@gotcos/glasses-server 6.51.0 → 6.52.3

package/server/lib/client-instance-claim.ts

@@ -16,6 +16,20 @@
 export const CLIENT_INSTANCE_TICK_MS = 15_000
 /** Three missed ticks: the owner is gone. */
 export const CLIENT_INSTANCE_LIVE_MS = 3 * CLIENT_INSTANCE_TICK_MS
+/**
+ * 6.52.3: how long the owner must be quiet before an OLDER boot may take the ring back.
+ * On 2026-09-20 a hidden copy from the night before took the ring after the live copy
+ * went quiet (a locked phone throttles its timers) and answered a hold-to-talk 27 minutes
+ * later with a stale session. 45 s is a normal quiet spell for a locked phone; a dead
+ * copy stays dead, so waiting ten minutes costs nothing.
+ */
+export const CLIENT_INSTANCE_RECLAIM_MS = 10 * 60_000
+/**
+ * 6.52.3: an older boot may take the ring back only when ITS OWN previous claim is this
+ * recent. Both copies sleep when the phone does; a zombie that woke up alongside the live
+ * copy has a gap of its own, and the live copy's refresh lands within a tick.
+ */
+export const CLIENT_INSTANCE_AWAKE_MS = CLIENT_INSTANCE_LIVE_MS
 /**
  * 6.50.4: a meeting chunk inside this window means that copy is recording. Five chunk
  * intervals (~6 s each), so a stretch of silence or a slow upload does not end the hold.
@@ -126,6 +140,8 @@ export function arbitrateClientInstance(
   claim: ClientInstanceClaim,
   now: number,
   evidence: CaptureEvidence = NO_CAPTURE,
+  /** When this claimant last claimed (any verdict), or undefined: never seen. */
+  claimantLastSeenAt?: number,
 ): { owner: ClientInstanceOwner; verdict: ClientInstanceVerdict; took: boolean } {
   const fresh: ClientInstanceOwner = { ...claim, seenAt: now }
   if (!owner) return { owner: fresh, verdict: 'owner', took: true }
@@ -142,6 +158,11 @@ export function arbitrateClientInstance(
   // The ring moves on the newer copy's first claim after the meeting stops.
   if (ownerIsRecording(owner, evidence, now)) return { owner, verdict: 'yield', took: false }
   if (isNewer(claim, owner)) return { owner: fresh, verdict: 'owner', took: true }
-  if (now - owner.seenAt > CLIENT_INSTANCE_LIVE_MS) return { owner: fresh, verdict: 'owner', took: true }
+  // 6.52.3: an older boot takes a quiet ring back only after CLIENT_INSTANCE_RECLAIM_MS,
+  // and only while it has itself been claiming (awake), never on the first tick after a
+  // gap of its own. A dead newer copy is replaced when the user reopens COS (a newer boot
+  // still takes at once); this rule is for the copy that is merely quiet.
+  const claimantAwake = claimantLastSeenAt !== undefined && now - claimantLastSeenAt <= CLIENT_INSTANCE_AWAKE_MS
+  if (now - owner.seenAt > CLIENT_INSTANCE_RECLAIM_MS && claimantAwake) return { owner: fresh, verdict: 'owner', took: true }
   return { owner, verdict: 'yield', took: false }
 }

package/server/lib/client-liveness.ts

@@ -0,0 +1,50 @@
+// When a client that can ANSWER a session question last asked for them (6.52.0).
+//
+// THE SIGNAL, AND WHY THIS ONE. The permission broker holds a session question or a tool
+// approval only while a lens or phone client could show it and send the answer back. The
+// only proof of that is a client asking for the questions: an authenticated
+// `GET /api/session-questions?client=glasses|phone` (X-Cos-Token, never the hook token)
+// within the last 30 s, checked at admission and again while anything is held.
+//
+// Rejected, and why:
+//   - the client-instance claim (`POST /api/client-instance/claim`): every COS Glasses copy
+//     since 6.9.505 posts it every 15 s, including the ones with no question UI. Counting
+//     it made a 6.9.511 app on the phone read as "someone can answer", so the Mac held
+//     questions and approvals nobody could see for up to 110 s (coordinator review,
+//     2026-09-19). A claim says a copy is alive, not that it can answer.
+//   - the display stream: an open socket is not alive (a half-open connection, a
+//     `probe=1` connect, COS Control and curl all read the same).
+//   - client diagnostics and meeting chunks: lossy, or only while recording.
+//
+// So an app that has never heard of this feature never calls the route, and the broker
+// answers `{}` (the Mac's own dialog) for it, exactly as before. The poll also bounds
+// delivery: a copy whose timers are frozen (a locked phone) cannot poll, and could not
+// show the question either.
+//
+// In memory: a restart forgets it, and the next poll restores it. Until then nothing is
+// held, which is the native dialog, the safe side.
+
+let lastPollAt: number | null = null
+
+/** A stored stamp this far ahead of a new poll means the clock stepped back. */
+const CLOCK_STEP_BACK_MS = 5_000
+
+/**
+ * A counting questions poll answered at `at` (server clock). Never moves backwards for a
+ * slower request answered later, but a clock that stepped back is followed: a stamp left in
+ * the future would read stale to the broker, and ignoring every poll until the clock caught
+ * up would leave no live client for that long.
+ */
+export function noteQuestionsPoll(at: number): void {
+  if (!Number.isFinite(at)) return
+  if (lastPollAt === null || at > lastPollAt || lastPollAt - at > CLOCK_STEP_BACK_MS) lastPollAt = at
+}
+
+/** When the newest authenticated questions poll arrived, or null when none has since boot. */
+export function lastQuestionsPollAt(): number | null {
+  return lastPollAt
+}
+
+export function __resetClientLivenessForTests(): void {
+  lastPollAt = null
+}

package/server/lib/codex-bridge.ts

@@ -84,6 +84,7 @@ import {
 } from '../../shared/media-attachment.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
 import { terminateProviderProcess } from './provider-process-lifecycle.js'
+import { teeJobTrail } from './job-trail.js'
 
 const INACTIVITY_MS = 180_000
 const WALL_MAX_MS = 900_000
@@ -833,6 +834,11 @@ export async function callCodexStreaming(
     }
   })
 
+  // 6.52.0: the Messages trail, a SECOND stdout reader registered after the one above, so
+  // that handler sees every chunk first and nothing it decides can change. Without an
+  // `onTrail` (legacy /api/query, openai-compat, COS_MESSAGES_TRAIL=0) this attaches nothing.
+  teeJobTrail(proc.stdout, 'codex', callbacks.onTrail)
+
   proc.stderr.on('data', (chunk: Buffer) => {
     resetInactivity()
     stderr += chunk.toString()

package/server/lib/cursor-bridge.ts

@@ -63,6 +63,7 @@ import {
   type MediaAttachmentRef,
 } from '../../shared/media-attachment.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
+import { teeJobTrail } from './job-trail.js'
 
 const INACTIVITY_MS = 180_000
 const WALL_MAX_MS = 900_000
@@ -666,6 +667,11 @@ export async function callCursorStreaming(
     }
   })
 
+  // 6.52.0: the Messages trail, a SECOND stdout reader registered after the one above, so
+  // that handler sees every chunk first and nothing it decides can change. Without an
+  // `onTrail` (legacy /api/query, openai-compat, COS_MESSAGES_TRAIL=0) this attaches nothing.
+  teeJobTrail(proc.stdout, 'cursor', callbacks.onTrail)
+
   proc.stderr.on('data', (chunk: Buffer) => {
     resetInactivity()
     stderr += chunk.toString()