@melaya/runner 1.1.35 → 1.1.36

package/dist/pythonEnv.js

@@ -73,7 +73,15 @@ const PIP_DEPS = [
     "filetype",
     "json5",
     "json_repair",
-    "mcp>=1.13",
+    // PINNED <2: mcp 2.x renamed `streamablehttp_client` →
+    // `streamable_http_client` in mcp.client.streamable_http, which the in-house
+    // agentscope imports by the OLD name (agentscope/mcp/_http_state*_client.py).
+    // Unpinned `mcp>=1.13` let a FRESH venv pull 2.x → `import agentscope` fails
+    // with "cannot import name 'streamablehttp_client'", so the assistant host
+    // never boots. Old cached venvs kept 1.x and worked, which is why this only
+    // bit fresh installs (e.g. the Mac 3.14→3.12 rebuild). Keep on the 1.x line
+    // until agentscope is updated to the 2.x API.
+    "mcp>=1.13,<2",
     "numpy",
     "openai",
     "python-datauri",
@@ -440,14 +448,27 @@ export async function ensurePythonEnv(systemPython, expectedVersion, onProgress
     }
     // Step 2: upgrade pip + wheel so wheel-based deps install cleanly.
     onProgress("upgrading pip / wheel inside the venv");
-    await runProc(venvPython(), ["-m", "pip", "install", "--quiet", "--upgrade", "pip", "wheel"], onProgress);
+    // --use-feature=truststore makes pip verify TLS against the OS trust store
+    // instead of its bundled roots — required behind TLS-intercepting proxies /
+    // antivirus (else "CERTIFICATE_VERIFY_FAILED: unable to get local issuer
+    // certificate" and the whole venv build fails → agentscope import breaks).
+    // Same fix as uv's UV_SYSTEM_CERTS. Needs pip>=23.2, which every Python we
+    // provision (uv-managed 3.12) or accept (3.11/3.12) bundles.
+    await runProc(venvPython(), ["-m", "pip", "install", "--use-feature=truststore", "--quiet", "--upgrade", "pip", "wheel"], onProgress);
     // Step 3: install agentscope's transitive deps + tool extras directly.
     // We do NOT pip-install agentscope itself — the shared bundle ships
     // only *.py files (no pyproject.toml), so PYTHONPATH-based import is
     // the only path. The cached agentscope source under
     // ~/.melaya-runner/agentscope/ resolves via PYTHONPATH at spawn time.
     onProgress(`installing ${PIP_DEPS.length} python deps (anthropic, openai, opentelemetry, …) — first run can take 1-2 min`);
-    const acode = await runProc(venvPython(), ["-m", "pip", "install", "--quiet", "--disable-pip-version-check", ...PIP_DEPS], onProgress);
+    const acode = await runProc(venvPython(), 
+    // --no-cache-dir: skip pip's on-disk HTTP/wheel cache. It silences the
+    // "Cache entry deserialization failed, entry ignored" warning flood (stale
+    // entries left by other Python versions in the shared user cache) and, more
+    // importantly, guarantees a corrupt cached wheel can never install a subtly
+    // broken package into a fresh runner venv. Costs a re-download on rebuild,
+    // which is rare (only on a deps change or a manual clear).
+    ["-m", "pip", "install", "--use-feature=truststore", "--no-cache-dir", "--quiet", "--disable-pip-version-check", ...PIP_DEPS], onProgress);
     if (acode !== 0) {
         return {
             ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.35",
+  "version": "1.1.36",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,