@gotcos/glasses-server 6.40.2 → 6.41.0

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+## 6.41.0
+
+Allowlist mode can finally read the workspace it was pointed at.
+
+A public user set `COS_CLAUDE_TRUST_MODE=allowlist` (the security-conscious
+choice, tried first) and got "I don't have access to your workspace files."
+That was the code working as written: in allowlist mode the per-query tool
+list is the entire tool universe, and it was built as WebSearch + WebFetch,
+with Read added only when the query carried a photo. The CLI's working
+directory correctly pointed at the user's workspace; nothing in the list
+could open a file in it.
+
+Three changes, one release:
+
+- The base tool list now always includes `Read`, `Glob`, and `Grep` — the
+  read-only exploration trio. Allowlist mode becomes "web plus read-only
+  workspace": shell, edits, and writes remain impossible by construction,
+  and a new test pins that Bash/Edit/Write can never appear in this list.
+  In trusted mode (the default) the list is only an auto-approve hint, so
+  behavior there is unchanged.
+- The allowlist capability prompt now affirms workspace readability — but
+  only when the list actually grants it, so the prompt can never over-claim.
+  Without the affirmation, a model told it is "genuinely limited" tends to
+  refuse reads it has.
+- The one listless spawn (prewarm) no longer passes an empty `--tools` in
+  allowlist mode. On the current CLI that flag triggers a spurious context
+  compaction and a synthetic 400 (the same pathology isolated by the fork
+  bisection on 2026-08-26); denial now rides `--permission-mode dontAsk`
+  plus an empty `--allowedTools` alone.
+
 ## 6.40.2
 
 A finished answer could leave the stream open forever.

package/README.md

@@ -87,8 +87,12 @@ without silently losing completed replies.
 > has those tools, so you will see it use them more readily than before.
 > Set `COS_CLAUDE_TRUST_MODE=allowlist` to remove Claude's permission bypass
 > and restrict it to COS's explicit per-query tool allowlist; undeclared tools
-> then fail closed without prompting. Only the exact value `allowlist` restricts
-> anything — any other value logs a warning and stays trusted.
+> then fail closed without prompting. In allowlist mode the query keeps web
+> search/fetch and **read-only workspace access** (Read, Glob, Grep) — no
+> shell, no edits, no writes. Only the exact value `allowlist` restricts
+> anything — any other value logs a warning and stays trusted. Servers before
+> 6.41.0 denied ALL workspace reads in allowlist mode; if a hardened install
+> answers "I don't have access to your workspace files", update the server.
 
 ## Connect your phone (the one gotcha)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.40.2",
+  "version": "6.41.0",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/claude-bridge.ts

@@ -459,7 +459,6 @@ export async function callClaudeStreaming(
     throw err
   }
   const allowedToolList = buildClaudeToolList({
-    includeRead: imagePaths.length > 0,
     publisherTool: outputImagePublisher?.claudeAllowedTool,
   })
   let mcpConfigArgs: string[]

package/server/lib/claude-permissions.ts

@@ -45,10 +45,16 @@ export function claudePermissionArgs(
       : ['--dangerously-skip-permissions', '--allowedTools', allowedTools]
   }
 
-  const tools = allowedTools ?? ''
+  // No per-query list (the prewarm spawn): deny everything via dontAsk plus an
+  // empty allowedTools, but never pass an empty --tools — on the current CLI
+  // an empty --tools triggers a spurious context compaction and a synthetic
+  // 400 (single-flag bisection 2026-08-26, documented in fork-thread.ts).
+  if (allowedTools === null) {
+    return ['--permission-mode', 'dontAsk', '--allowedTools', '']
+  }
   return [
     '--permission-mode', 'dontAsk',
-    '--tools', tools,
-    '--allowedTools', tools,
+    '--tools', allowedTools,
+    '--allowedTools', allowedTools,
   ]
 }

package/server/lib/claude-tool-access.ts

@@ -89,12 +89,15 @@ export function reportClaudeExtraToolConfiguration(
 }
 
 export function buildClaudeToolList(input: {
-  includeRead?: boolean
   publisherTool?: string
   env?: NodeJS.ProcessEnv
 } = {}): string[] {
-  const tools = ['WebSearch', 'WebFetch']
-  if (input.includeRead) tools.push('Read')
+  // Read-only workspace tools are unconditional: in allowlist mode this list
+  // is the entire tool universe, and without them a hardened install cannot
+  // read the workspace the glasses are pointed at (field report 2026-08-27).
+  // Shell/Edit/Write stay excluded, so allowlist keeps its no-side-effects
+  // property. In trusted mode the list is only an auto-approve hint.
+  const tools = ['WebSearch', 'WebFetch', 'Read', 'Glob', 'Grep']
   tools.push(...configuredClaudeExtraTools(input.env))
   if (input.publisherTool) tools.push(input.publisherTool)
   return [...new Set(tools)]
@@ -186,8 +189,15 @@ export function claudeToolCapabilityPrompt(
   const honesty = TOOL_HONESTY_CLAUSE
 
   if (mode === 'allowlist') {
+    // Affirm workspace readability ONLY when the list actually grants it —
+    // this prompt is something the session trusts, and promising reads a
+    // caller did not include would recreate the 2026-07-28 class of header
+    // mismatch in the opposite direction.
+    const workspaceLine = tools.includes('Read')
+      ? `\nYour working directory is the user's COS workspace: Read, Glob, and Grep are in the list so you can search and read its files. The restriction here is on shell, writes, and undeclared tools — not on reading the workspace. Never refuse a workspace read in this mode.`
+      : ''
     return `TOOL CAPABILITY CONTRACT:
-This request runs in RESTRICTED allowlist mode and is genuinely limited to these tool selectors: ${list}. Undeclared tools are denied without prompting, so a call outside this list will fail.
+This request runs in RESTRICTED allowlist mode and is genuinely limited to these tool selectors: ${list}. Undeclared tools are denied without prompting, so a call outside this list will fail.${workspaceLine}
 Selectors are permissions, not proof that a connector is online. Use a tool only when it is actually present in this session. If the user asks for a tool or connector that is absent, or a tool call fails, say that it is unavailable. ${honesty}
 ${UNTRUSTED_CONTENT_CLAUSE}`
   }