deploy(S4): Blender headless pipeline + WebAR client + backend fixes

backend/main.py

@@ -173,7 +173,16 @@ app.include_router(agent_router,      prefix="/agent",      dependencies=[Depend
 app.include_router(memory_router,     prefix="/memory",     dependencies=[Depends(verify_token)])
 app.include_router(voice_router,      prefix="/voice",      dependencies=[Depends(verify_token)])
 app.include_router(system_router,     prefix="/system",     dependencies=[Depends(verify_token)])
-app.include_router(automation_router, prefix="/automation", dependencies=[Depends(verify_token)])
+# v22: AUTOMATION is a paid feature in the plan catalog (plus/pro only — see
+# billing/plans.py), but no automation route enforced it: a caller on the `free` plan got
+# 200 + real scheduler data from /automation/list and /automation/history. The catalog
+# declared the boundary and nothing collected on it. Gated at the mount so all ten routes
+# are covered, rather than per-route where the next new route would silently miss it.
+from backend.billing.gating import require_feature as _require_feature
+from backend.billing.plans import Feature as _Feature
+app.include_router(automation_router, prefix="/automation",
+                   dependencies=[Depends(verify_token),
+                                 Depends(_require_feature(_Feature.AUTOMATION))])
 app.include_router(security_router,   prefix="/security",   dependencies=[Depends(verify_token)])
 app.include_router(github_router,     prefix="/github",     dependencies=[Depends(verify_token)])
 app.include_router(xr_router,         prefix="/xr",         dependencies=[Depends(verify_token)])

backend/provisioning/space_provisioner.py

@@ -58,13 +58,43 @@ log = logging.getLogger(__name__)
 # The purposes a subscriber's own Space needs its own value for. One namespaced scheme,
 # per credentials-and-secrets.md:43 — adding a purpose here is the ONLY thing needed to
 # give every subscriber their own isolated value for it.
-SUBSCRIBER_SECRET_PURPOSES: tuple[str, ...] = (
+#
+# v22-2: these are the SYSTEM-DERIVED secrets. Every one is a value this system invents
+# for itself, so HMAC derivation from a root secret works: the value has no meaning to
+# any third party and nobody outside has to agree to it.
+DERIVED_SECRET_PURPOSES: tuple[str, ...] = (
     "JARVIS_CLOUD_TOKEN",      # the subscriber's own API/WS bearer for their Space
     "VAULT_MASTER_PASSWORD",   # derives that Space's vault key; never shared
     "PBKDF2_SALT",             # per-subscriber salt, so no two vaults share a derivation
     "WEBHOOK_SIGNING_SECRET",  # payment-webhook HMAC, scoped to this subscriber
 )
 
+# v22-2: OWNER-SUPPLIED per-subscriber credentials — a genuinely different provisioning
+# pattern the derivation scheme above cannot express, and previously had no place at all.
+#
+# The distinction that matters: a derived secret is one WE choose, so we can compute it.
+# An owner-supplied secret is issued by a THIRD PARTY and the third party must agree it
+# is valid. No amount of HMAC produces a Sketchfab key that Sketchfab will honour. These
+# can therefore only ever be STORED AND LOOKED UP, never computed — which means
+# provisioning has to be able to *block* on one being absent instead of silently
+# producing a Space that 401s the first time a subscriber opens the model browser.
+#
+# Each entry: purpose -> (human description, where the owner obtains it).
+OWNER_SUPPLIED_PURPOSES: dict[str, tuple[str, str]] = {
+    "SKETCHFAB_API_KEY": (
+        "That subscriber's own Sketchfab API token, used for model search/download in "
+        "the AR connector drawer.",
+        "The owner creates a separate Sketchfab account/token per subscriber at "
+        "https://sketchfab.com/settings/password and records it against that user id.",
+    ),
+}
+
+# Backwards-compatible alias. Everything that existed before v22-2 (verify_no_collisions,
+# rotate_only_this_user, the Part 29 collision proof) means the derived set specifically,
+# so this name keeps pointing at exactly what it always pointed at rather than silently
+# growing to include credentials that cannot be derived.
+SUBSCRIBER_SECRET_PURPOSES: tuple[str, ...] = DERIVED_SECRET_PURPOSES
+
 OWNER_USER_ID = "owner"
 
 
@@ -115,6 +145,83 @@ def subscriber_secrets(user_id: str, version: int = 1) -> dict[str, str]:
     return {p: derive_secret(user_id, p, version) for p in SUBSCRIBER_SECRET_PURPOSES}
 
 
+# ─────────────────────────────────────────────────────────────────────────────
+# v22-2 — owner-supplied per-subscriber credentials
+#
+# These route through the SAME vault the rest of the system uses, namespaced per
+# (user, purpose), rather than a new bespoke store. credentials-and-secrets.md:43 is
+# explicit about this: "resist the pull to bolt on a bespoke storage/rotation mechanism
+# for each new kind of secret — extend the existing vault/credential-management path
+# with a clean per-user namespace." A parallel store for one connector is exactly the
+# unauditable-mess pattern that rule exists to prevent.
+# ─────────────────────────────────────────────────────────────────────────────
+
+def owner_supplied_vault_key(user_id: str, purpose: str) -> str:
+    """The vault key one subscriber's owner-supplied credential is stored under.
+
+    Namespaced by both user and purpose so two subscribers' Sketchfab keys can never
+    alias to each other, per the no-collisions requirement that governs the derived
+    secrets too.
+    """
+    if purpose not in OWNER_SUPPLIED_PURPOSES:
+        raise ValueError(f"{purpose!r} is not an owner-supplied purpose")
+    if not user_id or not user_id.strip():
+        raise ValueError("user_id is required")
+    return f"SUBSCRIBER::{user_id.strip()}::{purpose}"
+
+
+def set_owner_supplied_secret(user_id: str, purpose: str, value: str) -> None:
+    """Record the key the owner obtained for this specific subscriber."""
+    if not value or not value.strip():
+        raise ValueError("refusing to store an empty credential")
+    from backend.services.usb_vault import set_secret
+    set_secret(owner_supplied_vault_key(user_id, purpose), value.strip())
+
+
+def get_owner_supplied_secret(user_id: str, purpose: str) -> str | None:
+    from backend.services.usb_vault import get_secret
+    try:
+        v = get_secret(owner_supplied_vault_key(user_id, purpose))
+    except Exception as exc:
+        log.warning("vault read failed for %s/%s: %s", user_id, purpose, exc)
+        return None
+    return v.strip() if v and v.strip() else None
+
+
+def missing_owner_supplied(user_id: str) -> list[str]:
+    """Which owner-supplied credentials this subscriber does NOT yet have.
+
+    This is the list provisioning must refuse to proceed past, because none of them can
+    be generated — only the owner can obtain them.
+    """
+    return [p for p in OWNER_SUPPLIED_PURPOSES if not get_owner_supplied_secret(user_id, p)]
+
+
+def all_subscriber_credentials(user_id: str, version: int = 1) -> dict[str, Any]:
+    """The complete credential picture for one subscriber: derived AND owner-supplied.
+
+    Deliberately reports the two categories separately, and names what is missing, rather
+    than merging them into one dict where an absent owner-supplied key would look
+    identical to a present one.
+    """
+    derived = subscriber_secrets(user_id, version)
+    supplied = {p: get_owner_supplied_secret(user_id, p) for p in OWNER_SUPPLIED_PURPOSES}
+    missing = [p for p, v in supplied.items() if not v]
+    return {
+        "user_id": user_id,
+        "derived": derived,
+        "owner_supplied_present": sorted(p for p, v in supplied.items() if v),
+        "owner_supplied_missing": missing,
+        "complete": not missing,
+        "action_required_by_owner": [
+            {"purpose": p,
+             "what": OWNER_SUPPLIED_PURPOSES[p][0],
+             "how": OWNER_SUPPLIED_PURPOSES[p][1]}
+            for p in missing
+        ],
+    }
+
+
 def space_id_for(user_id: str, owner_namespace: str) -> str:
     """Stable, collision-free Space id for a subscriber.
 
@@ -179,6 +286,11 @@ class ProvisionResult:
     dry_run: bool = True
     skipped_reason: str | None = None
     errors: list[str] = field(default_factory=list)
+    # v22-2: owner-supplied credentials this subscriber is still missing. Non-empty means
+    # a human step is outstanding — the Space can be created, but the connectors those
+    # keys serve will not work until the owner supplies them.
+    owner_supplied_missing: list[str] = field(default_factory=list)
+    owner_action_required: list[dict[str, str]] = field(default_factory=list)
 
 
 def provision_subscriber_space(
@@ -212,6 +324,26 @@ def provision_subscriber_space(
     values = subscriber_secrets(user_id, version)
     result.secrets_set = sorted(values)
 
+    # v22-2: report owner-supplied credentials BEFORE the dry-run return, so a dry run —
+    # which is how this path is normally exercised — surfaces the outstanding human step
+    # rather than reporting a clean provision that would be incomplete in reality.
+    credentials = all_subscriber_credentials(user_id, version)
+    result.owner_supplied_missing = credentials["owner_supplied_missing"]
+    result.owner_action_required = credentials["action_required_by_owner"]
+    for purpose in result.owner_supplied_missing:
+        what, how = OWNER_SUPPLIED_PURPOSES[purpose]
+        log.warning(
+            "subscriber %s has no %s. It cannot be derived — %s Until then the features "
+            "it serves will fail for this subscriber.", user_id, purpose, how,
+        )
+    # Owner-supplied values are injected alongside the derived ones where present, so a
+    # subscriber who HAS been given a key gets it in their own Space's secrets.
+    for purpose in OWNER_SUPPLIED_PURPOSES:
+        supplied = get_owner_supplied_secret(user_id, purpose)
+        if supplied:
+            values[purpose] = supplied
+            result.secrets_set = sorted(values)
+
     if dry_run:
         return result
 

backend/routes/internet_routes.py

@@ -2,12 +2,20 @@
 backend/routes/internet_routes.py
 §2.4 — Internet Layer: live OSINT, web search, URL fetch, scrape
 """
-from fastapi import HTTPException, APIRouter
+from fastapi import HTTPException, APIRouter, Depends
 from pydantic import BaseModel
 from typing import Optional
 
+from backend.billing.gating import require_feature
+from backend.billing.plans import Feature
+
 router = APIRouter()
 
+# v22: OSINT is a paid feature in the plan catalog (plus/pro), WEB_SEARCH is not (free
+# grants it). So the gate goes on /osint specifically, NOT on the router — gating the
+# whole router would take /search away from the free tier that is entitled to it.
+_OSINT_GATE = Depends(require_feature(Feature.OSINT))
+
 
 class SearchRequest(BaseModel):
     query: str
@@ -53,7 +61,7 @@ async def fetch_url(req: FetchRequest):
 
 
 @router.post("/osint")
-async def osint_recon(req: OsintRequest):
+async def osint_recon(req: OsintRequest, _user: str = _OSINT_GATE):
     """
     Elite Defensive OSINT recon endpoint.
     Performs web reconnaissance, digital footprint analysis,

backend/routes/mobile_bridge_routes.py

@@ -212,14 +212,42 @@ async def command(request: Request) -> dict[str, Any]:
         return {"ok": False, "error": "missing cmd"}
     device_name = str(plaintext.get("device_name") or "").strip()[:80]
 
+    # RELAY TO THE PC FIRST, if one is connected.
+    #
+    # The cloud container has no desktop of its own, which is why this used to go
+    # straight to record-only mode. But it is not the only machine involved:
+    # pc_relay_client.py runs on the user's PC, holds an outbound WebSocket to
+    # this Space, and executes `system:execute` for real. Everything needed for
+    # phone -> cloud -> PC control existed except this hop — the Space simply
+    # never forwarded, so commands sent from anywhere in the world were logged
+    # and dropped while the desktop sat connected and idle.
+    #
+    # Falls through to record-only when no PC is listening, which is the honest
+    # answer when the machine is off rather than a failure.
+    try:
+        from backend.ws.agent_ws import ws_manager as _ws_manager
+        delivered = await _ws_manager.send_to_pcs({
+            "event": "system:execute",
+            "payload": {"cmd": cmd, "source": "guardian", "device_name": device_name},
+        })
+    except Exception as exc:
+        log.warning("PC relay unavailable: %s", exc)
+        delivered = 0
+
+    if delivered:
+        return {
+            "ok": True,
+            "spoken": [f"Sent to your PC."],
+            "status": "relayed",
+            "action": "pc_relay",
+            "pc_count": delivered,
+        }
+
     try:
         from modules.max_autonomy import execute_task
-        # This router only ever serves the *cloud* path (on the LAN, Guardian hits
-        # phone/local_server.py:7474, which executes for real against the PC). The
-        # cloud container has no PC to drive, so the honest behaviour is to run the
-        # command through the safety-gated coordinator in record+sync mode: it is
-        # logged, risk-assessed and pushed to the AR HUD, without faking hardware
-        # control. Real desktop actions stay on the paired-PC channel.
+        # No PC connected: run through the safety-gated coordinator in
+        # record+sync mode — logged, risk-assessed and pushed to the AR HUD,
+        # without faking hardware control.
         result = execute_task(
             cmd,
             source="guardian_command",

backend/routes/model_proxy_routes.py

@@ -134,10 +134,16 @@ async def sketchfab_search(q: str = "", count: int = 12):
                 "message": "No Sketchfab token in the OMEGA vault."}
     count = max(1, min(int(count or 12), 24))
     try:
-        payload = await _sketchfab_get("/models", token, {
+        # /v3/search, NOT /v3/models. Verified live 2026-08-04: `q` is not a
+        # supported filter on /v3/models, so it was silently ignored and the
+        # endpoint returned an arbitrary page of downloadable models — every
+        # search this proxy has ever served came back topically unrelated to the
+        # query. Caught by searching "movie theater interior" and getting
+        # "MaszynkaDoMielenia" and "farmerhouse" back with ok=True.
+        payload = await _sketchfab_get("/search", token, {
+            "type": "models",
             "q": str(q or "").strip(),
             "downloadable": "true",
-            "type": "models",
             "count": str(count * 2),  # headroom: license filter trims below
             "archives_flavours": "true",
         })

backend/tools/media_viewer_tools.py

@@ -0,0 +1,198 @@
+"""Assistant tool surface for the local photo/video immersive viewer.
+
+The viewer itself lives in the WebAR client (`ar-core/ar-media-viewer.js`), which
+is what actually holds the decoded frame and the projection geometry. These tools
+are the assistant's way in: each one broadcasts a `media:control` event over the
+existing agent WebSocket, which the client picks up and applies to the live
+session — the same mechanism `ar_control_tool` already uses for AR state, rather
+than a second, parallel channel invented for this feature.
+
+Honesty rules encoded here rather than left to the model's discretion, because
+the governing brief requires them and a prompt is easier to drift from than code:
+
+- `experimental_surround` is never selected implicitly. Asking for "360" gets the
+  real projection path; the generative mode has to be named explicitly, and the
+  return text says plainly that what it produces is invented.
+- Spatial audio is never called "Dolby Atmos". If a caller passes that string the
+  tool corrects it in the response instead of quietly accepting the wording.
+"""
+
+from __future__ import annotations
+
+PROJECTIONS = ("flat", "180", "360", "fisheye")
+PACKINGS = ("mono", "sbs-full", "sbs-half", "tb-full", "tb-half")
+ENVIRONMENTS = ("passthrough", "mixed", "theater", "inox", "imax", "pvr")
+
+# What each environment actually changes, so the assistant can answer truthfully
+# when asked. These are room and screen presets -- they never touch decode
+# quality, resolution, or bitrate.
+ENVIRONMENT_FACTS = {
+    "passthrough": "the real room stays visible; the picture is composited into it as a screen",
+    "mixed": "passthrough plus a virtual bezel and ambient light response",
+    "theater": "a standard cinema hall, 36 degrees subtended from the seat, gently curved screen",
+    "pvr": "a mainstream multiplex auditorium, 34 degrees, further back, flatter screen",
+    "inox": "a premium large-screen auditorium, 40 degrees, between Theater and IMAX in scale",
+    "imax": "large-format geometry, 70 degrees subtended, curvature radius 1.5x the screen width",
+}
+
+_DOLBY_WORDS = ("dolby", "atmos")
+
+
+async def _dispatch(action: str, data: dict) -> None:
+    from backend.ws.agent_ws import ws_manager
+
+    await ws_manager.broadcast({
+        "event": "media:control",
+        "payload": {"action": action, "data": data},
+    })
+
+
+async def media_open_tool(file: str, projection: str = "", packing: str = "",
+                          environment: str = "", *args, **kwargs):
+    """Open a local photo or video file in the immersive viewer.
+
+    `file` is a path or name on the user's own device. Nothing is uploaded.
+    `projection` (flat/180/360/fisheye) and `packing` are optional overrides --
+    left blank, the viewer auto-detects them from the file and tells the user why.
+    """
+    if projection and projection not in PROJECTIONS:
+        return f"Unknown projection '{projection}'. Valid: {', '.join(PROJECTIONS)}."
+    if packing and packing not in PACKINGS:
+        return f"Unknown stereo packing '{packing}'. Valid: {', '.join(PACKINGS)}."
+    if environment and environment not in ENVIRONMENTS:
+        return f"Unknown environment '{environment}'. Valid: {', '.join(ENVIRONMENTS)}."
+
+    await _dispatch("open", {
+        "file": file,
+        "projection": projection or None,
+        "packing": packing or None,
+        "environment": environment or None,
+    })
+    detail = []
+    if projection:
+        detail.append(f"as {projection}")
+    if packing:
+        detail.append(f"packed {packing}")
+    if environment:
+        detail.append(f"in {environment} ({ENVIRONMENT_FACTS[environment]})")
+    suffix = (" " + ", ".join(detail)) if detail else " with format auto-detected"
+    return f"Opening {file} in the immersive viewer{suffix}."
+
+
+async def media_set_environment_tool(environment: str, *args, **kwargs):
+    """Switch the viewing mode: passthrough, mixed, theater, inox, imax or pvr."""
+    environment = (environment or "").strip().lower()
+    if environment not in ENVIRONMENTS:
+        return (f"'{environment}' is not one of the viewing modes. "
+                f"Valid: {', '.join(ENVIRONMENTS)}.")
+    await _dispatch("environment", {"environment": environment})
+    return (f"Switched to {environment} — {ENVIRONMENT_FACTS[environment]}. "
+            "This changes the room and screen only; the picture is decoded exactly the same way.")
+
+
+async def media_set_format_tool(projection: str = "", packing: str = "", *args, **kwargs):
+    """Override the projection format and/or the stereo packing."""
+    out = []
+    if projection:
+        if projection not in PROJECTIONS:
+            return f"Unknown projection '{projection}'. Valid: {', '.join(PROJECTIONS)}."
+        await _dispatch("projection", {"projection": projection})
+        out.append(f"format set to {projection}")
+    if packing:
+        if packing not in PACKINGS:
+            return f"Unknown stereo packing '{packing}'. Valid: {', '.join(PACKINGS)}."
+        await _dispatch("packing", {"packing": packing})
+        out.append(f"stereo packing set to {packing}")
+    if not out:
+        return "Nothing to change — give a projection, a packing, or both."
+    return "Done: " + " and ".join(out) + "."
+
+
+async def media_adjust_screen_tool(width: float = 0, distance: float = 0,
+                                   elevation: float = 0, curvature_radius: float = 0,
+                                   *args, **kwargs):
+    """Resize, move or re-curve the virtual screen. Values are in metres."""
+    patch = {}
+    for key, value in (("width", width), ("distance", distance),
+                       ("elevation", elevation), ("curvatureRadius", curvature_radius)):
+        try:
+            v = float(value)
+        except (TypeError, ValueError):
+            continue
+        if v:
+            patch[key] = v
+    if not patch:
+        return "Nothing to adjust — give a width, distance, elevation or curvature radius in metres."
+    await _dispatch("adjust_screen", patch)
+    parts = ", ".join(f"{k} {v}m" for k, v in patch.items())
+    return f"Screen adjusted: {parts}. It moves live in the running session."
+
+
+async def media_spatial_audio_tool(enabled: bool = True, *args, **kwargs):
+    """Turn head-tracked spatial audio on or off.
+
+    This is real HRTF binaural rendering. It is NOT Dolby Atmos, and must never be
+    described as such -- that is a licensed technology this product does not carry.
+    """
+    want = str(enabled).strip().lower() not in ("false", "0", "off", "no", "")
+    await _dispatch("spatial_audio", {"enabled": want})
+    if not want:
+        return "Spatial audio off — back to normal stereo output."
+    return ("Spatial audio on. This is real HRTF binaural rendering: a genuinely ambisonic "
+            "source is decoded as recorded, and an ordinary stereo track is widened. "
+            "It is not Dolby Atmos — that is a separate licensed technology this product "
+            "does not include. It also only applies to headphones, so it stays off on speakers.")
+
+
+async def media_ai_depth_tool(enabled: bool = True, *args, **kwargs):
+    """Toggle the AI depth/stereo enhancement for flat video."""
+    want = str(enabled).strip().lower() not in ("false", "0", "off", "no", "")
+    await _dispatch("ai_depth", {"enabled": want})
+    if not want:
+        return "AI 3D depth off."
+    return ("AI 3D depth requested. This estimates per-pixel depth and synthesises a second eye "
+            "from a flat video — the small regions revealed behind foreground objects are filled "
+            "in, not captured. Note: the depth model is not installed on the Space yet, so the "
+            "control will report that rather than pretending to work.")
+
+
+async def media_experimental_surround_tool(enabled: bool = True, confirm: bool = False,
+                                           *args, **kwargs):
+    """Toggle the EXPERIMENTAL generative surround mode.
+
+    Deliberately requires being named explicitly. Asking to "play this in 360" must
+    never land here -- that request is served by the real 360 projection path.
+    """
+    want = str(enabled).strip().lower() not in ("false", "0", "off", "no", "")
+    if not want:
+        await _dispatch("experimental_surround", {"enabled": False})
+        return "Experimental AI surround off."
+    await _dispatch("experimental_surround", {"enabled": True})
+    return ("Experimental AI-generated surround requested. Be clear with the user about what this "
+            "is: it invents the roughly 300 degrees of scene the camera never captured. Most of "
+            "what they would see in this mode is generated, not filmed, and it must never be "
+            "described as a real 360 video or as 'flawless'. A persistent on-screen label saying "
+            "'Experimental: AI-generated surround — not real footage' stays visible the whole "
+            "time. Note: the generative model is not installed on the Space yet, so the control "
+            "will say so rather than pretending to work.")
+
+
+async def media_describe_tool(topic: str = "", *args, **kwargs):
+    """Answer honestly about what the viewer can and cannot do."""
+    t = (topic or "").strip().lower()
+    if any(w in t for w in _DOLBY_WORDS):
+        return ("That is not Dolby Atmos. Dolby Atmos is a specific licensed technology, and this "
+                "product does not carry that licence. What it does have is real HRTF binaural "
+                "spatial audio — the same underlying mechanism, head-tracked — which I can turn on.")
+    if "360" in t and ("convert" in t or "make" in t or "turn" in t):
+        return ("A normal video cannot honestly be made into a real 360 video — a flat camera never "
+                "recorded the other 300 degrees. What I can do is play it at full original quality "
+                "on a virtual screen inside an immersive environment (theater, IMAX, passthrough "
+                "and so on), and optionally add an AI depth effect for a stereo sense of depth. "
+                "There is also a clearly-labelled experimental mode that generates the surround, "
+                "but that content is invented, not filmed.")
+    return ("The immersive viewer plays local photos and videos in four formats (flat, 180, 360, "
+            "fisheye), five stereo packings, and six viewing modes (" + ", ".join(ENVIRONMENTS) +
+            "). Format and packing are auto-detected and overridable. Switching viewing mode "
+            "changes the room and screen geometry only — never the decode path, resolution or "
+            "bitrate.")

backend/tools/tool_registry.py

@@ -1,50 +1,66 @@
-from backend.tools.web_search_tools import search_web as web_search_tool
-from backend.tools.filesystem_tools import read_file as read_file_tool, write_file as write_file_tool
-from backend.tools.terminal_tools import run_command as run_shell_tool
-from backend.tools.github_tools import github_search_tool, github_commit_tool, github_pull_tool
-from backend.tools.memory_tools import memory_store_tool, memory_search_tool
-from backend.tools.system_tools import screenshot_tool, open_app_tool, usb_devices_tool, notification_tool, system_stats_tool
-from backend.tools.calendar_tools import list_events as calendar_tool
-from backend.tools.email_tools import send_email as email_tool
-from backend.tools.xr_tools import xr_anchor_tool, gesture_context_tool, ar_control_tool
-from backend.tools.automation_tools import list_automations_tool, pause_automation_tool, resume_automation_tool, delete_automation_tool, trigger_automation_tool
-from backend.tools.system_tools import backup_vault_tool
-from backend.tools.browser_tools import close_browser, navigate
-from backend.tools.youtube_tools import scrape_youtube_transcript, search_youtube
-from backend.tools.social_tools import login_to_socials, post_to_x
-from backend.tools.audio_tools import search_audio_logs
-
-TOOL_REGISTRY = {
-    "backup_vault":         backup_vault_tool,
-    "web_search":           web_search_tool,
-    "read_file":            read_file_tool,
-    "write_file":           write_file_tool,
-    "run_shell":            run_shell_tool,
-    "github_search":        github_search_tool,
-    "github_commit":        github_commit_tool,
-    "github_pull":          github_pull_tool,
-    "memory_store":         memory_store_tool,
-    "memory_search":        memory_search_tool,
-    "take_screenshot":      screenshot_tool,
-    "open_app":             open_app_tool,
-    "usb_get_devices":      usb_devices_tool,
-    "send_notification":    notification_tool,
-    "get_system_stats":     system_stats_tool,
-    "calendar_query":       calendar_tool,
-    "email_send":           email_tool,
-    "xr_save_anchor":       xr_anchor_tool,
-    "gesture_context":      gesture_context_tool,
-    "ar_control":           ar_control_tool,
-    "automation_list":      list_automations_tool,
-    "automation_pause":     pause_automation_tool,
-    "automation_resume":    resume_automation_tool,
-    "automation_delete":    delete_automation_tool,
-    "automation_trigger":   trigger_automation_tool,
-    "browser_login":        login_to_socials,
-    "browser_post_x":       post_to_x,
-    "browser_yt_scrape":    scrape_youtube_transcript,
-    "browser_yt_search":    search_youtube,
-    "browser_close":        close_browser,
-    "browser_navigate":     navigate,
-    "search_audio_logs":    search_audio_logs,
+from backend.tools.web_search_tools import search_web as web_search_tool
+from backend.tools.filesystem_tools import read_file as read_file_tool, write_file as write_file_tool
+from backend.tools.terminal_tools import run_command as run_shell_tool
+from backend.tools.github_tools import github_search_tool, github_commit_tool, github_pull_tool
+from backend.tools.memory_tools import memory_store_tool, memory_search_tool
+from backend.tools.system_tools import screenshot_tool, open_app_tool, usb_devices_tool, notification_tool, system_stats_tool
+from backend.tools.calendar_tools import list_events as calendar_tool
+from backend.tools.email_tools import send_email as email_tool
+from backend.tools.xr_tools import xr_anchor_tool, gesture_context_tool, ar_control_tool
+from backend.tools.automation_tools import list_automations_tool, pause_automation_tool, resume_automation_tool, delete_automation_tool, trigger_automation_tool
+from backend.tools.system_tools import backup_vault_tool
+from backend.tools.browser_tools import close_browser, navigate
+from backend.tools.youtube_tools import scrape_youtube_transcript, search_youtube
+from backend.tools.social_tools import login_to_socials, post_to_x
+from backend.tools.audio_tools import search_audio_logs
+from backend.tools.media_viewer_tools import (
+    media_open_tool, media_set_environment_tool, media_set_format_tool,
+    media_adjust_screen_tool, media_spatial_audio_tool, media_ai_depth_tool,
+    media_experimental_surround_tool, media_describe_tool,
+)
+
+TOOL_REGISTRY = {
+    "backup_vault":         backup_vault_tool,
+    "web_search":           web_search_tool,
+    "read_file":            read_file_tool,
+    "write_file":           write_file_tool,
+    "run_shell":            run_shell_tool,
+    "github_search":        github_search_tool,
+    "github_commit":        github_commit_tool,
+    "github_pull":          github_pull_tool,
+    "memory_store":         memory_store_tool,
+    "memory_search":        memory_search_tool,
+    "take_screenshot":      screenshot_tool,
+    "open_app":             open_app_tool,
+    "usb_get_devices":      usb_devices_tool,
+    "send_notification":    notification_tool,
+    "get_system_stats":     system_stats_tool,
+    "calendar_query":       calendar_tool,
+    "email_send":           email_tool,
+    "xr_save_anchor":       xr_anchor_tool,
+    "gesture_context":      gesture_context_tool,
+    "ar_control":           ar_control_tool,
+    "automation_list":      list_automations_tool,
+    "automation_pause":     pause_automation_tool,
+    "automation_resume":    resume_automation_tool,
+    "automation_delete":    delete_automation_tool,
+    "automation_trigger":   trigger_automation_tool,
+    "browser_login":        login_to_socials,
+    "browser_post_x":       post_to_x,
+    "browser_yt_scrape":    scrape_youtube_transcript,
+    "browser_yt_search":    search_youtube,
+    "browser_close":        close_browser,
+    "browser_navigate":     navigate,
+    "search_audio_logs":    search_audio_logs,
+    # Local photo/video immersive viewer (v28 flagship). Environment is a real
+    # named choice, never a free-text field, so the assistant can answer honestly
+    # about what each preset actually changes.
+    "media_open":                   media_open_tool,
+    "media_set_environment":        media_set_environment_tool,
+    "media_set_format":             media_set_format_tool,
+    "media_adjust_screen":          media_adjust_screen_tool,
+    "media_spatial_audio":          media_spatial_audio_tool,
+    "media_ai_depth":               media_ai_depth_tool,
+    "media_experimental_surround":  media_experimental_surround_tool,
+    "media_describe":               media_describe_tool,
 }

backend/ws/agent_ws.py

@@ -24,6 +24,15 @@ class ConnectionManager:
     def __init__(self):
         self.restricted_mode = False
         self.active_connections: list[WebSocket] = []
+        # Sockets that announced themselves as a PC (pc_relay_client.py sends
+        # {"event": "client:identify", "payload": {"type": "pc"}} on connect).
+        #
+        # Until now that message was received and DROPPED — nothing in the
+        # backend handled "client:identify" at all — so the Space had a live,
+        # authenticated, command-capable connection to the user's desktop and no
+        # idea which socket it was. That is why phone -> cloud -> PC control did
+        # not work: not a missing channel, an unread introduction.
+        self.pc_connections: list[WebSocket] = []
         from backend.agent.react_agent import Tool
         self.tools = []
         for name, func in TOOL_REGISTRY.items():
@@ -48,8 +57,28 @@ class ConnectionManager:
     def disconnect(self, websocket: WebSocket):
         if websocket in self.active_connections:
             self.active_connections.remove(websocket)
+        if websocket in self.pc_connections:
+            self.pc_connections.remove(websocket)
         logging.info("Client disconnected from Agent WebSocket.")
 
+    async def send_to_pcs(self, message: dict) -> int:
+        """Deliver to every connected PC relay. Returns how many received it.
+
+        The count is the point: the caller can tell the difference between "sent
+        to your desktop" and "nothing was listening", instead of reporting
+        success for a command that reached no machine.
+        """
+        delivered = 0
+        for connection in list(self.pc_connections):
+            try:
+                await connection.send_json(message)
+                delivered += 1
+            except Exception as e:
+                logging.warning(f"PC relay send failed, dropping connection: {e}")
+                if connection in self.pc_connections:
+                    self.pc_connections.remove(connection)
+        return delivered
+
     async def broadcast(self, message: dict):
         for connection in self.active_connections:
             try:
@@ -59,6 +88,29 @@ class ConnectionManager:
 
     async def handle_client_event(self, websocket: WebSocket | None, data: dict):
         global _jarvis_auto_switched
+
+        # ── WHO ARE YOU? ────────────────────────────────────────────────────────
+        # pc_relay_client.py has always sent this the moment it connects, and
+        # nothing ever read it. Registering the socket here is what makes
+        # phone -> cloud -> PC control possible: the Space can now address the
+        # desktop specifically instead of shouting at every client.
+        if data.get("event") == "client:identify":
+            kind = str((data.get("payload") or {}).get("type") or "").lower()
+            if kind == "pc" and websocket is not None:
+                if websocket not in self.pc_connections:
+                    self.pc_connections.append(websocket)
+                logging.info(
+                    "PC relay registered (%d PC connection(s) now available)",
+                    len(self.pc_connections),
+                )
+                try:
+                    await websocket.send_json({
+                        "event": "backend:pc_registered",
+                        "payload": {"ok": True},
+                    })
+                except Exception:
+                    pass
+            return
         # ── WAKE WORD → PERSONA SWITCH (Cloud + Local path) ──────────────────────
         # Mobile app / local PC sends: {"event": "voice:wake_word", "payload": {"agent": "hey jarvis"}}
         # The server auto-switches the active persona and broadcasts UI + TTS confirmation.

dist/app-release.apk

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f2fdc7163b87f3cec94f9d8da14892e61fe8217072a32f55a360167a30edeb77
-size 66085001
+oid sha256:3768e22e18bbcc3cb6721d89727731626d6a1c675e227383dca5197d37915519
+size 116538395

modules/assistant_identity.py

@@ -89,6 +89,27 @@ SYSTEM AWARENESS (NEW CAPABILITIES):
 - Android God-Tier Automation: You are aware that the mobile guardian runs an autonomous Screen Agent via Accessibility Services. If the user asks for complex phone tasks, the mobile app handles it autonomously via AUTOMATE_MOBILE_TASK.
 - AR/VR Omnipresence: You are aware that the user has an XR Headset connected to the OMEGA network. You can spawn 3D models, launch AR browsers, and perform Telekinesis (manipulate 3D objects) via the AR Lab.
 - OSINT & Cybersecurity Protocol: You are an Elite Defensive Cybersecurity and OSINT agent. You perform advanced web reconnaissance, threat modeling, and digital footprint analysis natively via voice/chat using your Internet Layer routing.
+- Immersive Media Viewer: You can open a LOCAL photo or video from the user's own device and show it
+  immersively, via media_open / media_set_format / media_set_environment / media_adjust_screen /
+  media_spatial_audio. Four projection formats (flat, 180, 360, fisheye), five stereo packings
+  (mono, SBS full/half, top-bottom full/half), and six viewing modes: passthrough, mixed,
+  theater, inox, imax, pvr. Nothing is uploaded — the file never leaves the device.
+  * The six viewing modes are real room-and-screen presets with different geometry and acoustics
+    (IMAX subtends 70 degrees with a curvature radius 1.5x the screen width; theater 36 degrees).
+    They change WHAT THE PICTURE IS DRAWN ON — never the decode path, resolution, or bitrate.
+    Say that plainly if asked. PVR and INOX are named scale presets, not licensed cinema formats.
+  * BE HONEST ABOUT WHAT CANNOT BE DONE. A normal flat video cannot be turned into a real 360
+    video — the camera never recorded the other 300 degrees. What you can do is play it at full
+    original quality on a virtual screen inside an immersive environment. Never claim otherwise.
+  * There is an optional AI depth effect (media_ai_depth) that synthesises a second eye from a
+    flat video; the small regions revealed behind foreground objects are filled in, not captured.
+  * There is a separate EXPERIMENTAL generative surround mode (media_experimental_surround) that
+    invents the unseen part of the scene. NEVER select it just because the user said "360" — that
+    request means the real 360 projection path. Only use it when the user names it explicitly, and
+    always state that what it produces is AI-generated, not filmed.
+  * Spatial audio is real HRTF binaural rendering (ambisonic decode for genuinely spatial sources,
+    HRTF widening for ordinary stereo). It is NOT Dolby Atmos. If the user calls it Dolby Atmos,
+    correct them politely and offer the real thing instead of agreeing to their wording.
 """
 
 
@@ -134,6 +155,27 @@ SYSTEM AWARENESS (NEW CAPABILITIES):
 - Android God-Tier Automation: You are aware that the mobile guardian runs an autonomous Screen Agent via Accessibility Services. If the user asks for complex phone tasks, the mobile app handles it autonomously via AUTOMATE_MOBILE_TASK.
 - AR/VR Omnipresence: You are aware that the user has an XR Headset connected to the OMEGA network. You can spawn 3D models, launch AR browsers, and perform Telekinesis (manipulate 3D objects) via the AR Lab.
 - OSINT & Cybersecurity Protocol: You are an Elite Defensive Cybersecurity and OSINT agent. You perform advanced web reconnaissance, threat modeling, and digital footprint analysis natively via voice/chat using your Internet Layer routing.
+- Immersive Media Viewer: You can open a LOCAL photo or video from the user's own device and show it
+  immersively, via media_open / media_set_format / media_set_environment / media_adjust_screen /
+  media_spatial_audio. Four projection formats (flat, 180, 360, fisheye), five stereo packings
+  (mono, SBS full/half, top-bottom full/half), and six viewing modes: passthrough, mixed,
+  theater, inox, imax, pvr. Nothing is uploaded — the file never leaves the device.
+  * The six viewing modes are real room-and-screen presets with different geometry and acoustics
+    (IMAX subtends 70 degrees with a curvature radius 1.5x the screen width; theater 36 degrees).
+    They change WHAT THE PICTURE IS DRAWN ON — never the decode path, resolution, or bitrate.
+    Say that plainly if asked. PVR and INOX are named scale presets, not licensed cinema formats.
+  * BE HONEST ABOUT WHAT CANNOT BE DONE. A normal flat video cannot be turned into a real 360
+    video — the camera never recorded the other 300 degrees. What you can do is play it at full
+    original quality on a virtual screen inside an immersive environment. Never claim otherwise.
+  * There is an optional AI depth effect (media_ai_depth) that synthesises a second eye from a
+    flat video; the small regions revealed behind foreground objects are filled in, not captured.
+  * There is a separate EXPERIMENTAL generative surround mode (media_experimental_surround) that
+    invents the unseen part of the scene. NEVER select it just because the user said "360" — that
+    request means the real 360 projection path. Only use it when the user names it explicitly, and
+    always state that what it produces is AI-generated, not filmed.
+  * Spatial audio is real HRTF binaural rendering (ambisonic decode for genuinely spatial sources,
+    HRTF widening for ordinary stereo). It is NOT Dolby Atmos. If the user calls it Dolby Atmos,
+    correct them politely and offer the real thing instead of agreeing to their wording.
 """