@agentikos/omega-os 0.19.8 → 0.19.10

package/bootstrap/lib/steps.sh

@@ -35,25 +35,75 @@ step_system_deps() {
 
   # PyYAML — required by every install-side helper that reads the manifest
   # or audit YAMLs (bootstrap/lib/llm-clis.py, manifest-helpers.py, audit
-  # generator). apt/dnf already deliver it via the system package above;
-  # brew on macOS does NOT, so we install it here with a fallback chain
-  # robust to PEP-668 (externally-managed) macOS Pythons.
+  # generator). apt/dnf already deliver it via the system package above.
+  #
+  # macOS Tahoe / Sonoma ship externally-managed Pythons (PEP 668) AND
+  # often deny `pip install --user --break-system-packages` for security
+  # policy reasons. The 100% reliable path is a dedicated venv that we
+  # own, isolated from system Python rules.
+  #
+  # We prepend the venv's bin/ to PATH so every subsequent `python3 ...`
+  # call (37 sites across steps.sh) automatically uses this isolated
+  # Python WITHOUT touching the user's system Python or site-packages.
+  local installer_venv="$STATE_DIR/installer-venv"
   if ! python3 -c "import yaml" 2>/dev/null; then
-    info "installing pyyaml (required by install helpers)"
-    if   python3 -m pip install --user --quiet pyyaml 2>>"$LOG_FILE"; then
-      ok "pyyaml installed (--user)"
-    elif python3 -m pip install --user --quiet --break-system-packages pyyaml 2>>"$LOG_FILE"; then
-      ok "pyyaml installed (--user --break-system-packages — macOS Tahoe path)"
-    elif have pipx && pipx install pyyaml 2>>"$LOG_FILE"; then
-      ok "pyyaml installed via pipx"
+    # On macOS Tahoe (and any Python without working `ensurepip` /
+    # broken venv) the stdlib `python3 -m venv` crashes. Astral's `uv`
+    # creates venvs reliably from any Python and is the canonical path.
+    # We make it the PRIMARY method; stdlib venv is only a fallback for
+    # boxes where uv isn't installed yet.
+    #
+    # Bootstrap order: uv was added to step_system_deps later in this
+    # very function, but most Macs already have it. If neither uv nor
+    # working stdlib venv is available, we install uv first then loop.
+    if [ ! -f "$installer_venv/bin/python3" ]; then
+      info "creating installer venv (PEP-668-safe path for install helpers)"
+
+      # 1. Pre-install uv if it's missing — it's the safest venv tool.
+      if ! have uv && [ ! -x "$HOME/.local/bin/uv" ]; then
+        info "  → installing uv (Astral package manager) first"
+        curl -LsSf https://astral.sh/uv/install.sh 2>>"$LOG_FILE" | sh >>"$LOG_FILE" 2>&1 \
+          || info "  (uv install failed — will try python3 -m venv as fallback)"
+      fi
+      local uv_bin="$(command -v uv || echo "$HOME/.local/bin/uv")"
+
+      # 2. Try uv first (works on Tahoe + any PEP-668 Python).
+      if [ -x "$uv_bin" ] && "$uv_bin" venv "$installer_venv" \
+            --python python3 --quiet 2>>"$LOG_FILE"; then
+        ok "  installer venv created via uv"
+      elif python3 -m venv "$installer_venv" 2>>"$LOG_FILE"; then
+        ok "  installer venv created via python3 -m venv"
+      else
+        err "venv creation failed by both uv AND python3 -m venv — see $LOG_FILE"
+        err "diagnose:"
+        err "  $uv_bin venv $installer_venv --python python3"
+        err "  python3 -m venv $installer_venv"
+        return 1
+      fi
+    fi
+
+    # 3. Install pyyaml into the venv. Two methods, uv first.
+    local uv_bin="$(command -v uv || echo "$HOME/.local/bin/uv")"
+    if [ -x "$uv_bin" ] && "$uv_bin" pip install --quiet \
+          --python "$installer_venv/bin/python3" pyyaml 2>>"$LOG_FILE"; then
+      ok "  pyyaml installed via uv pip"
+    elif "$installer_venv/bin/pip" install --quiet pyyaml 2>>"$LOG_FILE"; then
+      ok "  pyyaml installed via venv pip"
     else
-      err "pyyaml install failed across all paths — see $LOG_FILE"
-      err "manual fix:  python3 -m pip install --user --break-system-packages pyyaml"
+      err "pyyaml install failed in venv — see $LOG_FILE"
+      err "diagnose: $installer_venv/bin/pip install pyyaml"
       return 1
     fi
-    # Sanity re-check
+    ok "installer venv ready: $installer_venv"
+  fi
+  # PATH prepend — persists for the rest of install.sh because steps are
+  # called as bash functions in the SAME shell. We do this on every run,
+  # not only when we just created the venv, so a resumed install with a
+  # pre-existing venv still gets `python3 -c "import yaml"` resolving here.
+  if [ -x "$installer_venv/bin/python3" ]; then
+    export PATH="$installer_venv/bin:$PATH"
     if ! python3 -c "import yaml" 2>/dev/null; then
-      err "pyyaml still not importable after install — PATH issue?"
+      err "venv python3 on PATH but yaml not importable — corrupted venv?"
       return 1
     fi
   fi

package/install.sh

@@ -86,6 +86,14 @@ STATE_FILE="$STATE_DIR/.install-state"
 LOG_FILE="$STATE_DIR/logs/install.log"
 mkdir -p "$STATE_DIR/logs"
 
+# Installer-venv guard — if a previous run created the PEP-668-safe venv,
+# prepend it to PATH NOW so subsequent steps that get skipped as
+# "already done" (step 10) still pick up its python3 with pyyaml. Without
+# this, a resumed install skips step 10 → step 15 hits "no module yaml".
+if [ -x "$STATE_DIR/installer-venv/bin/python3" ]; then
+  export PATH="$STATE_DIR/installer-venv/bin:$PATH"
+fi
+
 # Bundled version — used to detect state drift across upgrades. We read it
 # from the SSOT VERSION file shipped in the package, falling back to the
 # engine's pyproject.toml so a partially-installed system still works.

package/omega/Agentik_Engine/omega_engine/__init__.py

@@ -188,7 +188,7 @@ from omega_engine.genesis import (
 )
 from omega_engine import plan as plan_v7
 
-__version__ = "0.19.8"
+__version__ = "0.19.10"
 
 __all__ = [
     "__version__",

package/omega/Agentik_Engine/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "omega-engine"
-version = "0.19.8"
+version = "0.19.10"
 description = "The Omega OS orchestration engine — event-sourced, verified-completion agent graphs."
 readme = "README.md"
 requires-python = ">=3.11"

package/omega/Agentik_SSOT/VERSION

@@ -1 +1 @@
-0.19.8
+0.19.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentikos/omega-os",
-  "version": "0.19.8",
+  "version": "0.19.10",
   "description": "Omega OS — installable agentic operating system with verified-completion orchestration. Event-sourced engine, 8-block rack, autonomous agents, MCP.",
   "bin": {
     "omega-os": "bin/omega-os.js"