@gotcos/glasses-server 6.50.3 → 6.51.0

package/server/routes/agent-session-bindings.ts

@@ -344,6 +344,16 @@ export interface AgentSessionBindingsDeps {
    */
   deliverLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; verifyTimeoutMs?: number; clientTurnId?: string }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; pid?: number | null }>
 
+  /**
+   * 6.51.0: put a Codex turn into the Codex app's OWN queue when the app holds the thread.
+   *
+   * `makeCodexLiveDeliverer` from `server/lib/codex-live-queue-deps.ts`. Separate from
+   * `deliverLiveTurn` on purpose, so the Claude branch is byte-for-byte 6.50. Asked only
+   * when the gate's verdict carries a foreign writer on a Codex thread; absent, that turn
+   * spawns exactly as before.
+   */
+  deliverCodexLiveTurn?: (request: { provider: string; sessionId: string; prompt: string; foreignHolder: boolean }) => Promise<{ ok: boolean; reason: string; verifiedBy?: string | null; queuedId?: string | null }>
+
   /**
    * The self-recursion ledger. Defaults to the real process-wide one.
    *
@@ -498,6 +508,11 @@ export type WriteRefusal =
   // held as retryable and the retry re-reads before doing anything (see
   // `session-peer-inbox.ts`); it is never a fence, because nothing here ran a child.
   | 'live_unverified'
+  // 6.51.0: the Codex app holds this thread and `codex queue` did not take the turn.
+  // Nothing was queued. Never answered by spawning: a resume child against a held
+  // thread dies on "already has an active writer" after the prompt is written, which
+  // is the ambiguous fence this whole branch exists to avoid.
+  | 'codex_live_unavailable'
   // ------------------------------------------------------------------- fork
   //
   // Fork gets its OWN members rather than reusing the ones above, and the reason
@@ -572,6 +587,8 @@ export const WRITE_REASON_COPY: Record<Exclude<WriteRefusal, OccupancyReason>, s
     'COS lost track of this turn after sending it. Open the thread on your Mac and check before sending again.',
   live_unverified:
     'Sent, not yet confirmed. Send again: COS checks before sending twice.',
+  codex_live_unavailable:
+    'The Codex app has this thread open, and COS could not hand it the message. Nothing was sent. Send it from the Codex app, or fork it.',
   turn_failed:
     'COS could not run this turn. Nothing was sent. You can try again.',
 
@@ -1284,6 +1301,8 @@ export const ATTACHED_COPY = 'Attached. COS is driving the original thread.'
 export const TURN_SENT_COPY = 'Sent to the original thread.'
 /** 6.49.0: the turn went into the running session, where the desk will see it. */
 export const TURN_SENT_LIVE_COPY = 'Sent to the open session. It will show where you left it.'
+/** 6.51.0: a Codex turn handed to the Codex app's own queue for the thread it has open. */
+export const TURN_SENT_CODEX_QUEUE_COPY = 'Queued in the Codex app. It runs when the current turn ends, or right away if the thread is idle.'
 /**
  * How long the route waits for the session's transcript to show acceptance.
  *
@@ -1392,18 +1411,18 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
    * one place, so the write routes cannot come to a different conclusion than the
    * probe the user was shown a second earlier.
    */
-  const runOccupancy = (provider: string, threadId: string): AttachabilityBody => {
-    let verdict: Occupancy
+  const detectOccupancy = (provider: string, threadId: string): Occupancy => {
     try {
-      verdict = detect(provider, threadId, deps.probes, deps.dirs)
+      return detect(provider, threadId, deps.probes, deps.dirs)
     } catch (error) {
       // `threadOccupancy` already contains its own probe try/catch, so reaching
       // here means the detector itself threw. Logged without the thread id.
       console.error(`[agent-session-bindings] occupancy threw: ${error instanceof Error ? error.message : error}`)
-      verdict = { attachable: false, owners: [], reason: 'probe_failed' }
+      return { attachable: false, owners: [], reason: 'probe_failed' }
     }
-    return projectAttachability(verdict)
   }
+  const runOccupancy = (provider: string, threadId: string): AttachabilityBody =>
+    projectAttachability(detectOccupancy(provider, threadId))
 
   const refuseAttach = (res: Response, reason: WriteRefusal): void => {
     res.status(refusalStatus(reason)).json({
@@ -2153,9 +2172,16 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
       // session started in the gap is exactly the residual risk option B leaves
       // open, and it is terminal here rather than a warning because COS has no
       // cross-process lock that could fence a live desktop writer.
-      const verdict = runOccupancy(binding.provider, binding.nativeThreadId)
+      const detected = detectOccupancy(binding.provider, binding.nativeThreadId)
+      const verdict = projectAttachability(detected)
       stage('gate')
       if (!verdict.attachable) return refuseTurn(verdict.reason ?? 'probe_failed')
+      // 6.51.0: the SAME verdict says whether a live process that is not ours holds the
+      // thread. Only the declared idle-holder exemption can carry one on an attachable
+      // verdict (`projectAttachability` refuses anything else), so this is that fact.
+      const foreignHolder = detected.idleHolder === true
+        && Array.isArray(detected.owners)
+        && detected.owners.some(owner => owner?.selfOwned !== true)
 
       const head = await readHead(binding.provider, binding.nativeThreadId)
       stage('head')
@@ -2238,6 +2264,72 @@ export function createAgentSessionBindingsRouter(deps: AgentSessionBindingsDeps)
         // suspect_expired: nothing reached a session. Spawn as always.
       }
 
+      // 6.51.0: CODEX, WHEN THE CODEX APP HOLDS THE THREAD. Its app-server keeps the
+      // writer lock for as long as the thread is open, so the resume child below cannot
+      // run (it exits on "already has an active writer" after the prompt is written, and
+      // that fence is what August's two Codex Continues left behind). `codex queue`
+      // hands the turn to that app-server's own queue instead: it runs at the end of the
+      // current turn, or within seconds if the thread is idle (canary in
+      // `codex-live-queue.ts`). A thread nobody holds never gets here.
+      if (binding.provider === 'codex' && foreignHolder && typeof deps.deliverCodexLiveTurn === 'function') {
+        let live: { ok: boolean; reason: string; verifiedBy?: string | null; queuedId?: string | null } | null = null
+        try {
+          live = await deps.deliverCodexLiveTurn({
+            provider: binding.provider,
+            sessionId: binding.nativeThreadId,
+            prompt,
+            foreignHolder: true,
+          })
+        } catch (error) {
+          console.error(`[agent-session-bindings] codex live delivery threw: ${error instanceof Error ? error.message : error}`)
+          live = null
+        }
+        stage(`codex-live(${live?.reason ?? 'threw'})`)
+        if (live?.ok) {
+          console.log(`[agent-session-bindings] turn delivered live provider=codex turnId=${turnId} bindingId=${bindingId} verifiedBy=${live.verifiedBy ?? 'unknown'} queuedId=${live.queuedId ?? 'null'}`)
+          respond(200, {
+            turnId,
+            outcome: 'completed',
+            deliveryState: 'delivered',
+            via: 'live',
+            retryable: false,
+            changed: false,
+            revision: null,
+            reason: null,
+            reasonCopy: TURN_SENT_CODEX_QUEUE_COPY,
+          })
+          return
+        }
+        // The operator switched this off: the 6.50 path, unchanged, whatever it does.
+        if (live?.reason !== 'disabled') {
+          // A throw, a timeout, or a confirmation we could not read: a row MAY be in the
+          // app's queue. Unlike the Claude hop, nothing can re-check that before a resend
+          // (QA, 6.51.0), and a retryable answer would have the drainer insert the same
+          // sentence at every turn end until the TTL. So it is what every other unproven
+          // delivery is: ambiguous, ledgered (a replay answers the same), and fenced until
+          // a person looks at the Codex app's queue and releases it.
+          if (live === null || live.reason === 'unverified') {
+            guard.fence(key, 'native_target_fenced', {
+              provider: binding.provider,
+              headBefore: head.digest,
+              turnId,
+              bindingId,
+              now: Date.now(),
+              adapterReason: 'codex_queue_unverified',
+              fenceSite: 'ambiguous',
+              spawns: [],
+            })
+            console.warn(`[agent-session-bindings] fence set site=codex_live provider=codex target=${opaqueRevision(key)} turnId=${turnId} bindingId=${bindingId} headBefore=${head.digest} adapterReason=codex_queue_unverified`)
+            return reportAmbiguous()
+          }
+          // Nothing was queued, and the child cannot run against a held thread. Not
+          // retryable: a missing binary or a CLI that refused does not heal on a 20 s
+          // sweep, and a retryable reason would have the queue drainer re-run it for the
+          // whole TTL (`isRetryableDelivery` trusts the route's own verdict).
+          return refuseTurn('codex_live_unavailable', { retryable: false })
+        }
+      }
+
       // THE QUEUE POINT. Every gate is now behind us — body, replay, queued-prompt,
       // lease, target, epoch, fence, claim, occupancy, head baseline, pin — so a
       // refusal still reaches the user immediately and precisely. Only the spawn is

package/server/routes/agent-sessions.ts

@@ -39,7 +39,7 @@ import {
 import { searchAgentSessions, type AgentSessionSearchHit } from '../lib/agent-session-search.js'
 import { claudeSessionNamesVisible, claudeSessionsDir, claudeSessionsEnabled, readClaudePeerRecords, registryFacts } from './claude-sessions.js'
 import type { ClaudePeerRecord } from '../lib/claude-session-registry.js'
-import { deriveForRow } from '../lib/session-hooks-runtime.js'
+import { deriveForRow, signalFor } from '../lib/session-hooks-runtime.js'
 import { derivedRowFields, type DerivedSessionState } from '../lib/session-state-derive.js'
 import { queuedTurnsFields, queuedWaitingLookup } from '../lib/thread-turn-queue-store.js'
 import { isAttachedTurnActive, sessionStreamKey } from '../lib/session-stream-bus.js'
@@ -387,6 +387,14 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
         attachedTurn: isAttachedTurnActive(sessionStreamKey('claude', row.session_id)),
       }))
     }
+    // 6.51.0: a Cursor composer whose OWN hook events reached the store (Cursor runs the COS
+    // session hook from ~/.claude/settings.json) gets the same one derivation, from the
+    // signal alone. Hook-grounded only: a Cursor row with no events keeps exactly the 6.50
+    // shape, and nothing is inferred from its file times here.
+    for (const row of sessions) {
+      if (row.provider !== 'cursor' || !signalFor(row.session_id)) continue
+      derivedById.set(row.session_id, deriveForRow({ sessionId: row.session_id, now, remember: false }))
+    }
     const queuedOf = queuedWaitingLookup(now)
     res.json({
       sessions: sessions.map((row, index) => withRunning(toEntry(row, activity[index], derivedById.get(row.session_id), queuedOf(row.provider, row.session_id)), running)),
@@ -506,6 +514,9 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
         transcript: { inFlight: running.occupied.get(parsed.session_id)?.activeRecently === true, lastActivityAt: activity.lastActivityAt ? Date.parse(activity.lastActivityAt) : null },
         attachedTurn: isAttachedTurnActive(sessionStreamKey('claude', parsed.session_id)),
       })
+    } else if (provider === 'cursor' && signalFor(parsed.session_id)) {
+      // 6.51.0: the detail agrees with its list row (hook-grounded Cursor state).
+      derived = deriveForRow({ sessionId: parsed.session_id, remember: false })
     }
     res.json({
       ...withRunning({ session_id: parsed.session_id }, running),

package/server/routes/client-instance.ts

@@ -6,29 +6,77 @@
 // is still there, and must not steal the ring by asking (after a phone lock both copies'
 // timers were frozen, so the owner only LOOKS quiet; the older copy's first tick would
 // otherwise take it).
+//
+// 6.50.4: one owner PER DEVICE (the request's address), so an Even simulator on this Mac or
+// a second phone on the same token cannot take the ring from the glasses (QA, 6.50.3); and
+// the ring never moves in a way that stops the only recording. The router notes every
+// meeting-chunk POST as it passes (it is mounted BEFORE the transcribe-stream router, and
+// only notes, never answers): whose chunk it was (`?clientInstance=`, glasses 6.9.509+) or,
+// untagged, which device sent it. `captureLive` in the answer: the owner is recording.
 
 import { Router } from 'express'
-import { arbitrateClientInstance, parseClientInstanceClaim, type ClientInstanceOwner } from '../lib/client-instance-claim.js'
+import {
+  arbitrateClientInstance,
+  ownerIsRecording,
+  parseClientInstanceClaim,
+  parseInstanceTag,
+  ClientChunkLedger,
+  NO_CAPTURE,
+  type ClientInstanceOwner,
+} from '../lib/client-instance-claim.js'
+
+/** Owners kept at once; the least recently seen device is dropped past this. */
+export const CLIENT_INSTANCE_MAX_DEVICES = 16
 
-export function createClientInstanceRouter(now: () => number = Date.now): Router {
+export interface ClientInstanceRouterDeps {
+  now?: () => number
+}
+
+/** A POST that carries a meeting chunk: a live one, or an iPhone offline chunk replayed. The preview is not one. */
+export function isMeetingChunkPost(method: string, path: string): boolean {
+  return method === 'POST' && (path === '/transcribe-stream' || /^\/transcribe-stream\/offline-sessions\/[^/]+\/chunks$/.test(path))
+}
+
+/** `::ffff:100.64.1.2` and `100.64.1.2` are one device. */
+export function deviceKey(address: string | undefined): string {
+  const a = (address ?? '').trim()
+  return a.startsWith('::ffff:') ? a.slice(7) : (a || 'unknown')
+}
+
+export function createClientInstanceRouter(deps: ClientInstanceRouterDeps | (() => number) = {}): Router {
+  const opts: ClientInstanceRouterDeps = typeof deps === 'function' ? { now: deps } : deps
+  const now = opts.now ?? Date.now
   const router = Router()
-  let owner: ClientInstanceOwner | null = null
+  const owners = new Map<string, ClientInstanceOwner>()
+  const chunks = new ClientChunkLedger()
+  router.use((req, _res, next) => {
+    if (isMeetingChunkPost(req.method, req.path)) chunks.note(deviceKey(req.socket?.remoteAddress ?? req.ip), parseInstanceTag(req.query?.clientInstance), now())
+    next()
+  })
   router.post('/client-instance/claim', (req, res) => {
-    const claim = parseClientInstanceClaim(req.body)
+    const at = now()
+    const claim = parseClientInstanceClaim(req.body, at)
     if (!claim) return void res.status(400).json({ error: 'invalid_claim' })
-    const previous = owner
-    const result = arbitrateClientInstance(owner, claim, now())
+    const device = deviceKey(req.socket?.remoteAddress ?? req.ip)
+    const previous = owners.get(device) ?? null
+    const evidence = previous ? chunks.evidence(device, previous.id, claim.id, at) : NO_CAPTURE
+    const captureLive = previous ? ownerIsRecording(previous, evidence, at) : false
+    const result = arbitrateClientInstance(previous, claim, at, evidence)
     if (req.body?.check === true) {
       const shown = previous ?? result.owner
-      return void res.json({ verdict: result.verdict, owner: { id: shown.id, bootAt: shown.bootAt, version: shown.version, seenAt: shown.seenAt }, check: true })
+      return void res.json({ verdict: result.verdict, owner: { id: shown.id, bootAt: shown.bootAt, version: shown.version, seenAt: shown.seenAt }, check: true, captureLive })
     }
-    owner = result.owner
+    owners.delete(device)
+    owners.set(device, result.owner)
+    while (owners.size > CLIENT_INSTANCE_MAX_DEVICES) owners.delete(owners.keys().next().value as string)
+    const owner = result.owner
     if (result.took && previous && previous.id !== claim.id) {
-      console.log(`[client-instance] ${new Date(now()).toISOString()} ${claim.id} (${claim.version}) took the ring from ${previous.id}`)
+      console.log(`[client-instance] ${new Date(at).toISOString()} ${claim.id} (${claim.version}) took the ring from ${previous.id} on ${device}`)
     }
     res.json({
       verdict: result.verdict,
       owner: { id: owner.id, bootAt: owner.bootAt, version: owner.version, seenAt: owner.seenAt },
+      captureLive,
     })
   })
   return router

package/server/routes/cursor-stop-followup.ts

@@ -0,0 +1,67 @@
+// POST /hooks/cursor/stop-followup -- the COS session hook asks, at a Cursor composer's
+// Stop, whether a turn is queued for it (6.51.0). See `lib/cursor-stop-followup.ts`.
+//
+// NOT under /api, on purpose. The hook holds the per-install HOOK token
+// (`~/.cos-glasses/hook-token`, 0600), never the pairing token the /api gate checks, and
+// widening that gate for one caller would be the larger change. This route checks the
+// hook token itself, in constant time, before it reads anything. It answers only `{}` or
+// `{"followup_message": ...}` so the hook can print it verbatim, and it never answers
+// with anything a Claude Stop could act on: a body that is not a Cursor Stop is `{}`.
+
+import express, { Router, type Request, type Response } from 'express'
+import { timingSafeTokenEqual } from '../lib/token-auth.js'
+import { claimNextCursorTurn, cursorStopAcceptsFollowup, cursorStopIsFresh, parseCursorStopEnvelope } from '../lib/cursor-stop-followup.js'
+import { MAX_QUEUED_PER_THREAD, type QueuedThreadTurn } from '../lib/thread-turn-queue.js'
+
+export interface CursorStopFollowupDeps {
+  /** The per-install hook token, or null when none has been minted (then nothing is answered). */
+  hookToken: () => string | null
+  readQueue: (provider: string, threadId: string, now: number) => QueuedThreadTurn[]
+  writeQueue: (provider: string, threadId: string, queue: QueuedThreadTurn[]) => void
+  now: () => number
+}
+
+export const CURSOR_STOP_FOLLOWUP_PATH = '/hooks/cursor/stop-followup'
+
+export function createCursorStopFollowupRouter(deps: CursorStopFollowupDeps): Router {
+  const router = Router()
+  // The hook posts its spool envelope, capped at 1 MiB by the script itself.
+  router.post(CURSOR_STOP_FOLLOWUP_PATH, express.json({ limit: '2mb' }), (req: Request, res: Response) => {
+    res.set('Cache-Control', 'private, no-store')
+    let expected: string | null = null
+    try { expected = deps.hookToken() } catch { expected = null }
+    if (!expected || !timingSafeTokenEqual(req.headers['x-cos-hook-token'], expected)) {
+      return res.status(401).json({})
+    }
+    const facts = parseCursorStopEnvelope(req.body)
+    if (!facts || !cursorStopAcceptsFollowup(facts, MAX_QUEUED_PER_THREAD)) return res.json({})
+    // The hook waits three seconds and then moves on. A claim made after it stopped
+    // listening marks a turn delivered that Cursor never received (QA, 6.51.0: a Stop that
+    // lands while the event loop is busy). A socket that already reads closed is one sign;
+    // the reliable one is the hook's own start stamp (see cursorStopIsFresh). Everything
+    // from here to the reply is synchronous.
+    if (req.socket?.destroyed === true || res.writableEnded) {
+      console.warn('[cursor-stop-followup] the hook hung up before the claim; nothing claimed')
+      return undefined
+    }
+    let claimed: ReturnType<typeof claimNextCursorTurn> = null
+    try {
+      const now = deps.now()
+      if (!cursorStopIsFresh(facts.hookStartedAtMs, now)) {
+        console.warn(`[cursor-stop-followup] the Stop is ${facts.hookStartedAtMs === null ? 'unstamped' : `${now - facts.hookStartedAtMs} ms old`}; the hook may have stopped listening, so nothing is claimed and the turn waits for the next Stop`)
+        return res.json({})
+      }
+      claimed = claimNextCursorTurn(deps.readQueue('cursor', facts.conversationId, now), now)
+      if (!claimed) return res.json({})
+      // Written BEFORE the text leaves: the row must never read `waiting` after the
+      // composer has been handed it, or a later Stop would hand it over again.
+      deps.writeQueue('cursor', facts.conversationId, claimed.queue)
+    } catch (error) {
+      console.error(`[cursor-stop-followup] claim failed: ${error instanceof Error ? error.message : error}`)
+      return res.json({})
+    }
+    console.log(`[cursor-stop-followup] handed a queued turn to Cursor clientTurnId=${claimed.turn.clientTurnId} chars=${claimed.turn.prompt.length} loop=${facts.loopCount ?? 'null'} cursor=${facts.cursorVersion}`)
+    return res.json({ followup_message: claimed.turn.prompt })
+  })
+  return router
+}

package/server/routes/health.ts

@@ -81,6 +81,8 @@ import {
 } from '../lib/thread-attach-capability.js'
 import { sessionHooksHealthFields } from '../lib/session-hooks-runtime.js'
 import { continueLiveEnabled, liveDeliveryStats } from '../lib/session-peer-inbox-deps.js'
+import { codexLiveStats } from '../lib/codex-live-queue-deps.js'
+import { codexLiveQueueEnabled } from '../lib/codex-live-queue.js'
 
 /**
  * 6.49.0: which last hop a Continue takes, and how often each fell back.
@@ -101,6 +103,18 @@ export function continueLiveHealthFields(): Record<string, unknown> {
       lastReason: stats.lastReason,
       lastAt: stats.lastAt,
     },
+    // 6.51.0: Codex's last hop, counted apart so the Claude row above keeps its meaning.
+    codexLiveQueue: (() => {
+      const codex = codexLiveStats()
+      return {
+        enabled: codexLiveQueueEnabled(),
+        attempts: codex.attempts,
+        delivered: codex.delivered,
+        fallbacks: codex.fallbacks,
+        lastReason: codex.lastReason,
+        lastAt: codex.lastAt,
+      }
+    })(),
   }
 }
 

package/server/routes/thread-turn-queue.ts

@@ -119,7 +119,14 @@ export async function drainThread(
     // for every queued row repeats a whole-process descriptor scan. A refusal
     // can delay delivery until the next sweep, but can never authorize a write.
     // Positive verdicts and all checks after a delivery remain fresh.
-    const gate: ReturnType<ThreadTurnQueueDeps['occupancy']> = refusedGate ?? deps.occupancy(provider, threadId)
+    //
+    // 6.51.0: a Cursor turn is NEVER delivered from here. It leaves through the
+    // composer's own Stop hook (`routes/cursor-stop-followup.ts`), which claims it the
+    // moment the turn ends; a second deliverer could hand the same sentence over twice.
+    // The pass still runs for it so the TTL retires an unclaimed turn honestly.
+    const gate: ReturnType<ThreadTurnQueueDeps['occupancy']> = provider === 'cursor'
+      ? { attachable: false, reason: 'cursor_stop_hook_delivery' }
+      : refusedGate ?? deps.occupancy(provider, threadId)
     if (!gate.attachable) refusedGate = gate
     const seen: DrainObservation = {
       attachable: gate.attachable,
@@ -228,15 +235,18 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
       return res.status(400).json({ error: 'invalid_request', reason: 'invalid_cos_session_id' })
     }
 
-    if (provider === 'cursor') {
-      return res.status(423).json({ error: 'unsupported_provider', queueable: false })
-    }
-
     // THE GATE DECIDES WHETHER PARKING IS EVEN HONEST. A structural refusal can never
     // clear, and telling someone their turn is queued when it can never run is worse
     // than refusing it. An attachable thread is not queued either -- it is sent now,
     // through the ordinary route, which the client does on this 409.
     const gate = deps.occupancy(provider, threadId)
+
+    // 6.51.0: Cursor queues ONLY a composer its hooks show mid-turn, because the only way
+    // in is that turn's Stop hook. An idle composer fires no Stop, so a turn parked there
+    // could never run; that stays the 423 it always was, as does every Agent CLI chat.
+    if (provider === 'cursor' && gate.reason !== 'native_thread_working') {
+      return res.status(423).json({ error: 'unsupported_provider', queueable: false })
+    }
     if (gate.attachable) return res.status(409).json({ error: 'thread_free', hint: 'send_now' })
     if (!queueableRefusal(gate.reason)) {
       return res.status(423).json({ error: gate.reason ?? 'probe_failed', queueable: false })