@gotcos/glasses-server 6.42.1 → 6.43.1

package/CHANGELOG.md

@@ -1,3 +1,106 @@
+## 6.43.1
+
+Two things the first night of the morning brief taught us, plus the depth
+behind each source.
+
+- **A running brief no longer collides with your next message.** The brief
+  reserved #74 at 22:18 and was still running when the phone minted #74 for
+  the next prompt at 22:25, because `/api/message-counter` only counted
+  exchanges that had already been projected. Numbers held by admitted,
+  not-yet-terminal durable jobs (and by the brief's own ledger row, which
+  exists before the job does) now count toward the ceiling. New
+  `lib/message-reservations.ts` registry; the job store keeps the number on
+  its always-in-memory identity so the answer is synchronous and survives a
+  restart.
+- **Sources show what is behind them.** `GET /api/morning-brief` now carries
+  `coverage`: one row per source with a state (`ready`, `empty`,
+  `unavailable`, `runtime`) and a summary line such as "2,312 meetings
+  stored, newest Sep 2026", "6,705 memories · 66 threads (12 active)", or
+  "/good-morning found under .claude/skills". Same wells COS Control's
+  Activity tiles read (meeting library, context status, the pipeline bridge
+  for calendar and tasks, the reflection log). Probes are cached for five
+  minutes and bounded to eight seconds each; a source the server cannot see
+  (Slack, health, dashboards) says so as `runtime` instead of showing a dash.
+  `GET /api/morning-brief/coverage?refresh=1` re-probes on demand.
+- **Each run records what it was asked for and what came back.** The ledger
+  row stores the sections the brief was composed with, and once the job
+  completes the run view reports each as `present`, `unavailable` (the
+  prompt's "<Section>: unavailable" line), `skipped` (silent-skip sections
+  with nothing behind them), or `missing`. A skill section is present unless
+  the answer says the skill was not found.
+
+No config migration: existing `config.json` and `runs.json` files load as
+they are; older run rows simply have no section outcome.
+
+## 6.43.0
+
+The brief is waiting before you ask for it.
+
+A start-of-day brief now runs on a schedule inside the server and lands in
+the inbox as an ordinary numbered reply — no prompt, no "run the good-morning
+skill", no phone awake at 07:00. Jun Kiat Lee's first-week note said it
+plainly: he deployed COS to his G2 expecting a push at the start of the day and
+nothing came, because until now the only thing that could start a brief was a
+person typing. The server is the one process awake at that hour, so it owns
+the schedule.
+
+What you get, by default: weekdays at 07:00 in the Mac's own timezone, four
+sections any COS brain can fill — Calendar, From recent meetings (decisions,
+deadlines, owed items), Due (tasks inside a seven-day horizon), and Waiting on
+you (unanswered mentions and asks across whatever channels the brain can
+read). Everything else in the catalog — Knowledge graph, Reflection, Health,
+an Opening reading, a Metrics pulse, a workspace skill, a custom section — is
+off until you turn it on. The brief is composed from the sources you choose,
+in the order you choose, with the windows you choose, so it is yours rather
+than a template with your name on it.
+
+How it works, so the cost is legible:
+
+- One durable query job per local calendar day, submitted to the same
+  coordinator every phone prompt uses. It survives the phone being asleep and
+  is projected into the conversation store with a reserved message number when
+  it completes, so the companion's history hydration surfaces it like any
+  reply.
+- The fire is remembered in a ledger written BEFORE admission. A crash between
+  that write and the 202 is resumed by a per-day client identity, never re-run.
+  A failed admission (store degraded, server draining) retries at most three
+  times, two minutes apart, then gives the day up.
+- A Mac asleep through the slot still fires inside a catch-up window (three
+  hours by default, up to twelve). Past that, the day is skipped rather than
+  delivered at lunch.
+- "Run now" is capped at five a day and refused while a brief is live.
+- The whole thing is inert when COS Control's "Background jobs" switch is off
+  or maintenance admissions are closed. The prompt is read-only by contract:
+  it forbids sending, creating, or editing anything.
+
+The prompt itself carries the evidence discipline the good-morning routine
+learned the hard way: a source that cannot be read produces one honest
+"unavailable" line; nothing is invented; only items with a hard edge (a
+decision, a date, a dollar figure, an owner) make the cut; the scribe's
+extracted action-item list is never pasted verbatim. Enable the "Workspace
+skill" source with `/good-morning` and that skill's output IS the brief —
+which is how Miles's own routine rides this without being rewritten.
+
+Surface:
+
+- `GET /api/morning-brief` — config, the source catalog (labels, descriptions,
+  option schemas a settings screen can render), status with `nextRunAt`, and
+  recent runs with live job status and the message number each produced.
+- `PUT /api/morning-brief` — patch any field; a bad time, zone, model, or
+  skill name is a 400 with a named code, never a silent keep.
+- `POST /api/morning-brief/run` — fire one now (202; 409 while one runs; 429
+  past the daily cap).
+- `GET /api/morning-brief/preview` — the exact prompt today's brief would send.
+- `/api/health` advertises `features.morningBrief` and
+  `capabilities.morningBrief` (`enabled`, `time`, `timezone`, `nextRunAt`,
+  `lastRunAt`, `lastRunStatus`, `gate`) — times and gate only, no prompt, no
+  ids.
+
+Config lives at `~/.cos-glasses/data/morning-brief/config.json` (0600), the
+ledger beside it. `COS_MORNING_BRIEF_DIR` relocates both. Schedule arithmetic
+uses Node's Intl in the configured IANA zone, and is covered across both US DST
+transitions and a zone east of UTC.
+
 ## 6.42.1
 
 Hardening of the 6.42.0 display-stream ticket, from a four-validator QA pass

package/README.md

@@ -208,6 +208,36 @@ Telegram activity export is disabled by default even when a private COS
 pipeline contains `.telegram_config.json`; enable it only with the explicit
 `COS_TELEGRAM_NOTIFICATIONS=1` opt-in.
 
+## Morning brief (6.43.0)
+
+A start-of-day brief runs on a schedule inside the server and waits in the
+inbox as a numbered reply. Default: weekdays at 07:00 in the Mac's timezone,
+with Calendar, recent-meeting decisions, tasks due this week, and what is
+waiting on you. Turn on more sources (knowledge graph, reflection, health, an
+opening reading, a metrics pulse, one of your own skills such as
+`/good-morning`, a custom section), reorder them, and set their windows from
+COS Control or the companion, or directly:
+
+```bash
+curl -H "X-COS-Token: $COS_TOKEN" http://127.0.0.1:3141/api/morning-brief
+curl -H "X-COS-Token: $COS_TOKEN" -X PUT -H 'Content-Type: application/json' \
+  -d '{"time":"06:30","sources":[{"id":"skill","enabled":true,"options":{"name":"/good-morning"}}]}' \
+  http://127.0.0.1:3141/api/morning-brief
+curl -H "X-COS-Token: $COS_TOKEN" -X POST http://127.0.0.1:3141/api/morning-brief/run
+```
+
+One provider run per local day, remembered in a ledger so a restart never
+doubles it; a Mac asleep at the slot still fires inside a three-hour catch-up
+window; "Run now" is capped at five a day. Off entirely when Background jobs
+are off. The brief is read-only by contract.
+
+Since 6.43.1 the same `GET /api/morning-brief` response carries `coverage`,
+one row per source saying what the server can see behind it (meetings stored,
+memories and threads, whether the named skill exists) and every run reports
+which sections the answer actually opened. Numbers reserved by a running
+brief count toward `/api/message-counter`, so the phone never mints the same
+`#NNN` twice.
+
 ## Speaker diarization (opt-in)
 
 Without a voiceprint model this server does not classify speakers at all — it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.42.1",
+  "version": "6.43.1",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -83,6 +83,8 @@ import { initializeServerInstanceId } from './lib/server-instance-id.js'
 import { appendPrivateEnvBlock, UnsafeUserConfigPathError } from './lib/secure-user-config.js'
 import { getTranscriptionProfileStatus } from './lib/profile.js'
 import { createQueryJobsRouter } from './routes/query-jobs.js'
+import { createMorningBriefRouter } from './routes/morning-brief.js'
+import { getMorningBriefScheduler, startMorningBriefScheduler, stopMorningBriefScheduler } from './lib/morning-brief-runtime.js'
 import {
   initQueryJobRuntime,
   preparePublicDurableQueryAdmission,
@@ -488,6 +490,9 @@ app.use('/api', createQueryJobsRouter(queryJobCoordinator, {
   prepareAdmission: preparePublicDurableQueryAdmission,
 }))
 app.use('/api', queryRouter)
+// The scheduled start-of-day brief: settings, status, run-now. Same auth as
+// every other settings route; the brief itself is an ordinary durable job.
+app.use('/api', createMorningBriefRouter(getMorningBriefScheduler))
 app.use('/api', providerProofRouter)
 app.use('/api', transcribeRouter)
 // Ported from cos-glasses-app in 6.24.0. The companion's Sessions tab has been
@@ -713,6 +718,7 @@ async function gracefulShutdown(): Promise<void> {
   gracefulShutdownStarted = true
   const forceExit = setTimeout(() => process.exit(1), 8_000)
   forceExit.unref?.()
+  stopMorningBriefScheduler()
   try {
     await shutdownQueryJobRuntime('server_shutdown')
   } catch (error) {
@@ -909,6 +915,10 @@ listenRequiredServers(listeners).then(() => {
       } else {
         console.log('[COS API] Durable query jobs: disabled by COS_DURABLE_QUERY_JOBS=0')
       }
+      // The morning brief rides the durable coordinator, so it starts only once
+      // that store is ready. Its own tick checks the durable-jobs switch and the
+      // maintenance gate, so starting it here is safe when either is off.
+      startMorningBriefScheduler()
     }).catch(error => {
       // The store remains degraded and rejects admission. Legacy /api/query is
       // still mounted, so the kill switch is an immediate rollback.

package/server/lib/message-reservations.ts

@@ -0,0 +1,59 @@
+// Message-number reservations that are not exchanges yet.
+//
+// The phone mints its own #NNN from the `max` that /api/message-counter
+// reports, and a durable job carries the number it was minted with until its
+// terminal projection writes the exchange into the session. Between admission
+// and projection the number existed nowhere the counter looked, so a second
+// producer minted it again: on 2026-09-01 the scheduled morning brief reserved
+// #74 at 22:18:40 and the phone handed #74 to "Cross surface" at 22:25:15,
+// because its counter only re-syncs at boot and the server said max was 73.
+//
+// Every holder of a not-yet-projected number registers a source here. The
+// counter route and the brief's own reservation read the union. Sources
+// register themselves rather than being imported, because the morning-brief
+// runtime already imports the counter route (a direct import would cycle).
+
+import { exchangeBelongsToEra } from './message-era.js'
+
+export interface MessageReservation {
+  globalMsgNum: number
+  messageEra?: string
+  /** Diagnostic owner label, e.g. `job:<id>` or `brief:<day>`. Never a prompt. */
+  owner: string
+}
+
+export type MessageReservationSource = () => readonly MessageReservation[]
+
+const sources = new Set<MessageReservationSource>()
+
+export function registerMessageReservationSource(source: MessageReservationSource): () => void {
+  sources.add(source)
+  return () => { sources.delete(source) }
+}
+
+/** Every live reservation in `era`. A source that throws contributes nothing;
+ * the counter must never fail because one holder is mid-shutdown. */
+export function reservedGlobalMsgNums(era: string): MessageReservation[] {
+  const out: MessageReservation[] = []
+  for (const source of sources) {
+    let items: readonly MessageReservation[]
+    try { items = source() } catch { continue }
+    for (const item of items) {
+      if (!Number.isSafeInteger(item.globalMsgNum) || item.globalMsgNum <= 0) continue
+      if (!exchangeBelongsToEra(item, era)) continue
+      out.push(item)
+    }
+  }
+  return out
+}
+
+export function maxReservedGlobalMsgNum(era: string): number {
+  let max = 0
+  for (const item of reservedGlobalMsgNums(era)) if (item.globalMsgNum > max) max = item.globalMsgNum
+  return max
+}
+
+/** Test-only. */
+export function resetMessageReservationSourcesForTests(): void {
+  sources.clear()
+}