@gotcos/glasses-server 6.61.6 → 6.62.1

package/server/lib/banned-permission-args.ts

@@ -21,6 +21,41 @@ const BARE_BANNED_PERMISSION_ARGS = new Set(
   BANNED_PERMISSION_ARGS.filter(flag => !flag.startsWith('-')),
 )
 
+/** The two spellings of Codex's sandbox option. The allowed value must be the NEXT argv slot. */
+const CODEX_SANDBOX_FLAGS = new Set(['--sandbox', '-s'])
+
+/**
+ * 6.62.0 (plan 3.1, D1): the one exception to the ban, for a Continue that carries the
+ * session's OWN permissions. ONE object, built once per turn from the Continue plan and
+ * handed to BOTH checks in `attached-provider-adapter.ts` (the builder and the spawn
+ * boundary), so the two can never disagree about what was allowed.
+ *
+ * Narrow by construction:
+ *   - `cursorForce` admits exactly the argv slot `--force` (Cursor's Run Everything). Not
+ *     `--force=…`, not `-f`, and nothing else on the list.
+ *   - `codexSandbox` admits the bare token `danger-full-access` only as the value right
+ *     after `--sandbox` / `-s`. The `--flag=value` spelling and every other position stay
+ *     banned.
+ *
+ * Fork (`fork-thread.ts`) and G2 extra-args (`codex-extra-args.ts`) never pass one, so the
+ * full ban holds there. Anything that is not exactly this shape counts as no allowance.
+ */
+export interface PermissionAllowance {
+  path: 'attached_continue'
+  cursorForce?: true
+  codexSandbox?: 'danger-full-access'
+}
+
+function readAllowance(allowance: unknown): { cursorForce: boolean; codexDanger: boolean } {
+  if (!allowance || typeof allowance !== 'object') return { cursorForce: false, codexDanger: false }
+  const row = allowance as Record<string, unknown>
+  if (row.path !== 'attached_continue') return { cursorForce: false, codexDanger: false }
+  return {
+    cursorForce: row.cursorForce === true,
+    codexDanger: row.codexSandbox === 'danger-full-access',
+  }
+}
+
 /**
  * Is this argv free of every flag plan 4.7 bans?
  *
@@ -29,12 +64,18 @@ const BARE_BANNED_PERMISSION_ARGS = new Set(
  * (`danger-full-access`) match only as their own argv slot. Values of
  * `--workspace` / `-C` are skipped: a cwd containing `--force` is a path,
  * not a permission flag.
+ *
+ * `allowance` (6.62.0) lifts exactly what `PermissionAllowance` names, and only for the
+ * attached Continue path. Omitted, it is the full ban, byte for byte the 6.61 check.
  */
-export function findBannedPermissionArg(args: readonly string[]): string | null {
+export function findBannedPermissionArg(args: readonly string[], allowance?: PermissionAllowance): string | null {
+  const allowed = readAllowance(allowance)
   for (let i = 0; i < args.length; i++) {
     const value = String(args[i])
     const prev = i > 0 ? String(args[i - 1]) : ''
     if (PATH_VALUED_FLAGS.has(prev)) continue
+    if (allowed.cursorForce && value === '--force') continue
+    if (allowed.codexDanger && value === 'danger-full-access' && CODEX_SANDBOX_FLAGS.has(prev)) continue
     if (BARE_BANNED_PERMISSION_ARGS.has(value)) return value
     if (!value.startsWith('-')) continue
     for (const banned of BANNED_PERMISSION_ARGS) {

package/server/lib/claude-bridge.ts

@@ -61,6 +61,7 @@ import { claudePermissionArgs, getClaudeTrustMode } from './claude-permissions.j
 import { terminateProviderProcess } from './provider-process-lifecycle.js'
 import { teeJobTrail, type JobTrailDraft } from './job-trail.js'
 import { claudeSupportsSessionName } from './claude-cli-support.js'
+import { applyTurnRequestEnv, createTurnRequestBinding, spawnWithTurnRequest } from './turn-request.js'
 
 // Inactivity = no stdout data for this long → kill (catches stalls)
 const INACTIVITY_BY_MODEL: Record<ClaudeModelPreference, number> = {
@@ -220,6 +221,8 @@ export async function preWarmCLI(): Promise<void> {
   return new Promise<void>((resolve) => {
     const env = { ...process.env }
     delete env.CLAUDECODE
+    // 'ready' is not a user query: no turn-request file, and never an inherited path.
+    applyTurnRequestEnv(env, null)
 
     const proc = spawn('claude', [
       '-p',
@@ -346,7 +349,7 @@ export interface StreamCallbacks {
    * its session id in the first stream event; before this the id reached the job only with
    * the result, so COS Control could not show a New session from Work while it ran.
    */
-  onNativeSession?: (linkage: { cliSessionId: string }) => void
+  onNativeSession?: (linkage: { cliSessionId: string; provider?: 'claude' | 'codex' | 'cursor' }) => void
 }
 
 /** Claude CLI can emit `subtype: success` with `is_error: true`; the boolean
@@ -622,12 +625,23 @@ export async function callClaudeStreaming(
     cliModelId: resolveClaudeCliModelId(resolvedModel),
   })
 
-  const proc = spawn('claude', args, {
+  // Ultracode is a CLI-only orchestration keyword; history/chat keeps the
+  // original user text so the keyword never appears on the lens.
+  const cliQuery = resolvedEffort === 'ultracode'
+    ? `${fullQuery}\n\n${ULTRACODE_KEYWORD}`
+    : fullQuery
+  // The COS UserPromptSubmit hook sees `cliQuery` (image preamble, attachment block and
+  // all). This private file hands it the user's own words, bound by the hash of exactly
+  // what goes on stdin; the file dies with the child. See lib/turn-request.ts.
+  const turnRequest = createTurnRequestBinding({ userText: query, prompt: cliQuery, turnId: options?.turnId })
+  applyTurnRequestEnv(env, turnRequest)
+
+  const proc = spawnWithTurnRequest(turnRequest, () => spawn('claude', args, {
     stdio: ['pipe', 'pipe', 'pipe'],
     env,
     cwd: cliCwd,
     detached: true,
-  })
+  }))
 
   let fullText = ''
   let stderr = ''
@@ -1061,11 +1075,6 @@ export async function callClaudeStreaming(
     options.abortSignal.addEventListener('abort', handleAbort, { once: true })
   }
 
-  // Ultracode is a CLI-only orchestration keyword; history/chat keeps the
-  // original user text so the keyword never appears on the lens.
-  const cliQuery = resolvedEffort === 'ultracode'
-    ? `${fullQuery}\n\n${ULTRACODE_KEYWORD}`
-    : fullQuery
   try {
     const providerOwned = await callbacks.onProviderProcess?.({
       provider: 'claude',

package/server/lib/claude-hooks-installer.ts

@@ -90,6 +90,7 @@ export const HOOK_SUBSCRIPTIONS: readonly HookSubscription[] = [
   { event: 'Notification', matcher: 'permission_prompt|idle_prompt|elicitation_dialog|agent_needs_input', async: true, timeout: 10 },
   { event: 'SubagentStart', async: true, timeout: 10 },
   { event: 'SubagentStop', async: true, timeout: 10 },
+  { event: 'PreCompact', async: true, timeout: 10 },
   { event: 'PostCompact', async: true, timeout: 10 },
   { event: 'PostModelSwitch', async: true, timeout: 10 },
 ]
@@ -157,7 +158,8 @@ export function currentHookPaths(): HookPaths {
 
 type HookBlock = { matcher?: unknown; hooks?: unknown }
 
-function hookIsOurs(h: unknown): boolean {
+/** Exported (6.62.0) so the Codex installer names our hooks by the same script path. */
+export function hookIsOurs(h: unknown): boolean {
   return !!h && typeof h === 'object' && typeof (h as { command?: unknown }).command === 'string'
     && ((h as { command: string }).command.includes(HOOK_SCRIPT_MARKER) || (h as { command: string }).command.includes(HOOK_SCRIPT_NAME + ' '))
 }
@@ -307,6 +309,7 @@ export interface HookStatus {
    * has not run Install hooks since. Questions are then held at most 120 s, as before.
    */
   priorWaitOnly: boolean
+  observerOnlyDrift?: boolean
   /** 6.60.0: our PermissionRequest hook's `timeout` in the settings file, or null (`permissionHookTimeoutS`). */
   permissionHookTimeoutS: number | null
   tokenPresent: boolean
@@ -362,7 +365,8 @@ export function hookStatus(paths: { settingsPath?: string; scriptPath?: string;
   else state = 'installed'
   const priorWaitOnly = state === 'drift' && events.missing.length === 0 && events.drifted.length > 0
     && events.drifted.every(event => events.priorWait.includes(event))
-  return { state, installed: state === 'installed', settingsPath, scriptPath, scriptSha, packageScriptSha, ...events, priorWaitOnly, permissionHookTimeoutS: permissionWaitS, tokenPresent }
+  const observerOnlyDrift = state === 'drift' && events.missing.length > 0 && events.missing.every(event => event === 'PreCompact') && events.drifted.every(event => events.priorWait.includes(event))
+  return { observerOnlyDrift, state, installed: state === 'installed', settingsPath, scriptPath, scriptSha, packageScriptSha, ...events, priorWaitOnly, permissionHookTimeoutS: permissionWaitS, tokenPresent }
 }
 
 /**
@@ -378,12 +382,20 @@ export function hookStatus(paths: { settingsPath?: string; scriptPath?: string;
  *     (7433b7f), and it carries the same halt check.
  *   - df54677f...: the script 6.53.3 through 6.59.0 shipped. 6.60.0 changed it only for the
  *     away hold (the PermissionRequest wait); its halt check is the same.
+ *   - 0e1bbb98...: the script 6.60.0 through 6.61.7 shipped (B1). 6.62.0 changed it for Codex
+ *     and Cursor (provider stamp, Codex deny-only reply, Cursor `conversation_id`); its Claude
+ *     halt reply is byte for byte the same, so a Mac still on it stops desk Claude runs.
+ *   - 1877c90c...: the 6.62.0 script as first built, before its /qa round taught it to recognise
+ *     a Codex payload (QA W13). Never published, but installable from a local build of that
+ *     branch, and its Claude halt check is the same.
  * Each is pinned against its bytes in `server/lib/__fixtures__/`.
  */
 export const HALT_CAPABLE_PRIOR_SCRIPT_SHAS: readonly string[] = [
   '1158bb06297550128f01fc47caa68806a5287d6da2d05b0d1c812e8ae20764e7',
   'c0b41bf8581cfea498e1e1ac5220fe4e148bd97448d13b60a88879ee5992cc51',
   'df54677f79908893509ee87608cfe3f4a53ced03f88f337f16a63741d6b3d547',
+  '0e1bbb9816c9475436f89f6326d5504eccc9aa6519ff5e466b949d53a73d8439',
+  '1877c90c5359571dfc74c6d03395104a73925868147e8a50cd9d7b4226b1b5ca',
 ]
 
 /**
@@ -397,16 +409,26 @@ export const HALT_CAPABLE_PRIOR_SCRIPT_SHAS: readonly string[] = [
  * check, so updating the server never turns cancel from the lens off. Any other drift
  * still is not halt-ready.
  */
-export function hookHaltReady(status: Pick<HookStatus, 'installed' | 'state' | 'scriptSha'> & Partial<Pick<HookStatus, 'priorWaitOnly' | 'packageScriptSha'>>): boolean {
+export function hookHaltReady(status: Pick<HookStatus, 'installed' | 'state' | 'scriptSha'> & Partial<Pick<HookStatus, 'priorWaitOnly' | 'observerOnlyDrift' | 'packageScriptSha'>>): boolean {
   if (status.installed === true) return true
   const priorScript = typeof status.scriptSha === 'string' && HALT_CAPABLE_PRIOR_SCRIPT_SHAS.includes(status.scriptSha)
   if (status.state === 'script_outdated') return priorScript
-  if (status.state === 'drift' && status.priorWaitOnly === true) {
+  if (status.state === 'drift' && (status.priorWaitOnly === true || status.observerOnlyDrift === true)) {
     return priorScript || (typeof status.scriptSha === 'string' && status.scriptSha === status.packageScriptSha)
   }
   return false
 }
 
+/**
+ * 6.62.0 (QA W1): can these hooks stop a desk CURSOR run? Halt-ready, AND the installed script is
+ * this package's, byte for byte. Every earlier script reads the first `session_id`, which Cursor
+ * writes behind `tool_input`: a large tool call is missed, and one naming another session stops
+ * the wrong run. Claude's own readiness (`hookHaltReady`) is unchanged.
+ */
+export function cursorDeskHaltReady(status: Parameters<typeof hookHaltReady>[0]): boolean {
+  return hookHaltReady(status) && typeof status.scriptSha === 'string' && status.scriptSha === status.packageScriptSha
+}
+
 const INSTALL_COMMAND = 'npx --yes @gotcos/glasses-server@latest --hooks install'
 
 /**
@@ -468,7 +490,8 @@ export interface InstallResult {
 
 const BACKUPS_KEPT = 3
 
-function backupSettings(settingsPath: string): string | null {
+/** Exported (6.62.0) for the Codex installer: the same backup, the same three kept. */
+export function backupSettings(settingsPath: string): string | null {
   if (!existsSync(settingsPath)) return null
   const stamp = new Date().toISOString().replace(/[:.]/g, '-')
   const backup = `${settingsPath}.cos-backup-${stamp}`

package/server/lib/codex-bridge.ts

@@ -85,6 +85,7 @@ import {
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
 import { terminateProviderProcess } from './provider-process-lifecycle.js'
 import { teeJobTrail } from './job-trail.js'
+import { applyTurnRequestEnv, createTurnRequestBinding, spawnWithTurnRequest } from './turn-request.js'
 
 const INACTIVITY_MS = 180_000
 const WALL_MAX_MS = 900_000
@@ -481,12 +482,19 @@ export async function callCodexStreaming(
     )
   }
 
-  const proc = spawn(resolvedCodex.path, args, {
+  // The COS UserPromptSubmit hook sees `prompt`, which is SYSTEM INSTRUCTIONS plus USER
+  // REQUEST in one text, on a fresh thread and on resume alike. This private file hands it
+  // the user's own words, bound by the hash of exactly what goes on stdin; the file dies
+  // with the child. See lib/turn-request.ts.
+  const turnRequest = createTurnRequestBinding({ userText: query, prompt, turnId: options?.turnId })
+  applyTurnRequestEnv(env, turnRequest)
+
+  const proc = spawnWithTurnRequest(turnRequest, () => spawn(resolvedCodex.path, args, {
     stdio: ['pipe', 'pipe', 'pipe'],
     env,
     cwd: codexCwd,
     detached: true,
-  })
+  }))
 
   let fullText = ''
   let stderr = ''
@@ -770,12 +778,19 @@ export async function callCodexStreaming(
     })
   }, WALL_MAX_MS)
 
+  let nativeSessionAnnounced = false
   function handleEvent(event: any) {
     const nextThreadId = extractCodexThreadId(event)
     if (nextThreadId && nextThreadId !== codexThreadId) {
       codexThreadId = nextThreadId
       updateCodexRun(run.runId, { codexThreadId })
     }
+    // 6.62.0 (plan 3.9): the job links to its native thread at the first event naming it,
+    // not only at completion.
+    if (nextThreadId && !nativeSessionAnnounced) {
+      nativeSessionAnnounced = true
+      try { callbacks.onNativeSession?.({ provider: 'codex', cliSessionId: nextThreadId }) } catch { /* linkage is best effort */ }
+    }
 
     const status = toolStatus(event)
     if (status) callbacks.onToolStatus?.(status)