Application Bridge API

The command layer between OOMU's interface (Next.js 16 / React 19) and its native engine (Tauri 2 / Rust).

Every action the interface takes crosses this boundary. There is no direct filesystem, network, or database access from the front end. The engine registers 246 commands, and nothing outside that list is reachable.

This reference describes OOMU 0.4.0. It is a description of an internal boundary, not a public integration surface: command names and shapes change between releases.

---

1. How the bridge works

1.1 Invocation

Commands are invoked through Tauri's IPC. The Content Security Policy restricts connect-src to ipc:, http://ipc.localhost, and tauri:, and nothing else; object-src is none and frame-ancestors is none. The interface cannot open a connection to any outside host. Web content rendered inside OOMU cannot reach these commands.

1.2 Naming

Commands are snake_case in Rust and invoked as such. Payload fields are camelCase in both directions, and most request structs are declared with deny_unknown_fields: an unrecognized field is an error, not something silently ignored.

1.3 Errors

Errors are structured, not strings:

{
  "code": "project_not_found",
  "entityKind": "project",
  "field": null,
  "diagnostic": "the project record does not exist"
}

code is stable and drives interface copy. diagnostic is for logs and support, not for display.

1.4 Mutations carry receipts

Any command that changes durable state returns a MutationResult<T>:

{
  "value":   { "...": "the changed record" },
  "receipt": {
    "receiptId":     "...",
    "operationId":   "...",
    "operation":     "create_project",
    "entityKind":    "project",
    "entityId":      "project_...",
    "resultDigest":  "<sha256>",
    "committedAtMs": 1756300000000,
    "replayed":      false
  }
}

The caller supplies operationId. The engine records it in data_mutations alongside a request digest and the result. Re-sending the same operationId returns the original result with replayed: true instead of performing the change again.

This makes the whole mutation surface idempotent. A retry after a dropped response cannot create a second project or send a second draft.

1.5 Native pickers are native

Commands prefixed choose_ open a real macOS file dialog. The path is never a parameter. choose_and_install_mod, choose_and_add_local_models, choose_project_documents, choose_project_document_paths, choose_chat_attachments, choose_and_add_document, and add_local_mcp_server all work this way.

The consequence: no model output, prompt, or page content can direct OOMU at a file. A human picked it, in a system dialog.

---

2. Command families

2.1 Startup, license, and setup

2.2 Models and providers

2.3 Chat and turns

2.4 Agents

list_agents · create_agent · update_agent · archive_agent · delete_agent · get_chat_agent_binding · set_chat_agent · start_agent_chat · choose_and_import_agent · migrate_agent_avatar_tones

choose_and_import_agent reads an agent folder, such as a Beta 1 export, and reports exactly which fields carried over and which did not.

2.5 Projects and documents

2.6 Artifacts

list_artifacts · export_artifact · open_deliverable · reveal_deliverable · copy_deliverable_file · list_document_engines · choose_and_add_document · get_document_preview · get_deliverable_preview · get_document_preview_helper_status · open_document_preview_helper_download · list_recoverable_artifact_deletions · stage_artifact_deletion · undo_artifact_deletion · commit_artifact_deletion · clear_stale_artifacts

list_document_engines probes by actually building and verifying a file per format, so its answer reflects the machine rather than a build flag.

2.7 Workflows and scheduling

2.8 Connections

2.9 Mods

list_installed_mods · set_mod_enabled · choose_and_install_mod · revalidate_installed_mod · remove_installed_mod · set_mod_tag_settings · open_oomu_marketplace

open_oomu_marketplace is blocked under Air-Gap Mode.

2.10 Quick Launcher and quick actions

2.11 Briefing, activity, and ledger

2.12 Profile, memory, and security

2.13 Browser

get_visible_browser_session · reload_visible_browser · resize_visible_browser · close_visible_browser · list_visible_browser_downloads

Browser commands take a navigationGeneration and validate it against the live session, so a stale interface cannot act on a browser that has since navigated or closed.

list_visible_browser_downloads currently returns an empty list. Downloads are not surfaced in this beta.

2.14 Updates

get_application_update_status · check_for_updates · install_update_and_restart

OOMU checks at launch and every 24 hours, against a signed manifest at a fixed endpoint, verified with a minisign public key compiled into the build. The request carries the app version and processor architecture, and no identifier. The check is skipped entirely under Air-Gap Mode, and you decide when to apply.

2.15 Mochi and Ready for review

The background service is a separate program and is not reached through this bridge. OOMU talks to it over a local socket in a folder only your account can open, and checks that whatever connects is running as the same user.

---

3. Invariants worth relying on

---

Related

• Capability catalog: the actions beneath these commands.
• Local database schema: where the results are stored.
• System design overview: how a turn flows through this layer.