@gotcos/glasses-server 6.63.0 → 6.63.1

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 6.63.1 — 2026-10-06 — Weather survives a restart
+
+- Home weather survives a server restart. The last good weather and place are kept in `<data>/welcome-weather.json`; when a forecast lookup fails (timeout, HTTP error, bad payload), the route answers with that saved weather if it is under 3 hours old, never older. A failed forecast or place lookup is now logged once per kind per 10 minutes, with the cause and whether a saved weather was served. Before, after a restart the first failed lookup sent the glasses no weather and nothing said why. Pairs with glasses 6.10.603, which also retries on Home and keeps its own last good weather.
+- Security: `proxy-addr` 2.0.8 (through Express), for GHSA-jqcg-44mw-7w3h (IP spoofing through an IPv4-mapped IPv6 trust subnet). Lockfile only.
+
 ## 6.63.0 — 2026-10-05 — Background forks
 
 - Background forks. `POST /api/agent-sessions/:provider/:threadId/fork` accepts an optional `clientForkId`: once every gate passes it answers 202 and runs the fork in the background, and `GET /api/agent-session-forks/:clientForkId` returns `running` or the exact answer the synchronous route would have sent. A repeated id replays its job and never makes a second copy. Outcomes are kept in `<data>/fork-jobs.json` (7 days, 200 rows); a fork still running when the server stops reads back as orphan-possible ("look in Sessions before forking again"), never as failed. Without the id the route is unchanged. Why: on 2026-10-05 COS Control waited 5 minutes for a 6.5-minute fork that succeeded and told Miles the server had stopped. Pairs with COS Control 0.5.257; older clients keep the synchronous route.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.63.0",
+  "version": "6.63.1",
   "description": "COS Glasses: self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -106,7 +106,7 @@ import { recoveryRouter } from './routes/recovery.js'
 import { promptEditRouter } from './routes/prompt-edit.js'
 import { lensGistRouter } from './routes/lens-gist.js'
 import { bookmarksRouter } from './routes/bookmarks.js'
-import { welcomeContextRouter } from './routes/welcome-context.js'
+import { setWeatherPersistence, welcomeContextRouter } from './routes/welcome-context.js'
 import { liveCuesRouter } from './routes/live-cues.js'
 import { tasksRouter } from './routes/tasks.js'
 import { memoryRouter } from './routes/memory.js'
@@ -143,6 +143,7 @@ import { createWorkIntakeRouter } from './routes/work-intake.js'
 import { createWorkHandoffRequestsRouter } from './routes/work-handoff-requests.js'
 import { createJevRouter } from './routes/jev.js'
 import { dataPath } from './lib/data-dir.js'
+import { loadJsonOrQuarantine, durableAtomicWriteFileSync } from './lib/atomic-fs.js'
 import { WorkIntakeStore, createOptionalWorkIntakeStore } from './lib/work-intake-store.js'
 import { WorkHandoffRequestStore, createOptionalWorkHandoffRequestStore, handoffRequestCapabilities } from './lib/work-handoff-requests.js'
 import { createWorkBoardReader } from './lib/work-board-reader.js'
@@ -1065,6 +1066,11 @@ app.use('/api', recoveryRouter)
 app.use('/api', promptEditRouter)
 app.use('/api', lensGistRouter)
 app.use('/api', bookmarksRouter)
+// 6.63.1: the last good weather and place survive a restart (<data>/welcome-weather.json).
+setWeatherPersistence({
+  load: () => { const r = loadJsonOrQuarantine<unknown>(dataPath('welcome-weather.json')); return r.status === 'ok' ? r.data : null },
+  save: (value) => durableAtomicWriteFileSync(dataPath('welcome-weather.json'), `${JSON.stringify(value)}\n`),
+})
 app.use('/api', welcomeContextRouter)
 app.use('/api', liveCuesRouter)
 app.use('/api', tasksRouter)

package/server/routes/welcome-context.ts

@@ -25,6 +25,72 @@ let lastKnownCity = ''
 let cachedNextEvent: NextEventPayload | null = null
 let calendarFetchedAt = 0
 
+// 6.63.1: after a server restart the first forecast lookup can fail and, with nothing cached, the
+// glasses Home got no weather until the app was relaunched. The last good weather and
+// place now survive a restart, and a failed lookup says why in the log (it was silent).
+/** A saved weather older than this is never served after a restart. */
+export const WEATHER_PERSIST_MAX_AGE_MS = 3 * 60 * 60_000
+const WEATHER_FAILURE_LOG_MS = 10 * 60_000
+
+export interface WeatherPersistence {
+  load(): unknown
+  save(value: unknown): void
+}
+let weatherPersistence: WeatherPersistence | null = null
+let weatherRestored = false
+const lastFailureLogAt = new Map<string, number>()
+
+/** Wired by the server (index.ts, `<data>/welcome-weather.json`); off by default so tests touch nothing. */
+export function setWeatherPersistence(p: WeatherPersistence | null): void {
+  weatherPersistence = p
+  weatherRestored = false
+}
+
+function restoreWeatherOnce(): void {
+  if (weatherRestored || !weatherPersistence) return
+  weatherRestored = true
+  try {
+    const v = weatherPersistence.load() as Record<string, unknown> | null
+    if (!v || typeof v !== 'object') return
+    const at = typeof v.fetchedAt === 'number' ? v.fetchedAt : 0
+    const w = v.weather as WeatherPayload | undefined
+    if (typeof v.lat === 'number' && typeof v.lon === 'number' && lastKnownLat == null) { lastKnownLat = v.lat; lastKnownLon = v.lon }
+    if (typeof v.city === 'string' && !lastKnownCity) lastKnownCity = v.city
+    const fresh = at > 0 && at <= Date.now() + 60_000 && Date.now() - at <= WEATHER_PERSIST_MAX_AGE_MS
+    if (fresh && w && typeof w.temp === 'string' && typeof w.desc === 'string' && !cachedWeather) {
+      cachedWeather = { temp: w.temp, desc: w.desc, location: typeof w.location === 'string' ? w.location : '' }
+      // Expired for the TTL check, so the next request still tries a fresh lookup; kept as the fallback.
+      weatherFetchedAt = 0
+    }
+  } catch (error) {
+    console.warn(`[welcome-context] saved weather unreadable: ${error instanceof Error ? error.message : error}`)
+  }
+}
+
+function persistWeather(): void {
+  if (!weatherPersistence) return
+  try {
+    weatherPersistence.save({ lat: lastKnownLat ?? null, lon: lastKnownLon ?? null, city: lastKnownCity, weather: cachedWeather, fetchedAt: weatherFetchedAt })
+  } catch (error) {
+    console.warn(`[welcome-context] saving weather failed: ${error instanceof Error ? error.message : error}`)
+  }
+}
+
+/** One line per failure kind per 10 minutes: the cause, never the coordinates. */
+function noteWeatherFailure(kind: 'forecast' | 'geocode', reason: string): void {
+  const key = `${kind}:${reason}`
+  const now = Date.now()
+  if (now - (lastFailureLogAt.get(key) ?? 0) < WEATHER_FAILURE_LOG_MS) return
+  lastFailureLogAt.set(key, now)
+  console.warn(`[welcome-context] ${kind} lookup failed: ${reason}${cachedWeather ? ' (serving the last good weather)' : ' (no weather to serve)'}`)
+}
+
+function failureReason(error: unknown): string {
+  const name = error instanceof Error ? error.name : ''
+  if (name === 'TimeoutError' || name === 'AbortError') return 'timeout'
+  return error instanceof Error ? (error.message.slice(0, 80) || name || 'error') : 'error'
+}
+
 /** Full WMO 4677 — discrete codes, exact match required. */
 export const WMO_CODES: Record<number, string> = {
   0: 'Clear',
@@ -108,7 +174,7 @@ async function reverseGeocode(lat: number, lon: number): Promise<string> {
       `https://api.bigdatacloud.net/data/reverse-geocode-client?latitude=${lat}&longitude=${lon}&localityLanguage=en`,
       { signal: AbortSignal.timeout(GEOCODE_TIMEOUT_MS) },
     )
-    if (!res.ok) return lastKnownCity
+    if (!res.ok) { noteWeatherFailure('geocode', `http ${res.status}`); return lastKnownCity }
     const data = await res.json() as {
       city?: string
       locality?: string
@@ -122,7 +188,8 @@ async function reverseGeocode(lat: number, lon: number): Promise<string> {
       lastKnownCity = region ? `${city}, ${region}` : city
     }
     return lastKnownCity
-  } catch {
+  } catch (error) {
+    noteWeatherFailure('geocode', failureReason(error))
     return lastKnownCity
   }
 }
@@ -144,6 +211,7 @@ export async function fetchWeather(
   queryLat?: number,
   queryLon?: number,
 ): Promise<WeatherPayload | null> {
+  restoreWeatherOnce()
   const resolved = resolveWeatherCoords(queryLat, queryLon)
   if (!resolved) return null
 
@@ -183,14 +251,14 @@ export async function fetchWeather(
       `https://api.open-meteo.com/v1/forecast?latitude=${useLat}&longitude=${useLon}&current=temperature_2m,weather_code&temperature_unit=fahrenheit&timezone=auto`,
       { signal: AbortSignal.timeout(FORECAST_TIMEOUT_MS) },
     )
-    if (!res.ok) return cachedWeather
+    if (!res.ok) { noteWeatherFailure('forecast', `http ${res.status}`); return cachedWeather }
 
     const data = await res.json() as {
       current?: { temperature_2m?: number; weather_code?: number }
     }
     const temp = data.current?.temperature_2m
     const code = data.current?.weather_code
-    if (typeof temp !== 'number' || typeof code !== 'number') return cachedWeather
+    if (typeof temp !== 'number' || typeof code !== 'number') { noteWeatherFailure('forecast', 'bad payload'); return cachedWeather }
 
     await ensureCityLabel(useLat, useLon, source)
 
@@ -200,8 +268,10 @@ export async function fetchWeather(
       location: lastKnownCity || `${useLat.toFixed(2)}, ${useLon.toFixed(2)}`,
     }
     weatherFetchedAt = Date.now()
+    persistWeather()
     return cachedWeather
-  } catch {
+  } catch (error) {
+    noteWeatherFailure('forecast', failureReason(error))
     return cachedWeather
   }
 }
@@ -272,6 +342,9 @@ export function _resetWelcomeContextCachesForTests(): void {
   lastKnownCity = ''
   cachedNextEvent = null
   calendarFetchedAt = 0
+  weatherPersistence = null
+  weatherRestored = false
+  lastFailureLogAt.clear()
 }
 
 welcomeContextRouter.get('/welcome-context', async (req, res) => {