@kaelio/ktx 0.1.0 → 0.1.1

package/assets/python/manifest.json

@@ -2,10 +2,10 @@
   "schemaVersion": 1,
   "distributionName": "kaelio-ktx",
   "normalizedName": "kaelio_ktx",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "wheel": {
-    "file": "kaelio_ktx-0.1.0-py3-none-any.whl",
-    "sha256": "1145cf0c90879270dc335a8d0ca49a598f81e0f47a37fdf646fc6c6798fe3c8b",
-    "bytes": 80523
+    "file": "kaelio_ktx-0.1.1-py3-none-any.whl",
+    "sha256": "2f4089f27519dbc10b0fdc1b03d5324cd69984171589907647961d1edbcab01b",
+    "bytes": 80519
   }
 }

package/dist/commands/setup-commands.js

@@ -79,8 +79,6 @@ function shouldShowSetupEntryMenu(options, command) {
         return false;
     }
     return ![
-        'new',
-        'existing',
         'agents',
         'target',
         'global',
@@ -92,7 +90,6 @@ function shouldShowSetupEntryMenu(options, command) {
         'anthropicApiKeyEnv',
         'anthropicApiKeyFile',
         'llmModel',
-        'anthropicModel',
         'vertexProject',
         'vertexLocation',
         'skipLlm',
@@ -100,7 +97,6 @@ function shouldShowSetupEntryMenu(options, command) {
         'embeddingApiKeyEnv',
         'embeddingApiKeyFile',
         'skipEmbeddings',
-        'newDatabaseConnectionId',
         'databaseUrl',
         'enableQueryHistory',
         'disableQueryHistory',
@@ -132,8 +128,6 @@ export function registerSetupCommands(program, context) {
         .command('setup')
         .description('Set up or resume a local KTX project')
         .addOption(new Option('--project-dir <path>', 'KTX project directory').hideHelp())
-        .addOption(new Option('--new', 'Create a new KTX project before setup').hideHelp().default(false))
-        .addOption(new Option('--existing', 'Use an existing KTX project').hideHelp().default(false))
         .option('--agents', 'Install agent integration only', false)
         .addOption(new Option('--target <target>', 'Agent target').choices([
         'claude-code',
@@ -146,13 +140,12 @@ export function registerSetupCommands(program, context) {
         .option('--global', 'Install agent integration into the global target scope', false)
         .option('--local', 'Install Claude Code MCP config into the private per-project ~/.claude.json scope', false)
         .addOption(new Option('--skip-agents', 'Leave agent integration incomplete for now').hideHelp().default(false))
-        .option('--yes', 'Accept safe defaults in non-interactive setup', false)
+        .option('--yes', 'Accept project creation and runtime install defaults where setup confirms', false)
         .option('--no-input', 'Disable interactive terminal input')
         .addOption(new Option('--llm-backend <backend>', 'LLM backend').argParser(llmBackend).hideHelp())
         .addOption(new Option('--anthropic-api-key-env <name>', 'Environment variable containing the Anthropic API key').hideHelp())
         .addOption(new Option('--anthropic-api-key-file <path>', 'File containing the Anthropic API key').hideHelp())
         .addOption(new Option('--llm-model <model>', 'LLM model ID or backend model alias').hideHelp())
-        .addOption(new Option('--anthropic-model <model>', 'Anthropic model ID to validate and save').hideHelp())
         .addOption(new Option('--vertex-project <project>', 'Google Vertex AI project ID, env:NAME, or file:/path').hideHelp())
         .addOption(new Option('--vertex-location <location>', 'Google Vertex AI location, env:NAME, or file:/path').hideHelp())
         .addOption(new Option('--skip-llm', 'Leave LLM setup incomplete for now').hideHelp().default(false))
@@ -169,14 +162,6 @@ export function registerSetupCommands(program, context) {
         .addOption(new Option('--database-connection-id <id>', 'Existing selected connection id or new connection id')
         .argParser((value, previous) => [...previous, value])
         .default([])
-        .hideHelp())
-        .addOption(new Option('--new-database-connection-id <id>', 'Connection id for one new database connection')
-        .argParser((value) => {
-        if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
-            throw new InvalidArgumentError(`Unsafe connection id: ${value}`);
-        }
-        return value;
-    })
         .hideHelp())
         .addOption(new Option('--database-url <url>', 'URL, env:NAME, or file:/path for one new URL-style database connection').hideHelp())
         .addOption(new Option('--database-schema <schema>', 'Database schema to include; repeatable')
@@ -238,11 +223,6 @@ export function registerSetupCommands(program, context) {
             context.setExitCode(1);
             return;
         }
-        if (options.llmModel && options.anthropicModel) {
-            context.io.stderr.write('Choose only one LLM model flag: --llm-model or --anthropic-model.\n');
-            context.setExitCode(1);
-            return;
-        }
         if (options.llmBackend &&
             options.llmBackend !== 'anthropic' &&
             (options.anthropicApiKeyEnv || options.anthropicApiKeyFile)) {
@@ -285,12 +265,17 @@ export function registerSetupCommands(program, context) {
             context.setExitCode(1);
             return;
         }
-        const mode = options.new ? 'new' : options.existing ? 'existing' : 'auto';
+        const creatingDatabaseConnection = options.database.length > 0 || options.databaseUrl !== undefined;
+        if (creatingDatabaseConnection && options.databaseConnectionId.length > 1) {
+            context.io.stderr.write('Choose only one new database connection id when configuring a database.\n');
+            context.setExitCode(1);
+            return;
+        }
         const resolvedAgentScope = options.local ? 'local' : options.global ? 'global' : 'project';
         await runSetupArgs(context, {
             command: 'run',
             projectDir: resolveCommandProjectDir(command),
-            mode,
+            mode: 'auto',
             agents: options.agents === true,
             ...(options.target ? { target: options.target } : {}),
             agentScope: resolvedAgentScope,
@@ -302,7 +287,6 @@ export function registerSetupCommands(program, context) {
             ...(options.anthropicApiKeyEnv ? { anthropicApiKeyEnv: options.anthropicApiKeyEnv } : {}),
             ...(options.anthropicApiKeyFile ? { anthropicApiKeyFile: options.anthropicApiKeyFile } : {}),
             ...(options.llmModel ? { llmModel: options.llmModel } : {}),
-            ...(options.anthropicModel ? { anthropicModel: options.anthropicModel } : {}),
             ...(options.vertexProject ? { vertexProject: options.vertexProject } : {}),
             ...(options.vertexLocation ? { vertexLocation: options.vertexLocation } : {}),
             skipLlm: options.skipLlm === true,
@@ -311,8 +295,12 @@ export function registerSetupCommands(program, context) {
             ...(options.embeddingApiKeyFile ? { embeddingApiKeyFile: options.embeddingApiKeyFile } : {}),
             skipEmbeddings: options.skipEmbeddings === true,
             ...(options.database.length > 0 ? { databaseDrivers: options.database } : {}),
-            ...(options.databaseConnectionId.length > 0 ? { databaseConnectionIds: options.databaseConnectionId } : {}),
-            ...(options.newDatabaseConnectionId ? { databaseConnectionId: options.newDatabaseConnectionId } : {}),
+            ...(options.databaseConnectionId.length > 0 && creatingDatabaseConnection
+                ? { databaseConnectionId: options.databaseConnectionId[0] }
+                : {}),
+            ...(options.databaseConnectionId.length > 0 && !creatingDatabaseConnection
+                ? { databaseConnectionIds: options.databaseConnectionId }
+                : {}),
             ...(options.databaseUrl ? { databaseUrl: options.databaseUrl } : {}),
             databaseSchemas: options.databaseSchema,
             ...(options.enableQueryHistory ? { enableQueryHistory: true } : {}),

package/dist/doctor.test.js

@@ -498,16 +498,15 @@ describe('runKtxDoctor', () => {
             '  adapters:',
             '    - live-database',
             '  embeddings:',
-            '    backend: deterministic',
-            '    model: deterministic',
+            '    backend: none',
             '    dimensions: 8',
             '',
         ].join('\n'), 'utf-8');
         const testIo = makeIo();
         await expect(runKtxDoctor({ command: 'project', projectDir: tempDir, outputMode: 'plain', inputMode: 'disabled' }, testIo.io, {})).resolves.toBe(0);
         expect(testIo.stdout()).toContain('Embeddings');
-        expect(testIo.stdout()).toContain('deterministic');
-        expect(testIo.stdout()).toContain('semantic search degraded');
+        expect(testIo.stdout()).toContain('none');
+        expect(testIo.stdout()).toContain('semantic search will be skipped');
         delete process.env.ANTHROPIC_API_KEY;
     });
     describe('command: validate', () => {

package/dist/index.test.js

@@ -318,8 +318,6 @@ describe('runKtxCli', () => {
         expect(stdout).not.toContain('setup demo');
         expect(stdout).not.toContain('setup context');
         for (const hiddenFlag of [
-            '--new',
-            '--existing',
             '--agent-scope',
             '--skip-agents',
             '--llm-backend',
@@ -328,7 +326,6 @@ describe('runKtxCli', () => {
             '--embedding-backend',
             '--database ',
             '--database-connection-id',
-            '--new-database-connection-id',
             '--enable-historic-sql',
             '--historic-sql-min-executions',
             '--enable-query-history',
@@ -612,8 +609,12 @@ describe('runKtxCli', () => {
     it('rejects removed setup options', async () => {
         const setup = vi.fn(async () => 0);
         const cases = [
+            ['setup', '--new'],
+            ['setup', '--existing'],
             ['setup', '--project'],
             ['setup', '--agent-scope', 'global'],
+            ['setup', '--anthropic-model', 'claude-sonnet-4-6'],
+            ['setup', '--new-database-connection-id', 'warehouse'],
             ['setup', '--skip-initial-source-ingest'],
         ];
         for (const args of cases) {
@@ -778,7 +779,7 @@ describe('runKtxCli', () => {
             '--no-input',
             '--anthropic-api-key-env',
             'ANTHROPIC_API_KEY',
-            '--anthropic-model',
+            '--llm-model',
             'claude-sonnet-4-6',
         ], setupIo.io, { setup })).resolves.toBe(0);
         expect(setup).toHaveBeenCalledWith(expect.objectContaining({
@@ -787,7 +788,7 @@ describe('runKtxCli', () => {
             inputMode: 'disabled',
             cliVersion: '0.1.0-rc.1',
             anthropicApiKeyEnv: 'ANTHROPIC_API_KEY', // pragma: allowlist secret
-            anthropicModel: 'claude-sonnet-4-6',
+            llmModel: 'claude-sonnet-4-6',
             skipLlm: false,
         }), setupIo.io);
     });
@@ -805,7 +806,7 @@ describe('runKtxCli', () => {
             'local-gcp-project',
             '--vertex-location',
             'us-east5',
-            '--anthropic-model',
+            '--llm-model',
             'claude-sonnet-4-6',
         ], setupIo.io, { setup })).resolves.toBe(0);
         expect(setup).toHaveBeenCalledWith(expect.objectContaining({
@@ -816,7 +817,7 @@ describe('runKtxCli', () => {
             llmBackend: 'vertex',
             vertexProject: 'local-gcp-project',
             vertexLocation: 'us-east5',
-            anthropicModel: 'claude-sonnet-4-6',
+            llmModel: 'claude-sonnet-4-6',
             skipLlm: false,
         }), setupIo.io);
     });
@@ -895,7 +896,7 @@ describe('runKtxCli', () => {
             '--skip-embeddings',
             '--database',
             'postgres',
-            '--new-database-connection-id',
+            '--database-connection-id',
             'warehouse',
             '--database-url',
             'env:DATABASE_URL',
@@ -928,11 +929,26 @@ describe('runKtxCli', () => {
     it('dispatches setup database connection ids that match former ingest subcommand names', async () => {
         const testIo = makeIo();
         const setup = vi.fn(async () => 0);
-        await expect(runKtxCli(['setup', '--new-database-connection-id', 'status', '--no-input'], testIo.io, { setup })).resolves.toBe(0);
+        await expect(runKtxCli(['setup', '--database-connection-id', 'status', '--no-input'], testIo.io, { setup })).resolves.toBe(0);
+        expect(setup).toHaveBeenCalledWith(expect.objectContaining({
+            command: 'run',
+            databaseConnectionIds: ['status'],
+        }), testIo.io);
+    });
+    it('dispatches non-TTY agents setup with target without requiring --no-input or --yes', async () => {
+        const testIo = makeIo({ stdoutIsTty: false });
+        const setup = vi.fn(async () => 0);
+        await expect(runKtxCli(['--project-dir', tempDir, 'setup', '--agents', '--target', 'claude-code'], testIo.io, { setup })).resolves.toBe(0);
         expect(setup).toHaveBeenCalledWith(expect.objectContaining({
             command: 'run',
-            databaseConnectionId: 'status',
+            projectDir: tempDir,
+            agents: true,
+            target: 'claude-code',
+            agentScope: 'project',
+            inputMode: 'auto',
+            yes: false,
         }), testIo.io);
+        expect(testIo.stderr()).toBe('');
     });
     it('dispatches setup source flags', async () => {
         const setup = vi.fn(async () => 0);

package/dist/ingest-depth.js

@@ -46,7 +46,6 @@ export function deepReadinessGaps(config) {
     const embeddings = config.scan.enrichment.embeddings;
     if (!embeddings ||
         embeddings.backend === 'none' ||
-        embeddings.backend === 'deterministic' ||
         !embeddings.model ||
         embeddings.dimensions <= 0) {
         gaps.push('scan embeddings');

package/dist/ingest.test-utils.js

@@ -84,7 +84,7 @@ export async function writeMetabaseConfig(projectDir) {
         '  adapters:',
         '    - metabase',
         '  embeddings:',
-        '    backend: deterministic',
+        '    backend: none',
         '',
     ].join('\n'), 'utf-8');
 }
@@ -418,7 +418,7 @@ export async function runPublicMetabaseSyncModeCase(tempDir, input) {
         '  adapters:',
         '    - metabase',
         '  embeddings:',
-        '    backend: deterministic',
+        '    backend: none',
         '',
     ].join('\n'), 'utf-8');
     const project = await loadKtxProject({ projectDir });

package/dist/ingest.test.js

@@ -182,7 +182,7 @@ describe('runKtxIngest', () => {
         await expect(runKtxSetup({
             command: 'run',
             projectDir,
-            mode: 'new',
+            mode: 'auto',
             agents: false,
             agentScope: 'project',
             skipAgents: true,
@@ -227,7 +227,7 @@ describe('runKtxIngest', () => {
         expect(runIo.stderr()).toContain('ktx ingest requires llm.provider.backend: anthropic, vertex, gateway, or claude-code, or an injected agentRunner.');
         expect(runIo.stderr()).toContain('Configure a local Claude Code session or API-backed LLM, then rerun ingest:');
         expect(runIo.stderr()).toContain(`ktx setup --project-dir ${projectDir} --llm-backend claude-code --no-input`);
-        expect(runIo.stderr()).toContain(`ktx setup --project-dir ${projectDir} --llm-backend anthropic --anthropic-api-key-env ANTHROPIC_API_KEY --anthropic-model claude-sonnet-4-6 --no-input`);
+        expect(runIo.stderr()).toContain(`ktx setup --project-dir ${projectDir} --llm-backend anthropic --anthropic-api-key-env ANTHROPIC_API_KEY --llm-model claude-sonnet-4-6 --no-input`);
     });
     it('routes metabase scheduled pulls to the fan-out runner and prints child summaries', async () => {
         const projectDir = join(tempDir, 'project');
@@ -620,7 +620,7 @@ describe('runKtxIngest', () => {
             '  adapters:',
             '    - metabase',
             '  embeddings:',
-            '    backend: deterministic',
+            '    backend: none',
             '',
         ].join('\n'), 'utf-8');
         const project = await loadKtxProject({ projectDir });
@@ -1449,7 +1449,7 @@ describe('runKtxIngest', () => {
             '  adapters:',
             '    - looker',
             '  embeddings:',
-            '    backend: deterministic',
+            '    backend: none',
             '',
         ].join('\n'), 'utf-8');
         const project = await loadKtxProject({ projectDir });

package/dist/managed-local-embeddings.d.ts

@@ -6,6 +6,8 @@ import { type KtxManagedPythonInstallPolicy, type ManagedPythonCommandRuntime }
 import { type ManagedPythonDaemonStartResult } from './managed-python-daemon.js';
 export interface ManagedLocalEmbeddingsDaemon {
     baseUrl: string;
+    stdoutLog: string;
+    stderrLog: string;
     env: Record<typeof MANAGED_SENTENCE_TRANSFORMERS_BASE_URL_ENV, string>;
 }
 export interface ManagedLocalEmbeddingsOptions {

package/dist/managed-local-embeddings.js

@@ -42,6 +42,8 @@ export async function ensureManagedLocalEmbeddingsDaemon(options) {
     options.io.stderr.write(`${verb} KTX local embeddings daemon: ${daemon.baseUrl}\n`);
     return {
         baseUrl: daemon.baseUrl,
+        stdoutLog: daemon.state.stdoutLog,
+        stderrLog: daemon.state.stderrLog,
         env: {
             [MANAGED_SENTENCE_TRANSFORMERS_BASE_URL_ENV]: daemon.baseUrl,
         },

package/dist/managed-local-embeddings.test.js

@@ -128,6 +128,8 @@ describe('ensureManagedLocalEmbeddingsDaemon', () => {
             startDaemon,
         })).resolves.toEqual({
             baseUrl: 'http://127.0.0.1:61234',
+            stdoutLog: '/work/proj/.ktx/runtime/daemon.stdout.log',
+            stderrLog: '/work/proj/.ktx/runtime/daemon.stderr.log',
             env: {
                 [MANAGED_SENTENCE_TRANSFORMERS_BASE_URL_ENV]: 'http://127.0.0.1:61234',
             },

package/dist/managed-mcp-daemon.js

@@ -4,6 +4,7 @@ import { createServer } from 'node:net';
 import { dirname, join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { z } from 'zod';
+import { sanitizeChildProxyEnv } from './proxy-env.js';
 const stateSchema = z.object({
     schemaVersion: z.literal(1),
     pid: z.number().int().positive(),
@@ -118,11 +119,11 @@ export async function startKtxMcpDaemon(options) {
         const child = (options.spawnDaemon ?? defaultSpawnDaemon)(process.execPath, args, {
             detached: true,
             stdio: ['ignore', log.fd, log.fd],
-            env: {
+            env: sanitizeChildProxyEnv({
                 ...process.env,
                 KTX_CLI_VERSION: options.cliVersion,
                 ...(options.token ? { KTX_MCP_TOKEN: options.token } : {}),
-            },
+            }),
         });
         if (!child.pid) {
             throw new Error('Failed to start KTX MCP daemon: child process pid was not available.');

package/dist/managed-mcp-daemon.test.js

@@ -28,6 +28,7 @@ describe('managed MCP daemon lifecycle', () => {
         await mkdir(projectDir, { recursive: true });
     });
     afterEach(async () => {
+        vi.unstubAllEnvs();
         await rm(tempDir, { recursive: true, force: true });
     });
     it('uses the spec state and log paths', () => {
@@ -72,6 +73,30 @@ describe('managed MCP daemon lifecycle', () => {
         }));
         expect(JSON.stringify(JSON.parse(await readFile(join(projectDir, '.ktx/mcp.json'), 'utf8')))).not.toContain('secret-token');
     });
+    it('sanitizes IPv6 CIDR entries from child NO_PROXY env', async () => {
+        vi.stubEnv('NO_PROXY', 'localhost,fd07:b51a:cc66:f0::/64');
+        vi.stubEnv('no_proxy', '::1,fd00::/8,*.orb.local');
+        const spawnDaemon = vi.fn(() => child(5555));
+        await startKtxMcpDaemon({
+            projectDir,
+            cliVersion: '0.0.0-test',
+            host: '127.0.0.1',
+            port: 7879,
+            allowedHosts: [],
+            allowedOrigins: [],
+            binPath: '/repo/packages/cli/dist/bin.js',
+            spawnDaemon,
+            processAlive: vi.fn(() => false),
+            portAvailable: vi.fn(async () => true),
+            now: () => new Date('2026-05-14T00:00:00.000Z'),
+        });
+        const env = spawnDaemon.mock.calls[0]?.[2].env;
+        if (!env) {
+            throw new Error('Expected MCP daemon spawn env');
+        }
+        expect(env.NO_PROXY).toBe('localhost,::1,*.orb.local');
+        expect(env.no_proxy).toBe(env.NO_PROXY);
+    });
     it('returns already-running without spawning when the daemon is alive at the same host/port', async () => {
         await mkdir(join(projectDir, '.ktx'), { recursive: true });
         await writeFile(join(projectDir, '.ktx/mcp.json'), `${JSON.stringify(state(projectDir), null, 2)}\n`);

package/dist/managed-python-command.test.js

@@ -81,6 +81,7 @@ function installResult(features = ['core']) {
         asset: {
             manifest: installedManifest.asset,
             wheelPath: '/assets/python/kaelio_ktx-0.2.0-py3-none-any.whl',
+            requiresPython: { specifier: '>=3.13', minimumVersion: '3.13' },
         },
         manifest: installedManifest,
     };

package/dist/managed-python-daemon.js

@@ -5,6 +5,7 @@ import { setTimeout as delay } from 'node:timers/promises';
 import { promisify } from 'node:util';
 import { z } from 'zod';
 import { installManagedPythonRuntime, managedPythonDaemonLayout, runtimeFeatureSchema, } from './managed-python-runtime.js';
+import { sanitizeChildProxyEnv } from './proxy-env.js';
 const execFileAsync = promisify(execFile);
 const daemonStateSchema = z.object({
     schemaVersion: z.literal(1),
@@ -483,10 +484,10 @@ export async function startManagedPythonDaemon(options) {
         const child = spawnDaemon(installed.manifest.python.daemonExecutable, ['serve-http', '--host', '127.0.0.1', '--port', String(port)], {
             detached: true,
             stdio: ['ignore', stdout.fd, stderr.fd],
-            env: {
+            env: sanitizeChildProxyEnv({
                 ...process.env,
                 KTX_DAEMON_VERSION: options.cliVersion,
-            },
+            }),
         });
         child.unref();
         if (!child.pid) {

package/dist/managed-python-daemon.test.js

@@ -59,6 +59,7 @@ function installResult(root, features = ['core']) {
         asset: {
             manifest: manifest(root, features).asset,
             wheelPath: join(root, 'assets', 'python', 'kaelio_ktx-0.2.0-py3-none-any.whl'),
+            requiresPython: { specifier: '>=3.13', minimumVersion: '3.13' },
         },
         manifest: manifest(root, features),
     };
@@ -105,6 +106,7 @@ describe('managed Python daemon lifecycle', () => {
         tempDir = await mkdtemp(join(tmpdir(), 'ktx-managed-daemon-'));
     });
     afterEach(async () => {
+        vi.unstubAllEnvs();
         await rm(tempDir, { recursive: true, force: true });
     });
     it('reports stopped when no daemon state exists', async () => {
@@ -150,6 +152,24 @@ describe('managed Python daemon lifecycle', () => {
             stderrLog: layout(tempDir).daemonStderrPath,
         });
     });
+    it('sanitizes IPv6 CIDR entries from child NO_PROXY env', async () => {
+        vi.stubEnv('NO_PROXY', 'localhost,fd07:b51a:cc66:f0::/64,127.0.0.0/8');
+        vi.stubEnv('no_proxy', '::1,fd00::/8,*.orb.local');
+        const spawnDaemon = makeSpawn(5555);
+        await startManagedPythonDaemon({
+            ...daemonOptionsBase(tempDir),
+            features: ['local-embeddings'],
+            installRuntime: vi.fn(async () => installResult(tempDir, ['core', 'local-embeddings'])),
+            spawnDaemon,
+            fetch: makeFetch(),
+            allocatePort: vi.fn(async () => 61234),
+            now: () => new Date('2026-05-11T00:00:00.000Z'),
+            pollIntervalMs: 1,
+        });
+        const env = vi.mocked(spawnDaemon).mock.calls[0]?.[2].env;
+        expect(env?.NO_PROXY).toBe('localhost,127.0.0.0/8,::1,*.orb.local');
+        expect(env?.no_proxy).toBe(env?.NO_PROXY);
+    });
     it('makes a final health probe before reporting startup failure', async () => {
         const spawnDaemon = makeSpawn(5556);
         const installRuntime = vi.fn(async () => installResult(tempDir));

package/dist/managed-python-runtime.d.ts

@@ -75,6 +75,10 @@ export interface ManagedPythonDaemonLayout extends ManagedPythonRuntimeLayout {
 export interface ManagedRuntimeAsset {
     manifest: KtxRuntimeAssetManifest;
     wheelPath: string;
+    requiresPython: {
+        specifier: string;
+        minimumVersion: string;
+    };
 }
 export type ManagedPythonRuntimeExec = (command: string, args: string[], options?: {
     cwd?: string;

package/dist/managed-python-runtime.js

@@ -5,6 +5,7 @@ import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
+import { strFromU8, unzipSync } from 'fflate';
 import { z } from 'zod';
 const execFileAsync = promisify(execFile);
 export const runtimeFeatureSchema = z.enum(['core', 'local-embeddings']);
@@ -100,6 +101,35 @@ async function readJsonFile(path) {
 function isErrnoException(error, code) {
     return typeof error === 'object' && error !== null && 'code' in error && error.code === code;
 }
+function parseRequiresPythonFromWheel(input) {
+    let files;
+    try {
+        files = unzipSync(new Uint8Array(input.contents));
+    }
+    catch (error) {
+        throw new Error(`Unable to read bundled Python runtime wheel metadata: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const metadataEntry = Object.entries(files).find(([path]) => path.endsWith('.dist-info/METADATA'));
+    if (!metadataEntry) {
+        throw new Error(`Bundled Python runtime wheel metadata is missing: ${input.wheelPath}`);
+    }
+    const metadata = strFromU8(metadataEntry[1]);
+    const requiresPython = metadata
+        .split(/\r?\n/)
+        .map((line) => line.match(/^Requires-Python:\s*(.+)\s*$/i)?.[1]?.trim())
+        .find((value) => typeof value === 'string' && value.length > 0);
+    if (!requiresPython) {
+        throw new Error('Bundled Python runtime wheel metadata is missing Requires-Python');
+    }
+    const minimumMatch = requiresPython.match(/(?:^|[,\s])>=\s*([0-9]+)\.([0-9]+)(?:\.[0-9]+)?\b/);
+    if (!minimumMatch) {
+        throw new Error(`Unsupported bundled Python runtime Requires-Python: ${requiresPython}`);
+    }
+    return {
+        specifier: requiresPython,
+        minimumVersion: `${minimumMatch[1]}.${minimumMatch[2]}`,
+    };
+}
 export async function verifyRuntimeAsset(input) {
     const manifestPath = join(input.assetDir, 'manifest.json');
     let manifestData;
@@ -124,7 +154,7 @@ export async function verifyRuntimeAsset(input) {
     if (sha256 !== manifest.wheel.sha256 || wheel.byteLength !== manifest.wheel.bytes) {
         throw new Error(`Bundled Python runtime wheel checksum mismatch: ${wheelPath}`);
     }
-    return { manifest, wheelPath };
+    return { manifest, wheelPath, requiresPython: parseRequiresPythonFromWheel({ wheelPath, contents: wheel }) };
 }
 function normalizeFeatures(features) {
     const requested = new Set(['core', ...features]);
@@ -155,6 +185,13 @@ function errorOutput(error) {
         stderr: typeof value.stderr === 'string' ? value.stderr : '',
     };
 }
+function installFailureMessage(input) {
+    const output = [input.stderr.trim(), input.stdout.trim()].filter((part) => part.length > 0).join('\n');
+    if (!output) {
+        return `Python runtime install failed. Install log: ${input.logPath}`;
+    }
+    return `Python runtime install failed.\n${output}\nInstall log: ${input.logPath}`;
+}
 async function runLogged(input) {
     await appendFile(input.logPath, `$ ${input.command} ${input.args.join(' ')}\n`);
     try {
@@ -175,7 +212,7 @@ async function runLogged(input) {
         if (output.stderr) {
             await appendFile(input.logPath, output.stderr.endsWith('\n') ? output.stderr : `${output.stderr}\n`);
         }
-        throw new Error(`Python runtime install failed. Install log: ${input.logPath}`);
+        throw new Error(installFailureMessage({ logPath: input.logPath, stdout: output.stdout, stderr: output.stderr }));
     }
 }
 function managedRuntimeUvEnv(baseEnv) {
@@ -214,7 +251,14 @@ export async function installManagedPythonRuntime(options) {
         exec,
         logPath: layout.installLogPath,
         command: 'uv',
-        args: ['venv', layout.venvDir],
+        args: ['python', 'install', asset.requiresPython.minimumVersion],
+        env: uvEnv,
+    });
+    await runLogged({
+        exec,
+        logPath: layout.installLogPath,
+        command: 'uv',
+        args: ['venv', '--python', asset.requiresPython.minimumVersion, layout.venvDir],
         env: uvEnv,
     });
     const wheelSpec = features.includes('local-embeddings') ? `${asset.wheelPath}[local-embeddings]` : asset.wheelPath;