@melaya/runner 1.1.34 → 1.1.36

package/dist/pythonEnv.js

@@ -73,7 +73,15 @@ const PIP_DEPS = [
     "filetype",
     "json5",
     "json_repair",
-    "mcp>=1.13",
+    // PINNED <2: mcp 2.x renamed `streamablehttp_client` →
+    // `streamable_http_client` in mcp.client.streamable_http, which the in-house
+    // agentscope imports by the OLD name (agentscope/mcp/_http_state*_client.py).
+    // Unpinned `mcp>=1.13` let a FRESH venv pull 2.x → `import agentscope` fails
+    // with "cannot import name 'streamablehttp_client'", so the assistant host
+    // never boots. Old cached venvs kept 1.x and worked, which is why this only
+    // bit fresh installs (e.g. the Mac 3.14→3.12 rebuild). Keep on the 1.x line
+    // until agentscope is updated to the 2.x API.
+    "mcp>=1.13,<2",
     "numpy",
     "openai",
     "python-datauri",
@@ -440,14 +448,27 @@ export async function ensurePythonEnv(systemPython, expectedVersion, onProgress
     }
     // Step 2: upgrade pip + wheel so wheel-based deps install cleanly.
     onProgress("upgrading pip / wheel inside the venv");
-    await runProc(venvPython(), ["-m", "pip", "install", "--quiet", "--upgrade", "pip", "wheel"], onProgress);
+    // --use-feature=truststore makes pip verify TLS against the OS trust store
+    // instead of its bundled roots — required behind TLS-intercepting proxies /
+    // antivirus (else "CERTIFICATE_VERIFY_FAILED: unable to get local issuer
+    // certificate" and the whole venv build fails → agentscope import breaks).
+    // Same fix as uv's UV_SYSTEM_CERTS. Needs pip>=23.2, which every Python we
+    // provision (uv-managed 3.12) or accept (3.11/3.12) bundles.
+    await runProc(venvPython(), ["-m", "pip", "install", "--use-feature=truststore", "--quiet", "--upgrade", "pip", "wheel"], onProgress);
     // Step 3: install agentscope's transitive deps + tool extras directly.
     // We do NOT pip-install agentscope itself — the shared bundle ships
     // only *.py files (no pyproject.toml), so PYTHONPATH-based import is
     // the only path. The cached agentscope source under
     // ~/.melaya-runner/agentscope/ resolves via PYTHONPATH at spawn time.
     onProgress(`installing ${PIP_DEPS.length} python deps (anthropic, openai, opentelemetry, …) — first run can take 1-2 min`);
-    const acode = await runProc(venvPython(), ["-m", "pip", "install", "--quiet", "--disable-pip-version-check", ...PIP_DEPS], onProgress);
+    const acode = await runProc(venvPython(), 
+    // --no-cache-dir: skip pip's on-disk HTTP/wheel cache. It silences the
+    // "Cache entry deserialization failed, entry ignored" warning flood (stale
+    // entries left by other Python versions in the shared user cache) and, more
+    // importantly, guarantees a corrupt cached wheel can never install a subtly
+    // broken package into a fresh runner venv. Costs a re-download on rebuild,
+    // which is rare (only on a deps change or a manual clear).
+    ["-m", "pip", "install", "--use-feature=truststore", "--no-cache-dir", "--quiet", "--disable-pip-version-check", ...PIP_DEPS], onProgress);
     if (acode !== 0) {
         return {
             ok: false,
@@ -496,12 +517,38 @@ export async function ensurePythonEnv(systemPython, expectedVersion, onProgress
     // this passes, so a half-built venv is never cached as valid: the next
     // launch re-enters this rebuild path and self-heals instead of returning a
     // broken venv as ok.
-    const probe = await runProc(venvPython(), ["-c", "import shortuuid, agentscope, anthropic, openai"], onProgress, { PYTHONPATH: CACHE_DIR });
+    // Importing the in-house agentscope eagerly loads its full submodule tree
+    // (model/tool/rag/embedding/…), so it drags in every third-party dep at load
+    // time. A single broken wheel therefore surfaces here as an "agentscope"
+    // failure even though our package is fine. Import each name in turn and, on
+    // the FIRST failure, emit a machine-parseable PROBE_FAIL line naming the exact
+    // module + error — captured below so the reason names the real culprit instead
+    // of the useless "agentscope import failed" (which sent every Mac 3.14→3.12
+    // dep breakage back as an unactionable message).
+    let probeErr = "";
+    const probe = await runProc(venvPython(), ["-c",
+        "import sys\n" +
+            "for _m in ('shortuuid','agentscope','anthropic','openai'):\n" +
+            "    try:\n" +
+            "        __import__(_m)\n" +
+            "    except Exception as _e:\n" +
+            "        import traceback\n" +
+            "        sys.stderr.write('PROBE_FAIL module=%s %s: %s\\n' % (_m, type(_e).__name__, _e))\n" +
+            "        traceback.print_exc()\n" +
+            "        sys.exit(1)\n",
+    ], (line) => {
+        if (/^PROBE_FAIL /.test(line))
+            probeErr = line.replace(/^PROBE_FAIL\s+/, "").trim();
+        onProgress(line);
+    }, { PYTHONPATH: CACHE_DIR });
     if (probe !== 0) {
+        const where = venvMinorVersion() === null ? "" : `Python 3.${venvMinorVersion()} `;
         return {
             ok: false,
             pythonPath: systemPython,
-            reason: `agentscope import probe failed on the ${venvMinorVersion() === null ? "" : `Python 3.${venvMinorVersion()} `}venv — the deps above did not import. See the pip lines above for the cause; the venv will be rebuilt on next launch.`,
+            reason: probeErr
+                ? `${where}venv import probe failed — ${probeErr}. Importing agentscope loads its whole dependency tree, so this is the dep that broke (not agentscope itself). See the traceback above; the venv will be rebuilt on next launch.`
+                : `agentscope import probe failed on the ${where}venv — a dependency did not import. See the lines above; the venv will be rebuilt on next launch.`,
         };
     }
     writeFileSync(VENV_MARK, venvMarkerValue(expectedVersion), "utf-8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.34",
+  "version": "1.1.36",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,