@gotcos/glasses-server 6.27.13 → 6.28.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 ## Unreleased
 
+## 6.28.0
+- **Continue Original Agent Thread — attach to a live desktop thread and append a turn
+  to it.** From the glasses you can now continue a Claude Code or Codex conversation that
+  already exists on your Mac: the turn is written into the REAL transcript, not a copy.
+  Verified end to end on disposable threads for both providers.
+
+  **OFF BY DEFAULT and permanently supported that way.** Set `COS_THREAD_ATTACH_ENABLED=1`
+  to turn it on. With it unset you get exactly the behaviour that existed before: read-only
+  session browsing and Fork-only everywhere. The two write routes are not registered at all
+  when it is off, so a disabled server holds no reachable write code, and the attachability
+  endpoint answers `attach_disabled` without touching the filesystem.
+
+- **A thread that someone has open on the desktop is never written to.** COS resolves, from
+  a first-party per-session registry, whether a live process owns the thread, and refuses
+  with "Open on your Mac. Fork it instead." Ownership of COS's own spawned child is
+  established from a measured kernel process start, because a bare pid can be recycled.
+
+- **A repeated POST replays instead of delivering twice.** Turns carry a required client
+  idempotency key and completed or ambiguous outcomes are remembered durably, so a retry
+  after a lost response returns what the first turn did rather than posting a second copy
+  into the conversation. A pre-delivery refusal stays re-evaluatable.
+
+- **A turn whose fate is unknown is never reported as a clean failure.** If the provider
+  fails after the prompt was delivered, the outcome is `ambiguous` with `retryable: false`
+  and copy telling you to check the thread, because a retry there would double-post.
+
+- No always-approve, bypass-permissions or sandbox-escape flag can reach a provider running
+  an attached turn; the argv is checked before any process is created.
+
 ## 6.27.13
 - **`POST /api/meeting/:sessionId/backfill-enrolment`** — train a profile from a voice
   that was named BEFORE enrolment shipped. Those meetings have a correct transcript and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.27.13",
+  "version": "6.28.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -20,6 +20,14 @@ import { transcribeRouter } from './routes/transcribe.js'
 import { sessionIndexRouter } from './routes/session-index.js'
 import { agentSessionsRouter } from './routes/agent-sessions.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
+import { createAgentSessionBindingsRouter } from './routes/agent-session-bindings.js'
+import { AgentSessionBindingRegistry } from './lib/agent-session-binding-registry.js'
+import { cosSpawnedPids } from './lib/agent-session-ownership-store.js'
+import { realOccupancyDirs, realOccupancyProbes } from './lib/occupancy-probes.js'
+import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
+import { deliverAttachedTurn, realAttachedTurnDeps } from './lib/attached-provider-adapter.js'
+import { nativeHead, realNativeHeadDeps } from './lib/native-head.js'
+import { threadOccupancy } from './lib/thread-occupancy.js'
 import { displayRouter } from './routes/display.js'
 import { transcribeStreamRouter } from './routes/transcribe-stream.js'
 import { meetingRouter, resumeMeetingFinalizationJobs } from './routes/meeting.js'
@@ -263,6 +271,111 @@ app.use((_req, _res, next) => {
   next()
 })
 
+// Hydrated once at boot, before any route can read it. Never throws; a corrupt
+// or unreadable store yields a degraded registry rather than a silent empty one.
+const agentSessionBindingRegistry = AgentSessionBindingRegistry.open()
+// Boot reap, and it is load-bearing rather than housekeeping. A turn pins its
+// binding and unpins in a `finally` that never runs if the process dies during the
+// provider run — a window of up to the 21-minute attached timeout, and exactly what
+// a crash, a force-quit, or a COS Control "Update Server" does. A pinned binding
+// never expires by design, and `blocksTarget` refuses any pinned target, so the
+// thread becomes permanently unattachable: measured at +1m, +31m, +2d, +40d and
+// +400d, all `native_target_busy`. The refusal copy tells the user to detach the
+// other chat, and this router registers no detach route, so the only recovery was
+// hand-editing the store. `reap()` already fixes it and simply had no caller.
+try {
+  const reaped = agentSessionBindingRegistry.reap(Date.now())
+  if (reaped.pinsDropped > 0 || reaped.removed.length > 0) {
+    console.log(`[binding-registry] boot reap: ${reaped.pinsDropped} stale pin(s) dropped, ${reaped.removed.length} binding(s) removed`)
+  }
+} catch (error) {
+  console.warn('[binding-registry] boot reap failed', error)
+}
+// And periodically, so a strand created mid-run clears without waiting for the next
+// restart. Unref'd so it never holds the process open during shutdown.
+const bindingReapTimer = setInterval(() => {
+  try { agentSessionBindingRegistry.reap(Date.now()) } catch { /* next tick retries */ }
+}, 10 * 60_000)
+bindingReapTimer.unref()
+
+// Built once. Each of these reads the disk, so sharing them keeps an attach from
+// re-deriving roots per request.
+const occupancyProbes = realOccupancyProbes(cosSpawnedPids)
+const occupancyDirs = realOccupancyDirs()
+const nativeHeadDeps = realNativeHeadDeps()
+const attachedWorkspaceDeps = realAttachedWorkspaceDeps(nativeHeadDeps)
+
+/**
+ * The shim between the route's request shape and the adapter's.
+ *
+ * The route was written against a contract that carries fingerprints and a veto
+ * hook; the adapter needs a real cwd, a permission policy, and its dependencies.
+ * Reconciling them is the composition root's job — putting it in either module
+ * would make one of them know about the other's shape.
+ *
+ * OWNERSHIP IS RECORDED EXACTLY ONCE, BY THE ROUTE.
+ *
+ * An earlier version of this comment claimed "exactly once" while the code did it
+ * twice: it called `recordCosSpawn` here and then `request.onSpawn(pid)`, and the
+ * route's `onSpawn` is not a veto — it re-probes the process start and records the
+ * claim itself (agent-session-bindings.ts:1395-1422). Measured, one turn produced
+ * `recorded +2 / released +1`. Not a leak, since both writes hit one Map key and a
+ * single release clears it, but it pinned `stats().recorded : released` at a
+ * permanent 2:1 — and that ratio is exactly what an operator reads to detect the
+ * leak this ledger exists to prevent, so the diagnostic was poisoned by the code
+ * meant to feed it.
+ *
+ * The route is the right owner: it holds the `recordedPids` list its own `finally`
+ * releases from. So this delegates rather than duplicating. Any return other than
+ * the exact string 'recorded' makes the adapter SIGKILL the child and release
+ * before a single prompt byte is written, which is the veto the route wants.
+ */
+const deliverAttachedTurnForRoute = async (request: {
+  provider: 'claude' | 'codex'
+  nativeThreadId: string
+  prompt: string
+  onSpawn: (pid: number) => boolean
+}): Promise<unknown> => {
+  // Resolved here, not stored on the binding: the cwd is read from the transcript,
+  // which records it verbatim. Decoding the project slug is lossy — this Mac's own
+  // workspace path contains both a space and hyphens.
+  const workspace = resolveAttachedWorkspace(
+    request.provider, request.nativeThreadId, attachedWorkspaceDeps,
+  )
+  // No cwd means no attach. Never fall back to the server's own working directory,
+  // which is wherever the LaunchAgent happened to start.
+  if (workspace === null) {
+    return { ok: false, delivery: 'not_attempted', reason: 'target_unresolvable' }
+  }
+
+  const base = realAttachedTurnDeps(() => {
+    // The final occupancy re-check, synchronous and immediately before spawn
+    // (plan 4.3 step 6). A newly appeared owner is terminal, not a warning.
+    const verdict = threadOccupancy(
+      request.provider, request.nativeThreadId, occupancyProbes, occupancyDirs,
+    )
+    return { attachable: verdict.attachable, reason: verdict.reason }
+  })
+
+  return deliverAttachedTurn({
+    provider: request.provider,
+    nativeThreadId: request.nativeThreadId,
+    prompt: request.prompt,
+    cwd: workspace.path,
+    // The only policy this build accepts. The adapter refuses anything else and
+    // asserts no bypass/always-approve flag reaches the argv (plan 4.7).
+    policy: 'read_only',
+    deps: {
+      ...base,
+      // `startMs` is deliberately unused: the adapter already probed it as a GATE
+      // (a null there aborts before this is reached), and the route probes again
+      // as the recorder. One record, one authority.
+      recordSpawn: (pid: number, _startMs: number) =>
+        request.onSpawn(pid) ? 'recorded' : 'route_refused_ownership',
+    },
+  })
+}
+
 // API routes
 app.use('/api', healthRouter)
 app.use('/api', diagRouter)
@@ -280,6 +393,34 @@ app.use('/api', agentSessionsRouter)
 // Presence view of Claude Code sessions on this Mac. Dark unless
 // COS_CLAUDE_SESSIONS_ENABLED=1 — it projects another product's 0700 state dir.
 app.use('/api', claudeSessionsRouter)
+// Phase 0 of Continue Original Agent Thread: can COS write into a desktop thread
+// without colliding with a live writer? Read-only — it answers, it never attaches.
+// Registered AFTER agentSessionsRouter deliberately: its paths are 2 and 4 segments
+// (`/agent-sessions/bindings`, `/agent-sessions/:provider/:threadId/attachability`)
+// and cannot shadow that router's `/agent-sessions/:provider/:id` transcript route.
+app.use('/api', createAgentSessionBindingsRouter({
+  probes: occupancyProbes,
+  dirs: occupancyDirs,
+  now: () => Date.now(),
+  resolveTarget: (provider, threadId) => {
+    const workspace = resolveAttachedWorkspace(provider, threadId, attachedWorkspaceDeps)
+    // Only the fingerprints cross this boundary. The route persists what it is
+    // given, and plan 3.3 keeps a filesystem path off anything client-visible.
+    return workspace === null ? null : {
+      workspaceFingerprint: workspace.workspaceFingerprint,
+      sourceFingerprint: workspace.sourceFingerprint,
+    }
+  },
+  nativeHead: (provider, threadId) => nativeHead(provider, threadId, nativeHeadDeps),
+  deliverAttachedTurn: deliverAttachedTurnForRoute as never,
+  // One instance per process. The epoch high-water mark is only monotonic if a
+  // single reader owns the durable store, so this must never be constructed twice.
+  // `open()` never throws: an unreadable store yields a DEGRADED registry whose
+  // `available()` is false, which the route renders as a refusal rather than as an
+  // empty list — "nothing is bound" and "the store could not be read" must not
+  // look the same.
+  bindings: agentSessionBindingRegistry,
+}))
 app.use('/api', displayRouter)
 app.use('/api', transcribeStreamRouter)
 app.use('/api', meetingRouter)