deploy(S4): Blender headless pipeline + WebAR client + backend fixes

backend/routes/mobile_bridge_routes.py

@@ -257,9 +257,24 @@ async def command(request: Request) -> dict[str, Any]:
             "pc_count": delivered,
         }
 
+    # PC offline but the command was accepted onto the replay queue: say so
+    # plainly. "Queued" and "recorded" are different promises — one will actually
+    # run, the other never will — and the user has to be able to tell them apart.
+    if outcome.get("queued"):
+        depth = int(outcome.get("queue_depth") or 0)
+        return {
+            "ok": True,
+            "spoken": ["Your PC is offline. I'll run this the moment it comes "
+                       f"back online.{f' ({depth} waiting.)' if depth > 1 else ''}"],
+            "status": "queued",
+            "action": "pc_queue",
+            "queue_depth": depth,
+        }
+
     try:
         from modules.max_autonomy import execute_task
-        # No PC connected: run through the safety-gated coordinator in
+        # No PC connected AND not queueable (e.g. an unlock, which must never be
+        # replayed later): run through the safety-gated coordinator in
         # record+sync mode — logged, risk-assessed and pushed to the AR HUD,
         # without faking hardware control.
         result = execute_task(

backend/services/usb_monitor.py

@@ -1,9 +1,27 @@
 import asyncio
 import logging
 import os
+# wmi/pythoncom are OPTIONAL, and the import must never be fatal.
+#
+# This was a bare `import wmi` on the non-cloud path. wmi is not installed in
+# this repo's venv, so importing backend.services.usb_monitor raised
+# ModuleNotFoundError — and usb_vault.py imports get_db_path FROM this module,
+# so the entire secrets vault became unimportable on the very PC it protects.
+# Every caller wrapped that in `except Exception: return ""`, so the vault did
+# not fail loudly; it just answered "no such secret" forever. That is how
+# pc_relay_client's vault token lookup came back empty and how the vault ended up
+# holding nothing at all.
+#
+# WMI is used only to map drive letters inside the monitor loop, which already
+# handles wmi being None. A missing USB-enumeration dependency must not take the
+# credential store down with it.
 if os.environ.get("CLOUD_ENV", "false").lower() != "true":
-    import wmi
-    import pythoncom
+    try:
+        import wmi
+        import pythoncom
+    except Exception:  # pragma: no cover - depends on host packages
+        wmi = None
+        pythoncom = None
 else:
     wmi = None
     pythoncom = None

backend/ws/agent_ws.py

@@ -2,6 +2,7 @@ import asyncio
 import json
 import logging
 import os
+import time
 from fastapi import WebSocket
 import uuid
 
@@ -62,6 +63,12 @@ class ConnectionManager:
         # desktop then refused outright (locked session) or failed to run. The
         # phone showed success for work that never happened.
         self.pending_results: dict[str, asyncio.Future] = {}
+        # Commands accepted while NO PC was connected, replayed in order the
+        # moment one registers. Without this the honest answer to "open notepad"
+        # with the desktop asleep was "nothing was listening" and the command was
+        # simply dropped — the user had to remember it and send it again once the
+        # PC woke up.
+        self.pending_commands: list[dict] = []
         from backend.agent.react_agent import Tool
         self.tools = []
         for name, func in TOOL_REGISTRY.items():
@@ -132,7 +139,10 @@ class ConnectionManager:
                 },
             })
             if not delivered:
-                return {"delivered": 0, "ok": False, "spoken": [], "timed_out": False}
+                queued = self.queue_for_offline_pc(cmd, device_name)
+                return {"delivered": 0, "ok": False, "spoken": [],
+                        "timed_out": False, "queued": queued,
+                        "queue_depth": len(self.pending_commands)}
             try:
                 result = await asyncio.wait_for(future, timeout=timeout)
             except asyncio.TimeoutError:
@@ -151,6 +161,80 @@ class ConnectionManager:
         finally:
             self.pending_results.pop(command_id, None)
 
+    # Bounded on purpose. A PC that has been off for a week must not wake up and
+    # execute a hundred stale instructions in a burst — that is how "convenient"
+    # becomes "destructive". Oldest is dropped past the cap; anything older than
+    # the TTL is discarded rather than run.
+    QUEUE_MAX = 25
+    QUEUE_TTL_SECONDS = 12 * 3600
+
+    def queue_for_offline_pc(self, cmd: str, device_name: str = "") -> bool:
+        cmd = (cmd or "").strip()
+        if not cmd:
+            return False
+        # Unlock commands carry a password and are time-sensitive; replaying one
+        # later against a PC that may already be unlocked is pointless and would
+        # persist a credential in memory for hours. Never queue them.
+        if cmd.lower().startswith(("unlock", "activate")):
+            return False
+        self._expire_queue()
+        self.pending_commands.append({
+            "cmd": cmd,
+            "device_name": device_name,
+            "queued_at": time.time(),
+        })
+        if len(self.pending_commands) > self.QUEUE_MAX:
+            dropped = self.pending_commands.pop(0)
+            logging.warning("Offline command queue full; dropped %r",
+                            dropped.get("cmd"))
+        logging.info("Queued %r for an offline PC (depth=%d)", cmd,
+                     len(self.pending_commands))
+        return True
+
+    def _expire_queue(self) -> None:
+        cutoff = time.time() - self.QUEUE_TTL_SECONDS
+        before = len(self.pending_commands)
+        self.pending_commands = [
+            item for item in self.pending_commands
+            if float(item.get("queued_at") or 0) >= cutoff
+        ]
+        if len(self.pending_commands) != before:
+            logging.info("Expired %d stale queued command(s)",
+                         before - len(self.pending_commands))
+
+    async def flush_pending_commands(self, websocket: WebSocket) -> int:
+        """Replay queued commands to a PC that just came online, in order."""
+        self._expire_queue()
+        if not self.pending_commands:
+            return 0
+        queued, self.pending_commands = self.pending_commands, []
+        sent = 0
+        for item in queued:
+            try:
+                await websocket.send_json({
+                    "event": "system:execute",
+                    "payload": {
+                        "cmd": item["cmd"],
+                        "source": "guardian_queued",
+                        "device_name": item.get("device_name", ""),
+                        "queued_at": item.get("queued_at"),
+                        # No command_id: the HTTP caller that queued this is long
+                        # gone, so there is no future to resolve. The PC still
+                        # logs its own result.
+                    },
+                })
+                sent += 1
+            except Exception as exc:
+                # Put back what we could not deliver, preserving order, so a
+                # half-failed flush does not silently eat the rest.
+                logging.warning("Flush failed after %d command(s): %s", sent, exc)
+                self.pending_commands = queued[sent:] + self.pending_commands
+                break
+        if sent:
+            logging.info("Replayed %d queued command(s) to the PC that came online",
+                         sent)
+        return sent
+
     async def broadcast(self, message: dict):
         for connection in self.active_connections:
             try:
@@ -175,13 +259,20 @@ class ConnectionManager:
                     "PC relay registered (%d PC connection(s) now available)",
                     len(self.pc_connections),
                 )
+                replayed = 0
                 try:
                     await websocket.send_json({
                         "event": "backend:pc_registered",
-                        "payload": {"ok": True},
+                        "payload": {"ok": True,
+                                    "queued": len(self.pending_commands)},
                     })
-                except Exception:
-                    pass
+                    # The PC is back: run whatever was sent while it was away.
+                    replayed = await self.flush_pending_commands(websocket)
+                except Exception as exc:
+                    logging.warning("PC registration follow-up failed: %s", exc)
+                if replayed:
+                    logging.info("PC came online and picked up %d queued command(s)",
+                                 replayed)
             return
 
         # ── WHAT HAPPENED? ──────────────────────────────────────────────────────

dist/app-release.apk

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:3ad8ae06d51f018c394e07acd4492bd6d3ec89137891812596d50286595ecd3b
+oid sha256:9f6ff4329c1d9ab621312b87542baa2a90f5020db9131cb1601b5058ab50853d
 size 116538395

modules/activation_state.py

@@ -9,6 +9,14 @@ from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 UNLOCK_JSON = ROOT / "data" / "session_unlocked.json"
 
+# One wording for the refusal, shared by every caller that has to explain it —
+# core.commands (voice/GUI) and phone.command_runner (phone and cloud relay) —
+# so a remote user is never told something different from a local one.
+LOCKED_MESSAGE = (
+    "This PC is locked. Activate JARVIS on the desktop with your "
+    "activation key, then send the command again."
+)
+
 
 def _boot_id() -> int:
     try: