@gotcos/glasses-server 6.98.1 → 6.99.16

package/server/lib/api-auth.ts

@@ -1,6 +1,7 @@
 import type { RequestHandler } from 'express'
 import { timingSafeTokenEqual } from './token-auth.js'
 import { PAIRING_NONCE_BODY } from './glasses-pairing.js'
+import { isWebSessionAuthorized } from './web-session-auth.js'
 
 // Recovery/setup clients need these availability surfaces before they have a
 // usable token. Keep private provider state and every mutation route out.
@@ -47,6 +48,11 @@ export function isPublicApiRequest(method: string, path: string): boolean {
   if (PUBLIC_API_PATHS.has(path)) return true
   if (method === 'POST' && path === '/pairing/claim') return true
   if (method === 'GET' && PAIRING_POLL_PATH.test(path)) return true
+  // COS Control Web (browser on the tailnet). Login takes the token or a one-time handoff
+  // ticket and answers with the HttpOnly cookie; it is rate limited in the route. Status
+  // says only whether this browser is signed in. Everything else stays behind the gate.
+  if (method === 'POST' && (path === '/web-session/login' || path === '/web-session/logout')) return true
+  if (method === 'GET' && path === '/web-session/status') return true
   if (method !== 'GET' && method !== 'HEAD') return false
   return TTS_PLAYBACK_CAPABILITY_PATH.test(path)
     || DISPLAY_STREAM_CAPABILITY_PATH.test(path)
@@ -54,29 +60,40 @@ export function isPublicApiRequest(method: string, path: string): boolean {
 
 export interface RequireApiTokenOptions {
   /**
-   * Called once per request that passed the token check (never for a public path).
-   * Pairing uses it to stamp `firstAuthAfterClaimAt`. A throw here is swallowed: an
-   * observer must never turn an authenticated request into a failure.
+   * Called once per request that passed the X-COS-Token header check (never for a
+   * public path and never for a browser cookie session so web login cannot disturb
+   * the glasses pairing state machine).
    */
   onAuthenticated?: (req: Parameters<RequestHandler>[0]) => void
+  /** Verified Tailscale `Self.DNSName` for validating browser cookie Origins. */
+  selfDnsName?: () => string | null
+  /** Allowed browser-facing server ports (e.g. `[3141, 3143]`) for cookie Origin port binding. */
+  allowedPorts?: () => readonly number[]
 }
 
 /** Global /api authentication boundary. Mount before all body parsers. */
 export function requireApiToken(apiToken: string, options: RequireApiTokenOptions = {}): RequestHandler {
   return (req, res, next) => {
     if (isPublicApiRequest(req.method, req.path)) return next()
-    if (!timingSafeTokenEqual(req.headers['x-cos-token'], apiToken)) {
-      return res.status(401).json({
-        error: 'unauthorized',
-        // Stable on purpose: clients key off this value, not the message.
-        reason: 'pairing_token_rejected',
-        // Older COS Glasses builds, which cannot scan, show this message word for word.
-        message: 'Paste the pairing token from COS Control, or scan its code with COS Glasses 6.10.621 or newer.',
-      })
+    if (timingSafeTokenEqual(req.headers['x-cos-token'], apiToken)) {
+      if (options.onAuthenticated) {
+        try { options.onAuthenticated(req) } catch { /* observer only */ }
+      }
+      return next()
     }
-    if (options.onAuthenticated) {
-      try { options.onAuthenticated(req) } catch { /* observer only */ }
+    const cookieAuth = isWebSessionAuthorized(req, apiToken, {
+      selfDnsName: options.selfDnsName?.() ?? null,
+      allowedPorts: options.allowedPorts?.(),
+    })
+    if (cookieAuth) {
+      return next()
     }
-    next()
+    return res.status(401).json({
+      error: 'unauthorized',
+      // Stable on purpose: clients key off this value, not the message.
+      reason: 'pairing_token_rejected',
+      // Older COS Glasses builds, which cannot scan, show this message word for word.
+      message: 'Paste the pairing token from COS Control, or scan its code with COS Glasses 6.10.621 or newer.',
+    })
   }
 }

package/server/lib/claude-bridge.ts

@@ -418,6 +418,8 @@ const PHASE_LABELS: Record<Phase, string> = {
  * Returns the session ID for multi-turn tracking.
  */
 export interface CallOptions {
+  /** Internal checkpoint runner only; timeout is never a successful answer. */
+  maintenancePass?: true
   lightweight?: boolean  // Skip async context fetch — use cached context instantly (G2 speed path)
   abortSignal?: AbortSignal
   effort?: EffortPreference
@@ -700,7 +702,7 @@ export async function callClaudeStreaming(
   const effortWallMax = resolvedEffort === 'max' || resolvedEffort === 'ultracode'
     ? Math.max(defaultWallMax, WALL_MAX_DEEP_EFFORT_MS)
     : defaultWallMax
-  const wallMax = isExtendedQuery(query) ? Math.max(WALL_MAX_EXTENDED_MS, effortWallMax) : effortWallMax
+  const wallMax = options?.maintenancePass ? 900_000 : isExtendedQuery(query) ? Math.max(WALL_MAX_EXTENDED_MS, effortWallMax) : effortWallMax
   // Key lanes: one nonce per turn from the relay (P2 contract), then the child env points at it.
   // Only the child's copy is written. A relay that cannot issue ends the turn before spawn.
   let keyTurn: RelayTurnHandle | null = null
@@ -850,8 +852,16 @@ export async function callClaudeStreaming(
     })
   }
 
+  let maintenanceClosed = false
   async function finalize(text: string) {
     if (finalized) return
+    // A next maintenance pass may start only after the entire provider tree
+    // has closed. Normal chat retains its existing result-event behavior.
+    if (options?.maintenancePass && !maintenanceClosed) {
+      if (terminationRequested) return
+      await terminateForTerminal('maintenance checkpoint', () => finalize(text))
+      return
+    }
     const responseAuthFailure = terminalProviderAuthFailure('claude', text)
     const authFailure = responseAuthFailure
       ?? (!text.trim() ? terminalTextError ?? terminalProviderAuthFailure('claude', stderr) : null)
@@ -1010,6 +1020,11 @@ export async function callClaudeStreaming(
     status: Exclude<ClaudeRunStatus, 'running'> = 'failed',
   ) {
     if (finalized) return
+    if (options?.maintenancePass && !maintenanceClosed) {
+      if (terminationRequested) return
+      await terminateForTerminal('maintenance error', () => finalizeError(msg, exitCode, status))
+      return
+    }
     finalized = true
     cleanup()
     armSteerReaper()
@@ -1041,6 +1056,7 @@ export async function callClaudeStreaming(
       console.error(`[claude-bridge] provider did not close after SIGKILL (${reason}); retaining lifecycle ownership`)
       return
     }
+    maintenanceClosed = true
     await onClosed(result)
   }
 
@@ -1117,6 +1133,7 @@ export async function callClaudeStreaming(
 
   const wallTimer = setTimeout(() => {
     void terminateForTerminal('wall timeout', result => {
+      if (options?.maintenancePass) return finalizeError('maintenance_pass_timeout', result.code)
       // 6.78.0 steer: a steered run past its first whole answer completes with that answer.
       if (steerCheckpoint !== null) return finalize(steerCheckpoint)
       if (fullText) {
@@ -1338,7 +1355,9 @@ export async function callClaudeStreaming(
       } catch { /* ignore */ }
     }
 
-    if (fullText) {
+    if (options?.maintenancePass) {
+      void finalizeError('maintenance_pass_incomplete_exit', code)
+    } else if (fullText) {
       // If we got text but no explicit result event, still finalize. A sole,
       // machine-shaped auth response is classified inside finalize.
       void finalize(fullText)

package/server/lib/codex-bridge.ts

@@ -722,8 +722,16 @@ export async function callCodexStreaming(
     callbacks.onChunk(text)
   }
 
+  let maintenanceClosed = false
   async function finalize(text: string) {
     if (finalized) return
+    // A next maintenance pass may start only after the entire provider tree
+    // has closed. Normal chat retains its existing result-event behavior.
+    if (options?.maintenancePass && !maintenanceClosed) {
+      if (terminationRequested) return
+      await terminateForTerminal('maintenance checkpoint', () => finalize(text))
+      return
+    }
     const responseAuthFailure = terminalProviderAuthFailure('codex', text)
     const authFailure = responseAuthFailure
       ?? (!text.trim() ? terminalTextError ?? terminalProviderAuthFailure('codex', stderr) : null)
@@ -861,6 +869,11 @@ export async function callCodexStreaming(
 
   async function finalizeError(msg: string, exitCode?: number | null, status: Exclude<CodexRunStatus, 'running'> = 'failed') {
     if (finalized) return
+    if (options?.maintenancePass && !maintenanceClosed) {
+      if (terminationRequested) return
+      await terminateForTerminal('maintenance error', () => finalizeError(msg, exitCode, status))
+      return
+    }
     finalized = true
     // Canary R14: a Codex child keeps retrying after the bridge ends the turn; its nonce dies now.
     keyTurn?.revoke('cancel')
@@ -876,7 +889,7 @@ export async function callCodexStreaming(
       exitCode,
     })
     try {
-      await callbacks.onError(safeCodexUserError(msg))
+      await callbacks.onError(options?.maintenancePass && msg === 'maintenance_pass_timeout' ? msg : safeCodexUserError(msg))
     } catch (error) {
       console.error('[codex-bridge] terminal error callback failed:', error)
     }
@@ -910,6 +923,7 @@ export async function callCodexStreaming(
       console.error(`[codex-bridge] provider did not close after SIGKILL (${reason}); retaining lifecycle ownership`)
       return
     }
+    maintenanceClosed = true
     await onClosed(result)
   }
 
@@ -949,6 +963,7 @@ export async function callCodexStreaming(
 
   const wallTimer = setTimeout(() => {
     void terminateForTerminal('wall timeout', result => {
+      if (options?.maintenancePass) return finalizeError('maintenance_pass_timeout', result.code)
       if (fullText) return finalize(fullText)
       return finalizeError(`Wall clock limit reached (${WALL_MAX_MS / 1000}s). Codex process killed.`, result.code)
     })
@@ -1046,7 +1061,11 @@ export async function callCodexStreaming(
       try { handleEvent(JSON.parse(buffer.trim())) } catch { /* ignore */ }
     }
     runUsage.settle()
-    if (finalized) return
+    if (finalized || terminationRequested) return
+    if (options?.maintenancePass) {
+      finalizeError('maintenance_pass_incomplete_exit', code)
+      return
+    }
     if (fullText) {
       void finalize(fullText)
       return