@gotcos/glasses-server 6.36.22 → 6.36.24

package/CHANGELOG.md

@@ -1,3 +1,76 @@
+## 6.36.24
+
+**Playback stopped after about a minute, whatever the reply length.**
+
+The TTS play session held a deadline fixed 60 seconds from creation. iOS WKWebView
+re-requests `audio.src` every few seconds to refill its decode buffer, so once the
+session expired those refills 404'd and the audio simply stopped mid-sentence.
+
+Measured on this machine: 250 characters is 14 seconds of speech, 4,000 characters
+is 211. So any reply over roughly 1,100 characters outlived its own session. The
+symptom was "the first ten seconds play and nothing else comes" -- the fast-path
+prefix is 250 characters, which is that 14 seconds exactly.
+
+6.36.23 removed a character cap that was also real, but the cap truncated the
+TEXT; this truncated the PLAYBACK. The ceiling was time, not length, which is what
+"caps out at a max duration" meant literally.
+
+`SESSION_TTL_MS` becomes `SESSION_IDLE_MS`, refreshed on every read, so a session
+stays alive while audio is actively playing and dies a minute after it stops.
+
+Because the session UUID IS the auth for an unauthenticated play route, a purely
+sliding window could be held open indefinitely by polling. `SESSION_MAX_LIFETIME_MS`
+(30 minutes) is an absolute ceiling that reading never extends -- far longer than
+any plausible reply, and still a bounded exposure window for a leaked URL. The
+periodic reaper honours it too.
+
+v5.9.4 made these reads non-destructive for exactly this symptom and stopped one
+step short, noting "sessions still expire on the existing 60s TTL, so the practical
+exposure window is unchanged". True, and also what left the ceiling in place.
+
+Suite 3013 / 214, tsc 0. Both halves mutation-verified: removing the refresh fails
+the playback tests, and letting a read extend past the ceiling fails the security
+tests.
+
+## 6.36.23
+
+**Long replies stopped speaking at about three or four pages.**
+
+`MAX_TTS_CHARS = 4000` is OpenAI's input limit -- `gpt-4o-mini-tts` rejects
+anything longer -- and it was applied UP FRONT, before COS chose an engine. Kokoro
+runs locally and has no such limit, so local speech was being truncated by a rule
+belonging to an API it was not using. The sidecar then applied its own `text[:4000]`
+as a bare slice: no sentence boundary, no error, no signal to the caller. It simply
+stopped mid-word.
+
+The cap now lives where the backend is actually known. OpenAI keeps 4000, applied
+in BOTH its entry points (the cached generator and the streaming sibling -- capping
+one truncates silently through the other). Local gets 40,000, which is a memory and
+latency bound rather than a product limit. The sidecar's slice is now a named
+runaway-caller bound, overridable via `COS_TTS_MAX_INPUT_CHARS`.
+
+**Eight British English voices**, on disk all along and offered by nothing:
+bm_george, bm_daniel, bm_lewis, bm_fable, bf_emma, bf_alice, bf_isabella, bf_lily.
+`/api/tts/voices` now serves 28 local voices with an `accent` field, American
+first so `local[0]` is still the historical default.
+
+The voice pack ships 54. The other 26 -- Mandarin, Japanese, Hindi, Spanish,
+Brazilian Portuguese, Italian, French -- are deliberately NOT offered: the sidecar
+phonemises with `lang_code="a"`, so they would be read through an American English
+grapheme-to-phoneme pass, producing an accent artefact rather than the language.
+Exposing them needs a lang_code map and text in the matching language.
+
+**`isKokoroVoiceId` now checks the catalog instead of the shape.** It was
+`/^[a-z]{2}_[a-z0-9]+$/i`, which accepts any id of the right form -- the 26
+non-English voices, and ids for no voice at all. Nothing downstream refused them
+either: the sidecar falls back requested -> COS_TTS_KOKORO_VOICE -> am_echo and
+returns audio, so an unrecognised voice produced a DIFFERENT voice with no error.
+`KOKORO_VOICE_IDS` had existed for exactly this check and was never read.
+
+Suite 3008 / 213, tsc 0. Three mutations verified: restoring the shared cap on the
+local path, reintroducing the up-front cap, and dropping the British set each fail
+the assertion written for them.
+
 ## 6.36.22
 
 **`features.claudeSessions` in health**, so a client toggle can read its own state.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.36.22",
+  "version": "6.36.24",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/tts-cache.ts

@@ -71,7 +71,10 @@ interface SessionEntry {
   preferOpenAI?: boolean
   /** Settings forced Local/Kokoro — do not auto-escape to OpenAI on play miss. */
   forceLocal?: boolean
+  /** Idle deadline. Pushed out on every read; never past `hardExpiresAt`. */
   expiresAt: number
+  /** Absolute deadline, fixed at creation. Reading never extends it. */
+  hardExpiresAt: number
 }
 
 interface DiskSidecar {
@@ -83,7 +86,32 @@ interface DiskSidecar {
 
 const MAX_ENTRIES = 50
 const MAX_TOTAL_BYTES = 100 * 1024 * 1024 // 100 MB — in-memory cap
-const SESSION_TTL_MS = 60_000
+/**
+ * IDLE timeout, not a lifetime. Refreshed on every read.
+ *
+ * It was a fixed 60s from creation, which silently capped PLAYBACK at 60
+ * seconds: iOS WKWebView re-requests `audio.src` every few seconds to refill
+ * its decode buffer, and once the session expired those refills 404'd and the
+ * audio simply stopped. Measured on this machine, 250 characters is 14 seconds
+ * of speech and 4,000 characters is 211 -- so any reply over roughly 1,100
+ * characters outlived its own session and cut off mid-sentence.
+ *
+ * v5.9.4 made reads non-destructive for exactly this reason and stopped one
+ * step short, noting "sessions still expire on the existing 60s TTL, so the
+ * practical exposure window is unchanged". That was true, and it is also what
+ * left the ceiling in place.
+ */
+const SESSION_IDLE_MS = 60_000
+
+/**
+ * Absolute ceiling, never refreshed.
+ *
+ * The session UUID IS the auth for an unauthenticated play route, so a purely
+ * sliding window could be kept alive indefinitely by polling. Thirty minutes is
+ * far longer than any plausible single reply (211 seconds for 4,000 characters)
+ * and still bounds the exposure of a leaked URL.
+ */
+const SESSION_MAX_LIFETIME_MS = 30 * 60_000
 
 /** Disk cache configuration (env-overridable). Defaults sized for "I run this
  *  on my laptop and forget about it for months" rather than a service tier.
@@ -499,9 +527,14 @@ function sweepStaleByAge(): void {
  *  (hash, text, voice, format) bundle. The play route may reread it for native
  *  Range refills during the 60-second TTL; expired sessions are rejected and
  *  reaped by the periodic sweeper below. */
-export function createSession(s: Omit<SessionEntry, 'expiresAt'>): string {
+export function createSession(s: Omit<SessionEntry, 'expiresAt' | 'hardExpiresAt'>): string {
   const uuid = randomUUID()
-  sessions.set(uuid, { ...s, expiresAt: Date.now() + SESSION_TTL_MS })
+  const now = Date.now()
+  sessions.set(uuid, {
+    ...s,
+    expiresAt: now + SESSION_IDLE_MS,
+    hardExpiresAt: now + SESSION_MAX_LIFETIME_MS,
+  })
   return uuid
 }
 
@@ -520,10 +553,16 @@ export function createSession(s: Omit<SessionEntry, 'expiresAt'>): string {
 export function peekSession(uuid: string): SessionEntry | null {
   const s = sessions.get(uuid)
   if (!s) return null
-  if (s.expiresAt < Date.now()) {
+  const now = Date.now()
+  // Absolute ceiling first: a hard expiry must not be extendable by reading.
+  if (s.hardExpiresAt <= now || s.expiresAt < now) {
     sessions.delete(uuid)
     return null
   }
+  // SLIDING. Every Range refill during playback pushes the idle deadline out, so
+  // a session lives as long as audio is actively being played and dies a minute
+  // after it stops -- never past the hard ceiling.
+  s.expiresAt = Math.min(now + SESSION_IDLE_MS, s.hardExpiresAt)
   return s
 }
 
@@ -552,7 +591,7 @@ export function consumeSession(uuid: string): SessionEntry | null {
 export function reapExpiredSessions(): void {
   const now = Date.now()
   for (const [uuid, s] of sessions) {
-    if (s.expiresAt < now) sessions.delete(uuid)
+    if (s.hardExpiresAt <= now || s.expiresAt < now) sessions.delete(uuid)
   }
 }
 

package/server/lib/tts-engine.ts

@@ -47,6 +47,29 @@ export const KOKORO_VOICE_OPTIONS = [
   { id: 'af_river', label: 'River (af_river)' },
 ] as const
 
+/** British English presets, verified on disk in the same voice pack.
+ *
+ *  Kept a SEPARATE list rather than folded into the American one: the picker
+ *  groups by accent, and a caller that wants "the default set" should not silently
+ *  get a British voice. All 54 packaged voices were considered; only these 8 are
+ *  added, because the sidecar phonemises with `lang_code="a"` and the remaining 26
+ *  (Mandarin, Japanese, Hindi, Spanish, Portuguese, Italian, French) would be read
+ *  through an American English grapheme-to-phoneme pass. That produces an accent
+ *  artefact, not the language. Exposing them needs a lang_code map and text in the
+ *  matching language -- deliberately out of scope, not overlooked. */
+export const KOKORO_EN_GB_VOICE_OPTIONS = [
+  { id: 'bm_george', label: 'George (bm_george) · British' },
+  { id: 'bm_daniel', label: 'Daniel (bm_daniel) · British' },
+  { id: 'bm_lewis', label: 'Lewis (bm_lewis) · British' },
+  { id: 'bm_fable', label: 'Fable (bm_fable) · British' },
+  { id: 'bf_emma', label: 'Emma (bf_emma) · British' },
+  { id: 'bf_alice', label: 'Alice (bf_alice) · British' },
+  { id: 'bf_isabella', label: 'Isabella (bf_isabella) · British' },
+  { id: 'bf_lily', label: 'Lily (bf_lily) · British' },
+] as const
+
+export const KOKORO_EN_GB_VOICES = KOKORO_EN_GB_VOICE_OPTIONS.map((v) => v.id)
+
 export const KOKORO_EN_US_VOICES = KOKORO_VOICE_OPTIONS.map((v) => v.id)
 
 // OpenAI id → Kokoro when Settings still sends an OpenAI id on the local path.
@@ -63,15 +86,30 @@ const VOICE_MAP: Record<string, string> = {
 }
 
 const OPENAI_VOICE_IDS = new Set(OPENAI_VOICE_OPTIONS.map((v) => v.id))
-const KOKORO_VOICE_IDS = new Set(KOKORO_EN_US_VOICES)
+// BOTH accents, and this Set is now what `isKokoroVoiceId` actually checks.
+// Omitting either list here would make the picker offer voices the server then
+// refuses -- the UI and the server disagreeing in silence.
+const KOKORO_VOICE_IDS = new Set<string>([...KOKORO_EN_US_VOICES, ...KOKORO_EN_GB_VOICES])
 
 export function isOpenAIVoiceId(voice: string): boolean {
   return OPENAI_VOICE_IDS.has(voice as typeof OPENAI_VOICE_OPTIONS[number]['id'])
 }
 
-/** Kokoro / Misaki voice file ids look like am_echo, af_heart, bm_george. */
+/**
+ * Is this a Kokoro voice COS actually offers?
+ *
+ * THE CATALOG, not the shape. This was `/^[a-z]{2}_[a-z0-9]+$/i`, which accepts
+ * any id of the right form -- including the 26 non-English voices in the same
+ * pack, and including ids for no voice at all. Neither is refused anywhere
+ * downstream: the sidecar's `synthesize` falls back through
+ * requested -> COS_TTS_KOKORO_VOICE -> am_echo and returns audio, so an
+ * unrecognised voice produced a DIFFERENT voice with no error. The caller asked
+ * for one thing, got another, and nothing said so.
+ *
+ * `KOKORO_VOICE_IDS` existed for this and was never read.
+ */
 export function isKokoroVoiceId(voice: string): boolean {
-  return /^[a-z]{2}_[a-z0-9]+$/i.test(voice)
+  return KOKORO_VOICE_IDS.has(voice)
 }
 
 export function getTtsEngineMode(): TtsEngineMode {

package/server/routes/tts.ts

@@ -41,6 +41,7 @@ import {
   getTtsEngineMode,
   isKokoroVoiceId,
   isOpenAIVoiceId,
+  KOKORO_EN_GB_VOICE_OPTIONS,
   KOKORO_VOICE_OPTIONS,
   mapOpenAIVoiceToLocal,
   OPENAI_VOICE_OPTIONS,
@@ -63,10 +64,23 @@ export const ttsRouter = Router()
 // process lifetime — no teardown needed.
 setInterval(reapExpiredSessions, 30_000).unref()
 
-// Hard text length cap — OpenAI gpt-4o-mini-tts accepts up to 4096 input chars.
-// Anything longer would be rejected; we trim defensively at a sentence boundary
-// near the cap so the audio doesn't end mid-word.
-const MAX_TTS_CHARS = 4000
+// THE CAP IS PER BACKEND, and it is applied where the backend is known.
+//
+// 4000 is OpenAI's constraint: gpt-4o-mini-tts rejects input over 4096 chars.
+// Kokoro has no such limit -- it is a local model reading whatever it is handed.
+// This cap used to be applied up front, before the engine was chosen, so a local
+// synthesis was silently truncated at ~3-4 pages by a rule belonging to an API it
+// was not using. Long replies just stopped mid-thought.
+//
+// Applied in the generators instead, because the backend is not settled until
+// then: a local request can still fall back to OpenAI when Kokoro is unavailable,
+// and that fallback must obey OpenAI's limit even though the request did not.
+const MAX_OPENAI_TTS_CHARS = 4000
+
+// Not a product limit -- a memory and latency bound. 40k chars is roughly 40
+// minutes of speech and several hundred MB of PCM before encode. Past that, a
+// runaway caller is the likelier explanation than a real request.
+const MAX_LOCAL_TTS_CHARS = 40_000
 
 // OpenAI voice IDs supported by gpt-4o-mini-tts. Default is alloy (warm,
 // neutral, gender-neutral). Voice can be overridden per-request and the
@@ -94,13 +108,13 @@ const FORMAT_MIME: Record<string, string> = {
   pcm: 'audio/pcm',
 }
 
-/** Trim text to MAX_TTS_CHARS at a sentence boundary if possible. */
-function trimToCap(text: string): string {
-  if (text.length <= MAX_TTS_CHARS) return text
-  const slice = text.slice(0, MAX_TTS_CHARS)
+/** Trim to `cap` at a sentence boundary if possible, else a word boundary. */
+function trimToCap(text: string, cap: number): string {
+  if (text.length <= cap) return text
+  const slice = text.slice(0, cap)
   // Walk back to the last sentence terminator (.!?) to avoid mid-word cuts.
   const lastTerm = Math.max(slice.lastIndexOf('. '), slice.lastIndexOf('! '), slice.lastIndexOf('? '))
-  if (lastTerm > MAX_TTS_CHARS * 0.6) return slice.slice(0, lastTerm + 1)
+  if (lastTerm > cap * 0.6) return slice.slice(0, lastTerm + 1)
   // Fall back to the last word boundary.
   const lastSpace = slice.lastIndexOf(' ')
   return lastSpace > 0 ? slice.slice(0, lastSpace) : slice
@@ -332,6 +346,10 @@ async function generateOpenAIIntoCache(
   instructions: string,
   signal?: AbortSignal,
 ): Promise<{ ok: true } | { ok: false; status: number; message: string }> {
+  // OpenAI's own limit, applied HERE because this is the first point that knows
+  // OpenAI is what actually runs. A local request that fell back to OpenAI arrives
+  // uncapped and must still be trimmed.
+  text = trimToCap(text, MAX_OPENAI_TTS_CHARS)
   let key: string
   try {
     key = getOpenAIKey()
@@ -425,6 +443,10 @@ async function generateLocalIntoCache(
   format: string,
   signal?: AbortSignal,
 ): Promise<{ ok: true } | { ok: false; status: number; message: string }> {
+  // A memory/latency bound, NOT OpenAI's 4096. Kokoro reads what it is handed;
+  // the old shared cap truncated local speech at ~3-4 pages for no reason that
+  // applied to it.
+  text = trimToCap(text, MAX_LOCAL_TTS_CHARS)
   if (!isLocalTtsReady()) {
     return { ok: false, status: 503, message: 'local TTS sidecar not ready' }
   }
@@ -601,7 +623,14 @@ ttsRouter.get('/tts/voices', (_req, res) => {
       : 'local',
     localReady: isLocalTtsReady(),
     openai: OPENAI_VOICE_OPTIONS,
-    local: KOKORO_VOICE_OPTIONS,
+    // American first, then British. ONE list rather than a new key, so an existing
+    // client picks up the extra voices without a change, and `local[0]` stays the
+    // default it always was. Each entry's label carries the accent; `accent` is
+    // there so a picker can group without parsing the id prefix.
+    local: [
+      ...KOKORO_VOICE_OPTIONS.map((v) => ({ ...v, accent: 'en-US' as const })),
+      ...KOKORO_EN_GB_VOICE_OPTIONS.map((v) => ({ ...v, accent: 'en-GB' as const })),
+    ],
   })
 })
 
@@ -618,6 +647,9 @@ async function streamOpenAIToResponse(
     onFirstByte?: () => void
   },
 ): Promise<{ ok: true } | { ok: false; status: number; message: string }> {
+  // Same limit, the streaming sibling. Two OpenAI entry points, so the cap has to
+  // exist at both -- capping only the cached one would truncate silently here.
+  const text = trimToCap(opts.text, MAX_OPENAI_TTS_CHARS)
   let key: string
   try {
     key = getOpenAIKey()
@@ -629,7 +661,7 @@ async function streamOpenAIToResponse(
     return { ok: false, status: 503, message: errMsg(err) }
   }
 
-  const spoken = applyOpenAIPronunciation(opts.text)
+  const spoken = applyOpenAIPronunciation(text)
   let upstream: Response
   try {
     upstream = await fetch('https://api.openai.com/v1/audio/speech', {
@@ -715,7 +747,9 @@ ttsRouter.post('/tts/stream', async (req, res) => {
       ? instructions : DEFAULT_INSTRUCTIONS
 
     const cleaned = stripMarkdownLight(text).trim()
-    const capped = trimToCap(cleaned)
+    // NOT capped here -- the backend is not known yet, and the OpenAI limit does
+    // not apply to Kokoro. The generators cap for whichever backend actually runs.
+    const capped = cleaned
 
     const upstreamController = new AbortController()
     res.once('close', () => {
@@ -854,7 +888,9 @@ ttsRouter.post('/tts/prepare', async (req, res) => {
     }
 
     const cleaned = stripMarkdownLight(text).trim()
-    const capped = trimToCap(cleaned)
+    // NOT capped here -- the backend is not known yet, and the OpenAI limit does
+    // not apply to Kokoro. The generators cap for whichever backend actually runs.
+    const capped = cleaned
     const preferOpenAI = enginePreference === 'openai'
     const forceLocal = enginePreference === 'local'
 

package/server/tts-sidecar/server.py

@@ -31,6 +31,9 @@ PROTOCOL = "cos-tts-v1"
 AUTH_TOKEN = os.environ.get("COS_TTS_AUTH_TOKEN", "")
 MODEL_ID = os.environ.get("COS_TTS_KOKORO_MODEL", "mlx-community/Kokoro-82M-bf16")
 DEFAULT_VOICE = os.environ.get("COS_TTS_KOKORO_VOICE", "am_echo")
+# Runaway-caller bound only. Roughly 40 minutes of speech; the server applies
+# the real per-backend cap before calling here.
+MAX_INPUT_CHARS = int(os.environ.get("COS_TTS_MAX_INPUT_CHARS", "40000"))
 SAMPLE_RATE = 24_000
 
 _model = None
@@ -210,8 +213,12 @@ def speech(req: SpeechRequest, authorization: str | None = Header(default=None))
     text = req.input.strip()
     if not text:
         raise HTTPException(status_code=400, detail="input is required")
-    if len(text) > 4000:
-        text = text[:4000]
+    # 4000 was OpenAI's input limit, applied here to a LOCAL model that has no
+    # such constraint -- and applied as a bare slice, so a long reply stopped
+    # mid-word with no error and no signal to the caller. The server now caps per
+    # backend before it calls us; this is only a runaway-caller bound.
+    if len(text) > MAX_INPUT_CHARS:
+        text = text[:MAX_INPUT_CHARS]
     try:
         audio = synthesize(text, req.voice, req.speed)
         body, mime = encode_audio(audio, req.response_format)