@gotcos/glasses-server 6.40.1 → 6.41.0

package/CHANGELOG.md

@@ -1,3 +1,64 @@
+## 6.41.0
+
+Allowlist mode can finally read the workspace it was pointed at.
+
+A public user set `COS_CLAUDE_TRUST_MODE=allowlist` (the security-conscious
+choice, tried first) and got "I don't have access to your workspace files."
+That was the code working as written: in allowlist mode the per-query tool
+list is the entire tool universe, and it was built as WebSearch + WebFetch,
+with Read added only when the query carried a photo. The CLI's working
+directory correctly pointed at the user's workspace; nothing in the list
+could open a file in it.
+
+Three changes, one release:
+
+- The base tool list now always includes `Read`, `Glob`, and `Grep` — the
+  read-only exploration trio. Allowlist mode becomes "web plus read-only
+  workspace": shell, edits, and writes remain impossible by construction,
+  and a new test pins that Bash/Edit/Write can never appear in this list.
+  In trusted mode (the default) the list is only an auto-approve hint, so
+  behavior there is unchanged.
+- The allowlist capability prompt now affirms workspace readability — but
+  only when the list actually grants it, so the prompt can never over-claim.
+  Without the affirmation, a model told it is "genuinely limited" tends to
+  refuse reads it has.
+- The one listless spawn (prewarm) no longer passes an empty `--tools` in
+  allowlist mode. On the current CLI that flag triggers a spurious context
+  compaction and a synthetic 400 (the same pathology isolated by the fork
+  bisection on 2026-08-26); denial now rides `--permission-mode dontAsk`
+  plus an empty `--allowedTools` alone.
+
+## 6.40.2
+
+A finished answer could leave the stream open forever.
+
+An Ollama turn with tools streamed its whole answer, persisted it, and then
+never sent the terminal `done` event. On the glasses the turn counted past
+1,100 seconds while the reply had actually completed in 166 and was already
+saved in Messages. Double-tap to cancel did nothing, because there was no live
+job to cancel.
+
+The cause is one line in the query route, and it predates the tool loop. The
+SSE callbacks are declared inside `const sid = await callModelStreaming(...)`,
+so while that call is running `sid` is in its temporal dead zone. `onStart`
+never noticed because its own `sid` PARAMETER shadows the outer binding.
+`onDone` has no such parameter: it read the outer `sid`, threw
+ReferenceError, and — critically — threw AFTER setting `done = true` and
+BEFORE writing the terminal event, so the failure could not even fall through
+to the error path. The socket stayed open with the work already committed.
+
+Only Ollama hit it. The child-process bridges resolve outside that window, so
+Claude and Codex kept working; the in-process Ollama loop awaits its own
+finalize before returning, which lands the callback squarely inside the dead
+zone. Both readers now use the session id captured from `onStart`.
+
+The existing SSE contract test could never have caught this: it fires
+callbacks on a macrotask after the router resolves, with a comment asserting
+that bridges "never" call back synchronously. That assumption is now marked
+as covering the child-process bridges only, and a new test pins the
+in-process ordering. Reverting the fix makes all three of its cases hang,
+which is the production symptom exactly.
+
 ## 6.40.1
 
 The local model can read your meetings and memories.

package/README.md

@@ -87,8 +87,12 @@ without silently losing completed replies.
 > has those tools, so you will see it use them more readily than before.
 > Set `COS_CLAUDE_TRUST_MODE=allowlist` to remove Claude's permission bypass
 > and restrict it to COS's explicit per-query tool allowlist; undeclared tools
-> then fail closed without prompting. Only the exact value `allowlist` restricts
-> anything — any other value logs a warning and stays trusted.
+> then fail closed without prompting. In allowlist mode the query keeps web
+> search/fetch and **read-only workspace access** (Read, Glob, Grep) — no
+> shell, no edits, no writes. Only the exact value `allowlist` restricts
+> anything — any other value logs a warning and stays trusted. Servers before
+> 6.41.0 denied ALL workspace reads in allowlist mode; if a hardened install
+> answers "I don't have access to your workspace files", update the server.
 
 ## Connect your phone (the one gotcha)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.40.1",
+  "version": "6.41.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/claude-bridge.ts

@@ -459,7 +459,6 @@ export async function callClaudeStreaming(
     throw err
   }
   const allowedToolList = buildClaudeToolList({
-    includeRead: imagePaths.length > 0,
     publisherTool: outputImagePublisher?.claudeAllowedTool,
   })
   let mcpConfigArgs: string[]

package/server/lib/claude-permissions.ts

@@ -45,10 +45,16 @@ export function claudePermissionArgs(
       : ['--dangerously-skip-permissions', '--allowedTools', allowedTools]
   }
 
-  const tools = allowedTools ?? ''
+  // No per-query list (the prewarm spawn): deny everything via dontAsk plus an
+  // empty allowedTools, but never pass an empty --tools — on the current CLI
+  // an empty --tools triggers a spurious context compaction and a synthetic
+  // 400 (single-flag bisection 2026-08-26, documented in fork-thread.ts).
+  if (allowedTools === null) {
+    return ['--permission-mode', 'dontAsk', '--allowedTools', '']
+  }
   return [
     '--permission-mode', 'dontAsk',
-    '--tools', tools,
-    '--allowedTools', tools,
+    '--tools', allowedTools,
+    '--allowedTools', allowedTools,
   ]
 }

package/server/lib/claude-tool-access.ts

@@ -89,12 +89,15 @@ export function reportClaudeExtraToolConfiguration(
 }
 
 export function buildClaudeToolList(input: {
-  includeRead?: boolean
   publisherTool?: string
   env?: NodeJS.ProcessEnv
 } = {}): string[] {
-  const tools = ['WebSearch', 'WebFetch']
-  if (input.includeRead) tools.push('Read')
+  // Read-only workspace tools are unconditional: in allowlist mode this list
+  // is the entire tool universe, and without them a hardened install cannot
+  // read the workspace the glasses are pointed at (field report 2026-08-27).
+  // Shell/Edit/Write stay excluded, so allowlist keeps its no-side-effects
+  // property. In trusted mode the list is only an auto-approve hint.
+  const tools = ['WebSearch', 'WebFetch', 'Read', 'Glob', 'Grep']
   tools.push(...configuredClaudeExtraTools(input.env))
   if (input.publisherTool) tools.push(input.publisherTool)
   return [...new Set(tools)]
@@ -186,8 +189,15 @@ export function claudeToolCapabilityPrompt(
   const honesty = TOOL_HONESTY_CLAUSE
 
   if (mode === 'allowlist') {
+    // Affirm workspace readability ONLY when the list actually grants it —
+    // this prompt is something the session trusts, and promising reads a
+    // caller did not include would recreate the 2026-07-28 class of header
+    // mismatch in the opposite direction.
+    const workspaceLine = tools.includes('Read')
+      ? `\nYour working directory is the user's COS workspace: Read, Glob, and Grep are in the list so you can search and read its files. The restriction here is on shell, writes, and undeclared tools — not on reading the workspace. Never refuse a workspace read in this mode.`
+      : ''
     return `TOOL CAPABILITY CONTRACT:
-This request runs in RESTRICTED allowlist mode and is genuinely limited to these tool selectors: ${list}. Undeclared tools are denied without prompting, so a call outside this list will fail.
+This request runs in RESTRICTED allowlist mode and is genuinely limited to these tool selectors: ${list}. Undeclared tools are denied without prompting, so a call outside this list will fail.${workspaceLine}
 Selectors are permissions, not proof that a connector is online. Use a tool only when it is actually present in this session. If the user asks for a tool or connector that is absent, or a tool call fails, say that it is unavailable. ${honesty}
 ${UNTRUSTED_CONTENT_CLAUSE}`
   }

package/server/routes/query.ts

@@ -114,6 +114,22 @@ queryRouter.post('/query', async (req, res) => {
   res.write(': keepalive\n\n')
 
   let done = false
+  // The session id AS REPORTED BY THE BRIDGE.
+  //
+  // `const sid = await callModelStreaming(...)` below is not assigned until the
+  // whole call resolves, but these callbacks fire DURING that await — so any
+  // callback that reads `sid` reads a temporal-dead-zone binding and throws
+  // ReferenceError. `onStart` never noticed because its own `sid` PARAMETER
+  // shadows the outer const; `onDone` has no such parameter and did throw,
+  // after setting `done = true` and before writing the terminal event, which
+  // left the SSE socket open forever with the answer already persisted.
+  //
+  // Measured 2026-08-26: an Ollama tool turn streamed its full answer and never
+  // sent `done`; the glasses counted past 1,100 seconds on a turn that had
+  // finished in 166. Claude survived only because its bridge resolves outside
+  // the window — the same line was one scheduling change away from hanging
+  // every provider.
+  let streamSessionId: string | undefined = typeof sessionId === 'string' ? sessionId : undefined
   const abortController = new AbortController()
   res.on('close', () => {
     if (!done) abortController.abort()
@@ -123,6 +139,7 @@ queryRouter.post('/query', async (req, res) => {
   try {
     const sid = await callModelStreaming(resolvedQuery || '', sessionId, {
       onStart: (model, sid, cliSessionId, metadata) => {
+        streamSessionId = sid
         if (!done) {
           const payload = { model, sessionId: sid, cliSessionId, ...metadata }
           res.write(`event: start\ndata: ${JSON.stringify(payload)}\n\n`)
@@ -161,7 +178,7 @@ queryRouter.post('/query', async (req, res) => {
           // expiry or make maintenance proof outrun the pending write.
           if (resolvedAttachments.ids.length > 0) {
             await getMediaStore().associate(resolvedAttachments.ids, {
-              sessionId: sid,
+              sessionId: streamSessionId ?? '',
               ...(validGlobalMsgNum ? { globalMsgNum: validGlobalMsgNum } : {}),
               messageEra: activeMessageEra,
             }).catch((err) => console.error('[query] attachment association failed:', err))
@@ -171,7 +188,7 @@ queryRouter.post('/query', async (req, res) => {
             const attachments = mergeMediaAttachmentRefs(attachmentRefs, metadata?.outputAttachments)
             const { outputAttachments: _outputAttachments, ...runMetadata } = metadata ?? {}
             const payload = {
-              text: fullText, sessionId: sid, model, cliSessionId, ...runMetadata,
+              text: fullText, sessionId: streamSessionId, model, cliSessionId, ...runMetadata,
               ...(attachments.length > 0 ? { attachments } : {}),
             }
             res.write(`event: done\ndata: ${JSON.stringify(payload)}\n\n`)