@gotcos/glasses-server 6.27.4 → 6.27.6

package/CHANGELOG.md

@@ -1,3 +1,42 @@
+## 6.27.6
+- **V2 original chunks are 1 MiB.** Same sequential one-in-flight loop, same
+  ArrayBuffer bodies, same GET-progress resume. A 244 MB clip goes from 953
+  round trips to ~239. That is the leftover ~10% against legacy 8 MiB, paid as
+  per-chunk RTT, without opening a second fetch — two concurrent ArrayBuffer
+  PUTs from this WebView are still an untested shape.
+- **In-flight 256 KiB drafts keep their size.** `putOriginal` checks the
+  session's own `chunkBytes`, not the live constant, so a draft that started
+  before this upgrade still accepts 256 KiB parts and rejects a 1 MiB PUT into
+  that slot. New inits advertise 1 MiB. Do not raise this above 1 MiB until the
+  phone parser cap is raised first — above that, V2 capability parse returns
+  null and the transport silently falls back to legacy.
+- Frame parts stay 256 KiB. Protocol stays 1.
+
+## 6.27.5
+- **Chunk uploads now leave a server-side trace.** On 2026-08-12 a phone upload
+  stalled on both media transports and the server was a complete blind spot: nothing
+  recorded that a chunk request had arrived, so "the client never got the ack" could
+  not be separated from "the server never sent one" without reading a staging file's
+  mtime and running `netstat` by hand.
+- `[media-chunk]` now logs one line per REQUEST (never per data event - a 237-chunk
+  upload logging per `data` would bury the log): `body-read` when the body finishes
+  arriving, `responded` with status when the response is fully flushed to the socket,
+  `abandoned` when the client goes away mid-body, and `closed-unanswered` when the
+  socket closes with no response written. Each carries bytes received and elapsed ms.
+- `closed-unanswered` is the only case where blaming the server is correct, and it is
+  now stated explicitly rather than inferred from absence of evidence. It gates on
+  **`res` 'close', not `req` 'close'**: since Node 16 `IncomingMessage` emits 'close'
+  when the REQUEST completes rather than when the socket does, so on an async handler
+  (`putOriginal` and `putFrame` both are) it lands while `res.writableEnded` is still
+  false. Gated on `req` it false-fired on EVERY successful V2 chunk — 237 bogus alarms
+  per upload on the single most diagnostic line in the file. Caught by adversarial QA
+  before release and pinned by a test that fails if the gate moves back.
+- The two early refusals (`chunk_bytes_required` 400 and declared-Content-Length 413)
+  returned BEFORE the tracer existed, so a chunk the server actively rejected logged
+  nothing — the same silence as a request that never arrived. The tracer is now
+  declared above them and every refusal logs.
+- Diagnosis only. No behaviour change to any upload path.
+
 ## 6.27.4
 
 ### Fuzzy name corrections reach phone dictation

package/README.md

@@ -180,7 +180,8 @@ machine-wide rollback for build 204+ server-owned query recovery),
 `COS_MEDIA_ROOT` (optional image/video store location; default
 `~/.cos-glasses/data/media`), and `COS_VIDEO_UPLOAD_V2=1` (private 6.27.3+
 resumable-video canary, managed by COS Control 0.5.20). The V2 canary retains
-accepted 256 KiB chunks and finalize receipts across restarts; keep it off when
+accepted original chunks (1 MiB on new sessions; leftover 256 KiB drafts keep
+that size) and finalize receipts across restarts; keep it off when
 using an older companion. Your name + transcription vocabulary live in
 `~/.cos-glasses/.cos-profile.json` (see `.cos-profile.example.json`).
 Factory example values are ignored; add the real names, companies, acronyms,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.27.4",
+  "version": "6.27.6",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -162,7 +162,8 @@ app.use('/api', requireApiToken(API_TOKEN))
 // through their true terminal boundary.
 app.use('/api', (req, res, next) => {
   if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next()
-  // V2 video chunks are bounded to 256 KiB and commit through the upload
+  // V2 video original chunks are bounded to the advertised session size (1 MiB
+  // on new sessions, 256 KiB on leftover drafts) and commit through the upload
   // registry's own generation lock. Holding the global mutation lease while
   // the phone transfers the body recreated the exact 90-second drain failure
   // this protocol exists to remove. Admission is checked by the route before

package/server/lib/video-upload-v2.ts

@@ -27,7 +27,12 @@ import { getMediaStore } from './media-store.js'
 import { MAX_CHUNKED_MEDIA_BYTES, MAX_VIDEO_DURATION_MS } from './rich-media-safety.js'
 
 export const VIDEO_UPLOAD_V2_PROTOCOL = 1
-export const VIDEO_UPLOAD_V2_CHUNK_BYTES = 256 * 1024
+/** New sessions only. In-flight drafts keep the chunkBytes baked into their
+ *  manifest — a 256 KiB upload that survives this upgrade must not be rewritten
+ *  to 1 MiB mid-transfer. The phone parser currently rejects advertised sizes
+ *  above 1 MiB and disables V2 entirely, so do not raise this without raising
+ *  that cap first. */
+export const VIDEO_UPLOAD_V2_CHUNK_BYTES = 1024 * 1024
 export const VIDEO_UPLOAD_V2_MAX_FRAME_BYTES = 256 * 1024
 export const VIDEO_UPLOAD_V2_MAX_FRAME_PACK_BYTES = 2 * 1024 * 1024
 export const VIDEO_UPLOAD_PHONE_FRAMES_MIN = 8
@@ -177,6 +182,17 @@ function parseIndex(value: unknown): number | null {
   return typeof raw === 'number' && Number.isSafeInteger(raw) && raw >= 0 ? raw : null
 }
 
+/** Exact byte length this session expects for original index `index`.
+ *  Non-final parts are the session's own chunkBytes (which may be 256 KiB on a
+ *  draft that started before the 1 MiB advertisement). The last part is the
+ *  remainder. Using the live constant here would accept a 1 MiB PUT into a
+ *  256 KiB slot and fail assembly, or reject a legitimate leftover last chunk. */
+function expectedOriginalPartBytes(manifest: VideoUploadManifest, index: number): number {
+  if (index < 0 || index >= manifest.chunkCount) return 0
+  if (index === manifest.chunkCount - 1) return manifest.totalBytes - index * manifest.chunkBytes
+  return manifest.chunkBytes
+}
+
 function sameInit(manifest: VideoUploadManifest, input: Required<Pick<VideoUploadManifest,
   'serverInstanceId' | 'totalBytes' | 'mime'>> & Pick<VideoUploadManifest, 'label' | 'capturedAt' | 'sessionId'>): boolean {
   return manifest.serverInstanceId === input.serverInstanceId
@@ -442,8 +458,8 @@ export class VideoUploadRegistry {
   ): Promise<VideoUploadProgress> {
     const index = parseIndex(indexValue)
     if (index === null || bytes.length === 0) throw new VideoUploadError('video_upload_invalid', 'valid non-empty part required')
-    const max = kind === 'original' ? VIDEO_UPLOAD_V2_CHUNK_BYTES : VIDEO_UPLOAD_V2_MAX_FRAME_BYTES
-    if (bytes.length > max) throw new VideoUploadError('video_upload_invalid', 'part exceeds its byte ceiling', { maxBytes: max })
+    const advertisedMax = kind === 'original' ? VIDEO_UPLOAD_V2_CHUNK_BYTES : VIDEO_UPLOAD_V2_MAX_FRAME_BYTES
+    if (bytes.length > advertisedMax) throw new VideoUploadError('video_upload_invalid', 'part exceeds its byte ceiling', { maxBytes: advertisedMax })
     this.activeWriters.set(uploadId, (this.activeWriters.get(uploadId) ?? 0) + 1)
     try {
       return await this.withLock(uploadId, () => {
@@ -451,6 +467,14 @@ export class VideoUploadRegistry {
         if (manifest.state !== 'receiving') throw new VideoUploadError('video_upload_busy', `upload is ${manifest.state}`)
         if (kind === 'original' && index >= manifest.chunkCount) throw new VideoUploadError('video_upload_invalid', 'chunk index exceeds declared upload')
         if (kind === 'frames' && index >= VIDEO_UPLOAD_PHONE_FRAMES_MAX) throw new VideoUploadError('video_upload_invalid', 'frame index exceeds pack limit')
+        if (kind === 'original') {
+          const expected = expectedOriginalPartBytes(manifest, index)
+          if (bytes.length !== expected) {
+            throw new VideoUploadError('video_upload_invalid', 'part does not match the session chunk size', {
+              expectedBytes: expected, receivedBytes: bytes.length, chunkBytes: manifest.chunkBytes,
+            })
+          }
+        }
         const collection = manifest[kind]
         const key = String(index)
         const digest = sha256(bytes)

package/server/routes/media.ts

@@ -255,7 +255,42 @@ export function createMediaChunkBodyParser(options: MediaChunkParserOptions = {}
       return
     }
 
+    // Chunk-upload lifecycle trace.
+    //
+    // WHY. On 2026-08-12 a phone upload stalled on BOTH transports and the server side
+    // was a complete blind spot: nothing recorded that a chunk request had even
+    // arrived, so "the client never got the ack" could not be separated from "the
+    // server never sent one" without reading a staging file's mtime and running
+    // netstat by hand.
+    //
+    // SAMPLED like the client's breadcrumbs, and for the same reason. One line per
+    // REQUEST is still 2 rows x 248 chunks per video (~500), and at the advertised
+    // 2 GB ceiling ~16,400 rows and ~1.5 MB of log for ONE upload, into a LaunchAgent
+    // stdout with no rotation. Routine progress is sampled; the DIAGNOSTIC events —
+    // abandoned, closed-unanswered, too-large, and any non-2xx — are never sampled
+    // away, because those are the rows an investigation actually needs.
+    //
+    // Declared ABOVE the early refusals below: those used to return before this
+    // existed, so a chunk the server actively refused logged nothing at all — the
+    // same silence as a request that never arrived.
+    const openedAt = Date.now()
+    // `?? ''` is load-bearing: a request with neither field (the direct-parser test
+    // harness, and any non-Express caller) made `path.slice` throw and took the whole
+    // parser down. A tracer must never be able to break the thing it observes.
+    const path = req.originalUrl?.split('?')[0] ?? req.url ?? ''
+    const traceTarget = `${req.method} ${path}`
+    // Trailing segment is the chunk index on both routes
+    // (`/media/upload/:id/:index` and `/media/video-upload/:id/original/:index`).
+    const chunkIndex = Number(path.slice(path.lastIndexOf('/') + 1))
+    const sampled = !Number.isFinite(chunkIndex) || chunkIndex === 0 || chunkIndex % 32 === 0
+    let received = 0
+    const logLifecycle = (event: string, extra = '', always = false): void => {
+      if (!always && !sampled) return
+      console.log(`[media-chunk] ${event} ${traceTarget} bytes=${received} +${Date.now() - openedAt}ms${extra}`)
+    }
+
     const refuse = (status: number, body: Record<string, unknown>): void => {
+      logLifecycle('refused', ` status=${status} error=${String(body.error ?? '')}`, true)
       res.status(status).json(body)
       res.once('finish', () => req.destroy())
     }
@@ -279,7 +314,6 @@ export function createMediaChunkBodyParser(options: MediaChunkParserOptions = {}
     }
 
     const parts: Buffer[] = []
-    let received = 0
     let settled = false
 
     req.on('data', (chunk: Buffer) => {
@@ -288,6 +322,7 @@ export function createMediaChunkBodyParser(options: MediaChunkParserOptions = {}
       if (received > maxChunkBytes) {
         settled = true
         parts.length = 0
+        logLifecycle('too-large', ` max=${maxChunkBytes}`)
         refuse(413, { error: 'attachment_too_large', maxBytes: maxChunkBytes })
         return
       }
@@ -297,12 +332,33 @@ export function createMediaChunkBodyParser(options: MediaChunkParserOptions = {}
       if (settled) return
       settled = true
       parts.length = 0
+      // The client went away mid-body. Distinguishes a phone that stopped sending
+      // from a server that stopped answering — opposite diagnoses, same silence.
+      logLifecycle('abandoned')
     }
     req.once('aborted', abandon)
     req.once('error', abandon)
+    // Fires when the response is fully flushed to the socket. Paired with 'body-read'
+    // this is the proof that the server answered, and how fast.
+    res.once('finish', () => {
+      logLifecycle('responded', ` status=${res.statusCode}`)
+    })
+    // `res` 'close', NOT `req` 'close'. Since Node 16 `IncomingMessage` emits 'close'
+    // when the REQUEST completes, not when the socket does — so on any async handler
+    // it fires while `res.writableEnded` is still false. `putOriginal`/`putFrame` are
+    // both async, so gating on `req` made this false-fire on EVERY successful V2
+    // chunk: 237 bogus rows per upload, on the single line the changelog calls "the
+    // only case where blaming the server is correct". A watcher that cries wolf on the
+    // happy path is worse than no watcher. `res` 'close' fires after the response is
+    // finished or genuinely aborted, so the guard means what it says.
+    res.once('close', () => {
+      if (res.writableEnded) return
+      logLifecycle('closed-unanswered', '', true)
+    })
     req.once('end', () => {
       if (settled) return
       settled = true
+      logLifecycle('body-read')
       chunkBodies.set(req, Buffer.concat(parts))
       next()
     })