omnius 1.0.621 → 1.0.623

package/dist/update-worker.js

@@ -293776,9 +293776,9 @@ async function managedDaemonServiceOwnsPort(port, dependencies = {
 function systemdQuote(value) {
   return /[\s"\\]/.test(value) ? `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : value;
 }
-async function repairManagedDaemonUnit(port) {
+async function repairManagedDaemonUnit(port, preferredEntrypoint) {
   if (process.platform !== "linux") return false;
-  const command = await resolveDaemonCommand(process.execPath);
+  const command = await resolveDaemonCommand(process.execPath, preferredEntrypoint);
   if (!command) return false;
   try {
     const configHome = process.env["XDG_CONFIG_HOME"] || join14(homedir14(), ".config");
@@ -293990,7 +293990,7 @@ async function reclaimOwnedDaemonListener(port = getDaemonPort(), dependencies =
   }
   return { ok: true, action: "cleared", port, clearedPids, blockedPids: [] };
 }
-async function restartDaemon(port, expectedVersion) {
+async function restartDaemon(port, expectedVersion, preferredEntrypoint) {
   const p = port ?? getDaemonPort();
   const managed = await managedDaemonServiceMatchesPort(p);
   if (managed) {
@@ -293999,12 +293999,14 @@ async function restartDaemon(port, expectedVersion) {
       if (!reclaimed.ok) return false;
       await reclaimStaleDaemonEndpointClaim(p);
     }
+    await runUserSystemctl(["reset-failed", "omnius-daemon.service"]);
     const restarted = await runUserSystemctl(["restart", "omnius-daemon.service"]);
     if (restarted.ok && (await waitForDaemonReady(p, expectedVersion)).ok) return true;
-    const repaired = await repairManagedDaemonUnit(p);
+    const repaired = await repairManagedDaemonUnit(p, preferredEntrypoint);
     if (repaired) {
       await runUserSystemctl(["stop", "omnius-daemon.service"]);
       await waitForDaemonStopped(p);
+      await runUserSystemctl(["reset-failed", "omnius-daemon.service"]);
       const started = await runUserSystemctl(["start", "omnius-daemon.service"]);
       if (started.ok && (await waitForDaemonReady(p, expectedVersion)).ok) return true;
     }
@@ -294019,7 +294021,7 @@ async function restartDaemon(port, expectedVersion) {
     if (!reclaimed.ok) return false;
   }
   if (!await reclaimStaleDaemonEndpointClaim(p)) return false;
-  const pid = await startDaemon(p);
+  const pid = await startDaemon(p, preferredEntrypoint);
   if (!pid) return false;
   return (await waitForDaemonReady(p, expectedVersion)).ok;
 }
@@ -294039,8 +294041,9 @@ function commandForEntrypoint(path, nodeExe) {
   }
   return { command: path, args };
 }
-async function resolveDaemonCommand(nodeExe) {
+async function resolveDaemonCommand(nodeExe, preferredEntrypoint) {
   const candidates = [];
+  if (preferredEntrypoint) candidates.push(preferredEntrypoint);
   const thisDir = dirname8(fileURLToPath2(import.meta.url));
   candidates.push(join14(thisDir, "index.js"));
   if (process.argv[1]) candidates.push(process.argv[1]);
@@ -294063,13 +294066,13 @@ async function resolveDaemonCommand(nodeExe) {
   }
   return null;
 }
-async function startDaemon(port = getDaemonPort()) {
+async function startDaemon(port = getDaemonPort(), preferredEntrypoint) {
   mkdirSync3(OMNIUS_DIR, { recursive: true });
   const daemonPort = port;
   const endpointClaim = claimDaemonEndpoint(daemonPort);
   if (!endpointClaim) return null;
   const nodeExe = process.execPath;
-  const daemonCommand = await resolveDaemonCommand(nodeExe);
+  const daemonCommand = await resolveDaemonCommand(nodeExe, preferredEntrypoint);
   if (!daemonCommand) {
     releaseDaemonEndpointClaim(endpointClaim);
     return null;
@@ -294496,24 +294499,31 @@ async function runVerifiedUpdateTransaction(initial, dependencies, paths = resol
       executable_version: evidence.executableVersion
     }, paths);
     state = transition(state, { phase: "daemon_restarting" }, paths);
-    if (!await dependencies.restartDaemon(target)) {
-      throw new Error(
-        `The daemon restart at ${state.daemon_endpoint ?? "the configured endpoint"} did not produce Omnius v${target}`
-      );
+    let daemon = null;
+    let restartAcknowledged = false;
+    for (let attempt = 1; attempt <= 3; attempt++) {
+      restartAcknowledged = await dependencies.restartDaemon(target, evidence.executablePath) || restartAcknowledged;
+      daemon = await dependencies.observeDaemon();
+      if (daemon?.bootVersion === target && daemon.bootPackageHash === evidence.packageHash) {
+        break;
+      }
+      if (attempt < 3) await new Promise((resolve12) => setTimeout(resolve12, 1e3));
     }
-    daemonQuiesced = false;
-    const daemon = await dependencies.observeDaemon();
     if (!daemon || daemon.bootVersion !== target) {
-      throw new Error(`Daemon verification failed: expected ${target}, observed ${daemon?.bootVersion ?? "unreachable"}`);
+      const observed = daemon?.bootVersion ?? "unreachable";
+      throw new Error(
+        restartAcknowledged ? `Daemon verification failed after 3 recovery attempts: expected ${target}, observed ${observed}` : `The daemon at ${state.daemon_endpoint ?? "the configured endpoint"} could not be restarted from the verified Omnius v${target} executable after 3 attempts`
+      );
     }
     if (!daemon.bootPackageHash) {
-      throw new Error("Daemon package verification failed: the restarted runtime did not report a boot package hash");
+      throw new Error("Daemon package verification failed after 3 recovery attempts: the restarted runtime did not report a boot package hash");
     }
     if (daemon.bootPackageHash !== evidence.packageHash) {
       throw new Error(
-        `Daemon package verification failed: boot hash ${daemon.bootPackageHash} does not match installed hash ${evidence.packageHash}`
+        `Daemon package verification failed after 3 recovery attempts: boot hash ${daemon.bootPackageHash} does not match installed hash ${evidence.packageHash}`
       );
     }
+    daemonQuiesced = false;
     state = transition(state, {
       phase: "runtime_verified",
       daemon_version: daemon.bootVersion,
@@ -294865,8 +294875,8 @@ async function main() {
     state,
     {
       quiesceDaemon: () => quiesceDaemonForUpdate(port),
-      restartDaemon: (expected) => restartDaemon(port, expected),
-      recoverDaemon: () => restartDaemon(port),
+      restartDaemon: (expected, executable) => restartDaemon(port, expected, executable),
+      recoverDaemon: () => restartDaemon(port, target),
       observeDaemon: async () => {
         const identity = await getDaemonReportedIdentity(port);
         return identity ? { bootVersion: identity.bootVersion, bootPackageHash: identity.bootPackageHash } : null;

package/docs/DISCOVERY.json

@@ -12380,6 +12380,162 @@
         "packages/cli/src/api/openapi.ts"
       ]
     },
+    {
+      "id": "api.v1-services",
+      "kind": "api",
+      "title": "/v1/services",
+      "summary": "List all active daemon-owned REST services and their routes",
+      "aliases": [
+        "/v1/services"
+      ],
+      "keywords": [
+        "rest",
+        "openapi",
+        "GET",
+        "Discovery",
+        "v1",
+        "services"
+      ],
+      "maturity": "stable",
+      "layer": "interface",
+      "audiences": [
+        "integrator",
+        "service-agent",
+        "coding-agent"
+      ],
+      "interfaces": [
+        {
+          "type": "rest",
+          "target": "GET /v1/services"
+        },
+        {
+          "type": "openapi",
+          "target": "/openapi.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "source",
+          "target": "packages/cli/src/api/openapi.ts",
+          "relation": "openapi-source"
+        },
+        {
+          "type": "documentation",
+          "target": "docs/reference/rest-api.md",
+          "relation": "endpoint-inventory"
+        }
+      ],
+      "methods": [
+        "GET"
+      ],
+      "tags": [
+        "Discovery"
+      ],
+      "operations": {
+        "get": {
+          "summary": "List all active daemon-owned REST services and their routes",
+          "tags": [
+            "Discovery"
+          ],
+          "security": [],
+          "description": "Agent-readable service inventory generated from this OpenAPI document. Every entry includes lifecycle ownership, whether it depends on an interactive session, all registered routes, and a readiness/status endpoint when one exists. /listen and /hangup affect voice sessions only and do not own the REST daemon.",
+          "responses": {
+            "200": {
+              "description": "Active daemon and complete service catalog"
+            }
+          }
+        }
+      },
+      "source_of_truth": [
+        "GET /openapi.json",
+        "packages/cli/src/api/openapi.ts"
+      ]
+    },
+    {
+      "id": "api.v1-services-id",
+      "kind": "api",
+      "title": "/v1/services/{id}",
+      "summary": "Get one daemon-owned REST service contract",
+      "aliases": [
+        "/v1/services/{id}"
+      ],
+      "keywords": [
+        "rest",
+        "openapi",
+        "GET",
+        "Discovery",
+        "v1",
+        "services",
+        "{id}"
+      ],
+      "maturity": "stable",
+      "layer": "interface",
+      "audiences": [
+        "integrator",
+        "service-agent",
+        "coding-agent"
+      ],
+      "interfaces": [
+        {
+          "type": "rest",
+          "target": "GET /v1/services/{id}"
+        },
+        {
+          "type": "openapi",
+          "target": "/openapi.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "source",
+          "target": "packages/cli/src/api/openapi.ts",
+          "relation": "openapi-source"
+        },
+        {
+          "type": "documentation",
+          "target": "docs/reference/rest-api.md",
+          "relation": "endpoint-inventory"
+        }
+      ],
+      "methods": [
+        "GET"
+      ],
+      "tags": [
+        "Discovery"
+      ],
+      "operations": {
+        "get": {
+          "summary": "Get one daemon-owned REST service contract",
+          "tags": [
+            "Discovery"
+          ],
+          "security": [],
+          "parameters": [
+            {
+              "name": "id",
+              "in": "path",
+              "required": true,
+              "schema": {
+                "type": "string"
+              },
+              "description": "Service id from GET /v1/services"
+            }
+          ],
+          "responses": {
+            "200": {
+              "description": "Service lifecycle, availability, readiness, and routes"
+            },
+            "404": {
+              "description": "Unknown service id"
+            }
+          }
+        }
+      },
+      "source_of_truth": [
+        "GET /openapi.json",
+        "packages/cli/src/api/openapi.ts"
+      ]
+    },
     {
       "id": "api.v1-services-systemd",
       "kind": "api",
@@ -13663,7 +13819,7 @@
           "tags": [
             "Tools"
           ],
-          "description": "Returns each tool's name, class, description, JSON-schema parameters, security policy {categories, risk, requires_scope, off_device_allowed, rationale}, and per-tool endpoint hrefs. Filters: ?category=read|write|exec|network|hardware|agent|sensitive · ?scope=read|run|admin · ?risk=low|medium|high|critical. Pagination via ?limit=N&offset=N (default limit=50; pass limit=200 to see all).",
+          "description": "Returns every discovered tool, including unavailable tools with an availability reason, plus name, class, description, JSON-schema parameters, direct_callable, security policy {categories, risk, requires_scope, off_device_allowed, rationale}, and per-tool endpoint hrefs. Every available built-in is direct-callable through the shared policy gate. Filters: ?category=read|write|exec|network|hardware|agent|sensitive · ?scope=read|run|admin · ?risk=low|medium|high|critical. Pagination via ?limit=N&offset=N (default limit=50; pass limit=200 to see all).",
           "responses": {
             "200": {
               "description": "Paginated tools with security metadata"
@@ -13853,7 +14009,7 @@
           "tags": [
             "Tools"
           ],
-          "description": "Body: {args: object, working_dir?: string}. The `args` key is canonical (Q4) — the JSON-schema in /v1/tools/{name} `parameters` describes what goes INSIDE the args wrapper. Returns ToolResult {success, output, llmContent?, error?, durationMs} plus security metadata. Auth gating: request scope (read/run/admin) must satisfy tool.requires_scope; non-loopback callers need admin scope unless tool.off_device_allowed=true. Anonymous loopback callers default to admin scope; anonymous remote callers default to read scope.",
+          "description": "Body: {args: object, working_dir?: string}. The `args` key is canonical (Q4) — the JSON-schema in /v1/tools/{name} `parameters` describes what goes INSIDE the args wrapper. Every available built-in and registered external tool is callable here. Returns ToolResult {success, output, llmContent?, error?, durationMs} plus security metadata. Auth gating: request scope (read/run/admin) must satisfy tool.requires_scope; non-loopback callers need admin scope unless tool.off_device_allowed=true.",
           "parameters": [
             {
               "name": "name",
@@ -15989,6 +16145,352 @@
         "packages/cli/src/api/openapi.ts"
       ]
     },
+    {
+      "id": "api.v1-web-crawl",
+      "kind": "api",
+      "title": "/v1/web/crawl",
+      "summary": "Inspect web-crawl availability, schema, and security policy; Crawl a website directly through the Omnius tool runtime",
+      "aliases": [
+        "/v1/web/crawl"
+      ],
+      "keywords": [
+        "rest",
+        "openapi",
+        "GET",
+        "POST",
+        "Web",
+        "Tools",
+        "v1",
+        "web",
+        "crawl"
+      ],
+      "maturity": "stable",
+      "layer": "interface",
+      "audiences": [
+        "integrator",
+        "service-agent",
+        "coding-agent"
+      ],
+      "interfaces": [
+        {
+          "type": "rest",
+          "target": "GET /v1/web/crawl"
+        },
+        {
+          "type": "rest",
+          "target": "POST /v1/web/crawl"
+        },
+        {
+          "type": "openapi",
+          "target": "/openapi.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "source",
+          "target": "packages/cli/src/api/openapi.ts",
+          "relation": "openapi-source"
+        },
+        {
+          "type": "documentation",
+          "target": "docs/reference/rest-api.md",
+          "relation": "endpoint-inventory"
+        }
+      ],
+      "methods": [
+        "GET",
+        "POST"
+      ],
+      "tags": [
+        "Web",
+        "Tools"
+      ],
+      "operations": {
+        "get": {
+          "summary": "Inspect web-crawl availability, schema, and security policy",
+          "tags": [
+            "Web",
+            "Tools"
+          ],
+          "responses": {
+            "200": {
+              "description": "web_crawl capability metadata"
+            }
+          }
+        },
+        "post": {
+          "summary": "Crawl a website directly through the Omnius tool runtime",
+          "tags": [
+            "Web",
+            "Tools"
+          ],
+          "description": "Stable alias for POST /v1/tools/web_crawl/call. Shared tool security applies; browser-backed crawling requires the runtime dependencies reported by GET.",
+          "responses": {
+            "200": {
+              "description": "ToolResult crawl response"
+            },
+            "403": {
+              "description": "Policy denied"
+            },
+            "500": {
+              "description": "Crawl failed"
+            }
+          }
+        }
+      },
+      "source_of_truth": [
+        "GET /openapi.json",
+        "packages/cli/src/api/openapi.ts"
+      ]
+    },
+    {
+      "id": "api.v1-web-fetch",
+      "kind": "api",
+      "title": "/v1/web/fetch",
+      "summary": "Inspect web-fetch availability, schema, and security policy; Fetch a URL directly through the Omnius tool runtime",
+      "aliases": [
+        "/v1/web/fetch"
+      ],
+      "keywords": [
+        "rest",
+        "openapi",
+        "GET",
+        "POST",
+        "Web",
+        "Tools",
+        "v1",
+        "web",
+        "fetch"
+      ],
+      "maturity": "stable",
+      "layer": "interface",
+      "audiences": [
+        "integrator",
+        "service-agent",
+        "coding-agent"
+      ],
+      "interfaces": [
+        {
+          "type": "rest",
+          "target": "GET /v1/web/fetch"
+        },
+        {
+          "type": "rest",
+          "target": "POST /v1/web/fetch"
+        },
+        {
+          "type": "openapi",
+          "target": "/openapi.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "source",
+          "target": "packages/cli/src/api/openapi.ts",
+          "relation": "openapi-source"
+        },
+        {
+          "type": "documentation",
+          "target": "docs/reference/rest-api.md",
+          "relation": "endpoint-inventory"
+        }
+      ],
+      "methods": [
+        "GET",
+        "POST"
+      ],
+      "tags": [
+        "Web",
+        "Tools"
+      ],
+      "operations": {
+        "get": {
+          "summary": "Inspect web-fetch availability, schema, and security policy",
+          "tags": [
+            "Web",
+            "Tools"
+          ],
+          "responses": {
+            "200": {
+              "description": "web_fetch capability metadata"
+            }
+          }
+        },
+        "post": {
+          "summary": "Fetch a URL directly through the Omnius tool runtime",
+          "tags": [
+            "Web",
+            "Tools"
+          ],
+          "description": "Stable alias for POST /v1/tools/web_fetch/call. Body: {args:{url:string}}. Shared tool security and network-egress policy apply.",
+          "responses": {
+            "200": {
+              "description": "ToolResult fetch response"
+            },
+            "403": {
+              "description": "Policy denied"
+            },
+            "500": {
+              "description": "Fetch failed"
+            }
+          }
+        }
+      },
+      "source_of_truth": [
+        "GET /openapi.json",
+        "packages/cli/src/api/openapi.ts"
+      ]
+    },
+    {
+      "id": "api.v1-web-search",
+      "kind": "api",
+      "title": "/v1/web/search",
+      "summary": "Inspect web-search availability, schema, and security policy; Search the web directly through the Omnius tool runtime",
+      "aliases": [
+        "/v1/web/search"
+      ],
+      "keywords": [
+        "rest",
+        "openapi",
+        "GET",
+        "POST",
+        "Web",
+        "Tools",
+        "v1",
+        "web",
+        "search"
+      ],
+      "maturity": "stable",
+      "layer": "interface",
+      "audiences": [
+        "integrator",
+        "service-agent",
+        "coding-agent"
+      ],
+      "interfaces": [
+        {
+          "type": "rest",
+          "target": "GET /v1/web/search"
+        },
+        {
+          "type": "rest",
+          "target": "POST /v1/web/search"
+        },
+        {
+          "type": "openapi",
+          "target": "/openapi.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "source",
+          "target": "packages/cli/src/api/openapi.ts",
+          "relation": "openapi-source"
+        },
+        {
+          "type": "documentation",
+          "target": "docs/reference/rest-api.md",
+          "relation": "endpoint-inventory"
+        }
+      ],
+      "methods": [
+        "GET",
+        "POST"
+      ],
+      "tags": [
+        "Web",
+        "Tools"
+      ],
+      "operations": {
+        "get": {
+          "summary": "Inspect web-search availability, schema, and security policy",
+          "tags": [
+            "Web",
+            "Tools"
+          ],
+          "description": "Stable alias for GET /v1/tools/web_search.",
+          "responses": {
+            "200": {
+              "description": "web_search capability metadata"
+            },
+            "404": {
+              "description": "web_search runtime unavailable"
+            }
+          }
+        },
+        "post": {
+          "summary": "Search the web directly through the Omnius tool runtime",
+          "tags": [
+            "Web",
+            "Tools"
+          ],
+          "description": "Stable alias for POST /v1/tools/web_search/call. Uses the same auth, profile, origin, timeout, output-size, and audit policy. Body example: {\"args\":{\"query\":\"CUDA ASR on Jetson\",\"num_results\":5,\"provider\":\"duckduckgo\"}}. No search API key is required.",
+          "requestBody": {
+            "required": true,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "args"
+                  ],
+                  "properties": {
+                    "args": {
+                      "type": "object",
+                      "required": [
+                        "query"
+                      ],
+                      "properties": {
+                        "query": {
+                          "type": "string"
+                        },
+                        "num_results": {
+                          "type": "integer",
+                          "minimum": 1
+                        },
+                        "provider": {
+                          "type": "string",
+                          "enum": [
+                            "duckduckgo"
+                          ]
+                        }
+                      }
+                    },
+                    "session_id": {
+                      "type": "string"
+                    },
+                    "profile": {
+                      "type": "string"
+                    },
+                    "timeout_ms": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "responses": {
+            "200": {
+              "description": "ToolResult search response"
+            },
+            "400": {
+              "description": "Invalid request"
+            },
+            "403": {
+              "description": "Policy denied"
+            },
+            "500": {
+              "description": "Search failed"
+            }
+          }
+        }
+      },
+      "source_of_truth": [
+        "GET /openapi.json",
+        "packages/cli/src/api/openapi.ts"
+      ]
+    },
     {
       "id": "api.version",
       "kind": "api",

package/docs/DISCOVERY.md

@@ -189,6 +189,8 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `api.v1-scheduled-kill` | /v1/scheduled/kill | Kill a running scheduled job |
 | `api.v1-scheduled-reconcile` | /v1/scheduled/reconcile | Preview reconciliation of persisted and legacy scheduled jobs; Preview or apply scheduled-job reconciliation |
 | `api.v1-scheduled-status` | /v1/scheduled/status | Status of scheduled job runner |
+| `api.v1-services` | /v1/services | List all active daemon-owned REST services and their routes |
+| `api.v1-services-id` | /v1/services/{id} | Get one daemon-owned REST service contract |
 | `api.v1-services-systemd` | /v1/services/systemd | Systemd service status (where supported) |
 | `api.v1-services-systemd-unit` | /v1/services/systemd/{unit} | Perform an action on one user-level systemd unit |
 | `api.v1-sessions` | /v1/sessions | List Omnius task sessions |
@@ -228,6 +230,9 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `api.v1-voice-transcribe-stream` | /v1/voice/transcribe/stream | Isolated final ASR over Server-Sent Events |
 | `api.v1-voice-tts` | /v1/voice/tts | Synthesize text to audio bytes |
 | `api.v1-voicechat-ws` | /v1/voicechat/ws | WebSocket — full-duplex voicechat (binary PCM + JSON control) |
+| `api.v1-web-crawl` | /v1/web/crawl | Inspect web-crawl availability, schema, and security policy; Crawl a website directly through the Omnius tool runtime |
+| `api.v1-web-fetch` | /v1/web/fetch | Inspect web-fetch availability, schema, and security policy; Fetch a URL directly through the Omnius tool runtime |
+| `api.v1-web-search` | /v1/web/search | Inspect web-search availability, schema, and security policy; Search the web directly through the Omnius tool runtime |
 | `api.version` | /version | Package, API, and discovery contract versions |
 
 ## Capability