@gotcos/glasses-server 6.32.0 → 6.34.0

package/CHANGELOG.md

@@ -2219,6 +2219,61 @@ unsaved capture, and makes batch status stop lying about finished work.
 
 # Changelog
 
+## [6.34.0] - 2026-08-16
+
+### A continued turn now runs with the session's own permissions
+
+- **This widens what Continue can do.** A prompt spoken into the glasses can run
+  tools on the Mac with nobody at the keyboard. Authorized explicitly by Miles
+  after his first real continued turn came back reporting that every tool was
+  disabled, which is not the point of the feature.
+- Claude drops `--permission-mode plan` and the empty `--tools`/`--allowedTools`
+  pair. Codex now uses `getCodexTrustMode()`, the same posture ordinary Codex runs
+  use on the host, rather than a stricter one invented at this call site. Absent
+  `COS_CODEX_SANDBOX=workspace-write` that is still read-only, so this is never
+  more permissive than the rest of the server.
+- **Unchanged, and load-bearing:** `COS_THREAD_ATTACH_ENABLED` still gates the
+  surface and off still leaves the routes unregistered; `findBannedPermissionArg`
+  still rejects every real bypass at the spawn boundary; delivery is still gated
+  on a fresh occupancy probe, the epoch floor, the per-target claim and the head
+  watermark. Dropping a lockdown is not adding a bypass.
+- The old read-only posture had NO test asserting it was present, so it could have
+  been deleted silently. The new posture is pinned, and so is the bypass ban.
+
+## [6.33.0] - 2026-08-16
+
+### One switch turns Continue on
+
+Continue was gated by two environment variables, and the second one was
+invisible. `COS_THREAD_ATTACH_ENABLED=1` registered the write routes;
+`COS_THREAD_ATTACH_IDLE_HOLDER=1` was additionally needed before COS would write
+into a thread whose Mac window is open but idle. COS Control's "Continue agent
+threads" checkbox sets only the first, so health reported the feature ON while
+every single attempt was refused, because a developer's editor windows stay
+open and that is precisely the case the second flag covered.
+
+- **`COS_THREAD_ATTACH_ENABLED=1` is now the whole answer.** It registers the two
+  write routes and wires the transcript clock that tells an idle holder from a
+  working one. Nothing else to set.
+- **`COS_THREAD_ATTACH_IDLE_HOLDER` is REMOVED, not deprecated.** If you set it
+  by hand, it is now ignored and can be deleted from your LaunchAgent plist or
+  shell profile. Leaving it in place changes nothing either way.
+- **COS Control needs no update for this.** Its existing checkbox already writes
+  the surviving key, so the toggle that reported ON while refusing now reports
+  ON and works.
+
+The two switches were never independently useful, and folding them is the honest
+description of the decision rather than a convenience. The relaxation is what
+makes a silent fork possible, so "Continue is on" and "a fork may happen" are one
+choice, and one switch states it.
+
+Every safety behaviour is unchanged. A holder measured WRITING is still refused
+with `native_thread_working`; a holder COS cannot measure is still refused with
+`live_desktop_process`, because only a positive idle observation relaxes the gate
+and an unreadable transcript is not one. Off still means the write routes are not
+registered at all, so a disabled server answers 404 rather than 403 and holds no
+reachable write code.
+
 ## [6.32.0] - 2026-08-16
 
 ### Continue now blocks on WORKING, not on merely open

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.32.0",
+  "version": "6.34.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -20,15 +20,13 @@ import { transcribeRouter } from './routes/transcribe.js'
 import { sessionIndexRouter } from './routes/session-index.js'
 import { agentSessionsRouter } from './routes/agent-sessions.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
-import { createAgentSessionBindingsRouter } from './routes/agent-session-bindings.js'
+import {
+  createAgentSessionBindingsRouter,
+  threadAttachEnabled,
+} from './routes/agent-session-bindings.js'
 import { AgentSessionBindingRegistry } from './lib/agent-session-binding-registry.js'
 import { cosSpawnedPids } from './lib/agent-session-ownership-store.js'
-import {
-  idleHolderContinueEnabled,
-  realOccupancyDirs,
-  realOccupancyProbes,
-  withTranscriptClock,
-} from './lib/occupancy-probes.js'
+import { buildOccupancyProbes, realOccupancyDirs } from './lib/occupancy-probes.js'
 import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
 import { deliverAttachedTurn, realAttachedTurnDeps } from './lib/attached-provider-adapter.js'
 import { forkThread, realForkDeps } from './lib/fork-thread.js'
@@ -310,13 +308,20 @@ const occupancyDirs = realOccupancyDirs()
 const nativeHeadDeps = realNativeHeadDeps()
 const attachedWorkspaceDeps = realAttachedWorkspaceDeps(nativeHeadDeps)
 /**
- * THE ONE PLACE the idle-holder relaxation is switched on (6.32.0).
+ * THE ONE PLACE the idle-holder relaxation is switched on, on the ONE flag
+ * that also registers the write routes (6.33.0).
  *
  * Without the clock, a foreign holder is terminal and Continue is refused for
  * any thread with a Claude Code window open on it — including the ones Miles
  * actually works in, because he leaves those windows open. With it, a holder
  * measured idle is continuable and only a holder measured WRITING is refused.
  *
+ * `threadAttachEnabled()` is the same call `createAgentSessionBindingsRouter`
+ * makes below to decide whether the two POST routes exist at all. Reading it
+ * here rather than a second env key is what makes "Continue is on" a single
+ * answer: the pair of flags this replaced could disagree, and did, reporting
+ * the feature enabled while every attempt was refused.
+ *
  * Both gates read this same object — the route's detector via `probes` below,
  * and the adapter's pre-spawn preflight via `occupancyProbes` at the closure
  * further down — so they cannot come to different conclusions. That is the whole
@@ -325,9 +330,7 @@ const attachedWorkspaceDeps = realAttachedWorkspaceDeps(nativeHeadDeps)
  * Read the canary evidence in `thread-occupancy.ts` under THE IDLE-HOLDER
  * RELAXATION before changing this line.
  */
-const occupancyProbes = idleHolderContinueEnabled()
-  ? withTranscriptClock(realOccupancyProbes(cosSpawnedPids), nativeHeadDeps)
-  : realOccupancyProbes(cosSpawnedPids)
+const occupancyProbes = buildOccupancyProbes(cosSpawnedPids, nativeHeadDeps, threadAttachEnabled())
 
 /**
  * The shim between the route's request shape and the adapter's.

package/server/lib/attached-provider-adapter.ts

@@ -93,6 +93,7 @@ import { isValidNativeThreadId } from './native-thread-id.js'
 import { isBindableProvider, type BindableProvider } from './agent-session-binding-store.js'
 import { recordCosSpawn, releaseCosSpawn } from './agent-session-ownership-store.js'
 import { processStartMs as realProcessStartMs } from './occupancy-probes.js'
+import { getCodexTrustMode } from './codex-run-ledger.js'
 
 /** Providers with a certified attached path. Cursor is Fork-only (plan 2.5). */
 export type AttachedProvider = BindableProvider
@@ -529,17 +530,35 @@ const STRIPPED_ENV_KEYS: readonly string[] = ['CLAUDECODE', 'COS_API_TOKEN']
 // ---------------------------------------------------------------------------
 
 /**
- * Claude: `claude -p --resume <id>`, read-only, prompt on stdin.
+ * Claude: `claude -p --resume <id>`, prompt on stdin.
  *
  * The prompt is NOT an argv element. argv is world-readable through `ps`, and
  * the prompt is the user's private text; stdin also matches what both ordinary
  * bridges already do.
  *
- * Two independent read-only layers, because either alone is one assumption
- * deep: `--permission-mode plan` means the model cannot mutate regardless of
- * its tool list, and the empty `--tools`/`--allowedTools` pair is the exact
- * text-only posture `claude-permissions.ts` already ships for untrusted mode.
- * If an older CLI rejects `plan`, it exits non-zero and we fail closed.
+ * THE TURN INHERITS THE SESSION'S OWN PERMISSIONS (Miles, 2026-08-16, explicit).
+ *
+ * This used to force two independent read-only layers: `--permission-mode plan`
+ * plus an empty `--tools`/`--allowedTools` pair. The result was a Continue that
+ * could talk into a thread and do nothing in it -- his first real continued turn
+ * came back reporting that every tool was disabled, which is not "like being at
+ * the desk". Both layers are gone; a resumed turn now runs as that session
+ * ordinarily would.
+ *
+ * What that means plainly: a prompt spoken into a pair of glasses can run tools
+ * on this Mac with nobody at the keyboard. That is the intent, not an oversight.
+ * The protections that remain, and that must not be quietly removed with it:
+ *
+ *   1. `COS_THREAD_ATTACH_ENABLED` still gates the whole surface, and off means
+ *      the write routes are never registered.
+ *   2. `findBannedPermissionArg` still runs at the spawn boundary and still
+ *      rejects the actual bypasses -- `--dangerously-skip-permissions`, `--yolo`,
+ *      `danger-full-access` and the rest. Dropping a lockdown is not the same as
+ *      adding a bypass, and the bypass ban is unchanged.
+ *   3. The menu cursor rests on a row that cannot act, so a false-positive ring
+ *      tap cannot reach Continue (`defaultSessionThreadActionIndex`).
+ *   4. Delivery is still gated on a fresh occupancy probe, the epoch floor, the
+ *      per-target claim and the head watermark.
  */
 export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
   return [
@@ -549,9 +568,6 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
     // never observe the session id we are required to verify.
     '--verbose',
     '--resume', nativeThreadId,
-    '--permission-mode', 'plan',
-    '--tools', '',
-    '--allowedTools', '',
   ]
 }
 
@@ -571,7 +587,10 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
 export function buildCodexAttachedArgs(nativeThreadId: string, cwd: string): string[] {
   return [
     'exec',
-    '--sandbox', 'read-only',
+    // The posture ordinary Codex runs use on this host, not a stricter one
+    // invented here. `COS_CODEX_SANDBOX=workspace-write` opts in; absent stays
+    // read-only, so this is never MORE permissive than the rest of the server.
+    '--sandbox', getCodexTrustMode(),
     '--cd', cwd,
     'resume',
     '--json',

package/server/lib/occupancy-probes.ts

@@ -446,21 +446,39 @@ export function realOccupancyProbes(ledger: SpawnLedgerAccessor): OccupancyProbe
 }
 
 /**
- * Is the idle-holder relaxation switched on for this install?
+ * The probe set this install should run, clock and all.
  *
- * ONE READER, exported so every other module imports it rather than re-reading
- * `process.env` — the same anti-drift rule `threadAttachEnabled` follows, and for
- * the same reason: a second copy is how a surface comes to advertise a write path
- * the gate will refuse.
+ * ONE DECISION, IN ONE PLACE (6.33.0). `attachEnabled` is the SAME answer that
+ * decides whether the two write routes get registered — `threadAttachEnabled()`,
+ * passed in by the composition root rather than re-read here. There is exactly
+ * one reader of `COS_THREAD_ATTACH_ENABLED` in the server, and a second copy is
+ * how a surface comes to advertise a write path the gate will refuse.
  *
- * `=== '1'` opt-IN, not `!== '0'` opt-out. This decides whether COS may write
- * into a conversation a human still has open, so anything ambiguous — unset,
- * empty, 'true', 'yes' — reads as OFF. It composes with
- * `COS_THREAD_ATTACH_ENABLED`: with attach itself off, this flag does nothing at
- * all, because there is no write path to relax.
+ * WHY THE CLOCK RIDES THE SAME SWITCH. In 6.32.0 the relaxation had a second
+ * env key of its own (named in the 6.33.0 changelog entry; it is now ignored),
+ * and the two were never independently useful: without the clock, Continue is
+ * refused on every thread with an editor window open, which for a working
+ * developer is all of them. The pair also cost a real testing cycle, because
+ * COS Control's checkbox knew only the first key and reported the feature ON
+ * while the gate still refused every session. And the honest reading is that
+ * they were always ONE decision: the relaxation is what makes a silent fork
+ * possible, so "Continue is on" and "fork is possible" are the same choice, and
+ * one switch says so.
+ *
+ * Attach off is still byte-for-byte the pre-6.28 posture: no clock, so every
+ * foreign holder reads `unknown` and refuses, and the write routes do not exist
+ * to be reached anyway.
  */
-export function idleHolderContinueEnabled(): boolean {
-  return process.env.COS_THREAD_ATTACH_IDLE_HOLDER === '1'
+export function buildOccupancyProbes(
+  ledger: SpawnLedgerAccessor,
+  headDeps: NativeHeadDeps,
+  attachEnabled: boolean,
+): OccupancyProbes {
+  const base = realOccupancyProbes(ledger)
+  // Strictly `=== true`. A caller that hands over a truthy non-boolean has not
+  // answered the question, and the permissive branch is the one that must be
+  // earned by a real yes.
+  return attachEnabled === true ? withTranscriptClock(base, headDeps) : base
 }
 
 /**

package/server/lib/thread-occupancy.ts

@@ -142,8 +142,9 @@ export interface OccupancyProbes {
    * foreign holder stays `live_desktop_process` — byte-for-byte the behaviour
    * that shipped before the idle-holder relaxation existed. That is why it is
    * optional rather than required: the strict gate is what you get by doing
-   * nothing, and the relaxation has to be wired on purpose (see `server/index.ts`,
-   * where the wiring is itself behind `COS_THREAD_ATTACH_IDLE_HOLDER`).
+   * nothing, and the relaxation is wired on purpose by `buildOccupancyProbes`
+   * in `occupancy-probes.ts`, which attaches the clock only when thread attach
+   * itself is on.
    *
    * Null is NOT idle. See `holderActivity` for why that distinction is the whole
    * safety property here.
@@ -525,9 +526,12 @@ export interface OccupancyDirs {
 // `isActiveRecently` here; its `false` means "stale OR unmeasurable", and only
 // `holderActivity` separates those.
 //
-// TURNING IT OFF. Unwire `probes.transcriptMtimeMs` (in practice: unset
-// `COS_THREAD_ATTACH_IDLE_HOLDER`). Every foreign holder then reads `unknown`
-// and refuses, which is the pre-6.32.0 gate exactly. No rollback needed.
+// TURNING IT OFF. Unwire `probes.transcriptMtimeMs`. Since 6.33.0 that happens
+// by unsetting `COS_THREAD_ATTACH_ENABLED`, the one switch that also unregisters
+// the write routes: the relaxation is what makes a silent fork possible, so it
+// is the same decision as Continue itself and no longer has a flag of its own.
+// Every foreign holder then reads `unknown` and refuses, which is the pre-6.32.0
+// gate exactly, and with attach off there is no write route to reach anyway.
 
 /**
  * The Phase 0 attach precondition.