@melaya/runner 1.0.47 → 1.0.49

package/dist/connection.js

@@ -229,11 +229,24 @@ export async function connect(opts) {
                 if (k.startsWith("MEL_MODEL_"))
                     delete inherited[k];
             }
+            // certifi CA-bundle path resolved at venv setup. Set as both
+            // SSL_CERT_FILE (urllib / openssl) and REQUESTS_CA_BUNDLE (requests
+            // library) so EVERY HTTPS-using tool — gmail_send, slack_post_text,
+            // anthropic SDK, openai SDK, web_search, etc. — verifies against
+            // certifi's bundle rather than the platform default. Without this,
+            // macOS Python crashes with `[SSL: CERTIFICATE_VERIFY_FAILED]` on
+            // any cloud call (run eb1b8f67df56491b hit exactly this for
+            // gmail_send → api.googleapis.com).
+            const certBundle = (await import("./pythonEnv.js")).getCertBundlePath();
+            const sslEnv = certBundle
+                ? { SSL_CERT_FILE: certBundle, REQUESTS_CA_BUNDLE: certBundle }
+                : {};
             const env = {
                 ...inherited,
                 PYTHONPATH: sharedDir,
                 PYTHONIOENCODING: "utf-8",
                 PYTHONUTF8: "1",
+                ...sslEnv,
                 MEL_RUN_ID: payload.runId,
                 // Point agentscope hooks at the REAL server (not the browser's Vite URL).
                 // Convert wss://api.melaya.org → https://api.melaya.org so pushMessage,
@@ -542,6 +555,13 @@ export async function connect(opts) {
             ];
             const { existsSync: _exists2 } = await import("fs");
             const bundledNltkData = candidateNltkPaths.find((p) => _exists2(p)) || "";
+            // Resolve certifi bundle for HTTPS verification (same rationale as
+            // the runner:run spawn — embedder providers like OpenAI hit
+            // api.openai.com over TLS and crash on macOS without certifi).
+            const ragCertBundle = (await import("./pythonEnv.js")).getCertBundlePath();
+            const ragSslEnv = ragCertBundle
+                ? { SSL_CERT_FILE: ragCertBundle, REQUESTS_CA_BUNDLE: ragCertBundle }
+                : {};
             const proc = spawn(env.pythonPath, [
                 "-u", stagedScript,
                 "--pipeline-name", payload.pipelineName,
@@ -552,6 +572,7 @@ export async function connect(opts) {
                 env: {
                     ...process.env,
                     PYTHONPATH: sharedDir, // so `from agentscope.rag import …` resolves
+                    ...ragSslEnv,
                     ...(bundledNltkData ? { NLTK_DATA: bundledNltkData } : {}),
                 },
                 cwd: workDir,

package/dist/modelLoader.js

@@ -68,7 +68,17 @@ const FAMILY_OVERRIDES = [
     { pattern: /qwen3.*vl.*\b8b\b/i, family: "qwen3", tier: "agentic-capable", thinking: "on", reason: "qwen3-vl-8b: agentic-capable, full thinking" },
     // ── Qwen3 — capable (≥8B) BEFORE the smaller non-vl 4b pattern, so
     //    14b / 32b don't get caught by the 4b regex's stem match. ──
-    { pattern: /qwen3.*\b(8b|14b|32b)\b/i, family: "qwen3", tier: "agentic-capable", thinking: "on", reason: "qwen3 ≥8b: agentic-capable" },
+    //    Mainline qwen3 releases ship 8B, 14B, 32B. Custom/finetuned
+    //    27B/30B/72B variants exist (e.g. qwen3.6-27b on LM Studio) — we
+    //    enumerate them so `family="qwen3"` propagates and model.py can
+    //    apply chat_template_kwargs.enable_thinking=false when needed.
+    //    Without the explicit 27b entry, qwen3.6-27b falls through to
+    //    the param-count path with `family=null`, the disable_thinking
+    //    branch in model.py is skipped, and the model produces
+    //    thinking-only responses that the OpenAI formatter drops (run
+    //    1ecad7cb hit this — Copywriter ended in 11.5KB thinking block,
+    //    ReportWriter emailed [CONTENT NOT AVAILABLE]).
+    { pattern: /qwen3.*\b(8b|14b|27b|30b|32b|72b)\b/i, family: "qwen3", tier: "agentic-capable", thinking: "off", reason: "qwen3 ≥8b: agentic-capable, thinking disabled (model is large enough to reason without explicit <think> blocks; thinking-only responses get stripped by the OpenAI formatter and lose data to next agent)" },
     // ── Qwen3 — small variants ──
     { pattern: /qwen3.*\b1\.7b\b/i, family: "qwen3", tier: "text-only", thinking: "off", reason: "qwen3-1.7b: param count below the agentic 7B floor; thinking disabled to prevent <think> loops" },
     { pattern: /qwen3.*\b0\.5b\b/i, family: "qwen3", tier: "text-only", thinking: "off", reason: "qwen3-0.5b: too small for agentic work" },
@@ -214,7 +224,7 @@ export function classifyModel(id, lmstudioMeta) {
 // Bump whenever FAMILY_OVERRIDES, tier thresholds, or any classifier
 // logic changes in a way that could re-tier an existing cached model.
 // Cached profiles with a mismatched version are ignored and re-classified.
-const PROFILE_SCHEMA_VERSION = 2;
+const PROFILE_SCHEMA_VERSION = 3;
 const LMSTUDIO_BASE = process.env.LMSTUDIO_BASE_URL || "http://127.0.0.1:1234";
 const OLLAMA_BASE = process.env.OLLAMA_BASE_URL || "http://127.0.0.1:11434";
 // JIT-load timeout. 8B-class quantised models on M-series Macs typically

package/dist/pythonEnv.d.ts

@@ -10,6 +10,7 @@
  * shared-bundle version. Re-bootstraps when the bundle version changes.
  */
 export declare function venvPython(): string;
+export declare function getCertBundlePath(): string;
 export declare function ensurePythonEnv(systemPython: string, expectedVersion: string, onProgress?: (msg: string) => void): Promise<{
     ok: boolean;
     pythonPath: string;

package/dist/pythonEnv.js

@@ -119,12 +119,69 @@ const PIP_DEPS = [
     // "pandas is not installed". Numpy is already in PIP_DEPS (line 57) so
     // the wheel install is fast.
     "pandas",
+    // certifi — provides the CA root bundle that tools like gmail_send /
+    // any other HTTPS API rely on for cert verification. On macOS Python
+    // 3.x doesn't read the system keychain by default; without certifi +
+    // SSL_CERT_FILE pointed at its bundle, every Gmail / Slack / Anthropic
+    // / etc. API call raises SSL: CERTIFICATE_VERIFY_FAILED (run
+    // eb1b8f67df56491b hit exactly this — gmail_send dispatched but
+    // urllib couldn't verify api.googleapis.com). The runner exports
+    // SSL_CERT_FILE + REQUESTS_CA_BUNDLE pointing here when spawning
+    // pipeline Python — see getCertBundlePath() + spawn env merging in
+    // connection.ts.
+    "certifi",
 ];
 export function venvPython() {
     return platform() === "win32"
         ? join(VENV_DIR, "Scripts", "python.exe")
         : join(VENV_DIR, "bin", "python");
 }
+// ── certifi CA-bundle path resolution + cache ────────────────────────────
+// Set as SSL_CERT_FILE + REQUESTS_CA_BUNDLE when spawning pipeline Python
+// so that ANY HTTPS-using tool (gmail_send, slack_post_text, anthropic /
+// openai SDKs, requests, urllib, etc.) verifies certs against certifi's
+// bundle rather than the platform default. On macOS specifically, the
+// system Python doesn't read the keychain — without this, every API call
+// crashes with `[SSL: CERTIFICATE_VERIFY_FAILED]`.
+//
+// We cache the path in ~/.melaya-runner/cert-bundle-path so we don't pay
+// a Python startup roundtrip on every spawn. The cache is invalidated
+// when the venv is rebuilt (the file lives outside VENV_DIR but is
+// re-written every ensurePythonEnv).
+const CERT_PATH_CACHE = join(CACHE_DIR, "cert-bundle-path");
+export function getCertBundlePath() {
+    try {
+        if (existsSync(CERT_PATH_CACHE)) {
+            const cached = readFileSync(CERT_PATH_CACHE, "utf-8").trim();
+            if (cached && existsSync(cached))
+                return cached;
+        }
+    }
+    catch { /* fall through to resolution */ }
+    return "";
+}
+async function _resolveAndCacheCertBundle(onProgress) {
+    if (!existsSync(venvPython()))
+        return;
+    // Resolve certifi.where() — fast subprocess (<300 ms typical).
+    let resolved = "";
+    await runProc(venvPython(), ["-c", "import certifi, sys; sys.stdout.write(certifi.where())"], (line) => {
+        if (line && existsSync(line.trim()))
+            resolved = line.trim();
+    });
+    if (resolved) {
+        try {
+            writeFileSync(CERT_PATH_CACHE, resolved + "\n", "utf-8");
+            onProgress(`cert bundle: ${resolved}`);
+        }
+        catch (e) {
+            onProgress(`(warn: failed to cache cert bundle path: ${e?.message})`);
+        }
+    }
+    else {
+        onProgress("(warn: certifi.where() did not resolve a valid path — HTTPS calls may fail with cert verify errors)");
+    }
+}
 // The marker is keyed on sharedVersion + a hash of PIP_DEPS so changes
 // to either invalidate the venv. Without the PIP_DEPS half, a runner
 // update that adds a dep (e.g. scrapling[fetchers] in 1.0.32) would
@@ -226,6 +283,7 @@ export async function ensurePythonEnv(systemPython, expectedVersion, onProgress
         // says we're up to date. This is what previously broke for boxes
         // that upgraded the runner without invalidating the marker.
         await ensureNltkData(onProgress);
+        await _resolveAndCacheCertBundle(onProgress);
         return { ok: true, pythonPath: venvPython() };
     }
     if (!existsSync(AGENTSCOPE)) {
@@ -298,6 +356,7 @@ export async function ensurePythonEnv(systemPython, expectedVersion, onProgress
     // Centralised in `ensureNltkData()` so the success/failure surface is
     // identical whether the venv is fresh or already valid.
     await ensureNltkData(onProgress);
+    await _resolveAndCacheCertBundle(onProgress);
     writeFileSync(VENV_MARK, venvMarkerValue(expectedVersion), "utf-8");
     // sanity: confirm shortuuid + agentscope (via PYTHONPATH) resolve now.
     // Probe must mirror the spawn env so PYTHONPATH=CACHE_DIR points at

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.47",
+  "version": "1.0.49",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,