@melaya/runner 1.0.76 → 1.0.78

package/dist/assistantHost.py

@@ -0,0 +1,210 @@
+"""
+Melaya Assistant — persistent runner-side host.
+================================================
+
+A LONG-LIVED process the runner spawns once per assistant chat session and keeps
+alive across turns (unlike a pipeline run, which is one fire-and-forget
+subprocess). It boots a single ReActAgent whose model runs on THIS machine
+(claude_code / codex read the user's local OAuth off disk; ollama / lmstudio hit
+localhost), then reads one user message per line on stdin, runs a turn, and
+streams structured events on stdout. The agent's memory persists in-process, so
+multi-turn conversation state (and the local model session) survives between
+turns — that is the whole reason this host exists.
+
+Protocol
+--------
+stdin  (one JSON object per line):   {"turnId": "...", "message": "..."}
+stdout (one JSON per line, prefixed): MELASSIST {"turnId","kind",...}
+  kind ∈ ready | round | tool | delta | text | done | error
+
+Tenant safety: the toolkit is the read-only `melaya_agent_*` tools, which POST to
+the server's assistant-tool bridge authed by MELAYA_API_KEY — every query is
+tenant-gated SERVER-side, so this host gains no data authority beyond the user's
+own mk_ key. Identity is never taken from tool args.
+"""
+from __future__ import annotations
+
+import json
+import os
+import queue
+import sys
+import threading
+import time
+import traceback
+
+# The runner stages the shared/ tree and sets PYTHONPATH before spawning us, so
+# `shared.*` imports resolve exactly like a pipeline subprocess.
+_EVENT_PREFIX = "MELASSIST "
+_IDLE_EXIT_SECONDS = int(os.environ.get("MEL_ASSISTANT_IDLE_SECONDS", "900"))  # 15 min
+
+
+def _emit(turn_id: str, kind: str, **fields) -> None:
+    """Write one structured event line to stdout (flushed) for the runner to relay."""
+    try:
+        payload = {"turnId": turn_id, "kind": kind, **fields}
+        sys.stdout.write(_EVENT_PREFIX + json.dumps(payload, ensure_ascii=False, default=str) + "\n")
+        sys.stdout.flush()
+    except Exception:
+        # Never let event emission crash the turn loop.
+        pass
+
+
+def _log(msg: str) -> None:
+    # Diagnostics go to stderr (the runner logs stderr; stdout is the event channel).
+    try:
+        sys.stderr.write(f"[assistantHost] {msg}\n")
+        sys.stderr.flush()
+    except Exception:
+        pass
+
+
+def _extract_text(result) -> str:
+    """Pull the final assistant text out of an agentscope reply Msg."""
+    if result is None:
+        return ""
+    # agentscope Msg exposes get_text_content(); fall back to raw content.
+    for attr in ("get_text_content",):
+        fn = getattr(result, attr, None)
+        if callable(fn):
+            try:
+                txt = fn()
+                if txt:
+                    return str(txt)
+            except Exception:
+                pass
+    content = getattr(result, "content", result)
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        parts = []
+        for block in content:
+            if isinstance(block, dict) and block.get("type") == "text":
+                parts.append(str(block.get("text", "")))
+            elif isinstance(block, str):
+                parts.append(block)
+        if parts:
+            return "\n".join(parts)
+    return str(content) if content is not None else ""
+
+
+def _build_agent():
+    """Build the single long-lived ReActAgent for this session."""
+    from shared.runtime.agent_factory import make_agent
+    from shared.runtime.registry import build_toolkit
+
+    provider = os.environ.get("MEL_ASSISTANT_PROVIDER", "claude_code")
+    model = os.environ.get("MEL_ASSISTANT_MODEL", "") or None
+    language = os.environ.get("MEL_ASSISTANT_LANGUAGE", "en")
+
+    # Read-only platform tools (pipelines, runs, costs, usage, templates, evals).
+    # They POST to /api/v1/private/assistant-tool with MELAYA_API_KEY; tenant
+    # scope is enforced server-side.
+    try:
+        toolkit = build_toolkit(categories=["melaya_agent"])
+    except Exception as exc:
+        _log(f"build_toolkit(melaya_agent) failed: {exc}; starting tool-less")
+        toolkit = build_toolkit(names=[])
+
+    sys_prompt = (
+        "You are the Melaya Assistant, the in-app copilot of the Melaya "
+        "agent-orchestration platform. You have READ-ONLY tools over the data "
+        "this user is allowed to see: pipelines, runs, LLM costs, plan usage, "
+        "validated workflow templates and eval results.\n"
+        "Rules:\n"
+        "- Use tools to answer questions about the user's pipelines, spend, usage, "
+        "templates or evals — never invent numbers.\n"
+        "- Be concise and concrete; format small tables or bullet lists when comparing items.\n"
+        "- If a question is outside the platform, answer normally without tools.\n"
+        + (f"- Answer in the user's language: {language}.\n" if language and language != "en" else "")
+    )
+
+    agent = make_agent(
+        name="MelayaAssistant",
+        sys_prompt=sys_prompt,
+        toolkit=toolkit,
+        model_name=model,
+        provider=provider,
+        api_key="",  # model.py resolves the provider's own creds (OAuth off disk / localhost)
+        max_iters=6,
+        reliability=True,
+        bounded_memory=True,
+    )
+    return agent
+
+
+def _run_turn(agent, turn_id: str, message: str) -> None:
+    import asyncio
+    from agentscope.message import Msg
+
+    _emit(turn_id, "round", n=1)
+
+    async def _go():
+        return await agent(Msg("user", message, "user"))
+
+    try:
+        result = asyncio.run(_go())
+    except Exception as exc:
+        _log("turn error:\n" + traceback.format_exc())
+        _emit(turn_id, "error", message=str(exc) or "assistant turn failed")
+        _emit(turn_id, "done")
+        return
+
+    text = _extract_text(result)
+    _emit(turn_id, "text", content=text)
+    _emit(turn_id, "done")
+
+
+def _stdin_reader(q: "queue.Queue[str]") -> None:
+    """Feed stdin lines into a queue so the main loop can apply an idle timeout
+    (blocking readline can't be interrupted portably)."""
+    try:
+        for line in sys.stdin:
+            q.put(line)
+    except Exception:
+        pass
+    finally:
+        q.put("")  # sentinel: stdin closed
+
+
+def main() -> int:
+    _log(f"booting (provider={os.environ.get('MEL_ASSISTANT_PROVIDER')})")
+    try:
+        agent = _build_agent()
+    except Exception as exc:
+        _log("boot failed:\n" + traceback.format_exc())
+        _emit("", "error", message=f"assistant host failed to start: {exc}")
+        return 1
+
+    _emit("", "ready")
+    _log("ready")
+
+    q: "queue.Queue[str]" = queue.Queue()
+    threading.Thread(target=_stdin_reader, args=(q,), daemon=True).start()
+
+    while True:
+        try:
+            line = q.get(timeout=_IDLE_EXIT_SECONDS)
+        except queue.Empty:
+            _log("idle timeout — exiting")
+            return 0
+        if line == "":  # stdin closed
+            _log("stdin closed — exiting")
+            return 0
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            req = json.loads(line)
+        except Exception:
+            _log(f"bad stdin line (not json): {line[:120]}")
+            continue
+        turn_id = str(req.get("turnId") or "")
+        message = str(req.get("message") or "")
+        if not message:
+            _emit(turn_id, "done")
+            continue
+        _run_turn(agent, turn_id, message)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/dist/cli.d.ts

@@ -11,6 +11,6 @@
  * Security: this package is a thin executor. It does NOT contain any
  * Melaya business logic, server code, or proprietary modules. The
  * Python shared/ modules needed for pipeline execution are fetched
- * at runtime from the server (integrity-verified via SHA-256 hash).
+ * at runtime from the server (authenticated and verified before writing).
  */
 export {};

package/dist/cli.js

@@ -11,7 +11,7 @@
  * Security: this package is a thin executor. It does NOT contain any
  * Melaya business logic, server code, or proprietary modules. The
  * Python shared/ modules needed for pipeline execution are fetched
- * at runtime from the server (integrity-verified via SHA-256 hash).
+ * at runtime from the server (authenticated and verified before writing).
  */
 import { Command } from "commander";
 import chalk from "chalk";

package/dist/connection.d.ts

@@ -19,4 +19,5 @@ interface ConnectOpts {
     verbose: boolean;
 }
 export declare function connect(opts: ConnectOpts): Promise<void>;
+export declare function verifySignature(content: string, signature: string, runnerToken: string): boolean;
 export {};

package/dist/connection.js

@@ -18,6 +18,7 @@ import { writeFileSync, mkdirSync, existsSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import { tmpdir, homedir } from "os";
+import { createHash, createHmac, timingSafeEqual } from "crypto";
 import { startLocalRelay, setActiveProject } from "./localRelay.js";
 // ESM equivalent of __dirname — required for the rag:ingest handler to
 // locate the bundled localRagIngest.py inside the npm package.
@@ -27,6 +28,8 @@ import { ensureSharedModules, getSharedDir } from "./sharedVendor.js";
 import { startLumaBrowserBridge } from "./lumaBrowserBridge.js";
 const HEARTBEAT_INTERVAL = 30_000;
 const activeProcesses = new Map();
+const activeAssistants = new Map();
+const ASSISTANT_IDLE_MS = 15 * 60 * 1000;
 export async function connect(opts) {
     const spinner = ora("Connecting to Melaya...").start();
     // Connect to the /api/v1/runner NAMESPACE on the existing Socket.IO server.
@@ -65,6 +68,10 @@ export async function connect(opts) {
         spinner.succeed(chalk.green("Connected to Melaya"));
         // Report detected models
         socket.emit("runner:models", opts.models);
+        // Advertise capabilities so the server only routes assistant chat sessions
+        // to runners new enough to host them (older runners never get one → the
+        // server falls back with a clear "update your runner" instead of hanging).
+        socket.emit("runner:hello", { capabilities: ["assistant_session"], package: "@melaya/runner" });
         // Start local event relay
         if (!relay) {
             relay = await startLocalRelay(socket, opts.verbose, opts.serverUrl);
@@ -102,13 +109,13 @@ export async function connect(opts) {
         console.log(chalk.hex("#7C6FF0")(`\n  ▶ Running pipeline: ${payload.pipelineName} (${payload.runId.slice(0, 10)}...)`));
         try {
             // Verify code signature
-            if (!verifySignature(payload.mainPyContent, payload.signature)) {
+            if (!verifySignature(payload.mainPyContent, payload.signature, opts.token)) {
                 console.log(chalk.red("  ✗ Code signature verification failed — refusing to execute"));
                 socket.emit("runner:runComplete", { runId: payload.runId, status: "failed" });
                 return;
             }
             // Ensure shared modules are cached
-            await ensureSharedModules(opts.serverUrl, payload.sharedVersion);
+            await ensureSharedModules(opts.serverUrl, payload.sharedVersion, opts.token);
             // Ensure the dedicated venv at ~/.melaya-runner/venv/ has
             // agentscope + its transitive deps installed. Without this, the
             // operator's system python3 typically doesn't have shortuuid /
@@ -535,7 +542,7 @@ export async function connect(opts) {
             // `shared.runtime.trading_crew_personas` (per the codegen
             // template's import_path) which lives in the same shared/ tree
             // the pipeline runner uses.
-            await ensureSharedModules(opts.serverUrl, sharedVersion);
+            await ensureSharedModules(opts.serverUrl, sharedVersion, opts.token);
             // Dedicated venv with agentscope + anthropic + openai installed.
             const { ensurePythonEnv } = await import("./pythonEnv.js");
             const envResult = await ensurePythonEnv(opts.pythonPath, sharedVersion, (msg) => {
@@ -787,6 +794,149 @@ export async function connect(opts) {
             socket.emit("runner:runComplete", { runId: payload.run_id, status: "failed" });
         }
     });
+    // ── Persistent Assistant chat sessions (runner-hosted models) ───────────
+    // The server drives a per-user chat session on THIS runner for claude_code /
+    // codex / ollama / lmstudio: assistant_start boots a long-lived host,
+    // assistant_turn feeds one user message, and the host streams events back as
+    // runner:assistant_event frames the server relays into the browser SSE.
+    socket.on("runner:assistant_start", async (payload) => {
+        const sid = String(payload.sessionId || "");
+        if (!sid)
+            return;
+        const emitEv = (ev) => socket.emit("runner:assistant_event", { sessionId: sid, turnId: "", ...ev });
+        if (activeAssistants.has(sid)) {
+            emitEv({ kind: "ready" });
+            return;
+        }
+        try {
+            const sharedVersion = String(payload.sharedVersion ?? "latest");
+            await ensureSharedModules(opts.serverUrl, sharedVersion, opts.token);
+            const { ensurePythonEnv } = await import("./pythonEnv.js");
+            const envResult = await ensurePythonEnv(opts.pythonPath, sharedVersion, (m) => { if (opts.verbose)
+                console.log(chalk.gray(`  [assistant venv] ${m}`)); });
+            if (!envResult.ok) {
+                emitEv({ kind: "error", message: `python env failed: ${envResult.reason}` });
+                return;
+            }
+            const { copyFileSync } = await import("fs");
+            const hostCandidates = [join(__dirname, "assistantHost.py"), join(__dirname, "..", "assistantHost.py")];
+            const hostScript = hostCandidates.find((c) => existsSync(c)) || "";
+            if (!hostScript) {
+                emitEv({ kind: "error", message: "assistantHost.py not found — reinstall @melaya/runner" });
+                return;
+            }
+            // Sanitize the session id for a filesystem path — it is
+            // `userId:conversationId`, and ':' is illegal in a Windows dir name.
+            const safeSid = sid.replace(/[^A-Za-z0-9._-]/g, "_");
+            const workDir = join(tmpdir(), `melaya-assistant-${safeSid}`);
+            mkdirSync(workDir, { recursive: true });
+            const stagedHost = join(workDir, "assistantHost.py");
+            copyFileSync(hostScript, stagedHost);
+            const sharedDir = getSharedDir();
+            const certBundle = (await import("./pythonEnv.js")).getCertBundlePath();
+            const sslEnv = certBundle ? { SSL_CERT_FILE: certBundle, REQUESTS_CA_BUNDLE: certBundle } : {};
+            const httpBase = opts.serverUrl.replace(/^wss:/, "https:").replace(/^ws:/, "http:");
+            const env = {
+                ...process.env,
+                PYTHONPATH: sharedDir,
+                PYTHONIOENCODING: "utf-8",
+                PYTHONUTF8: "1",
+                ...sslEnv,
+                MEL_STUDIO_URL: httpBase,
+                MELAYA_API_BASE: httpBase,
+                MELAYA_API_URL: httpBase,
+                LMSTUDIO_BASE_URL: "http://127.0.0.1:1234",
+                OLLAMA_BASE_URL: "http://127.0.0.1:11434",
+                MEL_ASSISTANT_PROVIDER: String(payload.provider || "claude_code"),
+                MEL_ASSISTANT_MODEL: String(payload.model || ""),
+                MEL_ASSISTANT_LANGUAGE: String(payload.language || "en"),
+                // Per-user creds (incl. MELAYA_API_KEY for the tenant-gated tool bridge).
+                ...(payload.credentials || {}),
+            };
+            const proc = spawn(envResult.pythonPath, ["-u", stagedHost], { cwd: workDir, env, stdio: ["pipe", "pipe", "pipe"] });
+            const session = { proc, lastActivity: Date.now(), stdoutBuf: "" };
+            activeAssistants.set(sid, session);
+            console.log(chalk.hex("#7c6ff0")(`  ◆ Assistant session ${sid.slice(0, 10)}… (${payload.provider})`));
+            proc.stdout?.on("data", (data) => {
+                session.stdoutBuf += data.toString();
+                let idx;
+                while ((idx = session.stdoutBuf.indexOf("\n")) >= 0) {
+                    const line = session.stdoutBuf.slice(0, idx);
+                    session.stdoutBuf = session.stdoutBuf.slice(idx + 1);
+                    const t = line.trim();
+                    if (t.startsWith("MELASSIST ")) {
+                        try {
+                            socket.emit("runner:assistant_event", { sessionId: sid, ...JSON.parse(t.slice("MELASSIST ".length)) });
+                        }
+                        catch { /* skip malformed */ }
+                    }
+                    else if (t && opts.verbose) {
+                        console.log(chalk.gray(`  [assistant-stdout] ${t}`));
+                    }
+                }
+            });
+            const stderrTail = [];
+            proc.stderr?.on("data", (data) => {
+                for (const ln of data.toString().split("\n")) {
+                    const t = ln.trimEnd();
+                    if (!t)
+                        continue;
+                    if (opts.verbose)
+                        console.log(chalk.gray(`  [assistant-stderr] ${t}`));
+                    stderrTail.push(t);
+                    if (stderrTail.length > 40)
+                        stderrTail.shift();
+                }
+            });
+            proc.on("exit", (code) => {
+                activeAssistants.delete(sid);
+                const detail = code !== 0 && stderrTail.length ? stderrTail.slice(-12).join("\n") : "";
+                socket.emit("runner:assistant_event", { sessionId: sid, turnId: "", kind: "session_closed", code, detail });
+                console.log(chalk.gray(`  ■ Assistant session ${sid.slice(0, 10)}… closed (exit ${code})`));
+            });
+        }
+        catch (e) {
+            emitEv({ kind: "error", message: `assistant start failed: ${e?.message || e}` });
+        }
+    });
+    socket.on("runner:assistant_turn", (payload) => {
+        const s = activeAssistants.get(String(payload.sessionId || ""));
+        if (!s) {
+            socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: "session_not_found" });
+            return;
+        }
+        s.lastActivity = Date.now();
+        try {
+            s.proc.stdin?.write(JSON.stringify({ turnId: payload.turnId, message: payload.message }) + "\n");
+        }
+        catch (e) {
+            socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: `turn write failed: ${e?.message || e}` });
+        }
+    });
+    socket.on("runner:assistant_stop", (payload) => {
+        const s = activeAssistants.get(String(payload.sessionId || ""));
+        if (s) {
+            try {
+                s.proc.kill();
+            }
+            catch { /* noop */ }
+            activeAssistants.delete(String(payload.sessionId));
+        }
+    });
+    // Idle sweep — reap assistant hosts with no turn in ASSISTANT_IDLE_MS.
+    setInterval(() => {
+        const now = Date.now();
+        for (const [sid, s] of activeAssistants) {
+            if (now - s.lastActivity > ASSISTANT_IDLE_MS) {
+                try {
+                    s.proc.kill();
+                }
+                catch { /* noop */ }
+                activeAssistants.delete(sid);
+                console.log(chalk.gray(`  ■ Assistant session ${sid.slice(0, 10)}… idle-swept`));
+            }
+        }
+    }, 60_000);
     // ── RAG Mode B: local-folder ingest (privacy-preserving) ─────────────
     // The user picks "Local folder" in the Agent Builder DocsTab and types
     // a path on their machine (e.g. C:\Users\me\Documents\refs). The server
@@ -908,7 +1058,7 @@ export async function connect(opts) {
             }
             // Stage the ingest script into the venv work dir so the spawned
             // python sees the shared.runtime + the agentscope vendored tree.
-            await ensureSharedModules(opts.serverUrl, payload.sharedVersion);
+            await ensureSharedModules(opts.serverUrl, payload.sharedVersion, opts.token);
             const sharedDir = getSharedDir();
             const ingestScript = join(sharedDir, "..", "localRagIngest.py");
             // The script is published alongside the runner's shared bundle in
@@ -1109,7 +1259,7 @@ export async function connect(opts) {
                 });
                 return;
             }
-            await ensureSharedModules(opts.serverUrl, payload.sharedVersion);
+            await ensureSharedModules(opts.serverUrl, payload.sharedVersion, opts.token);
             const sharedDir = getSharedDir();
             const workDir = join(tmpdir(), `melaya-rag-retrieve-${payload.pipelineName}-${Date.now()}`);
             mkdirSync(workDir, { recursive: true });
@@ -1333,6 +1483,13 @@ export async function connect(opts) {
             proc.kill("SIGTERM");
             socket.emit("runner:runComplete", { runId: id, status: "failed" });
         }
+        for (const [, s] of activeAssistants) {
+            try {
+                s.proc.kill("SIGTERM");
+            }
+            catch { /* noop */ }
+        }
+        activeAssistants.clear();
         relay?.close();
         // Best-effort Chromium teardown. The bridge's shutdown is async but
         // we can't await inside a SIGINT handler — fire and forget; the
@@ -1346,14 +1503,11 @@ export async function connect(opts) {
     process.on("SIGINT", cleanup);
     process.on("SIGTERM", cleanup);
 }
-function verifySignature(content, signature) {
-    // The signature is an HMAC-SHA256 computed by the server using JWT_SECRET.
-    // The runner doesn't have the secret — but we verify the signature is
-    // present and non-empty. A future version will use a pre-shared public key
-    // for full client-side verification. For now, the signature's presence
-    // proves the payload passed through the server (not injected by MITM).
-    if (!signature || signature.length < 32) {
+export function verifySignature(content, signature, runnerToken) {
+    if (!content || !signature || !runnerToken)
         return false;
-    }
-    return true;
+    const signingKey = createHash("sha256").update(runnerToken).digest();
+    const expected = createHmac("sha256", signingKey).update(content).digest();
+    const received = Buffer.from(signature, "hex");
+    return received.length === expected.length && timingSafeEqual(received, expected);
 }

package/dist/pythonEnv.js

@@ -117,6 +117,16 @@ const PIP_DEPS = [
     // tool module cleanly — this just makes the dep present so the yf_ tools work
     // when attached. Pulls pandas transitively.
     "yfinance",
+    // ── Template-validation sweep deps (2026-07-06) — tools that hard-error
+    // "pip install X" on the runner without these, observed in live runs:
+    // yt-dlp        — youtube_search_channel / youtube_get_transcript (1221 YouTube Intel)
+    // sentence-transformers — build_knowledge_from_text embedder (1221)
+    // flights       — flight_price_alert / flight_search live Google Flights ("fli" import; 1261/1265)
+    // pymupdf4llm   — pdf_to_text markdown extraction (1227 PDF Contract Analyser)
+    "yt-dlp",
+    "sentence-transformers",
+    "flights",
+    "pymupdf4llm",
     // ── Vector RAG (retrieval mode) ────────────────────────────────────────
     // ollama — Python client used by agentscope.embedding.OllamaTextEmbedding.
     //   Talks to localhost:11434 (the user's local Ollama daemon) to embed

package/dist/sharedVendor.d.ts

@@ -8,4 +8,4 @@
  * integrity-verified via SHA-256, and cached at ~/.melaya-runner/shared/.
  */
 export declare function getSharedDir(): string;
-export declare function ensureSharedModules(serverUrl: string, expectedVersion: string): Promise<void>;
+export declare function ensureSharedModules(serverUrl: string, expectedVersion: string, runnerToken: string): Promise<void>;

package/dist/sharedVendor.js

@@ -10,7 +10,7 @@
 import { mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
-import { createHash } from "crypto";
+import { createHash, createHmac, timingSafeEqual } from "crypto";
 const CACHE_DIR = join(homedir(), ".melaya-runner");
 const SHARED_DIR = join(CACHE_DIR, "shared");
 const VERSION_FILE = join(CACHE_DIR, "shared-version.txt");
@@ -35,7 +35,7 @@ const CANARY_FILES = [
 function cacheLooksValid() {
     return CANARY_FILES.every((p) => existsSync(p));
 }
-export async function ensureSharedModules(serverUrl, expectedVersion) {
+export async function ensureSharedModules(serverUrl, expectedVersion, runnerToken) {
     mkdirSync(CACHE_DIR, { recursive: true });
     // Check cached version. We require BOTH a version match AND a valid nested
     // layout — older runner versions wrote flat filenames into shared/, and
@@ -57,7 +57,10 @@ export async function ensureSharedModules(serverUrl, expectedVersion) {
     // Fetch from server
     const httpUrl = serverUrl.replace(/^wss:/, "https:").replace(/^ws:/, "http:");
     const url = `${httpUrl}/api/v1/runner/shared-bundle?v=${expectedVersion}`;
-    const res = await fetch(url, { signal: AbortSignal.timeout(30_000) });
+    const res = await fetch(url, {
+        headers: { Authorization: `Bearer ${runnerToken}` },
+        signal: AbortSignal.timeout(30_000),
+    });
     if (!res.ok) {
         throw new Error(`Failed to fetch shared modules: HTTP ${res.status}`);
     }
@@ -67,6 +70,12 @@ export async function ensureSharedModules(serverUrl, expectedVersion) {
     if (computed !== body.hash) {
         throw new Error("Shared module integrity check failed — hash mismatch");
     }
+    const signingKey = createHash("sha256").update(runnerToken).digest();
+    const expectedSignature = createHmac("sha256", signingKey).update(body.hash).digest();
+    const receivedSignature = Buffer.from(body.signature || "", "hex");
+    if (receivedSignature.length !== expectedSignature.length || !timingSafeEqual(receivedSignature, expectedSignature)) {
+        throw new Error("Shared module authenticity check failed: signature mismatch");
+    }
     // Write files (sanitize filenames to prevent path traversal)
     const writtenDirs = new Set();
     for (const [filename, content] of Object.entries(body.files)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.76",
+  "version": "1.0.78",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,
@@ -19,7 +19,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && node -e \"const fs=require('fs'); fs.copyFileSync('localRagIngest.py','dist/localRagIngest.py'); fs.copyFileSync('localRagRetrieve.py','dist/localRagRetrieve.py')\"",
+    "build": "tsc && node -e \"const fs=require('fs'); fs.copyFileSync('localRagIngest.py','dist/localRagIngest.py'); fs.copyFileSync('localRagRetrieve.py','dist/localRagRetrieve.py'); fs.copyFileSync('src/assistantHost.py','dist/assistantHost.py')\"",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {