@melaya/runner 1.0.32 → 1.0.33

package/dist/pythonEnv.js

@@ -11,6 +11,7 @@
  */
 import { spawn } from "child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { createHash } from "crypto";
 import { join } from "path";
 import { homedir, platform } from "os";
 import chalk from "chalk";
@@ -86,6 +87,19 @@ export function venvPython() {
         ? join(VENV_DIR, "Scripts", "python.exe")
         : join(VENV_DIR, "bin", "python");
 }
+// The marker is keyed on sharedVersion + a hash of PIP_DEPS so changes
+// to either invalidate the venv. Without the PIP_DEPS half, a runner
+// update that adds a dep (e.g. scrapling[fetchers] in 1.0.32) would
+// silently skip the reinstall on any box whose sharedVersion hadn't
+// also changed — operators would update the runner but never see the
+// new deps. Hashing the full deps list catches additions, removals,
+// AND version-pin changes within deps.
+function _pipDepsHash() {
+    return createHash("sha256").update(JSON.stringify(PIP_DEPS)).digest("hex").slice(0, 12);
+}
+function venvMarkerValue(expectedVersion) {
+    return `${expectedVersion}::${_pipDepsHash()}`;
+}
 function venvIsValid(expectedVersion) {
     if (!existsSync(venvPython()))
         return false;
@@ -93,7 +107,7 @@ function venvIsValid(expectedVersion) {
         return false;
     try {
         const cached = readFileSync(VENV_MARK, "utf-8").trim();
-        return cached === expectedVersion;
+        return cached === venvMarkerValue(expectedVersion);
     }
     catch {
         return false;
@@ -170,7 +184,7 @@ export async function ensurePythonEnv(systemPython, expectedVersion, onProgress
     if (scrCode !== 0) {
         onProgress(`(scrapling install exited ${scrCode} — fast-path fetcher still works; stealth-rescue disabled)`);
     }
-    writeFileSync(VENV_MARK, expectedVersion, "utf-8");
+    writeFileSync(VENV_MARK, venvMarkerValue(expectedVersion), "utf-8");
     // sanity: confirm shortuuid + agentscope (via PYTHONPATH) resolve now.
     // Probe must mirror the spawn env so PYTHONPATH=CACHE_DIR points at
     // the cached agentscope source — without this the probe ImportError's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.32",
+  "version": "1.0.33",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,