@foggy-projects/deepseek-harness-plugin 0.4.0-beta.7 → 0.4.0-beta.8

package/lib/python-runtime.js

@@ -0,0 +1,339 @@
+import { execFile } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import {
+  access,
+  copyFile,
+  mkdir,
+  open,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from 'node:fs/promises'
+import { constants as fsConstants } from 'node:fs'
+import { dirname, isAbsolute, join } from 'node:path'
+import { promisify } from 'node:util'
+import { compatible, versionParts } from './version.js'
+
+const execFileAsync = promisify(execFile)
+const MARKER_SCHEMA = 'foggy-managed-python/v1'
+
+async function exists(path) {
+  try {
+    await access(path, fsConstants.F_OK)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function commandVersion(command) {
+  try {
+    const { stdout, stderr } = await execFileAsync(command, ['--version'], {
+      windowsHide: true,
+      timeout: 15_000,
+      maxBuffer: 256 * 1024,
+    })
+    return {
+      available: true,
+      output: `${stdout}\n${stderr}`.trim().split(/\r?\n/)[0] ?? '',
+      command,
+    }
+  } catch (error) {
+    return { available: false, output: '', command, error: error.code ?? 'COMMAND_FAILED' }
+  }
+}
+
+async function sha256(path) {
+  const file = await open(path, 'r')
+  const hash = createHash('sha256')
+  try {
+    for await (const chunk of file.readableWebStream()) hash.update(Buffer.from(chunk))
+  } finally {
+    await file.close()
+  }
+  return hash.digest('hex')
+}
+
+function pythonComponent(manifest) {
+  const component = manifest?.components?.python
+  if (!component?.version || !component?.assets) {
+    throw new Error('The Foggy component manifest does not define a managed Python runtime')
+  }
+  return component
+}
+
+export function pythonAssetKey(platform = process.platform, arch = process.arch) {
+  return `${platform}-${arch}`
+}
+
+export function selectPythonAsset(manifest, platform = process.platform, arch = process.arch) {
+  const component = pythonComponent(manifest)
+  const key = pythonAssetKey(platform, arch)
+  const asset = component.assets[key]
+  if (!asset) {
+    throw new Error(`Managed Python is not published for ${platform}/${arch}; set FOGGY_PYTHON to a compatible Python executable`)
+  }
+  if (!asset.file || !asset.url || !/^[a-f0-9]{64}$/.test(asset.sha256 || '')) {
+    throw new Error(`Managed Python asset ${key} is incomplete or has an invalid SHA256`)
+  }
+  return { ...asset, key }
+}
+
+export function managedPythonHome(installRoot, manifest) {
+  return join(installRoot, 'python', pythonComponent(manifest).version)
+}
+
+export function managedPythonExecutable(installRoot, manifest, platform = process.platform) {
+  const home = managedPythonHome(installRoot, manifest)
+  return platform === 'win32' ? join(home, 'python.exe') : join(home, 'bin', 'python3')
+}
+
+function markerPath(installRoot, manifest) {
+  return join(managedPythonHome(installRoot, manifest), '.foggy-managed-python.json')
+}
+
+async function readMarker(installRoot, manifest) {
+  try {
+    return JSON.parse(await readFile(markerPath(installRoot, manifest), 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+function exactVersion(probe, expected) {
+  const actualParts = versionParts(probe.output)
+  const expectedParts = versionParts(expected)
+  return expectedParts.every((part, index) => actualParts[index] === part)
+}
+
+export async function probePythonRuntime({ installRoot, manifest, env = process.env } = {}) {
+  const minimum = manifest.components.cli.minimumPythonVersion
+  if (env.FOGGY_PYTHON) {
+    const probe = compatible(await commandVersion(env.FOGGY_PYTHON), minimum)
+    const isPython = /^Python\s+\d+/i.test(probe.output)
+    return {
+      ...probe,
+      available: probe.available && isPython,
+      source: 'override',
+      managed: false,
+      path: env.FOGGY_PYTHON,
+      version: probe.available && isPython ? versionParts(probe.output).slice(0, 3).join('.') : null,
+      error: probe.available && !isPython ? 'Configured executable is not Python' : probe.error,
+    }
+  }
+
+  const component = pythonComponent(manifest)
+  const command = managedPythonExecutable(installRoot, manifest)
+  const marker = await readMarker(installRoot, manifest)
+  if (!marker || marker.schemaVersion !== MARKER_SCHEMA || marker.version !== component.version) {
+    return {
+      available: false,
+      detected: false,
+      output: '',
+      error: 'Managed Python is not installed or its marker is invalid',
+      source: 'managed',
+      managed: true,
+      path: command,
+      version: component.version,
+      minimum,
+    }
+  }
+  const probe = compatible(await commandVersion(command), minimum)
+  const valid = probe.available && exactVersion(probe, component.version)
+  return {
+    ...probe,
+    available: valid,
+    detected: probe.detected,
+    ...(valid ? {} : { error: probe.error || `Expected Python ${component.version}` }),
+    source: 'managed',
+    managed: true,
+    path: command,
+    home: managedPythonHome(installRoot, manifest),
+    version: component.version,
+    asset: marker.asset,
+  }
+}
+
+async function safeRenameCorrupt(path) {
+  if (!await exists(path)) return null
+  const corrupt = `${path}.corrupt-${Date.now()}`
+  await rename(path, corrupt)
+  return corrupt
+}
+
+async function cachedAsset(asset, cacheDirs) {
+  for (const directory of cacheDirs) {
+    const candidate = join(directory, asset.file)
+    try {
+      if ((await stat(candidate)).isFile() && await sha256(candidate) === asset.sha256) return candidate
+    } catch {}
+  }
+  return null
+}
+
+async function materializeAsset(asset, destination, cacheDirs, onProgress) {
+  await mkdir(dirname(destination), { recursive: true })
+  if (await exists(destination) && await sha256(destination) === asset.sha256) {
+    onProgress?.({ fraction: 0.82, message: 'Using verified managed Python archive', currentFile: asset.file })
+    return { path: destination, source: 'existing' }
+  }
+  await safeRenameCorrupt(destination)
+  const temporary = `${destination}.download`
+  const cached = await cachedAsset(asset, cacheDirs)
+  if (cached) {
+    onProgress?.({ fraction: 0.35, message: 'Copying managed Python from verified cache', currentFile: asset.file })
+    await rm(temporary, { force: true })
+    await copyFile(cached, temporary)
+  } else {
+    let resumeBytes = 0
+    try {
+      resumeBytes = (await stat(temporary)).size
+    } catch {}
+    if (resumeBytes >= Number(asset.size || Number.MAX_SAFE_INTEGER)) {
+      if (await sha256(temporary) === asset.sha256) {
+        await rename(temporary, destination)
+        return { path: destination, source: 'resumed' }
+      }
+      await rm(temporary, { force: true })
+      resumeBytes = 0
+    }
+    const controller = new AbortController()
+    const timeout = setTimeout(() => controller.abort(), 20 * 60_000)
+    try {
+      const headers = resumeBytes > 0 ? { Range: `bytes=${resumeBytes}-` } : undefined
+      const response = await fetch(asset.url, { redirect: 'follow', signal: controller.signal, headers })
+      if (!response.ok || !response.body) throw new Error(`Managed Python download failed: HTTP ${response.status}`)
+      const resumed = resumeBytes > 0 && response.status === 206
+      if (!resumed) {
+        await rm(temporary, { force: true })
+        resumeBytes = 0
+      }
+      const expectedSize = Number(asset.size || (Number(response.headers.get('content-length')) + resumeBytes) || 0)
+      const file = await open(temporary, resumed ? 'a' : 'w')
+      let received = resumeBytes
+      try {
+        const reader = response.body.getReader()
+        while (true) {
+          const { done, value } = await reader.read()
+          if (done) break
+          const chunk = Buffer.from(value)
+          await file.write(chunk)
+          received += chunk.length
+          const fraction = expectedSize > 0 ? Math.min(received / expectedSize, 1) : 0
+          onProgress?.({
+            fraction: 0.05 + fraction * 0.72,
+            message: resumed ? 'Resuming managed Python download' : 'Downloading managed Python',
+            currentFile: asset.file,
+            bytes: { received, total: expectedSize || null },
+          })
+        }
+        await file.sync()
+      } finally {
+        await file.close()
+      }
+    } finally {
+      clearTimeout(timeout)
+    }
+  }
+  if (await sha256(temporary) !== asset.sha256) {
+    await rm(temporary, { force: true })
+    throw new Error(`Managed Python SHA256 mismatch for ${asset.file}`)
+  }
+  await rename(temporary, destination)
+  return { path: destination, source: cached ? 'cache' : 'download' }
+}
+
+function validateArchiveEntries(text) {
+  const entries = text.split(/\r?\n/).map((entry) => entry.trim()).filter(Boolean)
+  if (!entries.length) throw new Error('Managed Python archive is empty')
+  for (const entry of entries) {
+    const normalized = entry.replaceAll('\\', '/')
+    if (isAbsolute(entry) || normalized.startsWith('/') || normalized.includes('../') || !normalized.startsWith('python/')) {
+      throw new Error(`Managed Python archive contains an unsafe entry: ${entry}`)
+    }
+  }
+}
+
+async function extractArchive(archive, installRoot, manifest, asset, onProgress) {
+  const pythonRoot = join(installRoot, 'python')
+  const target = managedPythonHome(installRoot, manifest)
+  const staging = join(pythonRoot, `.staging-${process.pid}-${Date.now()}`)
+  const backup = `${target}.previous-${Date.now()}`
+  await mkdir(staging, { recursive: true })
+  try {
+    onProgress?.({ fraction: 0.84, message: 'Inspecting managed Python archive', currentFile: asset.file })
+    const listed = await execFileAsync('tar', ['-tzf', archive], {
+      windowsHide: true,
+      timeout: 2 * 60_000,
+      maxBuffer: 16 * 1024 * 1024,
+    })
+    validateArchiveEntries(listed.stdout)
+    onProgress?.({ fraction: 0.88, message: 'Extracting managed Python', currentFile: asset.file })
+    await execFileAsync('tar', ['-xzf', archive, '-C', staging], {
+      windowsHide: true,
+      timeout: 5 * 60_000,
+      maxBuffer: 4 * 1024 * 1024,
+    })
+    const extracted = join(staging, 'python')
+    const executable = process.platform === 'win32' ? join(extracted, 'python.exe') : join(extracted, 'bin', 'python3')
+    if (!await exists(executable)) throw new Error('Managed Python archive did not contain the expected interpreter')
+    await writeFile(join(extracted, '.foggy-managed-python.json'), `${JSON.stringify({
+      schemaVersion: MARKER_SCHEMA,
+      version: pythonComponent(manifest).version,
+      distribution: pythonComponent(manifest).distribution,
+      buildRelease: pythonComponent(manifest).buildRelease,
+      platform: process.platform,
+      arch: process.arch,
+      asset: { file: asset.file, sha256: asset.sha256 },
+      installedAt: new Date().toISOString(),
+    }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 })
+
+    let movedPrevious = false
+    if (await exists(target)) {
+      await rename(target, backup)
+      movedPrevious = true
+    }
+    try {
+      await rename(extracted, target)
+    } catch (error) {
+      if (movedPrevious && !await exists(target)) await rename(backup, target)
+      throw error
+    }
+    if (movedPrevious) await rm(backup, { recursive: true, force: true })
+  } finally {
+    await rm(staging, { recursive: true, force: true })
+  }
+}
+
+export async function ensurePythonRuntime({
+  installRoot,
+  manifest,
+  cacheDirs = [],
+  force = false,
+  env = process.env,
+  onProgress,
+} = {}) {
+  if (env.FOGGY_PYTHON) {
+    const override = await probePythonRuntime({ installRoot, manifest, env })
+    if (!override.available) throw new Error(`FOGGY_PYTHON is not compatible: ${override.path}`)
+    onProgress?.({ fraction: 1, message: 'Using FOGGY_PYTHON override', currentFile: override.path })
+    return override
+  }
+
+  const current = await probePythonRuntime({ installRoot, manifest, env })
+  if (current.available && !force) {
+    onProgress?.({ fraction: 1, message: 'Managed Python is ready', currentFile: current.path })
+    return current
+  }
+
+  const asset = selectPythonAsset(manifest)
+  const archive = join(installRoot, 'downloads', 'python', asset.file)
+  const materialized = await materializeAsset(asset, archive, cacheDirs, onProgress)
+  await extractArchive(materialized.path, installRoot, manifest, asset, onProgress)
+  const installed = await probePythonRuntime({ installRoot, manifest, env })
+  if (!installed.available) throw new Error(installed.error || 'Managed Python verification failed')
+  onProgress?.({ fraction: 1, message: 'Managed Python is ready', currentFile: installed.path })
+  return installed
+}

package/lib/remote-descriptor.js

@@ -24,6 +24,7 @@ export const descriptors = [
   descriptor('plan'),
   descriptor('initialize'),
   descriptor('repair'),
+  descriptor('repairPython'),
   descriptor('runtimeStart'),
   descriptor('runtimeStop'),
 ]

package/lib/version.js

@@ -13,3 +13,8 @@ export function compatible(probe, minimum) {
   }
   return { ...probe, detected: true, available: true, minimum }
 }
+
+export function compatibleNode(version) {
+  const [major, minor] = String(version).split('.').map(Number)
+  return (major === 22 && minor >= 19) || major >= 24
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foggy-projects/deepseek-harness-plugin",
-  "version": "0.4.0-beta.7",
+  "version": "0.4.0-beta.8",
   "description": "Foggy Java data analysis engine integration for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",
@@ -19,11 +19,14 @@
     "!skills/**/*.pyc",
     "cordis.patch.yml",
     "experience/linux/**",
+    "docs/PUBLIC-BETA-READINESS.md",
+    "docs/WINDOWS-BETA-ACCEPTANCE.md",
+    "THIRD-PARTY-RUNTIME-NOTICES.md",
     "README.md"
   ],
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=22.19.0"
+    "node": "^22.19.0 || >=24.0.0"
   },
   "dsh": {
     "bundle": {
@@ -54,7 +57,7 @@
     "@deepseek-ai/dsh-typert-protocol": "^0.1.1-rc.2"
   },
   "scripts": {
-    "check": "node --check lib/index.js && node --check lib/skill-provider.js && node --check lib/client.js && node --check lib/typert.js && node --check lib/remote.js",
+    "check": "node --check lib/index.js && node --check lib/python-runtime.js && node --check lib/skill-provider.js && node --check lib/client.js && node --check lib/typert.js && node --check lib/remote.js",
     "test": "node --test test/package.test.js && python test/onboarding_unit.py"
   }
 }

package/skills/foggy-deepseek-onboarding/SKILL.md

@@ -20,6 +20,10 @@ copy this Skill into the current workspace.
   workspace as `--project-root`. The absence of `foggy-runtime` from `PATH` is not evidence that the
   managed CLI is missing; the plugin intentionally installs it in an isolated environment and records
   its absolute command in the global install state.
+- The plugin downloads and verifies a pinned private Python runtime before running this Skill. Do not
+  search for, install, or repair a system Python. Wrappers resolve the interpreter recorded in the
+  global install state. If private Python is missing, use the plugin's Python repair action. Only use
+  `FOGGY_PYTHON` or `FOGGY_ONBOARDING_PYTHON` when the user explicitly supplied an advanced override.
 - Do not independently download or reinstall the CLI. If the global install state, managed marker, or
   analysis Skill is missing or invalid, ask the user to open the Foggy plugin settings and use
   the matching component repair action. Repair restores managed components and invalidates the
@@ -71,9 +75,11 @@ For every new-database onboarding session, this Skill is the orchestration autho
 
 1. Run `scripts/doctor.ps1 --project-root <current-session-workspace>` on Windows or
    `bash scripts/doctor.sh --project-root <current-session-workspace>` on Linux.
-2. If the pinned CLI, Launcher, or global managed analysis Skill is missing, use the Foggy
-   plugin's Repair action. Use the matching install script only when the plugin UI is unavailable;
-   use `--dry-run` first when paths or permissions are uncertain.
+2. If private Python, the pinned CLI, Launcher, or global managed analysis Skill is missing, use the
+   Foggy plugin's matching Repair action. First-time Python bootstrap requires the plugin UI unless
+   the user explicitly supplies `FOGGY_ONBOARDING_PYTHON`. Use a matching install script only after
+   private Python exists and the plugin UI is unavailable; use `--dry-run` first when paths or
+   permissions are uncertain.
 3. Run `runtime-start` and require successful `wait-ready` plus `capabilities`. Record engine,
    Runtime API version, schema version, security mode, URL, namespace, PID, and evidence path. If the
    recorded Runtime is already running, `runtime-start` verifies and reuses it instead of starting a

package/skills/foggy-deepseek-onboarding/assets/versions.json

@@ -1,12 +1,56 @@
 {
   "schemaVersion": "foggy-deepseek-onboarding-versions/v1",
-  "packageVersion": "0.4.0-beta.7",
-  "validatedAt": "2026-09-01",
+  "packageVersion": "0.4.0-beta.8",
+  "validatedAt": "2026-09-03",
   "components": {
     "deepseekHarness": {
       "version": "0.1.1-rc.2",
       "minimumNodeVersion": "22.19.0"
     },
+    "python": {
+      "version": "3.12.13",
+      "distribution": "astral-sh/python-build-standalone",
+      "buildRelease": "20260718",
+      "license": "Python-2.0 AND MPL-2.0",
+      "assets": {
+        "win32-x64": {
+          "file": "cpython-3.12.13+20260718-x86_64-pc-windows-msvc-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-x86_64-pc-windows-msvc-install_only_stripped.tar.gz",
+          "sha256": "0d422a1439ec308e03f47df551bc30f5994727c456e414b026d202bcda9b7c1c",
+          "size": 21932298
+        },
+        "win32-arm64": {
+          "file": "cpython-3.12.13+20260718-aarch64-pc-windows-msvc-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-aarch64-pc-windows-msvc-install_only_stripped.tar.gz",
+          "sha256": "596808d2592a282c45921a324d5503ef0d4f488d104c1c1f12a1d5e7dea9d463",
+          "size": 20652311
+        },
+        "linux-x64": {
+          "file": "cpython-3.12.13+20260718-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+          "sha256": "5854aa6ec71cad00334d5065633c210b2e7feb40956767a59a91791cadcf0b79",
+          "size": 34199823
+        },
+        "linux-arm64": {
+          "file": "cpython-3.12.13+20260718-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+          "sha256": "f226576b91491ffa5739aa85726521e9031f4d87f80627d64ed348ac77cb31e9",
+          "size": 29195696
+        },
+        "darwin-x64": {
+          "file": "cpython-3.12.13+20260718-x86_64-apple-darwin-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-x86_64-apple-darwin-install_only_stripped.tar.gz",
+          "sha256": "8e6b7e6533bdf746287008edf91102e7bee0a6ca1d24f16c4514237cafd706c5",
+          "size": 24685843
+        },
+        "darwin-arm64": {
+          "file": "cpython-3.12.13+20260718-aarch64-apple-darwin-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-aarch64-apple-darwin-install_only_stripped.tar.gz",
+          "sha256": "9a1e9e06175c10efd8378b904b07fa21bd791ab3345d7cdffeb4a76c9ff55903",
+          "size": 25000146
+        }
+      }
+    },
     "cli": {
       "version": "0.1.23",
       "minimumPythonVersion": "3.11.0",

package/skills/foggy-deepseek-onboarding/scripts/doctor.ps1

@@ -1,4 +1,4 @@
 $ErrorActionPreference = "Stop"
-$pythonCommand = if ($env:FOGGY_ONBOARDING_PYTHON) { $env:FOGGY_ONBOARDING_PYTHON } else { "python" }
-& $pythonCommand (Join-Path $PSScriptRoot "onboarding.py") doctor @args
+& (Join-Path $PSScriptRoot 'invoke-onboarding.ps1') doctor @args
+exit $LASTEXITCODE
 exit $LASTEXITCODE

package/skills/foggy-deepseek-onboarding/scripts/doctor.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PYTHON_COMMAND="${FOGGY_ONBOARDING_PYTHON:-python3}"
-exec "$PYTHON_COMMAND" "$SCRIPT_DIR/onboarding.py" doctor "$@"
+exec bash "$SCRIPT_DIR/invoke-onboarding.sh" doctor "$@"

package/skills/foggy-deepseek-onboarding/scripts/install.ps1

@@ -1,4 +1,4 @@
 $ErrorActionPreference = "Stop"
-$pythonCommand = if ($env:FOGGY_ONBOARDING_PYTHON) { $env:FOGGY_ONBOARDING_PYTHON } else { "python" }
-& $pythonCommand (Join-Path $PSScriptRoot "onboarding.py") install @args
+& (Join-Path $PSScriptRoot 'invoke-onboarding.ps1') install @args
+exit $LASTEXITCODE
 exit $LASTEXITCODE

package/skills/foggy-deepseek-onboarding/scripts/install.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PYTHON_COMMAND="${FOGGY_ONBOARDING_PYTHON:-python3}"
-exec "$PYTHON_COMMAND" "$SCRIPT_DIR/onboarding.py" install "$@"
+exec bash "$SCRIPT_DIR/invoke-onboarding.sh" install "$@"

package/skills/foggy-deepseek-onboarding/scripts/invoke-onboarding.ps1

@@ -0,0 +1,30 @@
+param(
+    [Parameter(ValueFromRemainingArguments = $true)]
+    [string[]]$OnboardingArgs
+)
+
+$pythonCommand = $env:FOGGY_ONBOARDING_PYTHON
+if (-not $pythonCommand) {
+    $installRoot = if ($env:FOGGY_INSTALL_ROOT) {
+        $env:FOGGY_INSTALL_ROOT
+    } elseif ($env:LOCALAPPDATA) {
+        Join-Path $env:LOCALAPPDATA 'Foggy\DeepSeekHarness'
+    }
+    if ($installRoot) {
+        $statePath = Join-Path $installRoot 'install-state.json'
+        if (Test-Path -LiteralPath $statePath) {
+            try {
+                $state = Get-Content -Raw -LiteralPath $statePath | ConvertFrom-Json
+                $pythonCommand = $state.python.command
+            } catch {}
+        }
+    }
+}
+
+if (-not $pythonCommand -or -not (Test-Path -LiteralPath $pythonCommand)) {
+    Write-Error 'Foggy private Python is unavailable. Initialize or repair it in DeepSeek Harness plugin settings, or set FOGGY_ONBOARDING_PYTHON explicitly.'
+    exit 1
+}
+
+& $pythonCommand (Join-Path $PSScriptRoot 'onboarding.py') @OnboardingArgs
+exit $LASTEXITCODE

package/skills/foggy-deepseek-onboarding/scripts/invoke-onboarding.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+python_command="${FOGGY_ONBOARDING_PYTHON:-}"
+if [[ -z "$python_command" ]]; then
+  if [[ -n "${FOGGY_INSTALL_ROOT:-}" ]]; then
+    install_root="$FOGGY_INSTALL_ROOT"
+  elif [[ -n "${XDG_DATA_HOME:-}" ]]; then
+    install_root="$XDG_DATA_HOME/foggy/deepseek-harness"
+  else
+    install_root="$HOME/.local/share/foggy/deepseek-harness"
+  fi
+  state_path="$install_root/install-state.json"
+  if [[ -f "$state_path" ]]; then
+    python_command="$(node -e 'const fs=require("node:fs"); const state=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); process.stdout.write(state.python?.command || "")' "$state_path")"
+  fi
+fi
+
+if [[ -z "$python_command" || ! -x "$python_command" ]]; then
+  echo 'Foggy private Python is unavailable. Initialize or repair it in DeepSeek Harness plugin settings, or set FOGGY_ONBOARDING_PYTHON explicitly.' >&2
+  exit 1
+fi
+
+exec "$python_command" "$(dirname "$0")/onboarding.py" "$@"

package/skills/foggy-deepseek-onboarding/scripts/onboard.ps1

@@ -1,4 +1,4 @@
 $ErrorActionPreference = "Stop"
-$pythonCommand = if ($env:FOGGY_ONBOARDING_PYTHON) { $env:FOGGY_ONBOARDING_PYTHON } else { "python" }
-& $pythonCommand (Join-Path $PSScriptRoot "onboarding.py") @args
+& (Join-Path $PSScriptRoot 'invoke-onboarding.ps1') @args
+exit $LASTEXITCODE
 exit $LASTEXITCODE

package/skills/foggy-deepseek-onboarding/scripts/onboard.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PYTHON_COMMAND="${FOGGY_ONBOARDING_PYTHON:-python3}"
-exec "$PYTHON_COMMAND" "$SCRIPT_DIR/onboarding.py" "$@"
+exec bash "$SCRIPT_DIR/invoke-onboarding.sh" "$@"