@gotcos/glasses-server 6.50.2 → 6.50.3

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 6.50.3
+
+- **The server referees between copies of the COS Glasses app.** 2026-09-18 10:06: the Even Realities app kept an older WebView copy of the plugin alive (hidden since at least 09:30) behind the one Miles opened, both answered one Start Meeting to the millisecond, and the same 90-minute meeting was recorded and HQ-polished twice. Glasses 6.9.505's claim in the Even app's storage could not stop it: the new copy read the old copy's claim 36 minutes stale, and the hidden copy never refreshed its claim or read the new one, while its HTTP calls to this server kept working (it uploaded all 827 chunks). `POST /api/client-instance/claim` `{ id, bootAt, version }` answers `{ verdict: 'owner' | 'yield', owner }`: the newest boot that is still posting owns the ring (ties by id); a claim from an older boot takes over only after the owner has been quiet for 45 s (`CLIENT_INSTANCE_LIVE_MS`, three 15 s ticks). `check: true` answers without taking, so a copy that already yielded can ask whether the owner is gone without stealing the ring after a phone lock froze both copies' timers. Behind the API token. In memory: a restart forgets the owner and the next posts re-establish it within a tick. Glasses 6.9.507 asks this route first and falls back to the storage claim when the Mac is unreachable or older.
+- Tests (`client-instance.test.ts`): the arbitration executed (the zombie yields, the owner refreshes, the older reclaims one ms past the live edge, a same-millisecond tie has one owner, malformed claims refused) and over HTTP (state kept across requests, a 400 changes nothing); the mount sits after `requireApiToken` and is not a public path. Gate: `referee-dead-owner-never-released`, `referee-older-boot-wins`, `referee-not-mounted`, 3/3.
+
 ## 6.50.2
 
 - **The Turbo meeting preview no longer switches itself off for good.** Miles, 2026-09-18 08:43: the `~` provisional line on the lens was gone, Mac-reachable, Turbo configured. The preview route had answered "no text" to 5,719 requests since 2026-09-17 16:00 (in under a millisecond) while the Turbo sidecar itself transcribed the same audio in 0.27 s. One failed request (`The operation was aborted due to timeout`, then `fetch failed`, with the Mac under build load) set `previewAvailable = false`, and the only code that sets it back is the sidecar's own start, which runs once per server boot. Now a failure against a sidecar that is still running is a 10 s cooldown (`PREVIEW_FAILURE_COOLDOWN_MS`) and the next request after it tries again; five failures in a row (`PREVIEW_RECYCLE_AFTER_FAILURES`) recycle the sidecar; a sidecar that exited is restarted from the request path, at most once per 60 s window, doubling to 15 min while restarts keep failing and resetting on any answer. A missing model, a missing binary or a foreign listener on port 8177 is never restarted (a restart cannot fix it). After the server's own shutdown stop, nothing revives the sidecar (a request arriving during shutdown could otherwise have spawned one that outlived the process). Prompt previews were never affected (they fall back to the canonical worker); canonical meeting ASR never was. The preview log lines now carry an ISO timestamp: the lines that recorded this failure had none.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.50.2",
+  "version": "6.50.3",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -14,6 +14,7 @@ import { execSync } from 'node:child_process'
 import { randomBytes } from 'node:crypto'
 import { healthRouter } from './routes/health.js'
 import { diagRouter } from './routes/diag.js'
+import { createClientInstanceRouter } from './routes/client-instance.js'
 import { queryRouter } from './routes/query.js'
 import { providerProofRouter } from './routes/provider-proof.js'
 import { transcribeRouter } from './routes/transcribe.js'
@@ -530,6 +531,8 @@ const forkThreadForRoute = (request: {
 // API routes
 app.use('/api', healthRouter)
 app.use('/api', diagRouter)
+// 6.50.3: the referee between copies of the COS Glasses app (routes/client-instance.ts).
+app.use('/api', createClientInstanceRouter())
 app.use('/api', createQueryJobsRouter(queryJobCoordinator, {
   prepareAdmission: preparePublicDurableQueryAdmission,
 }))

package/server/lib/client-instance-claim.ts

@@ -0,0 +1,60 @@
+// Which copy of the COS Glasses app owns the ring (6.50.3). PURE: the clock is passed in.
+//
+// WHY THE SERVER. On 2026-09-18 the Even Realities app kept an older WebView copy of the
+// plugin alive behind a newly opened one and delivered every ring event to both, so one
+// Start Meeting recorded the same 90 minutes twice. Glasses 6.9.505 put a claim in the Even
+// app's own storage: the newest boot wins, the copy behind it yields. It failed in the field
+// because the hidden copy's storage calls went unanswered (its claim sat 36 min stale and it
+// never read the newer one), while its HTTP calls to this server kept working (it uploaded
+// all 827 chunks). This server is the one party every copy can still reach.
+//
+// RULE. One owner at a time. A claim from the owner refreshes it. A claim from a NEWER boot
+// (ties broken by id) takes ownership. A claim from an older boot takes ownership only when
+// the owner has gone quiet for CLIENT_INSTANCE_LIVE_MS (the newer copy died). In memory: a
+// server restart forgets the owner, and the next posts re-establish it within one tick.
+
+export const CLIENT_INSTANCE_TICK_MS = 15_000
+/** Three missed ticks: the owner is gone. */
+export const CLIENT_INSTANCE_LIVE_MS = 3 * CLIENT_INSTANCE_TICK_MS
+
+export interface ClientInstanceClaim {
+  id: string
+  bootAt: number
+  version: string
+}
+
+export interface ClientInstanceOwner extends ClientInstanceClaim {
+  seenAt: number
+}
+
+export type ClientInstanceVerdict = 'owner' | 'yield'
+
+const ID_PATTERN = /^[a-z0-9]{1,16}-[a-z0-9]{1,8}$/
+
+/** A body the route may act on, or null. Never throws. */
+export function parseClientInstanceClaim(body: unknown): ClientInstanceClaim | null {
+  if (!body || typeof body !== 'object') return null
+  const o = body as Record<string, unknown>
+  if (typeof o.id !== 'string' || !ID_PATTERN.test(o.id)) return null
+  if (typeof o.bootAt !== 'number' || !Number.isFinite(o.bootAt) || o.bootAt <= 0) return null
+  const version = typeof o.version === 'string' ? o.version.slice(0, 32) : ''
+  return { id: o.id, bootAt: o.bootAt, version }
+}
+
+function isNewer(a: ClientInstanceClaim, b: ClientInstanceClaim): boolean {
+  return a.bootAt > b.bootAt || (a.bootAt === b.bootAt && a.id > b.id)
+}
+
+/** The owner after `claim` arrives at `now`, and what to tell its sender. */
+export function arbitrateClientInstance(
+  owner: ClientInstanceOwner | null,
+  claim: ClientInstanceClaim,
+  now: number,
+): { owner: ClientInstanceOwner; verdict: ClientInstanceVerdict; took: boolean } {
+  const fresh: ClientInstanceOwner = { ...claim, seenAt: now }
+  if (!owner) return { owner: fresh, verdict: 'owner', took: true }
+  if (owner.id === claim.id) return { owner: { ...owner, seenAt: now }, verdict: 'owner', took: false }
+  if (isNewer(claim, owner)) return { owner: fresh, verdict: 'owner', took: true }
+  if (now - owner.seenAt > CLIENT_INSTANCE_LIVE_MS) return { owner: fresh, verdict: 'owner', took: true }
+  return { owner, verdict: 'yield', took: false }
+}

package/server/routes/client-instance.ts

@@ -0,0 +1,35 @@
+// POST /api/client-instance/claim — the referee between copies of the COS Glasses app (6.50.3).
+// See lib/client-instance-claim.ts for the why. Behind the global API token like every /api
+// route except health and diag. Body: { id, bootAt, version, check? }. Answer: { verdict, owner }.
+//
+// `check: true` answers without taking: a copy that already yielded asks whether the owner
+// is still there, and must not steal the ring by asking (after a phone lock both copies'
+// timers were frozen, so the owner only LOOKS quiet; the older copy's first tick would
+// otherwise take it).
+
+import { Router } from 'express'
+import { arbitrateClientInstance, parseClientInstanceClaim, type ClientInstanceOwner } from '../lib/client-instance-claim.js'
+
+export function createClientInstanceRouter(now: () => number = Date.now): Router {
+  const router = Router()
+  let owner: ClientInstanceOwner | null = null
+  router.post('/client-instance/claim', (req, res) => {
+    const claim = parseClientInstanceClaim(req.body)
+    if (!claim) return void res.status(400).json({ error: 'invalid_claim' })
+    const previous = owner
+    const result = arbitrateClientInstance(owner, claim, now())
+    if (req.body?.check === true) {
+      const shown = previous ?? result.owner
+      return void res.json({ verdict: result.verdict, owner: { id: shown.id, bootAt: shown.bootAt, version: shown.version, seenAt: shown.seenAt }, check: true })
+    }
+    owner = result.owner
+    if (result.took && previous && previous.id !== claim.id) {
+      console.log(`[client-instance] ${new Date(now()).toISOString()} ${claim.id} (${claim.version}) took the ring from ${previous.id}`)
+    }
+    res.json({
+      verdict: result.verdict,
+      owner: { id: owner.id, bootAt: owner.bootAt, version: owner.version, seenAt: owner.seenAt },
+    })
+  })
+  return router
+}