@gotcos/glasses-server 6.61.5 → 6.61.6

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 6.61.6 — 2026-10-03
+
+- Keep Codex-owned waiting messages visible in Sessions queue counts and queue reads after the COS handoff. Unavailable native reads report unknown, not empty.
+- Edit existing COS and Codex queue slots in place. Return full text for authenticated queue reads; never cancel and resend as an edit. Native messages with attachments or structured spans remain manageable in Codex.
+- Preserve concurrent enqueue, cancel and edit changes while the drainer awaits delivery. Native management uses local Codex queue protocol calls with automation and memory jobs disabled; no model turn is started.
+
+
 ## 6.61.5
 
 Local dictation-choice candidate, based on the 6.61.4 hardening candidate.
@@ -7,6 +14,7 @@ Local dictation-choice candidate, based on the 6.61.4 hardening candidate.
 - Run cleanup in a temporary workspace with no MCP. Claude tools/hooks are disabled; Cursor ask mode retains its read tools and uses an isolated subscription profile. Abort/timeout terminates the process tree; failures preserve the glossary-corrected transcript. Model circuit breakers are independent.
 - Local verification: model routing, legacy/default behavior, failure recovery, isolated configuration, cancellation, and real signed-in CLI smoke calls. Hardware acceptance and stable promotion remain outstanding.
 
+
 ## 6.61.4
 
 Local hardening candidate; stable promotion remains gated on native UI and G2 acceptance.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.61.5",
+  "version": "6.61.6",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/lib/codex-queue-control.ts

@@ -0,0 +1,100 @@
+// Queue management only. Never loads/starts a thread or starts a model turn.
+// Protocol verified from the installed Codex generate-ts schema (2026-10-03).
+import { spawn, execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { resolveProviderBinary } from './provider-binary.js'
+
+export interface NativeQueuedSubmission { id: string; input: Array<{ type: string; text?: string; text_elements?: unknown[] }>; clientUserMessageId: string }
+export interface NativeQueueControl {
+  list(threadId: string): Promise<NativeQueuedSubmission[]>
+  update(threadId: string, id: string, prompt: string): Promise<void>
+  cancel(threadId: string, id: string): Promise<boolean>
+}
+const METHODS = new Set(['thread/queue/list', 'thread/queue/update', 'thread/queue/delete'])
+export function codexQueueRpc(method: string, params: Record<string, unknown>, binary?: string): Promise<any> {
+  if (!METHODS.has(method)) return Promise.reject(new Error('queue_method_not_allowed'))
+  const resolved = binary ? { ok: true as const, path: binary } : resolveProviderBinary('codex')
+  if (!resolved.ok) return Promise.reject(new Error('codex_queue_unavailable'))
+  return new Promise((resolve, reject) => {
+    // A separate, short-lived protocol client: automations and memories explicitly
+    // disabled. No thread/start, turn/start or queue/start call is allowed here.
+    const child = spawn(resolved.path, ['app-server', '--disable', 'in_app_local_automation', '--disable', 'memories'], { stdio: ['pipe', 'pipe', 'ignore'], shell: false })
+    let buffer = '', done = false, initialized = false
+    const finish = (error: Error | null, value?: unknown) => {
+      if (done) return
+      done = true; clearTimeout(timer); child.kill(); error ? reject(error) : resolve(value)
+    }
+    const timer = setTimeout(() => finish(new Error('codex_queue_timeout')), 8000)
+    const send = (payload: unknown) => child.stdin.write(JSON.stringify(payload) + '\n')
+    child.on('error', () => finish(new Error('codex_queue_unavailable')))
+    child.stdin.on('error', () => finish(new Error('codex_queue_unavailable')))
+    child.on('exit', () => finish(new Error('codex_queue_closed')))
+    child.stdout.on('data', data => {
+      buffer += data.toString()
+      if (buffer.length > 4 * 1024 * 1024) { finish(new Error('codex_queue_response_too_large')); return }
+      let end: number
+      while ((end = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, end); buffer = buffer.slice(end + 1)
+        let row: any
+        try { row = JSON.parse(line) } catch { continue }
+        if (row.id !== 1 && row.id !== 2) continue
+        if (row.error) { finish(new Error('codex_queue_request_refused')); return }
+        if (row.id === 1 && !initialized) {
+          initialized = true
+          send({ method: 'initialized' })
+          send({ id: 2, method, params })
+        } else if (row.id === 2) { finish(null, row.result); return }
+      }
+    })
+    send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'cos-queue-control', version: '1' }, capabilities: { experimentalApi: true, explicitGatewayOauth: true } } })
+  })
+}
+
+export function plainQueueText(row: NativeQueuedSubmission): string | null {
+  // Never turn a message containing files, mentions or structured text into plain text.
+  return Array.isArray(row.input) && row.input.length === 1 && row.input[0]?.type === 'text'
+    && typeof row.input[0].text === 'string' && !row.input[0].text_elements?.length ? row.input[0].text : null
+}
+export const nativeQueueControl: NativeQueueControl = {
+  async list(threadId) {
+    const rows: NativeQueuedSubmission[] = []
+    let cursor: string | null = null
+    const seen = new Set<string>()
+    do {
+      const result = await codexQueueRpc('thread/queue/list', { threadId, cursor, limit: 100 })
+      if (!Array.isArray(result?.data) || result.data.some((r: any) => typeof r?.id !== 'string' || !Array.isArray(r.input))) throw new Error('codex_queue_bad_response')
+      rows.push(...result.data)
+      cursor = result.nextCursor ?? null
+      if (cursor && (seen.has(cursor) || rows.length >= 1000)) throw new Error('codex_queue_incomplete')
+      if (cursor) seen.add(cursor)
+    } while (cursor)
+    return rows
+  },
+  async update(threadId, id, prompt) {
+    const current = (await this.list(threadId)).find(r => r.id === id)
+    if (!current || plainQueueText(current) === null) throw new Error('queue_not_editable')
+    const result = await codexQueueRpc('thread/queue/update', { threadId, queuedSubmissionId: id, input: [{ type: 'text', text: prompt, text_elements: [] }] })
+    if (result?.queuedSubmission?.id !== id) throw new Error('codex_queue_bad_response')
+  },
+  async cancel(threadId, id) {
+    const result = await codexQueueRpc('thread/queue/delete', { threadId, queuedSubmissionId: id })
+    if (typeof result?.deleted !== 'boolean') throw new Error('codex_queue_bad_response')
+    return result.deleted
+  },
+}
+
+// One read-only aggregate per session-list request, not 80 protocol processes.
+// No queue file is ever edited via SQL; mutations use Codex's own protocol above.
+export async function nativeQueuedCounts(): Promise<Map<string, number> | null> {
+  const db = join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'queue_1.sqlite')
+  if (!existsSync(db)) return new Map()
+  try {
+    const { stdout } = await promisify(execFile)('/usr/bin/sqlite3', ['-readonly', '-json', db, 'SELECT thread_id, count(*) AS n FROM queued_items GROUP BY thread_id'], { timeout: 2000, maxBuffer: 1024 * 1024 })
+    const rows = JSON.parse(stdout || '[]')
+    if (!Array.isArray(rows) || rows.some(r => typeof r.thread_id !== 'string' || !Number.isInteger(r.n))) return null
+    return new Map(rows.map(r => [r.thread_id, r.n]))
+  } catch { return null }
+}

package/server/lib/thread-turn-queue-store.ts

@@ -1,3 +1,4 @@
+import { nativeQueuedCounts } from './codex-queue-control.js'
 // Durable storage for queued thread turns, and the terminal-record probe.
 //
 // SEPARATE FROM THE DECISIONS. `thread-turn-queue.ts` is pure and holds every rule;
@@ -104,8 +105,8 @@ export function queuedWaitingLookup(now: number): (provider: string, sessionId:
   return (provider, sessionId) => queuedWaitingForSession(queues, provider, sessionId)
 }
 
-export function queuedTurnsFields(count: number): { queued_turns?: number } {
-  return count > 0 ? { queued_turns: count } : {}
+export function queuedTurnsFields(count: number | null): { queued_turns?: number; queue_unknown?: boolean } {
+  return count === null ? { queue_unknown: true } : count > 0 ? { queued_turns: count } : {}
 }
 
 /** Every thread with a queue file, for the drain sweep. */
@@ -182,3 +183,11 @@ export function readTranscriptTailLines(path: string | null, maxBytes: number):
     return null
   }
 }
+
+/** Native queued submissions remain waiting after COS has handed them over. */
+export async function allQueuedWaitingLookup(now: number): Promise<(provider: string, id: string) => number | null> {
+  const cos = queuedWaitingLookup(now)
+  const native = await nativeQueuedCounts()
+  return (provider, id) => provider !== 'codex' ? cos(provider, id)
+    : native === null ? null : cos(provider, id) + (native.get(id) ?? 0)
+}

package/server/routes/agent-sessions.ts

@@ -43,7 +43,7 @@ import { claudeSessionNamesVisible, claudeSessionsDir, claudeSessionsEnabled, re
 import type { ClaudePeerRecord } from '../lib/claude-session-registry.js'
 import { deriveForRow, signalFor } from '../lib/session-hooks-runtime.js'
 import { derivedRowFields, type DerivedSessionState } from '../lib/session-state-derive.js'
-import { queuedTurnsFields, queuedWaitingLookup } from '../lib/thread-turn-queue-store.js'
+import { queuedTurnsFields, allQueuedWaitingLookup } from '../lib/thread-turn-queue-store.js'
 import { isAttachedTurnActive, sessionStreamKey } from '../lib/session-stream-bus.js'
 import { workspaceFromCwd } from '../lib/claude-session-registry.js'
 import {
@@ -83,7 +83,7 @@ function asSort(value: unknown): AgentSessionSort {
   return String(value ?? '').toLowerCase() === 'opened' ? 'opened' : 'updated'
 }
 
-function toSearchHit(row: AgentSessionSearchHit, queuedTurns = 0, derived?: DerivedSessionState) {
+function toSearchHit(row: AgentSessionSearchHit, queuedTurns: number | null = 0, derived?: DerivedSessionState) {
   return {
     ...toEntry(row, undefined, derived, queuedTurns),
     snippet: row.snippet,
@@ -269,7 +269,7 @@ function runningForThread(provider: AgentProvider, threadId: string, mtimeMs: nu
   }
 }
 
-function toEntry(row: AgentSessionRow, activity?: SessionActivity | null, derived?: DerivedSessionState, queuedTurns = 0) {
+function toEntry(row: AgentSessionRow, activity?: SessionActivity | null, derived?: DerivedSessionState, queuedTurns: number | null = 0) {
   return {
     session_id: row.session_id,
     provider: row.provider,
@@ -397,7 +397,7 @@ agentSessionsRouter.get('/agent-sessions', async (req, res) => {
       if (row.provider !== 'cursor' || !signalFor(row.session_id)) continue
       derivedById.set(row.session_id, deriveForRow({ sessionId: row.session_id, now, remember: false }))
     }
-    const queuedOf = queuedWaitingLookup(now)
+    const queuedOf = await allQueuedWaitingLookup(now)
     res.json({
       sessions: sessions.map((row, index) => withRunning(toEntry(row, activity[index], derivedById.get(row.session_id), queuedOf(row.provider, row.session_id)), running)),
       total: sessions.length,
@@ -428,7 +428,7 @@ agentSessionsRouter.get('/agent-sessions/search', async (req, res) => {
   try {
     const limit = boundedInteger(req.query.limit, 20, 1, 50)
     const result = await searchAgentSessions({ query, limit })
-    const queuedOf = queuedWaitingLookup(Date.now())
+    const queuedOf = await allQueuedWaitingLookup(Date.now())
     // 6.48.1: search hits carry the same derived state as list rows (no list/search shape
     // drift), from the registry and the hook signal; a hit has no transcript walk.
     const peers = await liveClaudePeerRecords()
@@ -532,7 +532,7 @@ agentSessionsRouter.get('/agent-sessions/:provider/:sessionId', async (req, res)
     res.json({
       ...withRunning({ session_id: parsed.session_id }, running),
       ...derivedRowFields(derived),
-      ...queuedTurnsFields(queuedWaitingLookup(Date.now())(provider, parsed.session_id)),
+      ...queuedTurnsFields((await allQueuedWaitingLookup(Date.now()))(provider, parsed.session_id)),
       // The client must be able to tell "this server stamped nothing" from "this
       // server stamped false", because the two demand opposite behaviour: an old
       // server's silence means keep using the hint borrowed from the list row, and

package/server/routes/thread-turn-queue.ts

@@ -16,7 +16,8 @@
 // EVERY DEPENDENCY IS INJECTED so the whole path is testable without a live server.
 
 import { Router, type Request, type Response } from 'express'
-import { COS_SESSION_ID_RE } from './agent-session-bindings.js'
+import { nativeQueueControl, plainQueueText, type NativeQueueControl } from '../lib/codex-queue-control.js'
+import { COS_SESSION_ID_RE, DEFAULT_MAX_PROMPT_CHARS } from './agent-session-bindings.js'
 import {
   admitToQueue, drainDecision, queueableRefusal, queuePosition,
   MAX_DELIVERY_ATTEMPTS, type DrainObservation, type QueuedThreadTurn,
@@ -47,6 +48,7 @@ export interface ThreadTurnQueueDeps {
     /** The turn route's OWN `retryable` judgement, when it sent one. Authoritative. */
     serverRetryable?: boolean
   }>
+  nativeQueue?: NativeQueueControl
   now: () => number
 }
 
@@ -58,6 +60,9 @@ function publicRow(turn: QueuedThreadTurn, position: number): Record<string, unk
     queuedAt: turn.queuedAt,
     attempts: turn.attempts,
     position: turn.status === 'waiting' ? position : -1,
+    prompt: turn.prompt,
+    editable: turn.status === 'waiting',
+    owner: 'cos',
     preview: turn.prompt.length > 80 ? `${turn.prompt.slice(0, 79)}…` : turn.prompt,
     ...(turn.reason ? { reason: turn.reason } : {}),
     ...(turn.settledAt ? { settledAt: turn.settledAt } : {}),
@@ -116,10 +121,16 @@ export async function drainThread(
   if (queue.length === 0) return { delivered: 0, held: 0, retired: 0 }
 
   let delivered = 0, held = 0, retired = 0
-  let dirty = false
+  const persist = (turn: QueuedThreadTurn) => {
+    const latest = readQueue(provider, threadId, deps.now())
+    const index = latest.findIndex(t => t.clientTurnId === turn.clientTurnId)
+    if (index >= 0) { latest[index] = turn; writeQueue(provider, threadId, latest) }
+  }
   let refusedGate: ReturnType<ThreadTurnQueueDeps['occupancy']> | null = null
 
-  for (const turn of queue) {
+  for (const snapshot of queue) {
+    const turn = readQueue(provider, threadId, deps.now()).find(t => t.clientTurnId === snapshot.clientTurnId)
+    if (!turn) continue
     if (turn.status !== 'waiting') continue
 
     // Reuse only refusal within this synchronous pass. Rechecking a busy thread
@@ -150,7 +161,7 @@ export async function drainThread(
       turn.status = decision === 'expire' ? 'expired' : 'refused'
       turn.reason = decision === 'expire' ? 'queued_turn_expired' : 'delivery_attempts_exhausted'
       turn.settledAt = deps.now()
-      retired += 1; dirty = true
+      retired += 1; persist(turn)
       continue
     }
 
@@ -159,8 +170,7 @@ export async function drainThread(
     // forever; the ceiling only bounds anything if it survives the crash it is bounding.
     turn.attempts += 1
     turn.status = 'delivering'
-    writeQueue(provider, threadId, queue)
-    dirty = true
+    persist(turn)
 
     let outcome: { ok: boolean; reason?: string; serverRetryable?: boolean }
     refusedGate = null
@@ -209,9 +219,8 @@ export async function drainThread(
       turn.reason = outcome.reason
       held += 1
     }
+    persist(turn)
   }
-
-  if (dirty) writeQueue(provider, threadId, queue)
   return { delivered, held, retired }
 }
 
@@ -286,20 +295,59 @@ export function createThreadTurnQueueRouter(deps: ThreadTurnQueueDeps): Router {
   })
 
   // GET — what is waiting, for the pending row on the lens.
-  router.get('/agent-sessions/:provider/:threadId/queued-turns', (req: Request, res: Response) => {
+  router.get('/agent-sessions/:provider/:threadId/queued-turns', async (req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')
     const provider = String(req.params.provider ?? '')
     const threadId = String(req.params.threadId ?? '')
     const queue = readQueue(provider, threadId, deps.now())
-    return res.json({ turns: queue.map(t => publicRow(t, queuePosition(queue, t.clientTurnId))) })
+    let native: Record<string, unknown>[] = []
+    if (provider === 'codex') {
+      try {
+        native = (await (deps.nativeQueue ?? nativeQueueControl).list(threadId)).map((row, position) => {
+          const text = plainQueueText(row)
+          return { clientTurnId: `codex-native:${row.id}`, status: 'waiting', position, queuedAt: 0,
+            attempts: 0, preview: text?.slice(0, 80) ?? 'Message with attachments · manage in Codex',
+            ...(text !== null ? { prompt: text } : {}), editable: text !== null, owner: 'codex' }
+        })
+      } catch { return res.status(503).json({ error: 'native_queue_unavailable' }) }
+    }
+    // Re-read after the native await: delivery may have changed COS ownership.
+    const current = readQueue(provider, threadId, deps.now())
+    return res.json({ turns: [...native, ...current.map(t => publicRow(t, queuePosition(current, t.clientTurnId) + native.length))] })
+  })
+
+  // Atomic replacement: no cancel-and-requeue window, and the slot is retained.
+  router.patch('/agent-sessions/:provider/:threadId/queued-turns/:clientTurnId', async (req: Request, res: Response) => {
+    res.set('Cache-Control', 'private, no-store')
+    const provider = String(req.params.provider), threadId = String(req.params.threadId), id = String(req.params.clientTurnId)
+    const prompt = req.body?.prompt
+    if (typeof prompt !== 'string' || !prompt.trim() || prompt.length > DEFAULT_MAX_PROMPT_CHARS) return res.status(400).json({ error: 'invalid_prompt' })
+    if (provider === 'codex' && id.startsWith('codex-native:')) {
+      try {
+        await (deps.nativeQueue ?? nativeQueueControl).update(threadId, id.slice(13), prompt)
+        return res.json({ updated: true })
+      } catch { return res.status(409).json({ error: 'queue_edit_unconfirmed' }) }
+    }
+    const queue = readQueue(provider, threadId, deps.now())
+    const row = queue.find(t => t.clientTurnId === id)
+    if (!row || row.status !== 'waiting') return res.status(409).json({ error: 'already_delivering' })
+    row.prompt = prompt
+    writeQueue(provider, threadId, queue)
+    return res.json({ updated: true })
   })
 
   // DELETE — the cancel control, the same affordance the desktop queue offers.
-  router.delete('/agent-sessions/:provider/:threadId/queued-turns/:clientTurnId', (req: Request, res: Response) => {
+  router.delete('/agent-sessions/:provider/:threadId/queued-turns/:clientTurnId', async (req: Request, res: Response) => {
     res.set('Cache-Control', 'private, no-store')
     const provider = String(req.params.provider ?? '')
     const threadId = String(req.params.threadId ?? '')
     const clientTurnId = String(req.params.clientTurnId ?? '')
+    if (provider === 'codex' && clientTurnId.startsWith('codex-native:')) {
+      try {
+        const cancelled = await (deps.nativeQueue ?? nativeQueueControl).cancel(threadId, clientTurnId.slice(13))
+        return res.status(cancelled ? 200 : 409).json(cancelled ? { cancelled: true, clientTurnId, status: 'cancelled' } : { error: 'already_delivering' })
+      } catch { return res.status(503).json({ error: 'native_queue_unavailable' }) }
+    }
     const now = deps.now()
     const queue = readQueue(provider, threadId, now)
     const row = queue.find(t => t.clientTurnId === clientTurnId)