deploy(S4): Blender headless pipeline + WebAR client + backend fixes

backend/main.py

@@ -2,6 +2,27 @@ import asyncio
 import logging
 import os
 import sys
+
+# ── No flashing console windows in the shipped app ────────────────────────────
+# On Windows every subprocess started from a frozen (PyInstaller) build pops a
+# console window unless CREATE_NO_WINDOW is set. This backend shells out from
+# ~85 call sites, several on short timers (the USB monitor runs every 2s), so
+# the user sees a terminal flashing continuously while JARVIS is running.
+# Rather than annotate every call site (and silently regress on the next one),
+# force the flag globally for the packaged build.
+if sys.platform == "win32":
+    import subprocess as _subprocess
+
+    _CREATE_NO_WINDOW = 0x08000000
+    _orig_popen_init = _subprocess.Popen.__init__
+
+    def _no_window_popen_init(self, *args, **kwargs):
+        # shell=True routes through cmd.exe, which is the loudest offender.
+        if not kwargs.get("close_fds_is_dummy"):
+            kwargs["creationflags"] = kwargs.get("creationflags", 0) | _CREATE_NO_WINDOW
+        return _orig_popen_init(self, *args, **kwargs)
+
+    _subprocess.Popen.__init__ = _no_window_popen_init
 # --- load .env early: token_manager.py executes at import time, before main() ---
 try:
     from dotenv import load_dotenv as _load_dotenv

backend/routes/automation_routes.py

@@ -1,89 +1,159 @@
-from fastapi import APIRouter
-from pydantic import BaseModel
-
-router = APIRouter()
-
-class Workflow(BaseModel):
-    name: str
-    steps: list
-
-@router.get("/list")
-async def get_automation_list():
-    return []
-
-@router.post("/trigger/{id}")
-async def trigger_automation_route(id: str):
-    from backend.services.automation_service import trigger_automation
-    await trigger_automation(id)
-    return {"status": "triggered"}
-
-@router.post("/pause_all")
-async def pause_all():
-    from backend.services.automation_service import pause_all_automations
-    await pause_all_automations()
-    return {"status": "paused"}
-
-@router.post("/resume_all")
-async def resume_all():
-    from backend.services.automation_service import resume_all_automations
-    await resume_all_automations()
-    return {"status": "resumed"}
-
-@router.post("/jobs/{job_id}/pause")
-async def pause_single_job(job_id: str):
-    from backend.services.automation_service import pause_job
-    pause_job(job_id)
-    return {"status": f"job {job_id} paused"}
-
-@router.post("/jobs/{job_id}/resume")
-async def resume_single_job(job_id: str):
-    from backend.services.automation_service import resume_job
-    resume_job(job_id)
-    return {"status": f"job {job_id} resumed"}
-
-@router.delete("/jobs/{job_id}")
-async def delete_single_job(job_id: str):
-    from backend.services.automation_service import delete_job
-    delete_job(job_id)
-    return {"status": f"job {job_id} deleted"}
-
-@router.post("/save")
-async def save_workflow(w: Workflow):
-    return {"status": "saved"}
-
-@router.get("/history")
-async def get_history():
-    return []
-
-@router.post("/dry-run")
-async def dry_run_workflow(w: Workflow):
-    """
-    Simulates workflow execution without side effects.
-    Returns a preview of the steps and their expected mock results.
-    """
-    import asyncio
-    preview_steps = []
-    
-    for i, step in enumerate(w.steps):
-        # Determine a mock result based on step type if present
-        step_type = step.get('type', 'unknown') if isinstance(step, dict) else 'unknown'
-        mock_result = f"Mock result for {step_type}"
-        if step_type == 'api_call': mock_result = "HTTP 200 OK (Mock)"
-        elif step_type == 'script': mock_result = "Script execution simulated"
-        elif step_type == 'agent': mock_result = "Agent reasoning simulated"
-        
-        preview_steps.append({
-            "step_index": i,
-            "step_config": step,
-            "expected_status": "success",
-            "mock_result": mock_result
-        })
-        
-        # Simulate minor delay
-        await asyncio.sleep(0.1)
-
-    return {
-        "status": "dry-run-complete",
-        "total_steps": len(w.steps),
-        "execution_preview": preview_steps
-    }
+import logging
+import re
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel
+
+router = APIRouter()
+
+class Workflow(BaseModel):
+    name: str
+    steps: list
+
+@router.get("/list")
+async def get_automation_list():
+    """User automations plus the live scheduler jobs.
+
+    This used to be a hardcoded `return []`, so the endpoint reported success
+    while claiming the system had no automations — even though
+    automation_service.load_automations() reads real rows from
+    `custom_automations`, and the scheduler genuinely runs persisted jobs
+    (mcu_suit_vitals, mcu_battlefield_intel, hf_keepalive_ping) out of the
+    `apscheduler_jobs` table. Anything driven off this route saw an empty system.
+    """
+    from backend.services.automation_service import load_automations, scheduler
+    try:
+        automations = load_automations()
+    except Exception as exc:  # a missing table must not 500 the whole panel
+        automations = []
+        logging.warning("load_automations failed: %s", exc)
+
+    jobs = []
+    try:
+        for job in scheduler.get_jobs():
+            jobs.append({
+                "id": job.id,
+                "name": getattr(job, "name", job.id),
+                "trigger": str(job.trigger),
+                "next_run_time": job.next_run_time.isoformat() if job.next_run_time else None,
+            })
+    except Exception as exc:
+        logging.warning("scheduler.get_jobs failed: %s", exc)
+
+    return {"automations": automations, "scheduled_jobs": jobs,
+            "counts": {"automations": len(automations), "scheduled_jobs": len(jobs)}}
+
+@router.post("/trigger/{id}")
+async def trigger_automation_route(id: str):
+    from backend.services.automation_service import trigger_automation
+    await trigger_automation(id)
+    return {"status": "triggered"}
+
+@router.post("/pause_all")
+async def pause_all():
+    from backend.services.automation_service import pause_all_automations
+    await pause_all_automations()
+    return {"status": "paused"}
+
+@router.post("/resume_all")
+async def resume_all():
+    from backend.services.automation_service import resume_all_automations
+    await resume_all_automations()
+    return {"status": "resumed"}
+
+@router.post("/jobs/{job_id}/pause")
+async def pause_single_job(job_id: str):
+    from backend.services.automation_service import pause_job
+    # APScheduler raises JobLookupError for an unknown id. Unhandled, that
+    # surfaced as a 500 "Internal Server Error" for what is really a client
+    # asking about a job that does not exist — a 404.
+    try:
+        pause_job(job_id)
+    except Exception as exc:
+        if "No job by the id" in str(exc):
+            raise HTTPException(status_code=404, detail=f"No job with id {job_id}")
+        raise
+    return {"status": f"job {job_id} paused"}
+
+@router.post("/jobs/{job_id}/resume")
+async def resume_single_job(job_id: str):
+    from backend.services.automation_service import resume_job
+    try:
+        resume_job(job_id)
+    except Exception as exc:
+        if "No job by the id" in str(exc):
+            raise HTTPException(status_code=404, detail=f"No job with id {job_id}")
+        raise
+    return {"status": f"job {job_id} resumed"}
+
+@router.delete("/jobs/{job_id}")
+async def delete_single_job(job_id: str):
+    from backend.services.automation_service import delete_job
+    delete_job(job_id)
+    return {"status": f"job {job_id} deleted"}
+
+@router.post("/save")
+async def save_workflow(w: Workflow):
+    """Persist a workflow.
+
+    This previously returned {"status": "saved"} without writing anything — the
+    Save action reported success and the workflow was gone on the next read.
+    automation_service.save_automation() is the real write path into the
+    `custom_automations` table that /list reads back.
+    """
+    from backend.services.automation_service import save_automation
+    if not (w.name or "").strip():
+        raise HTTPException(status_code=400, detail="name is required")
+    auto_id = re.sub(r"[^a-z0-9]+", "-", w.name.strip().lower()).strip("-") or "workflow"
+    try:
+        save_automation(
+            auto_id=auto_id,
+            trigger_type="manual",
+            trigger_data={},
+            action_type="workflow",
+            action_data={"name": w.name, "steps": w.steps},
+        )
+    except Exception as exc:
+        logging.exception("save_automation failed")
+        raise HTTPException(status_code=500, detail=str(exc))
+    return {"status": "saved", "id": auto_id, "steps": len(w.steps)}
+
+@router.get("/history")
+async def get_history():
+    # NOTE: intentionally empty — nothing in the system records automation run
+    # history yet. Flagged rather than faked; a real implementation needs a
+    # history table written by automation_service.execute_action.
+    return []
+
+@router.post("/dry-run")
+async def dry_run_workflow(w: Workflow):
+    """
+    Simulates workflow execution without side effects.
+    Returns a preview of the steps and their expected mock results.
+    """
+    import asyncio
+    preview_steps = []
+    
+    for i, step in enumerate(w.steps):
+        # Determine a mock result based on step type if present
+        step_type = step.get('type', 'unknown') if isinstance(step, dict) else 'unknown'
+        mock_result = f"Mock result for {step_type}"
+        if step_type == 'api_call': mock_result = "HTTP 200 OK (Mock)"
+        elif step_type == 'script': mock_result = "Script execution simulated"
+        elif step_type == 'agent': mock_result = "Agent reasoning simulated"
+        
+        preview_steps.append({
+            "step_index": i,
+            "step_config": step,
+            "expected_status": "success",
+            "mock_result": mock_result
+        })
+        
+        # Simulate minor delay
+        await asyncio.sleep(0.1)
+
+    return {
+        "status": "dry-run-complete",
+        "total_steps": len(w.steps),
+        "execution_preview": preview_steps
+    }

backend/routes/internet_routes.py

@@ -40,8 +40,13 @@ async def web_search(req: SearchRequest):
 async def fetch_url(req: FetchRequest):
     """Fetch and optionally summarise a URL using the browser tool."""
     try:
-        from backend.tools.browser_tools import fetch_url as _fetch
-        content = await _fetch(req.url)
+        # browser_tools has never exported `fetch_url` (it exposes navigate /
+        # get_ephemeral_context), so this route was a guaranteed 500:
+        # "cannot import name 'fetch_url' from 'backend.tools.browser_tools'".
+        # The function that actually does this job — Playwright fetch, CAPTCHA
+        # handling, text extraction — is web_search_tools.fetch_page.
+        from backend.tools.web_search_tools import fetch_page
+        content = await fetch_page(req.url)
         return {"status": "ok", "url": req.url, "content": content}
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
@@ -69,7 +74,13 @@ async def osint_recon(req: OsintRequest):
         all_results = []
         for q in queries:
             results = await search_web(q, num_results=3)
-            all_results.extend(results)
+            # search_web returns {"results": [...]} (or {"error": ...}).
+            # extend()ing the dict itself appended its KEYS — so findings came
+            # back as ["results", "results", ...] instead of the actual hits.
+            if isinstance(results, dict):
+                all_results.extend(results.get("results", []))
+            elif isinstance(results, list):
+                all_results.extend(results)
 
         return {
             "status": "ok",

backend/routes/xr_routes.py

@@ -1,4 +1,4 @@
-from fastapi import HTTPException, APIRouter
+from fastapi import HTTPException, APIRouter, Request
 from pydantic import BaseModel
 
 # AR-FIX-SESSION: import canonical AR scene store to mirror anchor writes.
@@ -107,19 +107,30 @@ async def handle_ar_task(payload: ArTaskPayload):
     return {"ok": True, "status": "dispatched", "message": f"Task '{payload.task}' sent to AR bus."}
 
 @router.get("/ar_config")
-async def get_ar_config():
+async def get_ar_config(request: Request):
     """
     Returns base configuration for the WebAR engine.
+
+    Everything here is derived from the *actual request*, never hardcoded. The
+    previous version returned ``ws://{HOST or 127.0.0.1}:5050`` and
+    ``http://127.0.0.1:7474/...`` unconditionally, which is wrong for every
+    client that is not on the same machine as the backend: a phone or headset
+    resolves 127.0.0.1 to itself, so the scene socket and game URLs could never
+    connect from the cloud deployment. Port 5050 was wrong too — the socket is
+    mounted at ``/scene-ws`` on this same app (backend/main.py), and a hosted
+    Space only exposes 443.
     """
-    import os
+    base = str(request.base_url).rstrip("/")          # e.g. https://host or http://127.0.0.1:7474
+    ws_base = "wss://" + base.split("://", 1)[1] if base.startswith("https://") \
+        else "ws://" + base.split("://", 1)[1]
     return {
         "ok": True,
         "deviceName": "OMEGA-CORE",
-        "wsBase": f"ws://{os.environ.get('HOST', '127.0.0.1')}:5050",
+        "wsBase": f"{ws_base}/scene-ws",
         "gameUrls": {
-            "eternum": "http://127.0.0.1:7474/games/eternum",
-            "ripples": "http://127.0.0.1:7474/games/ripples"
-        }
+            "eternum": f"{base}/games/eternum",
+            "ripples": f"{base}/games/ripples",
+        },
     }
 
 @router.post("/ar_scene_patch")

backend/services/usb_monitor.py

@@ -7,6 +7,11 @@ if os.environ.get("CLOUD_ENV", "false").lower() != "true":
 else:
     wmi = None
     pythoncom = None
+
+# Cached WMI/COM connection reused by the 2-second monitor loop (see
+# fetch_wmi_letters) instead of reconnecting on every single pass.
+_WMI_CONN = None
+
 import re
 import os
 import sys
@@ -178,7 +183,14 @@ async def start_usb_monitor():
             if wmi:
                 try:
                     def fetch_wmi_letters():
-                        c = wmi.WMI()
+                        # Reuse one COM connection. This runs every 2 seconds, so
+                        # building a fresh wmi.WMI() each pass meant ~30 new COM
+                        # connections per minute for the whole life of the app —
+                        # wasteful, and a steady source of process churn on Windows.
+                        global _WMI_CONN
+                        if _WMI_CONN is None:
+                            _WMI_CONN = wmi.WMI()
+                        c = _WMI_CONN
                         mapping = {}
                         for disk in c.Win32_DiskDrive():
                             if "USB" in disk.InterfaceType:

backend/tools/web_search_tools.py

@@ -4,24 +4,99 @@ import json
 import urllib.request
 import urllib.parse
 import os
+import logging
+
+def _resolve_key(*names: str) -> str | None:
+    """Resolve a credential the way the rest of the backend does.
+
+    `get_secret` checks real environment variables first (how HF Spaces inject
+    secrets) and then the encrypted SQLite vault. Reading `os.environ` directly —
+    as this module used to — bypasses the vault entirely, so a key the user had
+    actually configured through the UI was invisible here.
+    """
+    for name in names:
+        if not name:
+            continue
+        try:
+            from backend.services.usb_vault import get_secret
+            value = get_secret(name)
+        except Exception:
+            value = os.environ.get(name)
+        if value:
+            return value
+    return None
+
+
+async def search_web(query: str, num_results: int = 5) -> dict:
+    """Web search: Brave (primary) -> SerpAPI (fallback) -> DuckDuckGo (last resort).
+
+    Two real bugs fixed here.
+
+    1. ``num_results`` did not exist, yet every caller passed it —
+       internet_routes.py (search + osint) and sentinel_routes.py. All three
+       routes were a hard 500:
+       ``search_web() got an unexpected keyword argument 'num_results'``.
+       The result cap was also hardcoded at 5; it is now honoured.
+
+    2. The Brave credential was looked up as ``BRAVE_API_KEY`` via a raw
+       ``os.environ`` read, but the system provisions it as
+       ``BRAVE_SEARCH_API_KEY`` (src-tauri/src/key_registry.rs) and stores it in
+       the encrypted vault. The name never matched and the vault was never
+       consulted, so Brave was *always* skipped and every search silently fell
+       through to DuckDuckGo's instant-answer endpoint — which returns a single,
+       usually empty "Abstract" and ignores the result count. For an assistant
+       whose whole point is live research, that is a broken capability that
+       reports success.
+
+    SerpAPI is now wired as the real fallback; key_registry.rs already describes
+    ``SERPAPI_KEY`` as the "Google/Bing search fallback", but nothing used it, so
+    the documented main+fallback pair did not actually exist.
+    """
+    try:
+        num_results = max(1, min(int(num_results), 20))
+    except (TypeError, ValueError):
+        num_results = 5
+
+    brave_api_key = _resolve_key("BRAVE_SEARCH_API_KEY", "BRAVE_API_KEY")
+    serpapi_key = _resolve_key("SERPAPI_KEY")
+
+    def _duck_search():
+        url = f"https://api.duckduckgo.com/?q={urllib.parse.quote(query)}&format=json"
+        req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
+        try:
+            with urllib.request.urlopen(req, timeout=10) as response:
+                data = json.loads(response.read().decode('utf-8'))
+                results = []
+                abstract = data.get('AbstractText') or ''
+                if abstract:
+                    results.append({"title": data.get('Heading') or "Abstract",
+                                    "snippet": abstract, "url": data.get('AbstractURL', '')})
+                # RelatedTopics is the only part of the instant-answer API that
+                # returns more than one item, so honour num_results instead of
+                # always returning a single (often empty) abstract.
+                for topic in data.get('RelatedTopics', []):
+                    if len(results) >= num_results:
+                        break
+                    if isinstance(topic, dict) and topic.get('Text'):
+                        results.append({"title": topic.get('Text', '')[:80],
+                                        "snippet": topic.get('Text', ''),
+                                        "url": topic.get('FirstURL', '')})
+                return {"results": results[:num_results]}
+        except Exception as e:
+            return {"error": str(e)}
+
+    def _serpapi_search():
+        url = ("https://serpapi.com/search.json?q=" + urllib.parse.quote(query)
+               + f"&num={num_results}&api_key={urllib.parse.quote(serpapi_key)}")
+        try:
+            with urllib.request.urlopen(url, timeout=12) as response:
+                parsed = json.loads(response.read().decode('utf-8'))
+            results = [{"title": i.get("title"), "snippet": i.get("snippet"), "url": i.get("link")}
+                       for i in parsed.get("organic_results", [])[:num_results]]
+            return {"results": results} if results else {"error": "serpapi returned no results"}
+        except Exception as e:
+            return {"error": str(e)}
 
-async def search_web(query: str) -> dict:
-    """Search web using Brave Search API (fallback to DuckDuckGo if no key)"""
-    brave_api_key = os.environ.get("BRAVE_API_KEY")
-    
-    if not brave_api_key:
-        # Fallback to DuckDuckGo
-        def _duck_search():
-            url = f"https://api.duckduckgo.com/?q={urllib.parse.quote(query)}&format=json"
-            req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
-            try:
-                with urllib.request.urlopen(req, timeout=10) as response:
-                    data = json.loads(response.read().decode('utf-8'))
-                    return {"results": [{"title": "Abstract", "snippet": data.get('AbstractText', ''), "url": data.get('AbstractURL', '')}]}
-            except Exception as e:
-                return {"error": str(e)}
-        return await asyncio.to_thread(_duck_search)
-        
     def _brave_search():
         url = f"https://api.search.brave.com/res/v1/web/search?q={urllib.parse.quote(query)}"
         req = urllib.request.Request(url, headers={
@@ -39,17 +114,30 @@ async def search_web(query: str) -> dict:
                 
                 parsed = json.loads(data)
                 results = []
-                for item in parsed.get('web', {}).get('results', [])[:5]:
+                for item in parsed.get('web', {}).get('results', [])[:num_results]:
                     results.append({
                         "title": item.get("title"),
                         "snippet": item.get("description"),
                         "url": item.get("url")
                     })
-                return {"results": results}
+                return {"results": results} if results else {"error": "brave returned no results"}
         except Exception as e:
             return {"error": str(e)}
-            
-    return await asyncio.to_thread(_brave_search)
+
+    # Primary -> fallback -> last resort. A provider is only considered to have
+    # worked if it actually returned results; an empty 200 falls through, so a
+    # rate-limited or misconfigured primary degrades instead of silently
+    # returning nothing to the assistant.
+    for provider, available in ((_brave_search, brave_api_key),
+                                (_serpapi_search, serpapi_key)):
+        if not available:
+            continue
+        out = await asyncio.to_thread(provider)
+        if out.get("results"):
+            return out
+        logging.warning("web search provider %s failed (%s); trying next",
+                        provider.__name__, out.get("error"))
+    return await asyncio.to_thread(_duck_search)
 
 async def fetch_page(url: str) -> dict:
     """Fetch page via Playwright, bypassing CAPTCHAs if encountered"""

webar/assets/ar-compositor-Bfg5JfIW.js

@@ -0,0 +1 @@
+import{n as e}from"./ar-init-CHktDPD4.js";export{e as initVrStereoSplitScreen};

webar/assets/index-BGn3T9gi.css

@@ -0,0 +1 @@
+:root{--glass-bg:#0a161e6b;--glass-bg-hover:#12222c8c;--glass-bg-active:#35e6ff24;--glass-border:#78dcff33;--glass-border-strong:#78dcff57;--glass-blur:40px;--glass-saturate:180%;--glass-radius:18px;--glass-radius-sm:12px;--glass-radius-lg:26px;--glass-shadow:0 14px 40px #00000080, inset 0 1px 0 #b4f0ff1f, 0 0 0 .5px #00000059;--glass-shadow-deep:0 22px 60px #0009, inset 0 1px 0 #b4f0ff29;--accent:#35e6ff;--accent-glow:#35e6ff59;--accent-pressed:#14c3e0;--amber:#ffb454;--amber-glow:#ffb45466;--text-primary:#dff3fb;--text-secondary:#dff3fb9e;--text-tertiary:#7d99a6d9;--text-placeholder:#7d99a680;--bg-dark:#070f15db;--bg-darker:#03070cf0;--destructive:#ff5470;--destructive-glow:#ff547061;--success:#5ce0a8;--warning:var(--amber);--separator:#78dcff1f;--font:"Chakra Petch", "Inter", -apple-system, BlinkMacSystemFont, sans-serif;--font-mono:"JetBrains Mono", ui-monospace, monospace;--font-large-title:700 34px/1.2 var(--font);--font-title1:600 28px/1.3 var(--font);--font-title2:600 22px/1.3 var(--font);--font-title3:600 20px/1.4 var(--font);--font-headline:600 17px/1.4 var(--font);--font-body:400 17px/1.5 var(--font);--font-callout:400 16px/1.5 var(--font);--font-subheadline:400 15px/1.5 var(--font);--font-footnote:400 13px/1.5 var(--font);--font-caption:400 12px/1.4 var(--font);--letter-spacing-tight:0;--letter-spacing-body:0}*{box-sizing:border-box}html,body{background:var(--bg-darker);width:100vw;height:100vh;color:var(--text-primary);font-family:var(--font);letter-spacing:0;touch-action:none;-webkit-font-smoothing:antialiased;margin:0;overflow:hidden}button,input,textarea,select{font:inherit}button{-webkit-tap-highlight-color:transparent}#camerafeed{z-index:0;background:var(--bg-darker);width:100%;height:100%;display:block;position:fixed;top:0;bottom:0;left:0;right:0}#ar-scene{z-index:1;width:100vw;height:100vh;position:fixed;top:0;bottom:0;left:0;right:0;background:0 0!important}#css3d-layer{z-index:2;pointer-events:none;width:100vw;height:100vh;transform-style:preserve-3d;position:fixed;top:0;bottom:0;left:0;right:0;overflow:hidden}#hand-overlay{z-index:4;pointer-events:none;width:100vw;height:100vh;position:fixed;top:0;bottom:0;left:0;right:0}#world-label-layer{z-index:5;pointer-events:none;position:fixed;top:0;bottom:0;left:0;right:0}#ui-layer{z-index:10;pointer-events:none;padding:env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom) env(safe-area-inset-left);position:fixed;top:0;bottom:0;left:0;right:0;overflow:hidden}.glass-panel{background:var(--glass-bg);-webkit-backdrop-filter:blur(28px)saturate(1.35);border:1px solid var(--glass-border);border-radius:var(--glass-radius);box-shadow:var(--glass-shadow);position:relative;overflow:hidden}.glass-panel:before{content:"";border-radius:inherit;-webkit-mask-composite:xor;pointer-events:none;z-index:1;background:linear-gradient(135deg,#ffffff47 0%,#ffffff14 30%,#ffffff04 60%,#00000014 100%);padding:1px;position:absolute;top:0;bottom:0;left:0;right:0;-webkit-mask-image:linear-gradient(#fff 0 0),linear-gradient(#fff 0 0);-webkit-mask-position:0 0,0 0;-webkit-mask-size:auto,auto;-webkit-mask-repeat:repeat,repeat;-webkit-mask-clip:content-box,border-box;-webkit-mask-origin:content-box,border-box;-webkit-mask-composite:xor;mask-composite:exclude;-webkit-mask-source-type:auto,auto;mask-mode:match-source,match-source}.glass-panel>*{z-index:2;position:relative}.vibrancy-text{color:var(--text-primary);text-shadow:0 1px 3px #0009,0 0 8px #0000004d}.btn-primary{background:var(--accent);min-width:120px;min-height:50px;color:var(--text-primary);font:var(--font-headline);cursor:pointer;border:0;border-radius:50px;padding:14px 28px;transition:background .1s,transform .1s}.btn-primary:active{background:var(--accent-pressed);transform:scale(.97)}.btn-symbol{width:60px;height:60px;color:var(--text-tertiary);cursor:pointer;-webkit-backdrop-filter:blur(20px);background:0 0;border:1px solid #0000;border-radius:15px;justify-content:center;align-items:center;transition:background .18s,color .18s,border-color .18s,box-shadow .18s;display:flex}.btn-symbol .icon{letter-spacing:.04em;justify-content:center;align-items:center;min-width:24px;min-height:24px;font-size:15px;font-weight:700;display:inline-flex}.btn-symbol:hover{color:var(--text-primary);background:#35e6ff14}.btn-symbol:active{background:var(--glass-bg-active)}.btn-symbol.selected{border-color:var(--glass-border-strong);color:var(--accent);box-shadow:0 0 22px var(--accent-glow);background:#35e6ff24}.panel-close{background:var(--destructive);cursor:pointer;z-index:10;border:0;border-radius:50%;width:52px;height:52px;margin:-8px;padding:0;position:absolute;top:12px;left:12px}.ornament{background:var(--glass-bg);-webkit-backdrop-filter:blur(var(--glass-blur));border:1px solid var(--glass-border);box-shadow:var(--glass-shadow);white-space:nowrap;border-radius:50px;align-items:center;gap:4px;padding:8px;display:flex;position:absolute;bottom:-56px;left:50%;transform:translate(-50%)}.panel-drag-handle{cursor:grab;border-radius:var(--glass-radius) var(--glass-radius) 0 0;z-index:5;height:56px;position:absolute;top:0;left:0;right:0}.panel-drag-handle:active{cursor:grabbing}.panel-resize-handle{cursor:se-resize;border-radius:0 0 var(--glass-radius) 0;z-index:5;background:linear-gradient(135deg,#0000 50%,#fff3 50%);width:40px;height:40px;position:absolute;bottom:0;right:0}body.vision-pro-reduced-motion .glass-panel{-webkit-backdrop-filter:blur(18px)saturate(1.15)}body.vision-pro-reduced-motion .glass-panel:before{background:linear-gradient(135deg,#ffffff2e 0%,#ffffff0d 30%,#ffffff03 60%,#0000000d 100%)}body.vision-pro-reduced-motion .btn-primary,body.vision-pro-reduced-motion .btn-symbol,body.vision-pro-reduced-motion .panel-close{transition:none}body.vision-pro-reduced-motion .panel-drag-handle{cursor:default}@media (max-width:430px){:root{--glass-radius:18px;--glass-blur:32px}.ar-panel{max-width:calc(100vw - 16px);width:calc(100vw - 16px)!important}.hud-toolbar{left:8px;right:8px;bottom:calc(10px + env(safe-area-inset-bottom));gap:6px;padding:8px}.btn-symbol{flex:0 0 56px;width:56px;height:56px}}@media (orientation:landscape) and (max-height:520px){.hud-toolbar{top:calc(10px + env(safe-area-inset-top));bottom:auto;left:calc(8px + env(safe-area-inset-left));width:72px;max-height:calc(100vh - 20px - env(safe-area-inset-top) - env(safe-area-inset-bottom));flex-direction:column;right:auto}.status-panel{top:calc(10px + env(safe-area-inset-top));left:92px;right:calc(12px + env(safe-area-inset-right));bottom:auto}}@media (min-width:720px){.ar-panel{width:clamp(340px,38vw,520px)}}.loading-screen{z-index:30;background:radial-gradient(circle at 50% 42%,#007aff38,#000000e0 58%);justify-content:center;align-items:center;padding:20px;display:flex;position:fixed;top:0;bottom:0;left:0;right:0}.loading-screen.hidden,.hidden{display:none!important}.loading-card{pointer-events:auto;text-align:center;width:clamp(288px,92vw,420px);padding:24px}.loading-ring{border:2px solid #ffffff29;border-top-color:var(--accent);border-radius:50%;width:96px;height:96px;margin:0 auto 18px;animation:1.2s linear infinite spin}.caption{color:var(--text-secondary);font:var(--font-caption);text-transform:uppercase;margin:0 0 8px}.loading-card h1{font:var(--font-title1);margin:0 0 8px}.loading-card p{color:var(--text-secondary);font:var(--font-subheadline);margin:0 0 18px}.progress-track{background:#ffffff1f;border-radius:99px;height:4px;margin:0 0 20px;overflow:hidden}.progress-track span{border-radius:inherit;background:var(--accent);width:14%;height:100%;box-shadow:0 0 18px var(--accent-glow);transition:width .25s;display:block}.hud-toolbar{left:calc(12px + env(safe-area-inset-left));right:calc(12px + env(safe-area-inset-right));bottom:calc(14px + env(safe-area-inset-bottom));z-index:15;pointer-events:auto;scrollbar-width:none;justify-content:center;gap:8px;padding:10px;display:flex;position:fixed;overflow-x:auto}.hud-toolbar::-webkit-scrollbar{display:none}.status-panel{top:calc(12px + env(safe-area-inset-top));left:calc(12px + env(safe-area-inset-left));right:calc(12px + env(safe-area-inset-right));z-index:15;pointer-events:none;grid-template-columns:repeat(3,1fr);gap:8px;padding:10px 12px;display:grid;position:fixed}.status-panel span{color:var(--text-tertiary);font:var(--font-caption);letter-spacing:.18em;text-transform:uppercase;margin-bottom:3px;display:block}.status-panel strong{color:var(--accent);font:500 12px/1.25 var(--font-mono);letter-spacing:.02em;text-overflow:ellipsis;text-transform:uppercase;white-space:nowrap;display:block;overflow:hidden}.ar-panel{z-index:12;pointer-events:auto;width:clamp(280px,90vw,400px);min-height:220px;max-height:min(74vh,640px);padding:18px;transition:box-shadow .18s,transform 80ms;position:fixed;transform:translate(16px,96px)}.ar-panel.active{box-shadow:var(--glass-shadow-deep), 0 0 42px var(--accent-glow)}.ar-panel header{justify-content:space-between;align-items:center;gap:12px;height:44px;padding-left:34px;display:flex}.ar-panel h2{min-width:0;font:var(--font-title3);text-overflow:ellipsis;white-space:nowrap;margin:0;overflow:hidden}.panel-minimize{flex:0 0 48px;width:48px;height:48px}.panel-body{scrollbar-width:thin;max-height:calc(min(74vh,640px) - 80px);padding:6px 2px 2px;overflow:auto}.panel-body input,.panel-body select,.panel-body textarea{border:1px solid var(--separator);width:100%;min-height:46px;color:var(--text-primary);background:#00000038;border-radius:14px;outline:0;margin:6px 0;padding:12px 14px}.panel-grid{grid-template-columns:repeat(2,minmax(0,1fr));gap:8px;display:grid}.panel-row{align-items:center;gap:8px;display:flex}.panel-action{border:1px solid var(--glass-border);min-height:46px;color:var(--text-primary);cursor:pointer;background:#ffffff14;border-radius:14px;padding:10px 12px}.panel-action:active{background:var(--glass-bg-active);transform:scale(.98)}.panel-list{gap:8px;margin:12px 0;display:grid}.model-card{border:1px solid var(--separator);background:#ffffff0f;border-radius:14px;grid-template-columns:1fr auto;align-items:center;gap:8px;min-height:54px;padding:10px;display:grid}.model-card strong,.model-card span{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.model-card span{color:var(--text-secondary);font:var(--font-caption)}.sketchfab-panel{border:1px solid var(--separator);background:#ffffff0d;border-radius:16px;gap:8px;margin:12px 0;padding:12px;display:grid}.sketchfab-panel strong{font:var(--font-headline)}.panel-note{color:var(--text-secondary);font:var(--font-footnote);margin:0}.inline-row{grid-template-columns:minmax(0,1fr) auto;align-items:center;gap:8px;display:grid}.inline-row .panel-action{min-width:72px}.sketchfab-results{max-height:280px;padding-right:2px;overflow:auto}.sketchfab-card{grid-template-columns:68px minmax(0,1fr);align-items:stretch}.sketchfab-card img{object-fit:cover;background:#00000052;border-radius:12px;align-self:center;width:68px;height:68px}.sketchfab-card>div:first-of-type{gap:2px;min-width:0;display:grid}.sketchfab-card a{min-width:0;color:var(--text-secondary);font:var(--font-caption);text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.model-actions{grid-column:1/-1;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px;display:grid}.link-action{justify-content:center;align-items:center;min-height:46px;text-decoration:none;display:inline-flex}.jarvis-bubble{left:50%;bottom:calc(98px + env(safe-area-inset-bottom));z-index:20;pointer-events:none;width:min(390px,100vw - 24px);padding:14px 16px;position:fixed;transform:translate(-50%)}.jarvis-bubble span{color:var(--accent);font:700 11px/1 var(--font);letter-spacing:.3em;text-transform:uppercase;margin-bottom:4px;display:block}.jarvis-bubble p{color:var(--text-primary);font:var(--font-callout);margin:0}#error-host,#banner-host{z-index:25;pointer-events:none;position:fixed;left:12px;right:12px}#error-host{top:calc(78px + env(safe-area-inset-top))}#banner-host{top:calc(152px + env(safe-area-inset-top))}.error-panel,.banner-panel{pointer-events:auto;width:min(520px,100vw - 24px);margin:0 auto 8px;padding:12px 14px}.error-panel{box-shadow:var(--glass-shadow), 0 0 28px var(--destructive-glow);border-color:#ff3b3073}.error-panel strong,.banner-panel strong{font:var(--font-headline);margin-bottom:4px;display:block}.error-panel p,.banner-panel p{color:var(--text-secondary);font:var(--font-footnote);margin:0}.error-panel a{color:var(--text-primary)}.context-menu{z-index:22;pointer-events:auto;gap:6px;width:190px;padding:8px;display:grid;position:fixed}.context-menu button{min-height:42px;color:var(--text-primary);background:#ffffff14;border:0;border-radius:12px}.game-frame{background:var(--bg-darker);border:0;width:100%;height:100%}@keyframes spin{to{transform:rotate(360deg)}}@keyframes pulse{0%,to{opacity:.72;transform:scale(1)}50%{opacity:1;transform:scale(1.08)}}@keyframes riseIn{0%{opacity:0;transform:translate(-50%,14px)}to{opacity:1;transform:translate(-50%)}}.jarvis-bubble:not(.hidden){animation:.22s ease-out riseIn}.loading-ring{animation:1.2s linear infinite spin}.pinch-cursor{animation:1.4s ease-in-out infinite pulse}@media (prefers-reduced-motion:reduce){*,:before,:after{scroll-behavior:auto!important;transition-duration:.01ms!important;animation-duration:.01ms!important;animation-iteration-count:1!important}}

webar/assets/index-DCOWBc_V.js

@@ -0,0 +1,87 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./ar-init-CHktDPD4.js","./mediapipe-Ck-u_eH7.js","./three-Bwrc_W3C.js","./rolldown-runtime-DK3Fl9T5.js"])))=>i.map(i=>d[i]);
+import{r as e}from"./mediapipe-Ck-u_eH7.js";(function(){let e=document.createElement(`link`).relList;if(e&&e.supports&&e.supports(`modulepreload`))return;for(let e of document.querySelectorAll(`link[rel="modulepreload"]`))n(e);new MutationObserver(e=>{for(let t of e)if(t.type===`childList`)for(let e of t.addedNodes)e.tagName===`LINK`&&e.rel===`modulepreload`&&n(e)}).observe(document,{childList:!0,subtree:!0});function t(e){let t={};return e.integrity&&(t.integrity=e.integrity),e.referrerPolicy&&(t.referrerPolicy=e.referrerPolicy),e.crossOrigin===`use-credentials`?t.credentials=`include`:e.crossOrigin===`anonymous`?t.credentials=`omit`:t.credentials=`same-origin`,t}function n(e){if(e.ep)return;e.ep=!0;let n=t(e);fetch(e.href,n)}})();var t=`jarvis_omega_session_credentials_v1`,n=`/xr/ar_config`;function r(){try{return localStorage.getItem(t)||``}catch{return``}}function i(e){try{localStorage.setItem(t,String(e||``).trim())}catch{}}function a(){try{let e=new URLSearchParams(location.search),t=String(e.get(`omega`)||e.get(`omegaBridge`)||``).trim();if(t)return`${t.replace(/\/+$/,``)}${n}`}catch{}return n}async function o(e){try{return(await fetch(a(),{headers:{Authorization:`Bearer ${e}`},cache:`no-store`})).status===200}catch{return!1}}async function s(){await e(()=>import(`./ar-init-CHktDPD4.js`),__vite__mapDeps([0,1,2,3]),import.meta.url)}function c(){let e=document.createElement(`div`);return e.id=`omega-access-gate`,e.innerHTML=`
+    <style>
+      #omega-access-gate {
+        position: fixed; inset: 0; z-index: 100000;
+        display: flex; align-items: center; justify-content: center;
+        background:
+          radial-gradient(120% 90% at 50% -10%, rgba(11,132,255,0.18), transparent 60%),
+          radial-gradient(80% 70% at 50% 120%, rgba(0,224,198,0.10), transparent 55%),
+          #05070b;
+        font-family: 'Inter', system-ui, sans-serif;
+        -webkit-tap-highlight-color: transparent;
+        animation: gateFade .5s ease both;
+      }
+      @keyframes gateFade { from { opacity: 0 } to { opacity: 1 } }
+      #omega-access-gate .card {
+        width: min(92vw, 380px);
+        padding: 34px 30px 28px;
+        border-radius: 22px;
+        background: linear-gradient(180deg, rgba(255,255,255,0.06), rgba(255,255,255,0.02));
+        border: 1px solid rgba(120,180,255,0.18);
+        box-shadow: 0 30px 80px rgba(0,0,0,0.55), inset 0 1px 0 rgba(255,255,255,0.06);
+        backdrop-filter: blur(22px) saturate(140%);
+        text-align: center;
+      }
+      #omega-access-gate .ring {
+        width: 62px; height: 62px; margin: 0 auto 18px;
+        border-radius: 50%;
+        display: grid; place-items: center;
+        background: radial-gradient(circle at 50% 35%, rgba(11,132,255,0.35), rgba(11,132,255,0.06));
+        border: 1px solid rgba(120,180,255,0.4);
+        box-shadow: 0 0 30px rgba(11,132,255,0.35);
+      }
+      #omega-access-gate .ring svg { width: 26px; height: 26px; stroke: #cfe6ff; }
+      #omega-access-gate h1 {
+        margin: 0; font-size: 19px; font-weight: 700; letter-spacing: .3px; color: #eaf2ff;
+      }
+      #omega-access-gate p {
+        margin: 8px 0 22px; font-size: 12.5px; line-height: 1.5; color: rgba(200,216,240,0.62);
+      }
+      #omega-access-gate .field {
+        display: flex; gap: 8px; align-items: center;
+        background: rgba(0,0,0,0.35);
+        border: 1px solid rgba(120,180,255,0.22);
+        border-radius: 13px; padding: 4px 4px 4px 14px;
+        transition: border-color .2s, box-shadow .2s;
+      }
+      #omega-access-gate .field.focus { border-color: rgba(11,132,255,0.7); box-shadow: 0 0 0 3px rgba(11,132,255,0.18); }
+      #omega-access-gate .field.error { border-color: rgba(255,90,90,0.8); box-shadow: 0 0 0 3px rgba(255,90,90,0.16); }
+      #omega-access-gate input {
+        flex: 1; min-width: 0; border: 0; outline: 0; background: transparent;
+        color: #eaf2ff; font-size: 15px; letter-spacing: 1px; padding: 12px 0;
+      }
+      #omega-access-gate input::placeholder { color: rgba(200,216,240,0.35); letter-spacing: .3px; }
+      #omega-access-gate button {
+        border: 0; cursor: pointer;
+        width: 46px; height: 42px; border-radius: 10px;
+        background: linear-gradient(180deg, #1b8bff, #0a6be0);
+        color: #fff; font-size: 18px; display: grid; place-items: center;
+        transition: filter .15s, transform .1s;
+      }
+      #omega-access-gate button:hover { filter: brightness(1.08); }
+      #omega-access-gate button:active { transform: scale(0.94); }
+      #omega-access-gate button[disabled] { opacity: .55; cursor: default; }
+      #omega-access-gate .msg { margin-top: 14px; font-size: 12px; min-height: 16px; color: rgba(255,120,120,0.9); }
+      #omega-access-gate .foot { margin-top: 18px; font-size: 10.5px; color: rgba(200,216,240,0.32); letter-spacing: .4px; }
+      #omega-access-gate .spin { width: 16px; height: 16px; border: 2px solid rgba(255,255,255,0.35); border-top-color:#fff; border-radius:50%; animation: gateSpin .7s linear infinite; }
+      @keyframes gateSpin { to { transform: rotate(360deg) } }
+    </style>
+    <div class="card" role="dialog" aria-label="OMEGA access">
+      <div class="ring">
+        <svg viewBox="0 0 24 24" fill="none" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+          <rect x="4.5" y="10.5" width="15" height="10" rx="2.2"></rect>
+          <path d="M8 10.5V7.5a4 4 0 0 1 8 0v3"></path>
+          <circle cx="12" cy="15.4" r="1.3"></circle>
+        </svg>
+      </div>
+      <h1>OMEGA Access</h1>
+      <p>Enter your cloud access key to unlock the AR system.</p>
+      <div class="field" id="gate-field">
+        <input id="gate-input" type="password" inputmode="text" autocomplete="current-password"
+               placeholder="Access key" aria-label="Access key" />
+        <button id="gate-go" aria-label="Unlock">→</button>
+      </div>
+      <div class="msg" id="gate-msg"></div>
+      <div class="foot">JARVIS · FRIDAY · OMEGA</div>
+    </div>`,e}async function l(e,{field:t,input:n,go:r,msg:a},c){let l=String(e||n?.value||``).trim();if(!l){u(t,a,`Enter your access key.`);return}if(r.innerHTML=`<span class="spin"></span>`,r.disabled=!0,!await o(l)){r.disabled=!1,r.textContent=`→`,u(t,a,`Incorrect access key.`),n&&(n.value=``,n.focus());return}i(l),a.style.color=`rgba(0,224,198,0.9)`,a.textContent=`Access granted.`,c.style.transition=`opacity .45s ease`,c.style.opacity=`0`,setTimeout(()=>c.remove(),460),await s()}function u(e,t,n){t.style.color=`rgba(255,120,120,0.9)`,t.textContent=n,e.classList.add(`error`),setTimeout(()=>e.classList.remove(`error`),900)}async function d(){let e=r();if(e&&await o(e)){await s();return}let t=c();document.body.appendChild(t);let n=t.querySelector(`#gate-field`),i=t.querySelector(`#gate-input`),a=t.querySelector(`#gate-go`),u=t.querySelector(`#gate-msg`),d={field:n,input:i,go:a,msg:u};i.addEventListener(`focus`,()=>n.classList.add(`focus`)),i.addEventListener(`blur`,()=>n.classList.remove(`focus`)),i.addEventListener(`input`,()=>{u.textContent=``}),i.addEventListener(`keydown`,e=>{e.key===`Enter`&&l(null,d,t)}),a.addEventListener(`click`,()=>l(null,d,t)),setTimeout(()=>i.focus(),300)}document.readyState===`loading`?document.addEventListener(`DOMContentLoaded`,d,{once:!0}):d();

webar/index.html

@@ -92,9 +92,27 @@
     ar-init.js runs and <a-scene> can initialise normally.
     Pinned at v1.6.0; update by changing the version in both src and the integrity hash.
   -->
-  <script src="https://cdn.jsdelivr.net/npm/aframe@1.6.0/dist/aframe.min.js"
-          crossorigin="anonymous"
-          data-jarvis-aframe="true"></script>
+  <!--
+    A-Frame is deliberately NOT loaded. History, so this isn't "fixed" back:
+
+    The tag used to point at aframe@1.6.0/dist/aframe.min.js, which 404s on
+    jsDelivr (the real filename is aframe-master.min.js). So `window.AFRAME` has
+    never been defined in production, and every page load paid for a failed
+    request. Its only consumer was the physics tick in ar-physics.js, which
+    silently no-op'd behind `if (window.AFRAME)` — physics never stepped once.
+
+    Correcting the URL was tried and measured in a real browser: A-Frame ships its
+    own copy of three.js, which produced "WARNING: Multiple instances of Three.js
+    being imported" plus a CONTEXT_LOST_WEBGL against the app's own renderer.
+    A-Frame is not the renderer here — <a-scene> below is display:none and the live
+    context comes from XR8 or the fallback THREE canvas (utils/scene-db.js
+    getSceneContext/ensureFallbackThree) — so loading it buys nothing and costs a
+    duplicate WebGL/three stack.
+
+    The physics tick now runs on the app's own managed RAF loop instead, so nothing
+    depends on A-Frame. The <a-scene> block below is inert without it, which is
+    exactly how production has always behaved.
+  -->
 
   <!--
     BUG 32 FIX — XR binary loaded statically so XR8 is always attempted even
@@ -119,9 +137,9 @@
   <script src="https://cdn.jsdelivr.net/npm/@mediapipe/hands/hands.js" crossorigin="anonymous"></script>
   <script src="https://cdn.jsdelivr.net/npm/@mediapipe/camera_utils/camera_utils.js" crossorigin="anonymous"></script>
   <script type="module" src="https://ajax.googleapis.com/ajax/libs/model-viewer/3.5.0/model-viewer.min.js" crossorigin="anonymous"></script>
-  <script type="module" crossorigin src="./assets/index-Cl3oi4RS.js"></script>
+  <script type="module" crossorigin src="./assets/index-DCOWBc_V.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/mediapipe-Ck-u_eH7.js">
-  <link rel="stylesheet" crossorigin href="./assets/index-Io0-fChA.css">
+  <link rel="stylesheet" crossorigin href="./assets/index-BGn3T9gi.css">
 </head>
 <body>
   <canvas id="camerafeed" aria-label="Live rear camera AR feed"></canvas>

webar/ui/hud.css

@@ -353,12 +353,19 @@
   pointer-events: none;
 }
 
+/*
+  Both hosts must clear .status-panel, which is fixed at top:12px and ~50px tall.
+  #error-host was at top:14px with z-index 25 against the status panel's 15, so an
+  error card landed directly on top of the CAMERA / TRACKING / OMEGA readout and
+  hid the very state the user needs while something is failing. #banner-host had
+  already been cleared to 78px; the error host had not.
+*/
 #error-host {
-  top: calc(14px + env(safe-area-inset-top));
+  top: calc(78px + env(safe-area-inset-top));
 }
 
 #banner-host {
-  top: calc(78px + env(safe-area-inset-top));
+  top: calc(152px + env(safe-area-inset-top));
 }
 
 .error-panel,