@gotcos/glasses-server 6.95.0 → 6.98.0

package/server/lib/parakeet.ts

@@ -454,8 +454,49 @@ export function sweepParakeetStaging(): { removed: number; restored: boolean } {
 // ── Inference ─────────────────────────────────────────────────────────────────
 
 export type ParakeetFailure = 'not_installed' | 'sandbox_unavailable' | 'busy' | 'timeout' | 'cli_failed' | 'bad_output' | 'spawn_failed' | 'aborted'
+export interface ParakeetCliDiagnostics {
+  exitCode: number | null
+  signal: string | null
+  /** Safe categories extracted from stderr, never arbitrary native output. */
+  stderr: string
+}
+
+function safeCliDiagnostics(message: string, diagnostics?: ParakeetCliDiagnostics): ParakeetCliDiagnostics {
+  const raw = (diagnostics?.stderr ?? message).slice(-32_768)
+  // Native stderr can contain paths, credentials, or recognized speech. Keep
+  // only fixed diagnostic vocabulary; redacting a few secret patterns would
+  // still leave arbitrary transcript text in the durable save error/log.
+  const categories = [
+    /unknown option/i, /not supported/i, /transcription failed/i,
+    /invalidAudioData/i, /initializationFailed/i, /modelNotFound/i,
+    /modelLoadingFailed/i, /predictionFailed/i, /invalidModel/i,
+    /failed to load model/i, /failed to initialize/i, /CoreML/i,
+    /out of memory/i, /allocation failed/i, /operation not permitted/i,
+    /permission denied/i, /no such file or directory/i, /library not loaded/i,
+    /sandbox.*deny/i, /fatal error/i, /EXC_BAD_ACCESS/, /SIGABRT/, /SIGSEGV/,
+    /NSCocoaErrorDomain/, /MLModelErrorDomain/,
+  ].filter(pattern => pattern.test(raw)).map(pattern => {
+    // The pattern itself is trusted text; never copy the matching stderr.
+    return pattern.source.replace('.*', ' ').replace(/\\/g, '')
+  })
+  const legacyExit = /\bexit\s+(-?\d+|SIG[A-Z0-9]+)\b/.exec(message.slice(0, 100))?.[1]
+  const code = diagnostics?.exitCode ?? (legacyExit && /^-?\d+$/.test(legacyExit) ? Number(legacyExit) : null)
+  const signal = diagnostics?.signal ?? (legacyExit?.startsWith('SIG') ? legacyExit : null)
+  return {
+    exitCode: Number.isSafeInteger(code) ? code : null,
+    signal: typeof signal === 'string' && /^SIG[A-Z0-9]{1,12}$/.test(signal) ? signal : null,
+    stderr: categories.join(' | ').slice(0, 240) || 'unrecognized stderr omitted',
+  }
+}
+
 export class ParakeetError extends Error {
-  constructor(readonly reason: ParakeetFailure, message: string) { super(message); this.name = 'ParakeetError' }
+  readonly cliDiagnostics?: ParakeetCliDiagnostics
+  constructor(readonly reason: ParakeetFailure, message: string, diagnostics?: ParakeetCliDiagnostics) {
+    const safe = reason === 'cli_failed' ? safeCliDiagnostics(message, diagnostics) : undefined
+    super(safe ? `exit code=${safe.exitCode ?? 'unknown'} signal=${safe.signal ?? 'none'}; stderr=${safe.stderr}` : message)
+    this.name = 'ParakeetError'
+    this.cliDiagnostics = safe
+  }
 }
 
 export interface ParakeetResult {
@@ -721,9 +762,14 @@ function runParakeetChecked(wav: Buffer, options: ParakeetRunOptions): Promise<P
     if (child.pid && options.lane !== 'preview' && options.lane !== 'interactive') {
       try { setPriority(child.pid, 10) } catch { /* runs at normal priority */ }
     }
-    let stderr = ''
+    let stderr = '', stderrTail = ''
     child.stdout?.on('data', () => { /* the JSON file is the output */ })
-    child.stderr?.on('data', (d: Buffer) => { if (stderr.length < 32_768) stderr += d.toString() })
+    child.stderr?.on('data', (d: Buffer) => {
+      // Retain the existing leading-output option-failure check; keep a
+      // separate bounded tail for diagnostics from a nonzero native exit.
+      if (stderr.length < 32_768) stderr = (stderr + d.subarray(0, 32_768).toString()).slice(0, 32_768)
+      stderrTail = (stderrTail + d.subarray(-32_768).toString()).slice(-32_768)
+    })
     timer = setTimeout(() => {
       // SIGKILL: a CoreML compile does not stop for TERM.
       try { child.kill('SIGKILL') } catch { /* gone */ }
@@ -733,8 +779,8 @@ function runParakeetChecked(wav: Buffer, options: ParakeetRunOptions): Promise<P
     child.on('error', error => finish(new ParakeetError('spawn_failed', error.message)))
     child.on('close', (code, signal) => {
       if (settled) return
-      if (code !== 0) { finish(new ParakeetError('cli_failed', `exit ${code ?? signal}: ${stderr.trim().split('\n').slice(-2).join(' | ').slice(0, 240)}`)); return }
-      if (/Unknown option|not supported|transcription failed/i.test(stderr)) { finish(new ParakeetError('cli_failed', 'the CLI rejected an option')); return }
+      if (code !== 0) { finish(new ParakeetError('cli_failed', '', { exitCode: code, signal, stderr: stderrTail })); return }
+      if (/Unknown option|not supported|transcription failed/i.test(stderr)) { finish(new ParakeetError('cli_failed', '', { exitCode: code, signal, stderr })); return }
       try {
         const parsed = parseParakeetJson(readFileSync(output, 'utf8'))
         finish(null, { model: options.model, ...parsed, wallMs: Date.now() - started })

package/server/lib/pending-batch-retention.ts

@@ -0,0 +1,58 @@
+// How long a saved meeting's pending HQ audio stays in pending-batch.
+//
+// A directory is stale 12 hours after its _batch_pending.marker was last refreshed, and normally
+// goes then. A saved meeting still waiting on HQ is the exception: deleting its audio finishes the
+// job on streaming text the next time it resumes, which made "audio is preserved for retry" untrue
+// (2026-10-16 and 2026-10-29). It keeps its audio until a person or a fix can finish it, and for a
+// bounded time, so one job that can never finish does not hold disk forever.
+
+import { existsSync, readdirSync, rmSync, statSync } from 'node:fs'
+import { basename, resolve } from 'node:path'
+import { MeetingFinalizationJobStore, type MeetingFinalizationJob } from './meeting-finalization-jobs.js'
+
+export const PENDING_BATCH_STALE_MS = 12 * 60 * 60 * 1000
+export const WAITING_JOB_AUDIO_HOLD_MS = 30 * 24 * 60 * 60 * 1000
+
+/** Directory names of meetings still waiting on HQ, inside the hold. */
+export function pendingBatchDirsHeldForJobs(jobs: readonly MeetingFinalizationJob[], now: number): Set<string> {
+  const held = new Set<string>()
+  for (const job of jobs) {
+    if (job.phase !== 'batch_pending') continue
+    // An unreadable date cannot prove the hold ended, so the audio stays.
+    const created = Date.parse(job.createdAt)
+    if (Number.isFinite(created) && now - created > WAITING_JOB_AUDIO_HOLD_MS) continue
+    held.add(job.sessionId)
+    if (job.audioDir) held.add(basename(job.audioDir))
+  }
+  return held
+}
+
+export function sweepStalePendingBatch(root: string, options: {
+  now: number
+  batchBusy: boolean
+  jobs?: readonly MeetingFinalizationJob[]
+}): void {
+  const held = pendingBatchDirsHeldForJobs(options.jobs ?? new MeetingFinalizationJobStore().list(), options.now)
+  for (const dir of readdirSync(root)) {
+    const dirPath = resolve(root, dir)
+    try {
+      const files = readdirSync(dirPath)
+      if (files.length === 0) { rmSync(dirPath, { recursive: true, force: true }); continue }
+      // Prefer the marker file mtime over first chunk mtime
+      const markerPath = resolve(dirPath, '_batch_pending.marker')
+      // Fallback for pre-v5.4.3 dirs: use directory ctime (changes on rename)
+      const ageSource = existsSync(markerPath) ? statSync(markerPath).mtimeMs : statSync(dirPath).ctimeMs
+      if (options.now - ageSource <= PENDING_BATCH_STALE_MS) continue
+      if (held.has(dir)) {
+        console.warn(`[cleanup] Retaining pending-batch for a saved meeting waiting on HQ: ${dir}`)
+        continue
+      }
+      if (options.batchBusy) {
+        console.warn(`[cleanup] Retaining stale pending-batch while batch lease held: ${dir}`)
+        continue
+      }
+      rmSync(dirPath, { recursive: true, force: true })
+      console.log(`[cleanup] Purged stale pending-batch: ${dir}`)
+    } catch {}
+  }
+}

package/server/lib/private-reference.ts

@@ -0,0 +1,38 @@
+// "Private" as a PRIVACY reference, not as an ordinary adjective.
+//
+// A blocklist of private nouns (notes, pricing, ...) lets every other private thing through ("private funding round from Blackstone",
+// "my private hospital stay", "Acme's private valuation"), so this is inverted: the bare word "private" (and privately, privacy) blocks,
+// EXCEPT inside a short list of public phrases: private aviation, jet(s), plane(s), pilot(s), equity, school(s), sector, label,
+// market(s), company/companies, credit, and "privately held". Those are the subjects of public statistics and news.
+// Even a public phrase blocks when the question also
+//   - has a privacy phrase anywhere: stays private, keep ... private, in private, private for now, privately told (all caught because
+//     they carry a bare "private"), or off the record, between us; or
+//   - has a possessive or a person on it: my, our, his, her, their, your, <Name>'s ("Stephen's private plane crash rate",
+//     "private equity ... our CEO owns").
+// One helper, used by every gate that read the bare word (the Ask search gate, the public-topic and fact-check query filter, the
+// public-resource request check). The live-cue deny list keeps the bare word (live-cues-general-topic.ts): its queries are chosen by a
+// model, not typed by the user.
+const PUBLIC_PHRASE = 'aviation|jets?|planes?|pilots?|equity|schools?|sector|label|markets?|compan(?:y|ies)|credit'
+const PUBLIC_PHRASES = new RegExp(`\\bprivate\\s+(?:${PUBLIC_PHRASE})\\b|\\bprivately\\s+held\\b`, 'gi')
+const MARKER = /\bprivate(?:ly)?\b|\bprivacy\b/i
+// Phrases that make a question private WITHOUT the word "private" (every phrase with the word is already caught by the bare-word rule below).
+const PRIVACY_PHRASES: readonly RegExp[] = [
+  /\boff\s+the\s+record\b/i,
+  /\bbetween\s+(?:us|you\s+and\s+me)\b/i,
+]
+const POSSESSIVE = /\b(?:my|our|his|her|their|your|mine|ours|hers|theirs)\b/i
+// <Name>'s, except the contractions that are not possessives.
+const NOT_POSSESSIVE = new Set(['what', 'it', 'that', 'there', 'here', 'who', 'how', 'let', 'he', 'she', 'where', 'when', 'why', 'one', 'this'])
+function hasPossessive(text: string): boolean {
+  if (POSSESSIVE.test(text)) return true
+  for (const m of text.matchAll(/\b([\p{L}][\p{L}\p{N}&.-]*)['’]s\b/gu)) if (!NOT_POSSESSIVE.has(m[1].toLowerCase())) return true
+  return false
+}
+/** True when `text` uses "private" as a privacy marker. "private aviation", "private equity", "private jet" alone are not. */
+export function privateReference(text: string): boolean {
+  if (!MARKER.test(text)) return false
+  if (PRIVACY_PHRASES.some(p => p.test(text))) return true
+  const rest = text.replace(PUBLIC_PHRASES, ' ')
+  if (MARKER.test(rest)) return true                            // any other "private": notes, funding round, valuation, dinner, hospital ...
+  return hasPossessive(text)                                    // only public phrases are left: still private if it is someone's
+}