /** Private idempotency link used only by video-upload receipt recovery. */
+  videoUploadId?: string
 }
 
 /** Handle for a streaming upload's staging file. `dispose()` is idempotent and
@@ -313,6 +321,9 @@ function sanitizeRecord(raw: unknown): MediaRecord | null {
     updatedAtMs: typeof r.updatedAtMs === 'number' ? r.updatedAtMs : Date.now(),
     ...(typeof r.reservedAtMs === 'number' ? { reservedAtMs: r.reservedAtMs } : {}),
     ...(typeof r.associatedAtMs === 'number' ? { associatedAtMs: r.associatedAtMs } : {}),
+    ...(typeof r.videoUploadId === 'string' && /^vu_[0-9a-f]{24}$/.test(r.videoUploadId)
+      ? { videoUploadId: r.videoUploadId }
+      : {}),
   }
 }
 
@@ -468,15 +479,35 @@ export class MediaStore {
       rmSync(join(this.root, 'tmp'), { recursive: true, force: true })
       mkdirSync(join(this.root, 'tmp'), { recursive: true, mode: 0o700 })
     } catch { /* best effort */ }
+    let dirty = false
     if (this.allowOrphanCleanup) {
       try {
         for (const entry of readdirSync(join(this.root, 'assets'))) {
           try {
             if (!this.records.has(entry)) {
-              // Unpublished orphan — the upload died between rename and index
-              // publish. Remove; the client never received this id.
-              rmSync(join(this.root, 'assets', entry), { recursive: true, force: true })
-              console.warn(`[media-store] removed unpublished orphan asset ${entry}`)
+              const intentPath = join(this.root, 'assets', entry, 'publication-intent.json')
+              let recovered = false
+              if (existsSync(intentPath)) {
+                try {
+                  const candidate = sanitizeRecord(JSON.parse(readFileSync(intentPath, 'utf8')))
+                  if (candidate && candidate.ref.id === entry && candidate.videoUploadId
+                      && existsSync(this.absPath(candidate.storagePath))) {
+                    this.records.set(entry, candidate)
+                    dirty = true
+                    recovered = true
+                    console.warn(`[media-store] recovered resumable video publication ${entry}`)
+                  }
+                } catch {
+                  // An unreadable/inconsistent intent grants no publication.
+                  // The client can safely repeat finalize from its durable draft.
+                }
+              }
+              if (!recovered) {
+                // Unpublished orphan — the upload died between rename and index
+                // publish and supplied no valid durable publication intent.
+                rmSync(join(this.root, 'assets', entry), { recursive: true, force: true })
+                console.warn(`[media-store] removed unpublished orphan asset ${entry}`)
+              }
             }
           } catch { /* skip this asset */ }
         }
@@ -484,7 +515,6 @@ export class MediaStore {
     } else {
       console.warn('[media-store] preserving unindexed asset dirs for recovery this boot')
     }
-    let dirty = false
     for (const rec of this.records.values()) {
       try {
         if (!rec.contentRemoved && rec.lifecycle !== 'deleted' && rec.lifecycle !== 'expired' &&
@@ -497,7 +527,13 @@ export class MediaStore {
       } catch { /* skip */ }
     }
     if (dirty) {
-      try { this.saveIndex() } catch (err) { console.error('[media-store] reconcile save failed:', err) }
+      try {
+        this.saveIndex()
+        for (const rec of this.records.values()) {
+          if (!rec.videoUploadId) continue
+          try { rmSync(join(this.root, 'assets', rec.ref.id, 'publication-intent.json'), { force: true }) } catch { /* next boot */ }
+        }
+      } catch (err) { console.error('[media-store] reconcile save failed:', err) }
     }
   }
 
@@ -563,10 +599,23 @@ export class MediaStore {
   }
 
   private async publishPreparedRichMedia(
-    input: { label?: string; capturedAt?: string; sessionId?: string },
+    input: {
+      label?: string
+      capturedAt?: string
+      sessionId?: string
+      mediaId?: string
+      videoUploadId?: string
+    },
     prepared: PreparedRichMediaFile,
   ): Promise<MediaAttachmentRef> {
-    const id = `m_${randomBytes(12).toString('hex')}`
+    const id = input.mediaId && isValidMediaId(input.mediaId)
+      ? input.mediaId
+      : `m_${randomBytes(12).toString('hex')}`
+    const existing = this.getRecord(id)
+    if (existing) {
+      if (input.videoUploadId && existing.videoUploadId === input.videoUploadId) return existing.ref
+      throw new MediaStoreError('media_conflict', `attachment ${id} already exists`)
+    }
     const now = Date.now()
     const nowIso = new Date(now).toISOString()
     const extension = prepared.category === 'video'
@@ -631,13 +680,24 @@ export class MediaStore {
       sha256,
       lifecycle: 'staged',
       ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+      ...(input.videoUploadId ? { videoUploadId: input.videoUploadId } : {}),
       createdAtMs: now,
       updatedAtMs: now,
     }
+    // A crash can land after assets/<id> is renamed but before index.json is
+    // committed. Keep a private complete record beside the asset so boot
+    // reconciliation can finish that exact publication rather than deleting a
+    // valid video as an orphan. The public ref never exposes this file.
+    durableAtomicWriteFileSync(
+      join(this.root, 'assets', id, 'publication-intent.json'),
+      JSON.stringify(record),
+      { mode: 0o600 },
+    )
     await this.withLock(() => {
       this.records.set(id, record)
       this.saveIndex()
     })
+    try { rmSync(join(this.root, 'assets', id, 'publication-intent.json'), { force: true }) } catch { /* boot can clean it */ }
     // AFTER publication and outside the lock: x265 encodes at roughly real
     // time, so awaiting it here would hold the upload response open for the
     // length of the video.
@@ -814,6 +874,16 @@ export class MediaStore {
     return this.getRecord(id)?.ref ?? null
   }
 
+  /** Private receipt-recovery lookup. Upload ids are not capabilities and are
+   * never returned by ordinary media metadata routes. */
+  findByVideoUploadId(uploadId: string): MediaRecord | null {
+    if (!/^vu_[0-9a-f]{24}$/.test(uploadId)) return null
+    for (const record of this.records.values()) {
+      if (record.videoUploadId === uploadId) return record
+    }
+    return null
+  }
+
   /** Recover the public refs associated with one exact conversation turn.
    *
    * The media index is already the durable lifecycle authority for uploaded
@@ -1159,6 +1229,27 @@ export class MediaStore {
     })
   }
 
+  /** Resumable-upload cancel may release a just-published result, but it must
+   * never delete a reservation that a queued Ask already owns. */
+  deleteExactlyStaged(id: string): Promise<'deleted' | 'retained' | 'missing'> {
+    return this.withLock(() => {
+      const rec = this.records.get(id)
+      if (!rec || rec.lifecycle === 'deleted') return 'missing'
+      if (rec.lifecycle !== 'staged') return 'retained'
+      this.removeAssetFiles(rec)
+      rec.lifecycle = 'deleted'
+      rec.contentRemoved = true
+      rec.updatedAtMs = Date.now()
+      this.saveIndex()
+      return 'deleted'
+    })
+  }
+
+  /** Durable upload manifests live beside, not inside, the legacy tmp tree. */
+  rootDirectory(): string {
+    return this.root
+  }
+
   private removeAssetFiles(rec: MediaRecord): void {
     try {
       rmSync(join(this.root, 'assets', rec.ref.id), { recursive: true, force: true })

package/server/lib/query-attachments.ts

@@ -50,7 +50,7 @@ export interface ResolvedQueryAttachments {
  * an optional aid over canonical text — so this ceiling cannot be treated as a
  * budget to trim silently. It has to fit a whole video.
  */
-const MAX_MODEL_IMAGE_INPUTS = VIDEO_SUMMARY_FRAMES_MAX
+export const MAX_MODEL_IMAGE_INPUTS = VIDEO_SUMMARY_FRAMES_MAX
 const MAX_ATTACHMENT_PROMPT_CHARS = 60_000
 
 export class QueryAttachmentError extends Error {