Merge pull request #674 from straff2002/fix/support-report-findings

Six fixes from a tester's support report, and build 460

Author: straff2002

OpenGlasses/Info.plist

@@ -122,6 +122,8 @@
 	</array>
 	<key>CFBundleVersion</key>
 	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>AvenkinSourceCommit</key>
+	<string>$(AVENKIN_SOURCE_COMMIT)</string>
 	<key>LSApplicationQueriesSchemes</key>
 	<array>
 		<string>fb-viewapp</string>

OpenGlasses/Sources/App/OpenGlassesApp.swift

@@ -33,6 +33,21 @@ func privacyRoute(for url: URL) -> PrivacyLog.DeepLinkRoute {
     }
 }
 
+/// Which of the app's own actions a link asked for, when that is one of a fixed few. Never a
+/// persona or quick-action id: those are the wearer's own and identify them.
+func privacyAction(for url: URL) -> PrivacyToken? {
+    switch url.host {
+    case "connect", "disconnect":
+        return url.host.map { PrivacyToken($0) }
+    case "action", "listen":
+        let action = url.lastPathComponent
+        return ["ask", "photo", "describe", "on", "off", "toggle"].contains(action)
+            ? PrivacyToken(action) : nil
+    default:
+        return nil
+    }
+}
+
 private func processWearablesCallbackURL(_ url: URL, source: String) {
     let sourceToken = PrivacyToken(source)
     PrivacyLog.deepLink(route: .wearablesCallback, source: sourceToken, verdict: .received)
@@ -159,7 +174,18 @@ final class BackgroundSessionCompletionStore {
 final class OpenGlassesSceneDelegate: NSObject, UIWindowSceneDelegate {
     func scene(_ scene: UIScene, openURLContexts URLContexts: Set<UIOpenURLContext>) {
         for context in URLContexts {
-            processWearablesCallbackURL(context.url, source: "SceneDelegate")
+            let url = context.url
+            // The app's own links (widget, Control Centre, Action Button) arrive here as well as
+            // at the SwiftUI `onOpenURL`, which is what acts on them. They used to be handed to
+            // the glasses SDK and logged as its callback, so a photo asked for from a widget read
+            // as Meta AI calling back (support report, 2026-10-05). Named here for what they are.
+            let route = privacyRoute(for: url)
+            if DeepLinkScheme.isApp(url), route != .other {
+                PrivacyLog.deepLink(route: route, source: PrivacyToken("SceneDelegate"),
+                                    verdict: .received, action: privacyAction(for: url))
+                continue
+            }
+            processWearablesCallbackURL(url, source: "SceneDelegate")
         }
     }
 
@@ -2205,6 +2231,12 @@ class AppState: ObservableObject, AppStateProtocol {
         // isn't preferred while offline (it'd fail the network call and fall back anyway).
         speechService.reachability = reachability
 
+        // The cloud voice ran out of credit or refused the key: say so on screen, once. The
+        // wearer otherwise only hears a different voice (the spoken half is the service's own).
+        speechService.onCloudVoiceRejected = { [weak self] rejection in
+            self?.errorMessage = rejection.banner
+        }
+
         // Wire Tier 1 services
         ambientCaptions.wakeWordService = wakeWordService
         ambientCaptions.glassesDisplay = glassesDisplay

OpenGlasses/Sources/App/SupportReporting.swift

@@ -104,19 +104,28 @@ extension AppState {
     /// What only the running app knows: the phone, the glasses, the app's event log and the
     /// debug log, and the configured secrets the report is masked with.
     func supportEnvironment() -> JobTranscriptExporter.Environment {
-        let info = Bundle.main.infoDictionary
+        let app = AppBuildIdentity.current
         var phone = [
-            "App: \(info?["CFBundleShortVersionString"] as? String ?? "–") (\(info?["CFBundleVersion"] as? String ?? "–"))",
+            "App: \(app.version) (\(app.build))",
+            "Source: " + (app.commit.map { "\($0) when the Xcode project was generated" } ?? "not stamped"),
+            "Installed from: \(app.channel.rawValue) (\(app.bundleID))",
             "System: \(UIDevice.current.systemName) \(UIDevice.current.systemVersion)",
             "Device: \(Self.hardwareIdentifier)",
+            // The app's language and region, then the phone's own list: `en_MX` alone cannot say
+            // whether the phone is in English or in a language the app does not ship.
             "Language: \(Locale.current.identifier)",
+            "Phone languages: \(Locale.preferredLanguages.prefix(3).joined(separator: ", "))",
             "Mode: \(currentMode.rawValue)",
             "AI model: \(Config.activeModel?.name ?? "none set")",
             "Transcription preference: \(Config.asrEnginePreference.rawValue)",
         ]
         if isConnected {
             var glasses = "Glasses: connected"
-            if let name = glassesService.deviceName { glasses += " — \(name)" }
+            // A pair the SDK has not named yet reports an empty name, not a missing one.
+            if let name = glassesService.deviceName?.trimmingCharacters(in: .whitespaces),
+               !name.isEmpty {
+                glasses += " — \(name)"
+            }
             if let battery = glassesService.batteryLevel { glasses += ", battery \(battery)%" }
             phone.append(glasses)
             phone.append("Glasses display: \(glassesDisplay.hasDisplayCapability ? "yes" : "no")")
@@ -130,7 +139,7 @@ extension AppState {
         let events = (ring.previousEntries + ring.entries).map {
             JobTranscriptExport.AppEvent(at: $0.timestamp, line: $0.line)
         }
-        return .init(phone: phone, appEvents: events, debugLog: Array(debugEvents.suffix(60)),
+        return .init(phone: phone, app: app.summary, appEvents: events, debugLog: Array(debugEvents.suffix(60)),
                      secrets: Config.knownSecretValues)
     }
 

OpenGlasses/Sources/Services/Camera/MetaCameraBackend.swift

@@ -301,7 +301,18 @@ final class MetaCameraBackend: GlassesCameraBackend {
     }
 
     private func ensureSessionLocked() async throws {
-        guard streamSession == nil else { return }
+        if streamSession != nil {
+            // A stream is only as alive as the session it hangs off. A session that has stopped
+            // under a parked stream (device-reported 2026-10-05: an `unexpectedError` half a
+            // minute after a capture, then nothing for sixteen minutes) leaves a stream whose
+            // `start()` fails at once, and the next capture spent its first attempt finding that
+            // out. Anything short of stopped is left alone — a hold lifts on its own.
+            guard let session = deviceSession,
+                  session.state == .stopped || session.state == .stopping else { return }
+            PrivacyLog.camera(.glasses, .staleSessionDropped,
+                              state: PrivacyToken(String(describing: session.state)))
+            await resetSessionLocked()
+        }
 
         // Fresh attempt, fresh verdict: an error from a previous attempt must not abort this one.
         lastSessionError = nil
@@ -775,24 +786,13 @@ final class MetaCameraBackend: GlassesCameraBackend {
 
     // MARK: - Photo Capture
 
-    /// Capture a photo from the glasses camera. Returns JPEG data.
+    /// Bring the session up, waiting out the windows in which a healthy pair cannot be reached.
     ///
-    /// NOTE (device-reported, unverified here): `capturePhoto` also works on a stream that
-    /// was added but never `start()`ed, and capturing on a *streaming* stream has been
-    /// reported to race the frame flow and trip the glasses-side frame-stall watchdog.
-    /// Our start-then-capture path is field-traced and carries the frame fallback, so it
-    /// stays; if captures ever start stalling the stream, try the no-start discrete path
-    /// before reaching for bigger hammers.
-    func capturePhoto() async throws -> Data {
-        isCaptureInProgress = true
-        defer { isCaptureInProgress = false }
-        // Cleared as well as cancelled: a cancelled task that is still referenced would keep
-        // counting towards `scheduledWorkCount`, which is meant to be the truth about what is armed.
-        idleTeardownTask?.cancel()   // a capture during the idle grace keeps the session
-        idleTeardownTask = nil
-
-        try await ensurePermission()
-
+    /// Shared by the first start of a capture and the rebuild after a failed warm-up. The rebuild
+    /// used to get a single try with no wait, so a session the glasses refused in the first second
+    /// back from the background ended the capture there (device-reported 2026-10-05), in exactly
+    /// the window the first start is given twelve seconds to sit out.
+    private func ensureSessionWithRetry() async throws {
         // The DAT link drops when the glasses idle (battery saving) and discovery lags app
         // launch by seconds — a session created in that window throws noEligibleDevice
         // ("all discovered devices are powered off or disconnected") even though the glasses
@@ -846,6 +846,27 @@ final class MetaCameraBackend: GlassesCameraBackend {
             }
             throw rootError
         }
+    }
+
+    /// Capture a photo from the glasses camera. Returns JPEG data.
+    ///
+    /// NOTE (device-reported, unverified here): `capturePhoto` also works on a stream that
+    /// was added but never `start()`ed, and capturing on a *streaming* stream has been
+    /// reported to race the frame flow and trip the glasses-side frame-stall watchdog.
+    /// Our start-then-capture path is field-traced and carries the frame fallback, so it
+    /// stays; if captures ever start stalling the stream, try the no-start discrete path
+    /// before reaching for bigger hammers.
+    func capturePhoto() async throws -> Data {
+        isCaptureInProgress = true
+        defer { isCaptureInProgress = false }
+        // Cleared as well as cancelled: a cancelled task that is still referenced would keep
+        // counting towards `scheduledWorkCount`, which is meant to be the truth about what is armed.
+        idleTeardownTask?.cancel()   // a capture during the idle grace keeps the session
+        idleTeardownTask = nil
+
+        try await ensurePermission()
+
+        try await ensureSessionWithRetry()
 
         // Wait for stream to be ready (start if needed). Both attempts get the full warmup window
         // — see `StreamRecoveryPolicy.warmupTimeout` for why a shortened first attempt punished
@@ -863,7 +884,7 @@ final class MetaCameraBackend: GlassesCameraBackend {
                 if attempt < 2 {
                     // Reset session and retry
                     await resetSession()
-                    try await ensureSession()
+                    try await ensureSessionWithRetry()
                     try await Task.sleep(nanoseconds: 1_000_000_000)
                 }
             }

OpenGlasses/Sources/Services/FieldAssist/Job/JobTranscriptExport.swift

@@ -90,6 +90,9 @@ enum JobTranscriptExport {
         var jobEvents: [String: [SessionLogger.Event]] = [:]
         /// The phone, app and glasses, one fact per line.
         var phone: [String] = []
+        /// Which copy of the app wrote this (`AppBuildIdentity.summary`), for the header: the
+        /// first thing anyone reading a report needs, and it used to sit below the transcript.
+        var app: String?
         /// The app's event log (`DiagnosticRing`) within the scope's window.
         var appEvents: [AppEvent] = []
         /// The newest lines of the in-app debug log.
@@ -313,9 +316,9 @@ enum JobTranscriptExport {
         var out: [String] = [
             "Avenkin — \(title)",
             "Exported \(format.dateTime(exportedAt)) (\(format.offset(exportedAt)))",
-            "",
-            preamble,
         ]
+        if let app = details?.app { out.append("App \(app)") }
+        out += ["", preamble]
         if troubleshooting { out += ["", troubleshootingPreamble] }
 
         // Which traces belong where. A trace is claimed by the first thing it matches, so no turn
@@ -586,6 +589,7 @@ enum JobTranscriptExporter {
     /// the configured secrets to mask.
     struct Environment {
         var phone: [String] = []
+        var app: String?
         var appEvents: [JobTranscriptExport.AppEvent] = []
         var debugLog: [String] = []
         var secrets: [String] = []
@@ -680,6 +684,7 @@ enum JobTranscriptExporter {
                 traces: scoped,
                 jobEvents: events,
                 phone: environment.phone,
+                app: environment.app,
                 appEvents: environment.appEvents.filter { $0.at >= window.start && $0.at < window.end },
                 debugLog: environment.debugLog)
         }

OpenGlasses/Sources/Services/GeminiLive/GeminiLiveSessionManager.swift

@@ -661,6 +661,9 @@ class GeminiLiveSessionManager: ObservableObject {
             """
         }
 
+        // Where the assistant's own settings live — the same block Direct Mode carries.
+        prompt += "\n\n" + SystemPromptBuilder.appGuide(appName: RegistrationFlow.appName)
+
         // Add tool instructions
         let hasNativeTools = nativeToolRouter != nil
         let hasOpenClaw = Config.isOpenClawAgentActive   // BK P0: don't advertise the gateway with Agent Mode off

OpenGlasses/Sources/Services/LLMService.swift

@@ -484,6 +484,11 @@ class LLMService: ObservableObject {
 
         closeBlock("vision guidance")
 
+        // Where the assistant's own settings live. Unconditional and in the stable head: a question
+        // about the app matches no classifier section, and the text never changes turn to turn.
+        prompt += "\n\n" + SystemPromptBuilder.appGuide(appName: RegistrationFlow.appName)
+        closeBlock("app guide")
+
         if includeTools && shouldInclude(.tools) {
             var toolSection = """
 

OpenGlasses/Sources/Services/SystemPromptBuilder.swift

@@ -34,6 +34,30 @@ enum SystemPromptBuilder {
         return rules.map(flatten).joined(separator: "\n")
     }
 
+    /// Where the assistant's own settings live in this app, so "how do I change your voice?" gets
+    /// the real path. Without it the model has never heard of the app it runs in and answers from
+    /// general knowledge — the iPhone's Settings, the glasses' own app, Siri — none of which hold
+    /// these settings (support report, 2026-10-05). The category names come from `SettingsCatalog`,
+    /// the hub's own source, so the guide cannot name a screen the hub does not draw.
+    static func appGuide(appName: String) -> String {
+        func title(_ id: SettingsCategoryID) -> String { SettingsCatalog.category(id).title }
+        return """
+        THIS APP:
+        You run inside the \(appName) app on the user's iPhone, and the app's own Settings tab is where you are set up. \
+        When asked how to change something about you, give the path below. These settings are NOT in the iPhone's \
+        Settings app, the glasses' companion app or Siri — never send the user there for them.
+        - Your voice (voice engine, ElevenLabs key and voice, built-in iOS voice): Settings > \(title(.connections)) > Services & Integrations.
+        - Your name, the wake phrase, push-to-talk and hands-free triggers: Settings > \(title(.voice)).
+        - The AI model, personas and system prompt: Settings > \(title(.intelligence)).
+        - Tools and quick actions: Settings > \(title(.tools)).
+        - The glasses, microphone and privacy: Settings > \(title(.devices)).
+        - Theme and languages: Settings > \(title(.lookAndFeel)).
+        The one exception: a better-sounding built-in voice is downloaded in the iPhone's Settings > Accessibility > \
+        Spoken Content > Voices, and then picked under iOS Voice in the app.
+        You cannot change these settings yourself. Some are hidden in Simple Mode or on a phone an organisation manages.
+        """
+    }
+
     /// Collapse a multi-line tool description into one line so it reads as a single bullet.
     private static func flatten(_ description: String) -> String {
         description

OpenGlasses/Sources/Services/TTS/CloudVoiceFallback.swift

@@ -0,0 +1,71 @@
+import Foundation
+
+/// Why the cloud voice turned a request away, when the wearer is the only one who can fix it.
+///
+/// A network blip or a server error falls through to the next engine and is nobody's business.
+/// These two are different: they repeat on every reply until the wearer tops up or corrects the
+/// key, and until now the only sign was a worse voice with no explanation (support report,
+/// 2026-10-05 — the wearer went looking for a voice setting to undo a change they never made).
+enum CloudVoiceRejection: String, Equatable, CaseIterable {
+    /// The account has no credit left. ElevenLabs sends this as a 401 whose body names
+    /// `quota_exceeded`, so the status alone cannot tell it from a bad key.
+    case outOfCredit
+    /// The key, or the voice chosen for it, was refused.
+    case refused
+
+    static func classify(statusCode: Int, body: String) -> CloudVoiceRejection? {
+        if body.contains("quota_exceeded") { return .outOfCredit }
+        switch statusCode {
+        case 401, 402, 403: return .refused
+        default: return nil
+        }
+    }
+
+    /// Said once, after the reply it interrupted. The path is spoken as words: a wearer who is not
+    /// looking at the phone has to be able to find it later from memory.
+    var spokenLine: String {
+        switch self {
+        case .outOfCredit:
+            return String(localized: "By the way, your ElevenLabs credit has run out, so I'm using the built-in voice. You can change voices in the app's Settings, under Connections, then Services and Integrations.")
+        case .refused:
+            return String(localized: "By the way, ElevenLabs refused the voice request, so I'm using the built-in voice. Check the key and voice in the app's Settings, under Connections, then Services and Integrations.")
+        }
+    }
+
+    /// The same news for the screen.
+    var banner: String {
+        switch self {
+        case .outOfCredit:
+            return String(localized: "ElevenLabs is out of credit, so replies use the built-in voice. Change voices in Settings › Connections › Services & Integrations.")
+        case .refused:
+            return String(localized: "ElevenLabs refused the voice request, so replies use the built-in voice. Check the key and voice in Settings › Connections › Services & Integrations.")
+        }
+    }
+}
+
+/// When a rejection is worth saying aloud. Once per episode, not once per launch: a wearer who has
+/// decided to live with the built-in voice should not be told again every morning. The episode ends
+/// when the cloud voice speaks again or the wearer changes the key or voice.
+struct CloudVoiceFallbackAnnouncer {
+    static let defaultsKey = "cloudVoiceFallbackAnnounced"
+
+    var defaults: UserDefaults = .standard
+
+    /// The line to add to this utterance, or nil when this rejection has been said already or the
+    /// utterance is not one to append to.
+    ///
+    /// - Parameter plainReply: an ordinary reply at neutral urgency. An alert or a warning is
+    ///   never lengthened with housekeeping, and stays unannounced until the next ordinary reply.
+    mutating func lineToSpeak(for rejection: CloudVoiceRejection, plainReply: Bool) -> String? {
+        guard plainReply, defaults.string(forKey: Self.defaultsKey) != rejection.rawValue else {
+            return nil
+        }
+        defaults.set(rejection.rawValue, forKey: Self.defaultsKey)
+        return rejection.spokenLine
+    }
+
+    /// The cloud voice is working, or its key or voice has changed: the next rejection is news.
+    func episodeEnded() {
+        defaults.removeObject(forKey: Self.defaultsKey)
+    }
+}