@melaya/runner 1.1.35 → 1.1.37

package/dist/connection.js

@@ -136,14 +136,40 @@ export async function connect(opts) {
         _assistantPrewarmed = true;
         try {
             const { getLocalSharedVersion } = await import("./sharedVendor.js");
-            const localVersion = getLocalSharedVersion();
-            if (!localVersion)
-                return; // nothing cached yet — let assistant_start do it
+            let localVersion = getLocalSharedVersion();
+            const freshSetup = !localVersion;
+            if (!localVersion) {
+                // FIRST LAUNCH: no shared bundle on disk yet. Download it now, on
+                // connect, so the venv is built UP-FRONT instead of making the user wait
+                // 1-2 min mid-chat on their first assistant/pipeline run. Shown to the
+                // user (not verbose-gated) — a silent multi-minute pause reads as "stuck"
+                // and users leave; a clear one-time-setup line keeps their trust.
+                console.log(chalk.hex("#7C6FF0")("\n  ⚙ First-time setup: preparing your local AI runtime (one-time)…"));
+                console.log(chalk.gray("    downloading runtime modules…"));
+                try {
+                    await ensureSharedModules(opts.serverUrl, "latest", opts.token);
+                    localVersion = getLocalSharedVersion();
+                }
+                catch (e) {
+                    console.log(chalk.gray(`    setup deferred (${e?.message || e}) — it will finish on your first run`));
+                    return;
+                }
+                if (!localVersion)
+                    return;
+            }
             const { ensurePythonEnv, getCertBundlePath } = await import("./pythonEnv.js");
+            if (freshSetup)
+                console.log(chalk.gray("    installing Python dependencies (~1-2 min)…"));
             const envResult = await ensurePythonEnv(opts.pythonPath, localVersion, (m) => { if (opts.verbose)
                 console.log(chalk.gray(`  [assistant prewarm] ${m}`)); });
-            if (opts.verbose)
+            if (freshSetup) {
+                console.log(envResult.ok
+                    ? chalk.green("  ✓ Local AI runtime ready — your first chat will start instantly\n")
+                    : chalk.yellow(`  ⚠ runtime setup did not finish (${envResult.reason || "unknown"}); it will retry on your first run\n`));
+            }
+            else if (opts.verbose) {
                 console.log(chalk.gray("  [assistant prewarm] ready"));
+            }
             // ALSO pre-import the heavy Python stack so the first real run/chat
             // doesn't pay the ~6s cold `import shared.runtime.registry`. Spawn it
             // detached + fire-and-forget with the SAME PYTHONPATH/env a real

package/dist/pythonEnv.d.ts

@@ -11,8 +11,10 @@
  */
 export declare function venvPython(): string;
 export declare function getCertBundlePath(): string;
-export declare function ensurePythonEnv(systemPython: string, expectedVersion: string, onProgress?: (msg: string) => void): Promise<{
+type EnsureResult = {
     ok: boolean;
     pythonPath: string;
     reason?: string;
-}>;
+};
+export declare function ensurePythonEnv(systemPython: string, expectedVersion: string, onProgress?: (msg: string) => void): Promise<EnsureResult>;
+export {};

package/dist/pythonEnv.js

@@ -73,7 +73,15 @@ const PIP_DEPS = [
     "filetype",
     "json5",
     "json_repair",
-    "mcp>=1.13",
+    // PINNED <2: mcp 2.x renamed `streamablehttp_client` →
+    // `streamable_http_client` in mcp.client.streamable_http, which the in-house
+    // agentscope imports by the OLD name (agentscope/mcp/_http_state*_client.py).
+    // Unpinned `mcp>=1.13` let a FRESH venv pull 2.x → `import agentscope` fails
+    // with "cannot import name 'streamablehttp_client'", so the assistant host
+    // never boots. Old cached venvs kept 1.x and worked, which is why this only
+    // bit fresh installs (e.g. the Mac 3.14→3.12 rebuild). Keep on the 1.x line
+    // until agentscope is updated to the 2.x API.
+    "mcp>=1.13,<2",
     "numpy",
     "openai",
     "python-datauri",
@@ -381,7 +389,24 @@ async function ensureNltkData(onProgress) {
 }
 // One-time-per-process guard for the cache-hit self-heal (NLTK + cert bundle).
 let _selfHealedThisProcess = false;
-export async function ensurePythonEnv(systemPython, expectedVersion, onProgress = (m) => console.log(chalk.gray(`  [venv] ${m}`))) {
+const _ensureInFlight = new Map();
+export function ensurePythonEnv(systemPython, expectedVersion, onProgress = (m) => console.log(chalk.gray(`  [venv] ${m}`))) {
+    // A valid venv resolves cheaply and must NOT be blocked behind an in-flight
+    // build for a different version — run the impl directly (its own early-return
+    // handles the cache hit). Only route through the singleflight when a build is
+    // actually needed, so two build requests coalesce.
+    if (venvIsValid(expectedVersion) && !_ensureInFlight.has(expectedVersion)) {
+        return _ensurePythonEnvImpl(systemPython, expectedVersion, onProgress);
+    }
+    const existing = _ensureInFlight.get(expectedVersion);
+    if (existing)
+        return existing;
+    const p = _ensurePythonEnvImpl(systemPython, expectedVersion, onProgress)
+        .finally(() => { _ensureInFlight.delete(expectedVersion); });
+    _ensureInFlight.set(expectedVersion, p);
+    return p;
+}
+async function _ensurePythonEnvImpl(systemPython, expectedVersion, onProgress = (m) => console.log(chalk.gray(`  [venv] ${m}`))) {
     if (venvIsValid(expectedVersion)) {
         // Self-heal: ensure NLTK data + the cert bundle are present even when the
         // venv marker says we're up to date (this is what previously broke for
@@ -440,14 +465,27 @@ export async function ensurePythonEnv(systemPython, expectedVersion, onProgress
     }
     // Step 2: upgrade pip + wheel so wheel-based deps install cleanly.
     onProgress("upgrading pip / wheel inside the venv");
-    await runProc(venvPython(), ["-m", "pip", "install", "--quiet", "--upgrade", "pip", "wheel"], onProgress);
+    // --use-feature=truststore makes pip verify TLS against the OS trust store
+    // instead of its bundled roots — required behind TLS-intercepting proxies /
+    // antivirus (else "CERTIFICATE_VERIFY_FAILED: unable to get local issuer
+    // certificate" and the whole venv build fails → agentscope import breaks).
+    // Same fix as uv's UV_SYSTEM_CERTS. Needs pip>=23.2, which every Python we
+    // provision (uv-managed 3.12) or accept (3.11/3.12) bundles.
+    await runProc(venvPython(), ["-m", "pip", "install", "--use-feature=truststore", "--quiet", "--upgrade", "pip", "wheel"], onProgress);
     // Step 3: install agentscope's transitive deps + tool extras directly.
     // We do NOT pip-install agentscope itself — the shared bundle ships
     // only *.py files (no pyproject.toml), so PYTHONPATH-based import is
     // the only path. The cached agentscope source under
     // ~/.melaya-runner/agentscope/ resolves via PYTHONPATH at spawn time.
     onProgress(`installing ${PIP_DEPS.length} python deps (anthropic, openai, opentelemetry, …) — first run can take 1-2 min`);
-    const acode = await runProc(venvPython(), ["-m", "pip", "install", "--quiet", "--disable-pip-version-check", ...PIP_DEPS], onProgress);
+    const acode = await runProc(venvPython(), 
+    // --no-cache-dir: skip pip's on-disk HTTP/wheel cache. It silences the
+    // "Cache entry deserialization failed, entry ignored" warning flood (stale
+    // entries left by other Python versions in the shared user cache) and, more
+    // importantly, guarantees a corrupt cached wheel can never install a subtly
+    // broken package into a fresh runner venv. Costs a re-download on rebuild,
+    // which is rare (only on a deps change or a manual clear).
+    ["-m", "pip", "install", "--use-feature=truststore", "--no-cache-dir", "--quiet", "--disable-pip-version-check", ...PIP_DEPS], onProgress);
     if (acode !== 0) {
         return {
             ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.35",
+  "version": "1.1.37",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,