@melaya/runner 1.0.31 → 1.0.33

package/dist/pythonEnv.js

@@ -11,6 +11,7 @@
  */
 import { spawn } from "child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { createHash } from "crypto";
 import { join } from "path";
 import { homedir, platform } from "os";
 import chalk from "chalk";
@@ -70,12 +71,35 @@ const PIP_DEPS = [
     "python-docx",
     "python-pptx",
     "ddgs", // duckduckgo search rebrand — shared.tools.core imports DDGS
+    // Scrapling — full-text article fetcher used by shared.tools.core.
+    // Without it, web_search emits the "Snippets only (Scrapling
+    // unavailable)" fallback, agents get 1-line DDG titles instead of
+    // article bodies, and small models hallucinate to fill the gap.
+    // [fetchers] extra brings curl_cffi for the TLS-impersonating
+    // AsyncFetcher (no browser needed) AND playwright for the optional
+    // StealthyFetcher rescue path. The stealth path also needs
+    // `scrapling install` to download Chromium — best-effort run below
+    // (failure non-fatal: AsyncFetcher fast-path still works without it).
+    "scrapling[fetchers]",
 ];
 export function venvPython() {
     return platform() === "win32"
         ? join(VENV_DIR, "Scripts", "python.exe")
         : join(VENV_DIR, "bin", "python");
 }
+// The marker is keyed on sharedVersion + a hash of PIP_DEPS so changes
+// to either invalidate the venv. Without the PIP_DEPS half, a runner
+// update that adds a dep (e.g. scrapling[fetchers] in 1.0.32) would
+// silently skip the reinstall on any box whose sharedVersion hadn't
+// also changed — operators would update the runner but never see the
+// new deps. Hashing the full deps list catches additions, removals,
+// AND version-pin changes within deps.
+function _pipDepsHash() {
+    return createHash("sha256").update(JSON.stringify(PIP_DEPS)).digest("hex").slice(0, 12);
+}
+function venvMarkerValue(expectedVersion) {
+    return `${expectedVersion}::${_pipDepsHash()}`;
+}
 function venvIsValid(expectedVersion) {
     if (!existsSync(venvPython()))
         return false;
@@ -83,7 +107,7 @@ function venvIsValid(expectedVersion) {
         return false;
     try {
         const cached = readFileSync(VENV_MARK, "utf-8").trim();
-        return cached === expectedVersion;
+        return cached === venvMarkerValue(expectedVersion);
     }
     catch {
         return false;
@@ -149,7 +173,18 @@ export async function ensurePythonEnv(systemPython, expectedVersion, onProgress
             reason: `pip install failed (exit ${acode}). Check the lines above for the actual pip error.`,
         };
     }
-    writeFileSync(VENV_MARK, expectedVersion, "utf-8");
+    // Scrapling browser binaries — best-effort. The fast-path AsyncFetcher
+    // (curl_cffi TLS impersonation) works without this; only StealthyFetcher
+    // (Cloudflare-bypass rescue path) needs Chromium. If `scrapling install`
+    // fails (offline, network blip, browser-download mirror down) we don't
+    // fail the venv — the search just stays on the fast path. Logs are
+    // surfaced so the operator sees what happened.
+    onProgress("installing scrapling browsers (best-effort, for stealth rescue path)");
+    const scrCode = await runProc(venvPython(), ["-m", "scrapling", "install"], onProgress);
+    if (scrCode !== 0) {
+        onProgress(`(scrapling install exited ${scrCode} — fast-path fetcher still works; stealth-rescue disabled)`);
+    }
+    writeFileSync(VENV_MARK, venvMarkerValue(expectedVersion), "utf-8");
     // sanity: confirm shortuuid + agentscope (via PYTHONPATH) resolve now.
     // Probe must mirror the spawn env so PYTHONPATH=CACHE_DIR points at
     // the cached agentscope source — without this the probe ImportError's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.31",
+  "version": "1.0.33",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,