@gotcos/glasses-server 6.43.1 → 6.43.2

package/CHANGELOG.md

@@ -1,17 +1,32 @@
+## 6.43.2
+
+Managed-server updates pass their Claude readiness proof again.
+
+- **The proof no longer loads your MCP catalog.** COS Control verifies a
+  candidate server by running one real `claude -p --model haiku` query with
+  no tools. On Claude Code 2.1.251, `--tools ''` still loads every MCP
+  server's tool definitions, and on a Mac with a large fleet that alone was
+  about 244,000 tokens against Haiku's 200,000-token window: "Prompt is too
+  long", exit 1, zero API time, and the update rolled back to the previous
+  server every time (six attempts on 6.43.1). The proof now passes
+  `--strict-mcp-config` with an empty MCP config, which keeps it under
+  20,000 tokens and answers in about two seconds. Nothing else changed.
+
 ## 6.43.1
 
 Two things the first night of the morning brief taught us, plus the depth
 behind each source.
 
-- **A running brief no longer collides with your next message.** The brief
-  reserved #74 at 22:18 and was still running when the phone minted #74 for
-  the next prompt at 22:25, because `/api/message-counter` only counted
-  exchanges that had already been projected. Numbers held by admitted,
-  not-yet-terminal durable jobs (and by the brief's own ledger row, which
-  exists before the job does) now count toward the ceiling. New
-  `lib/message-reservations.ts` registry; the job store keeps the number on
-  its always-in-memory identity so the answer is synchronous and survives a
-  restart.
+- **A running brief can no longer collide with your next message.** A brief
+  holds its number for the minutes it runs, but `/api/message-counter` only
+  counted exchanges that had already been projected, so a phone whose counter
+  last synced at boot could mint the same number for its next prompt. Numbers
+  held by admitted, not-yet-terminal durable jobs (and by the brief's own
+  ledger row, which exists before the job does) now count toward the ceiling.
+  New `lib/message-reservations.ts` registry; the job store keeps the number
+  on its always-in-memory identity so the answer is synchronous and survives
+  a restart. (The double #74 reported on 6.9.443 was the companion showing one
+  exchange twice; companion 6.9.445 fixes that side.)
 - **Sources show what is behind them.** `GET /api/morning-brief` now carries
   `coverage`: one row per source with a state (`ready`, `empty`,
   `unavailable`, `runtime`) and a summary line such as "2,312 meetings

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.43.1",
+  "version": "6.43.2",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/message-reservations.ts

@@ -4,9 +4,12 @@
 // reports, and a durable job carries the number it was minted with until its
 // terminal projection writes the exchange into the session. Between admission
 // and projection the number existed nowhere the counter looked, so a second
-// producer minted it again: on 2026-09-01 the scheduled morning brief reserved
-// #74 at 22:18:40 and the phone handed #74 to "Cross surface" at 22:25:15,
-// because its counter only re-syncs at boot and the server said max was 73.
+// producer could mint it again: a running morning brief holds its number for
+// minutes while the phone's counter, which only re-syncs at boot, still sits
+// below it. (The double "#74" seen on 2026-09-01 turned out to be the phone
+// showing ONE exchange twice, a display-bus placeholder plus the hydrated
+// row, fixed in companion 6.9.445. The window this closes is real all the
+// same: the same night's ledger shows the brief holding #74 for 6m35s.)
 //
 // Every holder of a not-yet-projected number registers a source here. The
 // counter route and the brief's own reservation read the union. Sources

package/server/lib/provider-proof.ts

@@ -110,12 +110,23 @@ export function runBounded(
 export const CLAUDE_PROOF_MODEL = 'haiku'
 export const CLAUDE_PROOF_TIMEOUT_MS = 45_000
 
+/** No MCP servers for the proof. Claude Code 2.1.251 turns `--tools ''`
+ * into "load the whole catalog, expose none of it", and on a Mac with a
+ * large MCP fleet that catalog alone was ~244K tokens against Haiku's 200K
+ * window: "Prompt is too long", exit 1, zero API time. Six 6.43.1 update
+ * attempts rolled back on 2026-09-01/02 before a single request was made.
+ * An explicit empty config with --strict-mcp-config keeps the proof under
+ * 20K tokens and is what a readiness check should be anyway. */
+export const CLAUDE_PROOF_MCP_CONFIG = '{"mcpServers":{}}'
+
 export function claudeProofArgs(): string[] {
   return [
     '-p',
     '--model', CLAUDE_PROOF_MODEL,
     '--output-format', 'json',
     '--permission-mode', 'dontAsk',
+    '--strict-mcp-config',
+    '--mcp-config', CLAUDE_PROOF_MCP_CONFIG,
     '--tools', '',
     '--allowedTools', '',
     '--system-prompt', PROOF_PROMPT,