@gotcos/glasses-server 6.52.3 → 6.53.1

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## 6.53.1
+
+### Cancel the whole Codex process tree
+
+The 6.53.0 live Codex canary found that `codex exec resume` can launch a tool in its own process group. Cancelling the wrapper group stopped the COS turn, but an in-flight tool could be re-parented to launchd and continue running. This hotfix snapshots verified descendant identities before signalling the wrapper, reaches separate descendant groups, retains PID/start-time identities across re-parenting, and escalates those retained processes to SIGKILL after the five-second cancel grace. A wrapper `close` no longer clears the escalation while any verified tree member remains. Probe failure fails closed, and PID reuse is never signalled.
+
+A spawned cancellation is now reported as ordinary `turn_cancelled` only after the adapter confirms the entire tree was reaped. An unverified or surviving tree takes the existing ambiguous-delivery fence path. A pre-spawn cancellation remains provably process-free; a spawned pre-write cancellation still requires reaping proof even though no prompt byte was sent.
+
+- Tests: a real detached Node wrapper launches a SIGTERM-resistant tool in a second process group; the wrapper dies, the retained tool survives TERM, SIGKILL reaches it after re-parenting, and the tree is confirmed gone. Fault-injected process-table and start-time probes stay uncertain instead of inventing death. Adapter coverage proves wrapper close cannot settle early; route coverage proves both post-write and pre-write unreaped cancellations fence. The mutation gate removes each of those protections independently.
+
+## 6.53.0
+
+### Cancel a session run from the glasses
+
+Miles, 2026-09-21: "If there's a current run that's going, it essentially clicks the cancel button ... similar to when they're at the desktop." This is the server half; COS Glasses 6.9.529 adds the Cancel run row. Who owns the run decides what a cancel can do, and the server says which in every attachability answer.
+
+- **A COS turn stops at once.** A Continue COS itself spawned (`claude -p --resume`, `codex exec resume`, `cursor-agent`) is registered when its target claim is taken, with its own abort controller, and forgotten in the same `finally` that releases the claim. A cancel aborts it: the adapter sends the child's process group SIGTERM, then SIGKILL after 5 s (a timeout keeps its 2 s; canary C3 saw `claude -p` end cleanly on SIGTERM in about 4 s), and checks the cancel before the spawn and before the prompt is written. The turn ends `turn_cancelled`: ledgered as refused and not retryable, so every app settles it, and NEVER fenced. Until now an aborted child exited on a signal, which read as "may or may not have been delivered" and locked the thread (plan validation B2). A clean exit 0 with our thread id that lands first still counts as delivered. The route re-reads the thread head after a cancel, so the next Continue is not refused as "changed on your Mac".
+- **A Claude run at the desk stops at its next tool call.** A Desktop tab, a terminal, or a Continue delivered into the open window. The server writes a halt marker, `data/session-halt/<session id>`, and the session hook, now synchronous on PreToolUse, answers deny plus `continue: false` before the next tool. Canaries on Claude Code 2.1.278: `continue: false` alone still ran the tool, with the deny it did not (C1b); an interactive session honours it (C5), and so does one opened before the hook was added (C10); the check costs about 11 ms per tool call (C2); a hook that times out or exits 1 lets the tool run (C6, C7), and the script never exits 2. A reply that is pure text finishes first, which is why the lens says "Stops at its next step." A permission prompt the broker is holding for that session is denied at once with `interrupt: true`.
+- **The marker lives only within the run it was written for.** The hook itself removes it on the session's next UserPromptSubmit (a prompt at the desk, a live Continue, a COS turn), so a new prompt is never stopped. The server removes it on that session's SessionEnd and after an hour. Not on Stop: a background subagent reports its parent's session id (C8) and is work a cancel must stop too.
+- **Codex app and Cursor runs cannot be stopped from outside**, and the answer says so: "Runs in Codex on your Mac. Stop it there." (or Cursor).
+- **`POST /api/agent-sessions/:provider/:threadId/cancel`**, body `{"clientCancelId": "..."}`, registered whether or not thread attach is on. `202 {"cancelled": true, "target": "cos_turn", "state": "stopping", "turnId", "queuedHeld", "queuedHoldMs"}` or `202 {"cancelled": true, "target": "desk_run", "effective": "next_tool_call", "queuedHeld", "queuedHoldMs", "settledPermissions"}` (`queuedHoldMs` is the hold below, 120000, so a client does not invent its duration); otherwise `409 {"cancelled": false, "reason", "reasonCopy"}` with `not_running` ("Nothing running now."), `cancel_unsupported`, `hooks_outdated` ("Install hooks in COS Control, then retry.") or `hooks_disabled`. A malformed provider, thread id or `clientCancelId` is `400 invalid_request`; a desk marker that could not be written is `500 cancel_failed` ("Could not cancel. Check the Mac."), never an acceptance. The same `clientCancelId` gets the same answer again while this server process remains up. Every cancel is a line in `data/session-cancel.jsonl`.
+- **Attachability says what a cancel would do.** `GET .../attachability` gains `cancel`: `cos_turn`, `desk_run`, `unsupported`, `hooks_outdated`, `hooks_disabled`, or null when nothing is running. The route and this field are decided by one function (`cancelTargetFor`), so the row the lens shows and the answer to the tap agree. A 6.52 server sends no field, and the app then shows no row.
+- **Parked turns wait two minutes after a cancel while this server process remains up**, then send as normal; the 202 says how many are held. The short hold is deliberately in memory, so a server restart returns persisted queued turns to the ordinary delivery gate. A cancel newer than the session's last transcript row or hook event ends the turn for the queue, so a killed child's unanswered tool call no longer holds parked turns for the 30-minute open-turn ceiling. A queued turn cancelled while it was being admitted is settled cancelled, never sent again.
+- **Health.** `features.sessionCancel`: `{"cosTurn": true, "deskClaude": <hooks on and the 6.53 hook installed>}`.
+- **Rollout: Install hooks in COS Control after updating the server.** The hook script and the PreToolUse subscription both changed (one synchronous block, no matcher; the script still spools only AskUserQuestion and ExitPlanMode). Update Server alone never re-copies the script, so until Install hooks runs the hooks read `drift` or `script_outdated`, a desk cancel answers `hooks_outdated`, and `deskClaude` is false. A COS turn can be cancelled right away.
+- Tests: the hook script executed against fixtures (the deny exactly, nothing printed or spooled for an ordinary tool, the two spooled tools, UserPromptSubmit clearing and still spooling, malformed input, the first session_id winning over one inside `tool_input`, a full spool, exit status never 2, no temp file left); the installer's single PreToolUse block and a 6.52 install reading drift; the adapter's abort before spawn, before the write, mid-run with the 5 s grace, a clean exit racing the cancel, a cancel during a timeout; the route end to end with the real adapter (SIGTERM, `turn_cancelled`, no fence), the head acknowledgement, idempotency, every refusal, the attachability field; the broker's deny with interrupt; the queue hold and its order after expiry; marker cleanup on SessionEnd but not Stop or a child; health. The script's sha pin moves on purpose. The halt cases live in their own file so a mutation of the script is judged by behaviour, not by the pin. Gate: the `halt-*`, `adapter-*cancel*`, `cancel-*`, `desk-running-*`, `broker-cancel-*`, `queue-cancel-*` and `health-desk-claude-needs-install` cases, 48 of 48 killed. Not gated: the script's lower-casing of the session id, whose mutant survives on this Mac's case-insensitive volume (it matters only on a case-sensitive one).
+
+### Grok 4.7
+
+- **Grok 4.7: the Cursor Grok slot now picks the newest Grok, including the new grok-4.7 ids (no cursor- prefix), so Messages on Grok run Grok 4.7 when the CLI advertises it.** Miles, 2026-09-21: "make sure we're running the latest and greatest on the grok front". `cursor-agent models` on CLI 2026.09.18 lists `grok-4.7-high-fast` beside the old `cursor-grok-4.6-high-fast`. The slot matches both schemes, compares versions numerically, and on an exact tie prefers the unprefixed id; low, medium, xhigh and non-fast are still never chosen. The live model list remains authoritative; `grok-4.7-high-fast` is the canonical id, not an unverified fallback.
+- **Display names from the CLI are cleaned**: format characters (the trailing zero-width spaces) are removed and runs of whitespace collapse, so the slot reads "Grok 4.7 High Fast", including from a model cache written before this release.
+- Tests: the 2026-09-18 list picks `grok-4.7-high-fast` with a clean name; low, medium, xhigh and non-fast ignored in the new scheme; an old-scheme-only list still picks its newest; numeric comparison and the tie in both list orders; the new ids resolve to the Grok slot. Gate: `grok-*`, 4 of 4 killed.
+
 ## 6.52.3
 
 ### A quiet ring stays with its owner; a zombie never takes it on waking

package/bin/cli.cjs

@@ -301,7 +301,9 @@ function cursorCliState() {
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: 7000,
     })
-    const grokHighFast = /cursor-grok-\d+(?:\.\d+)*-high-fast/.test(models)
+    // Cursor 2026.09 introduced `grok-4.7-high-fast` without the old
+    // `cursor-` prefix. Accept both exact high-fast families, like runtime does.
+    const grokHighFast = /(?:^|\n)(?:cursor-)?grok-\d+(?:\.\d+)*-high-fast\s+-/m.test(models)
     return {
       binary,
       version,
@@ -358,7 +360,7 @@ if (cursor.binary) {
     console.log('    Run: ' + bold('agent login'))
   } else if (cursor.auth === 'models-unresolved') {
     console.log(yellow('  ⚠') + ` Cursor Agent ${cursor.version} installed — required models unresolved`)
-    console.log('    Verify: ' + bold('agent models') + ' includes Composer 2.5 Fast and a cursor-grok-*-high-fast id')
+    console.log('    Verify: ' + bold('agent models') + ' includes Composer 2.5 Fast and a grok-*-high-fast id')
   } else {
     console.log(yellow('  ⚠') + ` Cursor Agent ${cursor.version} installed — readiness unavailable`)
     console.log('    Verify: ' + bold('agent models'))

package/bin/hooks/cos-session-hook

@@ -1,17 +1,66 @@
 #!/bin/sh
-# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0). Installed into ~/.claude/settings.json by
+# COS session hook (glasses-server 6.48.0; Cursor Stop follow-up 6.51.0; halt check 6.53.0). Installed into ~/.claude/settings.json by
 # `--hooks install`; Claude Code runs it with the hook event name as $1 and the event
 # payload on stdin. It spools one JSON file per event into the hook spool and exits 0
 # on every path. Only PermissionRequest ever talks to the server, and only when the
 # desk has been idle. Everything else is a file write, so the server being down or
 # restarting never delays a Claude session.
 #
+# 6.53.0: PreToolUse is SYNCHRONOUS with no matcher, so the first branch below runs before
+# EVERY tool call in every Claude session on this Mac. It is file-only (no curl, no spool
+# write) and prints nothing unless the server left a halt marker for this session, when it
+# prints the one reply that stops the run (canary C1b, 2026-09-21: `continue:false` alone
+# still ran the tool; with the deny it did not). It never exits 2: exit 2 blocks the tool,
+# while a timeout or any other code fails open (C6, C7).
+#
 # The installer bakes COS_GLASSES_HOME and COS_HOOK_SPOOL into the command, so this
 # script and the server can never disagree about where the token or the spool is.
 PATH=/usr/bin:/bin:/usr/sbin; umask 077; trap '' PIPE
 HOME=${HOME:-$(cd ~ 2>/dev/null && pwd)}; [ -n "$HOME" ] || exit 0
 GH=${COS_GLASSES_HOME:-$HOME/.cos-glasses}
 SPOOL=${COS_HOOK_SPOOL:-$GH/data/hook-spool}; EVENT="$1"
+# 6.53.0, the halt check. FIRST, before mkdir, perl and the B8 guard below: a full spool or
+# a stale drain stamp must never stop a cancel, and an ordinary tool call must cost nothing
+# but this. The marker folder sits beside the spool, like the Cursor queue folder; the server
+# writes `<folder>/<session id>` (lib/session-halt.ts). stdin is read ONCE, to a temp file,
+# and handed to the spool path below when the event still needs spooling.
+IN=''
+case "$EVENT" in PreToolUse|UserPromptSubmit)
+  IN=$(mktemp "${TMPDIR:-/tmp}/cos-hook.XXXXXX" 2>/dev/null || mktemp /tmp/cos-hook.XXXXXX 2>/dev/null) || IN=''
+  # No temp file: a tool call goes ahead unchecked (fail open), and a prompt is spooled
+  # below exactly as before, its stdin untouched.
+  [ -n "$IN" ] || [ "$EVENT" = UserPromptSubmit ] || exit 0
+  ;;
+esac
+[ -z "$IN" ] || {
+  HALT="$(dirname "$SPOOL")/session-halt"
+  trap 'rm -f "$IN"; exit 0' HUP INT TERM
+  head -c 1048576 > "$IN" 2>/dev/null
+  # Any marker at all? A glob is a builtin, so the common case (no cancel anywhere on the
+  # Mac) reads no session id and forks nothing for it.
+  SID=''; for F in "$HALT"/*; do [ -e "$F" ] && SID=x; break; done
+  # The FIRST session_id is the payload's own: Claude writes it first, and a tool's input
+  # that happens to carry one comes later.
+  [ -z "$SID" ] || SID=$(grep -Eo '"session_id"[[:space:]]*:[[:space:]]*"[0-9A-Fa-f-]{36}"' "$IN" 2>/dev/null | head -1 | grep -Eo '[0-9A-Fa-f-]{36}' | tr 'A-F' 'a-f')
+  if [ "$EVENT" = UserPromptSubmit ]; then
+    # A new prompt is never stopped: the marker lives only within the run it was written
+    # for. This covers a prompt typed at the desk, a Continue delivered into the open
+    # session, and a COS `-p` turn. Then the prompt is spooled exactly as before.
+    [ -z "$SID" ] || rm -f "$HALT/$SID" 2>/dev/null
+  elif [ -n "$SID" ] && [ -f "$HALT/$SID" ]; then
+    rm -f "$IN"
+    printf '%s' '{"continue":false,"stopReason":"Cancelled from COS","hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Cancelled from COS"}}'
+    exit 0
+  else
+    # Only the two tools the reducer reads were ever spooled (the 6.48 matcher); every
+    # other tool call ends here with nothing written and nothing printed.
+    TOOL=$(grep -Eo '"tool_name"[[:space:]]*:[[:space:]]*"[A-Za-z]+"' "$IN" 2>/dev/null | head -1)
+    case "$TOOL" in *'"AskUserQuestion"'|*'"ExitPlanMode"') ;; *) rm -f "$IN"; exit 0 ;; esac
+  fi
+  # The spool path below reads stdin: hand it the saved bytes. The open descriptor keeps
+  # them readable after the unlink, so no temp file outlives this line.
+  exec < "$IN"; rm -f "$IN"; trap - HUP INT TERM
+}
 mkdir -p "$SPOOL/rejected" 2>/dev/null || exit 0
 TS=$(perl -MTime::HiRes -e 'printf "%.0f", Time::HiRes::time()*1000' 2>/dev/null || date +%s000)
 # B8 guard: a full spool or a stale drain stamp means nobody is reading; keep only permissions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.52.3",
+  "version": "6.53.1",
   "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -24,7 +24,9 @@ import { agentSessionStreamRouter } from './routes/agent-session-stream.js'
 import { createAttachedTurnStream } from './lib/session-stream-producer.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
 import { createSessionHooksRouter } from './routes/session-hooks.js'
-import { deskIdleSeconds, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
+import { cachedHookStatus, claudeDeskRunning, deskIdleSeconds, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
+import { writeHaltMarker } from './lib/session-halt.js'
+import { appendSessionCancelLedger, cancelEndsTurn, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, threadCancelledAt } from './lib/session-cancel.js'
 import {
   PermissionBroker,
   brokerSignalSink,
@@ -495,6 +497,8 @@ const deliverAttachedTurnForRoute = async (request: {
   nativeThreadId: string
   prompt: string
   onSpawn: (pid: number) => boolean
+  /** 6.53.0: the cancel from the lens, passed straight through to the adapter. */
+  abortSignal?: AbortSignal
 }): Promise<unknown> => {
   // Resolved here, not stored on the binding: the cwd is read from the transcript,
   // which records it verbatim. Decoding the project slug is lossy — this Mac's own
@@ -537,6 +541,7 @@ const deliverAttachedTurnForRoute = async (request: {
       // The only policy this build accepts. The adapter refuses anything else and
       // asserts no bypass/always-approve flag reaches the argv (plan 4.7).
       policy: 'read_only',
+      abortSignal: request.abortSignal,
       deps: {
         ...base,
         // `startMs` is deliberately unused: the adapter already probed it as a GATE
@@ -709,6 +714,14 @@ if (threadAttachEnabled()) {
     turnEnded: (provider: string, threadId: string) => {
       if (provider !== 'claude' && provider !== 'codex') return false
       try {
+        // 6.53.0: a cancel with nothing written since it ENDED the turn. A killed COS child
+        // leaves its last tool_use unanswered, and no Stop or terminal record ever follows.
+        const cancelledAt = threadCancelledAt(provider, threadId)
+        if (cancelledAt !== null) {
+          const readMtime = occupancyProbes.transcriptMtimeMs
+          const lastRow = typeof readMtime === 'function' ? readMtime(provider, threadId) : null
+          if (cancelEndsTurn(cancelledAt, typeof lastRow === 'number' ? lastRow : null)) return true
+        }
         // 6.48.1: the engine's own end of turn: a Stop hook newer than the turn's prompt
         // AND the registry flipped idle after it (the Stop hooks have returned; a prompt
         // typed during them is queued and dequeues only then). The transcript tail
@@ -732,9 +745,14 @@ if (threadAttachEnabled()) {
       if (provider !== 'claude' && provider !== 'codex') return false
       try {
         const now = Date.now()
+        // 6.53.0: evidence older than a cancel on this thread is the cancelled run's, not a
+        // live turn (plan R1: a killed child's dangling tool_use read `tool_pending` for the
+        // whole 30-minute ceiling and held every parked turn behind it).
+        const cancelledAt = threadCancelledAt(provider, threadId)
         if (provider === 'claude') {
           const signal = signalFor(threadId)
-          if (signal && signal.turnOpen && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS) return true
+          if (signal && signal.turnOpen && now - signal.lastEventAt <= OPEN_TURN_CEILING_MS
+            && !cancelEndsTurn(cancelledAt, signal.lastEventAt)) return true
         }
         const path = transcriptPathFor(provider, threadId, nativeHeadDeps)
         const verdict = transcriptTurnVerdict(provider, path)
@@ -742,6 +760,7 @@ if (threadAttachEnabled()) {
         if (verdict.reason !== 'tool_pending' && verdict.reason !== 'prompt_open') return false
         const read = occupancyProbes.transcriptMtimeMs
         const mtime = typeof read === 'function' ? read(provider, threadId) : null
+        if (cancelEndsTurn(cancelledAt, typeof mtime === 'number' ? mtime : null)) return false
         return typeof mtime === 'number' && now - mtime <= OPEN_TURN_CEILING_MS
       } catch {
         return false
@@ -758,6 +777,8 @@ if (threadAttachEnabled()) {
       }
     },
     deliver: (turn: QueuedThreadTurn) => deliverQueuedTurnOverLoopback(turn, PORT, API_TOKEN),
+    // 6.53.0: parked turns hold for two minutes after a cancel on their thread.
+    cancelHoldUntil: (provider: string, threadId: string) => cancelHoldUntilFor(provider, threadId),
     now: () => Date.now(),
   }
   app.use('/api', createThreadTurnQueueRouter(queueDeps))
@@ -852,6 +873,19 @@ app.use('/api', createAgentSessionBindingsRouter({
   // empty list — "nothing is bound" and "the store could not be read" must not
   // look the same.
   bindings: agentSessionBindingRegistry,
+  // 6.53.0: cancel a session run from the lens. The route's own in-flight map answers for
+  // a COS turn; these answer for a run at the desk. Read per request, so Install hooks in
+  // Control flips `hooks_outdated` to `desk_run` within the status cache's five seconds.
+  cancel: {
+    deskRunning: sessionId => claudeDeskRunning(sessionId),
+    hooksEnabled: () => sessionHooksEnabled(),
+    hooksReady: () => cachedHookStatus().installed,
+    writeHalt: (sessionId, marker) => writeHaltMarker(sessionId, marker),
+    settlePermissions: sessionId => permissionBroker.cancelSession(sessionId),
+    queuedWaiting: (provider, threadId) => readQueue(provider, threadId, Date.now()).filter(t => t.status === 'waiting').length,
+    noteCancelled: (provider, threadId, at) => noteThreadCancelled(provider, threadId, at),
+    ledger: row => appendSessionCancelLedger(row),
+  },
 }))
 app.use('/api', displayRouter)
 app.use('/api', transcribeStreamRouter)