@gotcos/glasses-server 6.43.1 → 6.43.3

package/CHANGELOG.md

@@ -1,17 +1,53 @@
+## 6.43.3
+
+Managed-server updates no longer hinge on one vendor's meter.
+
+- **The readiness proof reports why it failed, as a code.** COS Control
+  verifies a candidate server with one real no-tool query per installed
+  provider. On 2026-09-01 Claude had hit its session limit, Codex proved in
+  seven seconds, and six 6.43.1 updates still rolled back because the only
+  answer was "provider process exited 1". `POST /api/diagnostics/provider-proof`
+  now returns `code`: `provider_quota` (vendor session or usage limit),
+  `provider_auth` (not signed in), `provider_context_overflow`,
+  `provider_missing`, `provider_timeout`, `provider_canceled`,
+  `provider_bad_answer`, or `provider_failed`. The `error` sentence is one
+  fixed phrase per code; vendor text never leaves the server. COS Control
+  0.5.184 uses the code to treat a quota as a skip when another provider
+  proves (on 6.43.2 and older it classifies the error sentence instead).
+- **Cursor is a proof provider.** `{"provider":"cursor"}` runs the Cursor
+  `agent` in documented read-only ask mode with the prompt on stdin and reads
+  the result event, so a Mac with Cursor signed in can prove an update while
+  Claude and Codex are both at their limits.
+
+## 6.43.2
+
+What actually reached npm under this number (published 2026-09-02 07:27 CDT
+from the commit before the proof codes landed):
+
+- **The Claude proof states its empty MCP config explicitly**
+  (`--strict-mcp-config --mcp-config '{"mcpServers":{}}'`) instead of relying
+  on `CLAUDE_CODE_SAFE_MODE` alone. Without safe mode, `--tools ''` on Claude
+  Code 2.1.251 still loads the whole catalog, which on a large fleet is a
+  244K-token request Haiku refuses before any API call. Belt and braces; the
+  2026-09-01 rollbacks were the session limit, not this.
+- The message-reservation rationale in code and changelog states the
+  observed double #74 accurately (one exchange shown twice by the companion).
+
 ## 6.43.1
 
 Two things the first night of the morning brief taught us, plus the depth
 behind each source.
 
-- **A running brief no longer collides with your next message.** The brief
-  reserved #74 at 22:18 and was still running when the phone minted #74 for
-  the next prompt at 22:25, because `/api/message-counter` only counted
-  exchanges that had already been projected. Numbers held by admitted,
-  not-yet-terminal durable jobs (and by the brief's own ledger row, which
-  exists before the job does) now count toward the ceiling. New
-  `lib/message-reservations.ts` registry; the job store keeps the number on
-  its always-in-memory identity so the answer is synchronous and survives a
-  restart.
+- **A running brief can no longer collide with your next message.** A brief
+  holds its number for the minutes it runs, but `/api/message-counter` only
+  counted exchanges that had already been projected, so a phone whose counter
+  last synced at boot could mint the same number for its next prompt. Numbers
+  held by admitted, not-yet-terminal durable jobs (and by the brief's own
+  ledger row, which exists before the job does) now count toward the ceiling.
+  New `lib/message-reservations.ts` registry; the job store keeps the number
+  on its always-in-memory identity so the answer is synchronous and survives
+  a restart. (The double #74 reported on 6.9.443 was the companion showing one
+  exchange twice; companion 6.9.445 fixes that side.)
 - **Sources show what is behind them.** `GET /api/morning-brief` now carries
   `coverage`: one row per source with a state (`ready`, `empty`,
   `unavailable`, `runtime`) and a summary line such as "2,312 meetings

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.43.1",
+  "version": "6.43.3",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/message-reservations.ts

@@ -4,9 +4,12 @@
 // reports, and a durable job carries the number it was minted with until its
 // terminal projection writes the exchange into the session. Between admission
 // and projection the number existed nowhere the counter looked, so a second
-// producer minted it again: on 2026-09-01 the scheduled morning brief reserved
-// #74 at 22:18:40 and the phone handed #74 to "Cross surface" at 22:25:15,
-// because its counter only re-syncs at boot and the server said max was 73.
+// producer could mint it again: a running morning brief holds its number for
+// minutes while the phone's counter, which only re-syncs at boot, still sits
+// below it. (The double "#74" seen on 2026-09-01 turned out to be the phone
+// showing ONE exchange twice, a display-bus placeholder plus the hydrated
+// row, fixed in companion 6.9.445. The window this closes is real all the
+// same: the same night's ledger shows the brief holding #74 for 6m35s.)
 //
 // Every holder of a not-yet-projected number registers a source here. The
 // counter route and the brief's own reservation read the union. Sources

package/server/lib/provider-proof.ts

@@ -1,8 +1,28 @@
 import { spawn } from 'node:child_process'
 import { cosBrainDir } from './launch-dir.js'
+import { resolveAgentBinary } from './cursor-model-catalog.js'
 import { terminateProviderProcess } from './provider-process-lifecycle.js'
 
-export type ProofProvider = 'claude' | 'codex'
+export type ProofProvider = 'claude' | 'codex' | 'cursor'
+export const PROOF_PROVIDERS: readonly ProofProvider[] = ['claude', 'codex', 'cursor']
+
+/**
+ * Why a proof did not pass, as a stable code COS Control can branch on
+ * without reading logs. `provider_quota` is the one that matters: a vendor
+ * session or usage limit is a fact about the vendor's meter, not about the
+ * candidate server, and an update must not roll back on it when another
+ * provider proves. (2026-09-01: six 6.43.1 updates rolled back on Claude's
+ * session limit while Codex proved in 7 s.)
+ */
+export type ProviderProofCode =
+  | 'provider_quota'
+  | 'provider_auth'
+  | 'provider_context_overflow'
+  | 'provider_missing'
+  | 'provider_timeout'
+  | 'provider_canceled'
+  | 'provider_bad_answer'
+  | 'provider_failed'
 
 export interface ProviderProofResult {
   provider: ProofProvider
@@ -10,6 +30,7 @@ export interface ProviderProofResult {
   durationMs: number
   cached: boolean
   error?: string
+  code?: ProviderProofCode
 }
 
 const PROOF_TOKEN = 'COS_CONTROL_OK'
@@ -110,12 +131,24 @@ export function runBounded(
 export const CLAUDE_PROOF_MODEL = 'haiku'
 export const CLAUDE_PROOF_TIMEOUT_MS = 45_000
 
+/** No MCP servers for the proof, stated explicitly rather than relied on
+ * from CLAUDE_CODE_SAFE_MODE alone. Without safe mode, Claude Code 2.1.251
+ * turns `--tools ''` into "load the whole catalog, expose none of it", and
+ * on a Mac with a large MCP fleet that catalog alone is ~244K tokens against
+ * Haiku's 200K window ("Prompt is too long", exit 1, zero API time). Safe
+ * mode currently prevents that; an explicit empty config with
+ * --strict-mcp-config keeps the proof under 20K tokens whatever a future
+ * CLI does with the safe-mode flag. */
+export const CLAUDE_PROOF_MCP_CONFIG = '{"mcpServers":{}}'
+
 export function claudeProofArgs(): string[] {
   return [
     '-p',
     '--model', CLAUDE_PROOF_MODEL,
     '--output-format', 'json',
     '--permission-mode', 'dontAsk',
+    '--strict-mcp-config',
+    '--mcp-config', CLAUDE_PROOF_MCP_CONFIG,
     '--tools', '',
     '--allowedTools', '',
     '--system-prompt', PROOF_PROMPT,
@@ -161,11 +194,85 @@ function safeProofError(result: ProcessResult): string {
   return 'provider returned no valid proof response'
 }
 
+const QUOTA_RE = /usage limit|hit your (?:usage |session )?limit|session limit|rate.?limit|too many requests|\b429\b|\bquota\b|resets? (?:at|in) |over capacity|overloaded|\b529\b|plan limit/i
+const AUTH_RE = /not logged in|please (?:log ?in|sign in)|invalid api key|authentication|unauthori[sz]ed|\b401\b|\b403\b|login required|token (?:has )?expired|no credentials/i
+const OVERFLOW_RE = /prompt is too long|context window|too many tokens|exceeds the (?:model|context)/i
+const MISSING_RE = /ENOENT|command not found|no such file/i
+
+/** Vendor text the provider printed, so the code can be derived without ever
+ * returning that text to a caller. Claude's JSON `result` carries the error
+ * sentence on `is_error`; Codex and Cursor print it on stderr or as a
+ * result/error event. */
+export function classifyProofFailure(result: ProcessResult, answer: string, expected = PROOF_TOKEN): ProviderProofCode {
+  if (result.aborted) return 'provider_canceled'
+  if (result.timedOut) return 'provider_timeout'
+  const haystack = `${result.stderr}\n${result.stdout}`.slice(0, 40_000)
+  if (result.code === null && MISSING_RE.test(haystack)) return 'provider_missing'
+  if (OVERFLOW_RE.test(haystack)) return 'provider_context_overflow'
+  if (QUOTA_RE.test(haystack)) return 'provider_quota'
+  if (AUTH_RE.test(haystack)) return 'provider_auth'
+  if (result.code === 0) return answer === expected ? 'provider_failed' : 'provider_bad_answer'
+  return 'provider_failed'
+}
+
+/** One safe sentence per code; never the vendor's text. */
+export function describeProofCode(code: ProviderProofCode, result: ProcessResult): string {
+  switch (code) {
+    case 'provider_quota': return 'provider session or usage limit reached'
+    case 'provider_auth': return 'provider is not signed in'
+    case 'provider_context_overflow': return 'provider refused the proof prompt as too long'
+    case 'provider_missing': return 'provider binary is not installed or not on PATH'
+    case 'provider_timeout': return 'provider proof timed out'
+    case 'provider_canceled': return 'provider proof canceled'
+    case 'provider_bad_answer': return 'provider answered but not with the proof token'
+    default: return safeProofError(result)
+  }
+}
+
+export const CURSOR_PROOF_TIMEOUT_MS = 120_000
+
+/** Cursor `agent` in documented read-only ask mode, one stream-json turn, the
+ * prompt on stdin like the bridge. No `--model`: the account default is the
+ * readiness question, not any particular model. */
+export function cursorProofArgs(workspace = cosBrainDir() ?? process.cwd()): string[] {
+  return ['-p', '--mode', 'ask', '--output-format', 'stream-json', '--trust', '--workspace', workspace]
+}
+
+/** The final `result` event wins; assistant deltas with a timestamp are the
+ * fallback, mirroring cursor-bridge's extractCursorResponseText. */
+export function cursorProofText(stdout: string): string {
+  let deltas = ''
+  for (const line of stdout.split('\n')) {
+    if (!line.trim()) continue
+    let event: any
+    try { event = JSON.parse(line) } catch { continue }
+    const type = String(event?.type ?? '').toLowerCase()
+    if (type === 'result') {
+      if (event?.subtype === 'success' && event?.is_error !== true && typeof event?.result === 'string') return event.result.trim()
+      continue
+    }
+    if (type !== 'assistant' || typeof event?.timestamp_ms !== 'number') continue
+    if (event?.model_call_id != null && event.model_call_id !== '') continue
+    const content = event?.message?.content
+    if (Array.isArray(content)) {
+      for (const block of content) {
+        if (typeof block === 'string') deltas += block
+        else if (typeof block?.text === 'string') deltas += block.text
+      }
+    } else if (typeof event?.text === 'string') {
+      deltas += event.text
+    }
+  }
+  return deltas.trim()
+}
+
 async function executeProof(provider: ProofProvider, signal?: AbortSignal): Promise<ProviderProofResult> {
   const started = Date.now()
-  const result = provider === 'claude'
-    ? await runBounded('claude', claudeProofArgs(), '', CLAUDE_PROOF_TIMEOUT_MS, signal)
-    : await runBounded('codex', [
+  let result: ProcessResult
+  if (provider === 'claude') {
+    result = await runBounded('claude', claudeProofArgs(), '', CLAUDE_PROOF_TIMEOUT_MS, signal)
+  } else if (provider === 'codex') {
+    result = await runBounded('codex', [
       'exec',
       '--sandbox', 'read-only',
       '--skip-git-repo-check',
@@ -174,16 +281,25 @@ async function executeProof(provider: ProofProvider, signal?: AbortSignal): Prom
       '--ephemeral',
       '-',
     ], PROOF_PROMPT, 120_000, signal)
+  } else {
+    const binary = resolveAgentBinary()
+    result = binary
+      ? await runBounded(binary, cursorProofArgs(), PROOF_PROMPT, CURSOR_PROOF_TIMEOUT_MS, signal)
+      : { code: null, stdout: '', stderr: 'ENOENT: cursor agent binary not found', timedOut: false, aborted: false }
+  }
   const text = provider === 'claude'
     ? claudeProofText(result.stdout)
-    : codexProofText(result.stdout)
+    : provider === 'codex' ? codexProofText(result.stdout) : cursorProofText(result.stdout)
   const ok = result.code === 0 && text === PROOF_TOKEN
+  if (ok) return { provider, ok, durationMs: Date.now() - started, cached: false }
+  const code = classifyProofFailure(result, text)
   return {
     provider,
-    ok,
+    ok: false,
     durationMs: Date.now() - started,
     cached: false,
-    ...(ok ? {} : { error: safeProofError(result) }),
+    error: describeProofCode(code, result),
+    code,
   }
 }
 

package/server/routes/provider-proof.ts

@@ -1,5 +1,5 @@
 import { Router } from 'express'
-import { runProviderProof, type ProofProvider } from '../lib/provider-proof.js'
+import { PROOF_PROVIDERS, runProviderProof, type ProofProvider } from '../lib/provider-proof.js'
 import {
   acquireMaintenanceWork,
   maintenanceErrorPayload,
@@ -17,8 +17,8 @@ providerProofRouter.post('/diagnostics/provider-proof', async (req, res) => {
     || address.startsWith('127.') || address.startsWith('::ffff:127.')
   if (!loopback) return res.status(403).json({ error: 'loopback_required' })
   const provider = req.body?.provider
-  if (provider !== 'claude' && provider !== 'codex') {
-    return res.status(400).json({ error: 'provider must be claude or codex' })
+  if (!PROOF_PROVIDERS.includes(provider)) {
+    return res.status(400).json({ error: 'provider must be claude, codex, or cursor', code: 'provider_unknown' })
   }
   const controllerProof = maintenanceOperationCredentialsValid({
     leaseId: typeof req.headers['x-cos-maintenance-lease'] === 'string'