@melaya/runner 1.1.56 → 1.1.59

package/dist/assistantHost.py

@@ -198,15 +198,22 @@ def _render_summary_text(summary) -> str:
 # this to emit delta / tool events keyed to the turn in flight. `cancel` is the
 # STOP flag: set by the stdin-reader thread, polled by the running turn.
 _stream = {"turnId": "", "lens": {}, "cancel": False, "usedBrowser": False,
-           "deltaBuf": "", "deltaMid": ""}
+           "deltaBuf": "", "deltaMid": "", "deltaAt": 0.0,
+           "thinkLens": {}, "toolIds": set()}
 
 # Coalesce per-token pre_print fragments before emitting a `delta`. agentscope
 # hands us one cumulative snapshot per model chunk; a streaming Anthropic/OpenAI
 # response fragments the answer into 2-15 char pieces, and emitting a MELASSIST
 # line (→ socket → server → SSE → client) PER fragment made streaming read as
 # ultra-choppy / ultra-slow (hundreds of round-trips for one answer). Hold the
-# suffix until it reaches ~a clause or hits a line break, then flush one delta.
-_DELTA_FLUSH_CHARS = 48
+# suffix briefly, then flush one delta. The flush is TIME-based (every
+# _DELTA_FLUSH_MS once a few chars are buffered) rather than waiting for a whole
+# clause: the old 48-char threshold made the answer appear in visible bursts of
+# ~10 tokens. 35 ms is below what the eye reads as chunky while still merging
+# the 2-15 char fragments a fast model emits in the same instant.
+_DELTA_FLUSH_CHARS = 48     # always flush once this much is buffered
+_DELTA_FLUSH_MIN_CHARS = 6  # time-based flush needs at least this much
+_DELTA_FLUSH_MS = 35
 
 # Sentinel returned by a turn's coroutine when the user pressed STOP.
 _CANCELLED = object()
@@ -465,6 +472,50 @@ def _emit(turn_id: str, kind: str, **fields) -> None:
         pass
 
 
+def _split_stream_blocks(content):
+    """Split a streamed message's content into (answer_text, thinking_text,
+    [(tool_id, tool_name)]).
+
+    The generic _flatten_agent_text folds thinking text AND tool_use `input`
+    values into one string. That was harmless while models only streamed text,
+    but now that the model wrappers also stream reasoning (Codex summaries) and
+    partial tool calls (Claude), flattening would leak reasoning and tool
+    arguments into the answer bubble. Typed blocks are routed by type; any other
+    shape falls back to the old flattening, so plain-text providers are
+    unchanged."""
+    from shared.runtime.events import _flatten_agent_text
+    if content is None:
+        return "", "", []
+    if isinstance(content, str):
+        return content, "", []
+    blocks = content if isinstance(content, (list, tuple)) else [content]
+    text_parts: list = []
+    think_parts: list = []
+    tools: list = []
+    for b in blocks:
+        btype = b.get("type") if isinstance(b, dict) else getattr(b, "type", None)
+        if btype == "text":
+            v = b.get("text") if isinstance(b, dict) else getattr(b, "text", "")
+            if v:
+                text_parts.append(str(v))
+        elif btype == "thinking":
+            v = b.get("thinking") if isinstance(b, dict) else getattr(b, "thinking", "")
+            if v:
+                think_parts.append(str(v))
+        elif btype == "tool_use":
+            tid = b.get("id") if isinstance(b, dict) else getattr(b, "id", "")
+            nm = b.get("name") if isinstance(b, dict) else getattr(b, "name", "")
+            if nm:
+                tools.append((str(tid or nm), str(nm)))
+        elif btype in ("image", "audio", "video", "tool_result"):
+            continue
+        else:
+            v = _flatten_agent_text(b)
+            if v:
+                text_parts.append(v)
+    return "".join(text_parts), "".join(think_parts), tools
+
+
 def _flush_delta(turn_id: str) -> None:
     """Emit any buffered pre_print suffix as one `delta` and clear the buffer.
 
@@ -475,6 +526,7 @@ def _flush_delta(turn_id: str) -> None:
     if buf and turn_id:
         _emit(turn_id, "delta", content=buf)
     _stream["deltaBuf"] = ""
+    _stream["deltaAt"] = time.monotonic()
 
 
 def _log(msg: str) -> None:
@@ -1022,7 +1074,24 @@ def _register_stream_hooks(agent) -> None:
             if msg is None:
                 return
             mid = str(getattr(msg, "id", "") or id(msg))
-            text = _flatten_agent_text(getattr(msg, "content", msg))
+            text, thinking, tool_uses = _split_stream_blocks(getattr(msg, "content", msg))
+            # Reasoning (Codex reasoning summaries, Claude thinking) streams to the
+            # thinking strip as `think`, never into the answer bubble.
+            if thinking:
+                tprev = _stream["thinkLens"].get(mid, 0)
+                if len(thinking) > tprev:
+                    _stream["thinkLens"][mid] = len(thinking)
+                    _emit(tid, "think", content=thinking[tprev:])
+            # A tool call shows its chip as soon as the model STARTS writing it
+            # (Claude streams tool arguments, which can take a while for a long
+            # file or message), not only after the tool has run. post_acting
+            # skips ids already announced here.
+            for _tid, _tname in tool_uses:
+                if _tid not in _stream["toolIds"]:
+                    _stream["toolIds"].add(_tid)
+                    if _tname.startswith("browser_"):
+                        _stream["usedBrowser"] = True
+                    _emit(tid, "tool", name=_tname)
             if not text:
                 return
             prev = _stream["lens"].get(mid, 0)
@@ -1046,7 +1115,10 @@ def _register_stream_hooks(agent) -> None:
                         _stream["deltaBuf"] = "\n\n"
                     _stream["deltaMid"] = mid
                 _stream["deltaBuf"] = _stream.get("deltaBuf", "") + suffix
-                if len(_stream["deltaBuf"]) >= _DELTA_FLUSH_CHARS or "\n" in suffix:
+                _blen = len(_stream["deltaBuf"])
+                _waited_ms = (time.monotonic() - float(_stream.get("deltaAt") or 0.0)) * 1000.0
+                if (_blen >= _DELTA_FLUSH_CHARS or "\n" in suffix
+                        or (_blen >= _DELTA_FLUSH_MIN_CHARS and _waited_ms >= _DELTA_FLUSH_MS)):
                     _flush_delta(tid)
         except Exception:
             pass
@@ -1066,6 +1138,9 @@ def _register_stream_hooks(agent) -> None:
                 tcs = [tc] if tc is not None else []
             for tc in tcs:
                 name = tc.get("name", "") if isinstance(tc, dict) else getattr(tc, "name", "")
+                _tc_id = tc.get("id", "") if isinstance(tc, dict) else getattr(tc, "id", "")
+                if name and str(_tc_id or name) in _stream.get("toolIds", set()):
+                    continue  # chip already shown while the call was streaming
                 if name:
                     # Browser action events ride the same `tool` stream (the
                     # client renders browser_* names as live action chips on the
@@ -1134,6 +1209,8 @@ def _run_turn(agent, turn_id: str, message: str, browser_turn: bool = False, ima
     _emit(turn_id, "round", n=1)
     _stream["turnId"] = turn_id
     _stream["lens"] = {}
+    _stream["thinkLens"] = {}
+    _stream["toolIds"] = set()
     _stream["deltaBuf"] = ""   # fresh turn — drop any stale streamed suffix
     _stream["deltaMid"] = ""
     _stream["cancel"] = False  # fresh turn — clear any stale STOP
@@ -1260,6 +1337,7 @@ def _stdin_reader(q: "queue.Queue[str]") -> None:
 
 
 def main() -> int:
+    global _GENERATION
     _boot_t0 = time.perf_counter()
     _log(f"booting (provider={os.environ.get('MEL_ASSISTANT_PROVIDER')})")
     # Wire OpenTelemetry → Melaya event relay so agentscope's @trace_llm actually
@@ -1306,6 +1384,20 @@ def main() -> int:
     _emit("", "ready", memoryWatermark=_memory_watermark(agent), hostInstanceId=_HOST_ID, generation=_GENERATION, configHash=_config_hash())
     _log(f"[timing] ready — {time.perf_counter() - _boot_t0:.2f}s (main start → ready). Import cost = gap from process spawn to the 'booting' line above.")
 
+    # Warm the provider's per-process caches (Claude Code User-Agent, /v1/models
+    # alias lookup) in the background, so the FIRST turn does not pay them.
+    try:
+        from shared.runtime.model import prewarm_cli_provider
+        _pw_provider = os.environ.get("MEL_ASSISTANT_PROVIDER", "")
+        if _pw_provider in ("claude_code", "codex"):
+            threading.Thread(
+                target=prewarm_cli_provider,
+                args=(_pw_provider, os.environ.get("MEL_ASSISTANT_MODEL", "")),
+                daemon=True,
+            ).start()
+    except Exception:
+        _log("provider prewarm unavailable (non-fatal)")
+
     q: "queue.Queue[str]" = queue.Queue()
     threading.Thread(target=_stdin_reader, args=(q,), daemon=True).start()
 
@@ -1326,6 +1418,20 @@ def main() -> int:
         except Exception:
             _log(f"bad stdin line (not json): {line[:120]}")
             continue
+        # Warm-pool adoption: the runner re-points a pre-booted spare to a new
+        # conversation and stamps that conversation's DB generation here, so the
+        # generation-bound `restore` below accepts its rehydrate frame. Only a
+        # spare that never ran a turn (empty memory) may be re-stamped.
+        if isinstance(req, dict) and req.get("kind") == "adopt":
+            try:
+                new_gen = int(req.get("generation") or 0)
+            except Exception:
+                new_gen = _GENERATION
+            if _memory_watermark(agent) == 0:
+                _GENERATION = new_gen
+            else:
+                _log(f"adopt ignored: host already has memory (gen stays {_GENERATION})")
+            continue
         # PR4: generation-bound rehydrate. Seed a FRESH host's memory from the
         # server snapshot (task pin + summary + recent tail) via restoreSnapshot —
         # watermark-guarded so a re-offer never double-seeds. Never memory.add().

package/dist/connection.d.ts

@@ -10,7 +10,7 @@
  *   - Heartbeat to keep the connection alive
  *   - Graceful disconnect on Ctrl+C
  */
-import type { DetectedModel } from "./detect.js";
+import { type DetectedModel } from "./detect.js";
 interface ConnectOpts {
     token: string;
     serverUrl: string;

package/dist/connection.js

@@ -25,6 +25,7 @@ import { startLocalRelay, setActiveProject } from "./localRelay.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 import { ensureSharedModules, getSharedDir } from "./sharedVendor.js";
+import { detectModels } from "./detect.js";
 import { startLumaBrowserBridge } from "./lumaBrowserBridge.js";
 // Melaya Browser (plan Sections 3/4/7): the governed browser control
 // bridge + its runner-side grant verifier and engine discovery.
@@ -76,6 +77,10 @@ let warmSpare = null;
 // the most recent real assistant_start so the spare matches the user's actual
 // usage. null until the first real boot teaches us a config.
 let warmSpareSeed = null;
+function _assistantCredHash(c) {
+    const entries = Object.entries(c || {}).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return createHash("sha256").update(JSON.stringify(entries)).digest("hex").slice(0, 16);
+}
 // PR4: sid-keyed boot reservation. The guard-then-spawn in runner:assistant_start
 // has an async gap (ensureSharedModules / ensurePythonEnv awaits) between the
 // activeAssistants.has() check and the .set(). A second assistant_start in that
@@ -177,10 +182,38 @@ export async function connect(opts) {
     // first assistant chat spawns near-instantly. No-op on a fresh runner (no
     // shared bundle on disk yet) — the real assistant_start installs it then.
     let _assistantPrewarmed = false;
+    // Resolve the installed Claude Code version ONCE per runner process and export
+    // it as MEL_CLAUDE_CODE_VERSION, which every assistant host inherits. Without
+    // it each host ran a blocking `claude --version` (slow on Windows, through a
+    // .cmd shim) on its first model call. Fixed argv, no user input.
+    const _detectClaudeCodeVersion = async () => {
+        if (process.env.MEL_CLAUDE_CODE_VERSION)
+            return;
+        const out = await new Promise((resolve) => {
+            let buf = "";
+            try {
+                const p = spawn("claude", ["--version"], { shell: process.platform === "win32", stdio: ["ignore", "pipe", "ignore"] });
+                const timer = setTimeout(() => { try {
+                    p.kill();
+                }
+                catch { /* gone */ } resolve(buf); }, 15_000);
+                p.stdout?.on("data", (d) => { buf += String(d); });
+                p.on("error", () => { clearTimeout(timer); resolve(""); });
+                p.on("close", () => { clearTimeout(timer); resolve(buf); });
+            }
+            catch {
+                resolve("");
+            }
+        });
+        const m = out.match(/\d+\.\d+\.\d+/);
+        if (m)
+            process.env.MEL_CLAUDE_CODE_VERSION = m[0];
+    };
     const _prewarmAssistantEnv = async () => {
         if (_assistantPrewarmed)
             return;
         _assistantPrewarmed = true;
+        void _detectClaudeCodeVersion();
         try {
             const { getLocalSharedVersion } = await import("./sharedVendor.js");
             let localVersion = getLocalSharedVersion();
@@ -254,6 +287,30 @@ export async function connect(opts) {
                 console.log(chalk.gray(`  [assistant prewarm] skipped: ${e?.message || e}`));
         }
     };
+    // Models were detected ONCE at startup, so a model a CLI added later (e.g.
+    // gpt-6-astra landing in ~/.codex/models_cache.json after the runner started,
+    // 2026-10-03) never reached the picker until a runner restart. Re-detect every
+    // 5 minutes and push the list when it changed. File reads only (plus the
+    // Claude model list call), no subprocess.
+    let modelRefresh = null;
+    const startModelRefresh = () => {
+        if (modelRefresh)
+            return;
+        modelRefresh = setInterval(async () => {
+            try {
+                const fresh = await detectModels();
+                if (JSON.stringify(fresh) === JSON.stringify(opts.models))
+                    return;
+                opts.models = fresh;
+                if (socket.connected)
+                    socket.emit("runner:models", fresh);
+                if (opts.verbose)
+                    console.log(chalk.gray(`  [models] refreshed: ${fresh.length} model(s)`));
+            }
+            catch { /* keep the last good list */ }
+        }, 5 * 60_000);
+        modelRefresh.unref?.();
+    };
     socket.on("connect", async () => {
         spinner.succeed(chalk.green("Connected to Melaya"));
         connectedAt = Date.now();
@@ -264,6 +321,7 @@ export async function connect(opts) {
         socketGeneration += 1;
         // Report detected models
         socket.emit("runner:models", opts.models);
+        startModelRefresh();
         // Discover installed browser engines (Chrome/Edge/Brave/bundled
         // Chromium) so the hello can advertise the browser_control capability
         // with an accurate engine + CDP report (plan Section 4). Best-effort:
@@ -1534,7 +1592,10 @@ export async function connect(opts) {
     // (claude_code/codex keep a per-user CLI/OAuth session) can contend when a
     // spare runs a turn alongside a live host — needs per-provider validation
     // before it's on for everyone. Set MEL_ASSISTANT_WARM_POOL=1 to enable.
-    const WARM_POOL_ENABLED = process.env.MEL_ASSISTANT_WARM_POOL === "1";
+    // ON by default since the providers call the HTTP APIs directly with the
+    // token read from disk (no CLI session to contend). MEL_ASSISTANT_WARM_POOL=0
+    // turns it off.
+    const WARM_POOL_ENABLED = process.env.MEL_ASSISTANT_WARM_POOL !== "0";
     let _prewarmInFlight = false;
     const schedulePrewarm = () => {
         if (!WARM_POOL_ENABLED || !warmSpareSeed || _prewarmInFlight)
@@ -1565,6 +1626,7 @@ export async function connect(opts) {
             // spare-specific id broke turn execution on adoption.
             const spareEnv = { ...seed.env };
             const spare = launchAssistantHost({ env: spareEnv, pythonPath: seed.pythonPath, workDir: wd, stagedHost: staged, sid: `__spare__:${stamp}`, generation: seed.generation, forward: false, providerLabel: "prewarm" });
+            spare.credHash = seed.credHash;
             warmSpare = spare;
             const t = setTimeout(() => { if (warmSpare === spare && !spare.forward) {
                 try {
@@ -1572,7 +1634,7 @@ export async function connect(opts) {
                 }
                 catch { /* gone */ }
                 warmSpare = null;
-            } }, 10 * 60_000);
+            } }, 30 * 60_000);
             t.unref?.();
         }
         catch (e) {
@@ -1583,6 +1645,168 @@ export async function connect(opts) {
             _prewarmInFlight = false;
         }
     };
+    // The assistant host's environment for a session (or a warm spare). Shared by
+    // runner:assistant_start and runner:assistant_prewarm so a pre-booted spare
+    // runs under exactly the env a real start would build.
+    const buildAssistantEnv = async (payload, sid, generation) => {
+        const sharedDir = getSharedDir();
+        const certBundle = (await import("./pythonEnv.js")).getCertBundlePath();
+        const sslEnv = certBundle ? { SSL_CERT_FILE: certBundle, REQUESTS_CA_BUNDLE: certBundle } : {};
+        const httpBase = opts.serverUrl.replace(/^wss:/, "https:").replace(/^ws:/, "http:");
+        const env = {
+            ...process.env,
+            PYTHONPATH: sharedDir,
+            PYTHONIOENCODING: "utf-8",
+            PYTHONUTF8: "1",
+            ...sslEnv,
+            MEL_STUDIO_URL: httpBase,
+            MELAYA_API_BASE: httpBase,
+            MELAYA_API_URL: httpBase,
+            LMSTUDIO_BASE_URL: "http://127.0.0.1:1234",
+            OLLAMA_BASE_URL: "http://127.0.0.1:11434",
+            MEL_ASSISTANT_PROVIDER: String(payload.provider || "claude_code"),
+            MEL_ASSISTANT_MODEL: String(payload.model || ""),
+            MEL_ASSISTANT_LANGUAGE: String(payload.language || "en"),
+            MEL_ASSISTANT_SURFACE: String(payload.surface || ""),
+            // Product attribution is deliberately separate from MEL_ASSISTANT_SURFACE,
+            // which controls runtime capabilities such as mobile-native phone tools.
+            MEL_ASSISTANT_TELEMETRY_SURFACE: String(payload.telemetrySurface || "assistant"),
+            // Phone toolkit unlocks when the user has a paired phone, on ANY surface
+            // (desktop drives the paired phone remotely). The host ORs this with the
+            // mobile-native surface check. Empty ⇒ not paired ⇒ no phone tools.
+            MEL_ASSISTANT_PHONE_READY: payload.phoneReady ? "1" : "",
+            // Melaya Browser (plan 0.4): the CAPABILITY flag. Presence means the
+            // runner advertises browser control and the browser toolkit should be
+            // included in the host's toolkit. The TARGET GRANT is NEVER in the boot
+            // env; it arrives per-turn on the turn frame and is purged at turn end.
+            // This is part of the config hash so the host reboots if capability
+            // presence changes (a runner that gains/loses browser control restarts
+            // the host automatically via config-drift detection above). MUST follow
+            // payload.browserCapable, not a hardcoded "1": the host's _config_hash
+            // appends "browser" only when this is set, and the server's hash does the
+            // same only when cfg.browserCapable is true. Hardcoding "1" made the host
+            // always hash "browser" while a non-browser server hash omitted it, which
+            // pinned every turn to a permanent runner_host_config_stale.
+            MEL_ASSISTANT_BROWSER_CAPABLE: payload.browserCapable ? "1" : "",
+            // Connector tool sets the user enabled for this chat (comma-joined service
+            // ids). The host seeds a lazy toolkit from these so ANY connector's tools
+            // are reachable without exploding context.
+            MEL_ASSISTANT_CONNECTORS: Array.isArray(payload.connectors) ? payload.connectors.join(",") : "",
+            // Surgical tool pinning: exact connector tool NAMES (not just service ids)
+            // the server already resolved creds for. The host registers these ACTIVE
+            // at boot instead of dumping them into the deferred pool, eliminating the
+            // search_tools -> activate_tool round-trip for known marketing tools.
+            // Byte-for-byte source of truth for _config_hash's pinned-tools field.
+            MEL_ASSISTANT_PINNED_TOOLS: payload.pinnedTools?.join(",") ?? "",
+            // Gate write connector-tools behind the in-chat approval card (fail-safe).
+            MEL_ASSISTANT_CONNECTOR_HITL: Array.isArray(payload.connectors) && payload.connectors.length ? "1" : "",
+            // HITL autonomy mode ("safe" | "autonomous" | "payments_only"). The host
+            // reads this at start; each turn's frame can flip it (see assistant_turn).
+            // Fail-safe: unknown ⇒ "safe".
+            MEL_ASSISTANT_HITL_MODE: (payload.hitlMode === "autonomous" || payload.hitlMode === "payments_only") ? payload.hitlMode : "safe",
+            // PR4: the DB-authoritative generation this host boots under. The host
+            // echoes it in `ready` and stamps events; an older boot self-terminates
+            // on a generation mismatch.
+            MEL_ASSISTANT_GENERATION: String(generation),
+            // Run context for phone-driving assistant turns. The assistant host has
+            // no pipeline MEL_RUN_ID, so without this phone.py._cmd omits `run_id`,
+            // the server's arm block (phone.ts, `if (runId)`) never fires, and the
+            // device never receives `hitlMode` — Autonomous still shows publish
+            // cards on the runner-assistant surface. Use the SAME stable
+            // `assistant:{userId}` runId the cloud assistant path uses (sid is
+            // `userId:conversationId`) so the arm / kill / active-run plumbing stays
+            // consistent across surfaces. assistantHost mirrors MEL_ASSISTANT_HITL_MODE
+            // → MEL_HITL_MODE so phone.py stamps the mode on the command body.
+            MEL_RUN_ID: `assistant:${sid.split(":")[0]}`,
+            // Span tracing → agents.spans. tracing_exporter.MelayaSpanExporter only
+            // exports when BOTH MEL_RUN_ID and MEL_BUILDER_URL are present (it POSTs
+            // batches through this same local relay the pipeline spawns use, lines
+            // ~463/853). The assistant host was missing these two, so — even with
+            // @trace_llm wired — every claude_code/codex assistant turn recorded ZERO
+            // token spans. Spans land under conversation_id = MEL_RUN_ID
+            // (`assistant:<userId>`); the server trigger resolves user_id from it.
+            MEL_BUILDER_URL: `http://127.0.0.1:${relay.port}`,
+            MEL_RELAY_NONCE: relay.nonce,
+            MEL_PIPELINE_NAME: "Melaya · Assistant",
+            // Luma browser bridge (same injection as pipeline runs, line ~431): lets
+            // shared/tools/luma.py route /event/register through Playwright and bypass
+            // Cloudflare's write rule. Reads keep using aiohttp. Empty when no signed-in
+            // Luma session exists (bridge not started) — reads still work, writes 403.
+            ...(lumaBridge
+                ? { MEL_LUMA_BROWSER_URL: lumaBridge.url, MEL_LUMA_BROWSER_TOKEN: lumaBridge.token }
+                : {}),
+            // Per-user creds (incl. MELAYA_API_KEY + the selected connectors' env).
+            ...(payload.credentials || {}),
+            // laya-local (decide_* built-in tools, always-on core): the runner can't
+            // see the box's private 127.0.0.1:8770, so point LAYA_LOCAL_URL at the
+            // server's PER-USER-gated proxy. AFTER creds so it can't be overridden.
+            // The proxy authenticates with this user's MELAYA_API_KEY (in the
+            // projected creds) - never a shared secret - and meters per user.
+            LAYA_LOCAL_URL: httpBase.replace(/\/$/, "") + "/api/v1/internal/laya",
+        };
+        return env;
+    };
+    // A warm spare whose shared bundle was replaced underneath it would lazily
+    // import NEW modules into OLD code; drop it when the bundle on disk changes.
+    let _spareBundle = "";
+    const _dropSpareOnOlderBundle = () => {
+        void import("./sharedVendor.js").then(({ getLocalSharedVersion }) => {
+            const v = getLocalSharedVersion() || "";
+            if (_spareBundle && v && v !== _spareBundle && warmSpare && !warmSpare.forward) {
+                try {
+                    warmSpare.proc.kill();
+                }
+                catch { /* gone */ }
+                warmSpare = null;
+            }
+            _spareBundle = v;
+        }).catch(() => { });
+    };
+    // Server push: download a new shared bundle in the background (after an
+    // agents deploy, and on connect) so the next chat does not pay for it.
+    socket.on("runner:prefetch_bundle", (p) => {
+        const v = String(p?.sharedVersion || "");
+        if (!v)
+            return;
+        void ensureSharedModules(opts.serverUrl, v, opts.token)
+            .then(() => { _dropSpareOnOlderBundle(); if (opts.verbose)
+            console.log(chalk.gray(`  [assistant] shared bundle ${v} prefetched`)); })
+            .catch((e) => { if (opts.verbose)
+            console.log(chalk.gray(`  [assistant] bundle prefetch failed: ${e?.message || e}`)); });
+    });
+    // Server push on connect: pre-boot a warm spare for the user's LAST assistant
+    // config, so even the first chat after a runner (re)start adopts a ready host.
+    // Builds the exact env a real start would; adoption still requires the same
+    // config and credentials, so a stale spare is simply never used.
+    socket.on("runner:assistant_prewarm", async (payload) => {
+        if (!WARM_POOL_ENABLED || warmSpare || _prewarmInFlight)
+            return;
+        if (!payload?.userId || !payload?.configHash)
+            return;
+        try {
+            const sharedVersion = String(payload.sharedVersion ?? "latest");
+            await ensureSharedModules(opts.serverUrl, sharedVersion, opts.token);
+            _dropSpareOnOlderBundle();
+            const { ensurePythonEnv } = await import("./pythonEnv.js");
+            const envResult = await ensurePythonEnv(opts.pythonPath, sharedVersion, (m) => { if (opts.verbose)
+                console.log(chalk.gray(`  [assistant prewarm] ${m}`)); });
+            if (!envResult.ok)
+                return;
+            const hostCandidates = [join(__dirname, "assistantHost.py"), join(__dirname, "..", "assistantHost.py")];
+            const hostScript = hostCandidates.find((c) => existsSync(c)) || "";
+            if (!hostScript)
+                return;
+            const env = await buildAssistantEnv({ ...payload, sessionId: `${payload.userId}:__prewarm__` }, `${payload.userId}:__prewarm__`, 0);
+            warmSpareSeed = { env, configHash: String(payload.configHash), generation: 0, pythonPath: envResult.pythonPath, workDirBase: tmpdir(), hostScript, credHash: _assistantCredHash(payload.credentials) };
+            schedulePrewarm();
+            if (opts.verbose)
+                console.log(chalk.gray(`  [assistant] warm host pre-booting (${payload.provider})`));
+        }
+        catch (e) {
+            if (opts.verbose)
+                console.log(chalk.gray(`  [assistant] prewarm skipped: ${e?.message || e}`));
+        }
+    });
     socket.on("runner:assistant_start", async (payload) => {
         const sid = String(payload.sessionId || "");
         if (!sid)
@@ -1623,11 +1847,22 @@ export async function connect(opts) {
         // immediately, skipping the ~7s cold boot (import + build_agent). Fail-safe:
         // exact match of a READY, un-killed spare ONLY; anything else falls straight
         // through to the fresh-boot path below, so the pool can never break a session.
+        // The spare must have the same config AND the same credentials, and must
+        // never have run a turn (empty memory). Its generation is re-stamped to this
+        // conversation's via an `adopt` frame, so a restored conversation's
+        // generation-bound rehydrate still applies (the old exact-generation match
+        // meant a spare could almost never be adopted).
         if (!activeAssistants.has(sid) && !bootingAssistants.has(sid)
             && warmSpare && warmSpare.ready && !warmSpare.killed && expectedConfig
-            && warmSpare.configHash === expectedConfig && warmSpare.generation === generation) {
+            && warmSpare.configHash === expectedConfig && (warmSpare.memoryWatermark || 0) === 0
+            && warmSpare.credHash === _assistantCredHash(payload.credentials)) {
             const spare = warmSpare;
             warmSpare = null;
+            try {
+                spare.proc.stdin?.write(JSON.stringify({ kind: "adopt", generation }) + "\n");
+            }
+            catch { /* host gone: falls to session_closed */ }
+            spare.generation = generation;
             spare.sid = sid;
             spare.forward = true;
             spare.lastActivity = Date.now();
@@ -1645,6 +1880,7 @@ export async function connect(opts) {
         try {
             const sharedVersion = String(payload.sharedVersion ?? "latest");
             await ensureSharedModules(opts.serverUrl, sharedVersion, opts.token);
+            _dropSpareOnOlderBundle();
             const { ensurePythonEnv } = await import("./pythonEnv.js");
             const envResult = await ensurePythonEnv(opts.pythonPath, sharedVersion, (m) => { if (opts.verbose)
                 console.log(chalk.gray(`  [assistant venv] ${m}`)); });
@@ -1674,101 +1910,7 @@ export async function connect(opts) {
             if (Array.isArray(payload.connectors) && payload.connectors.includes("luma")) {
                 await _ensureLumaBridge();
             }
-            const sharedDir = getSharedDir();
-            const certBundle = (await import("./pythonEnv.js")).getCertBundlePath();
-            const sslEnv = certBundle ? { SSL_CERT_FILE: certBundle, REQUESTS_CA_BUNDLE: certBundle } : {};
-            const httpBase = opts.serverUrl.replace(/^wss:/, "https:").replace(/^ws:/, "http:");
-            const env = {
-                ...process.env,
-                PYTHONPATH: sharedDir,
-                PYTHONIOENCODING: "utf-8",
-                PYTHONUTF8: "1",
-                ...sslEnv,
-                MEL_STUDIO_URL: httpBase,
-                MELAYA_API_BASE: httpBase,
-                MELAYA_API_URL: httpBase,
-                LMSTUDIO_BASE_URL: "http://127.0.0.1:1234",
-                OLLAMA_BASE_URL: "http://127.0.0.1:11434",
-                MEL_ASSISTANT_PROVIDER: String(payload.provider || "claude_code"),
-                MEL_ASSISTANT_MODEL: String(payload.model || ""),
-                MEL_ASSISTANT_LANGUAGE: String(payload.language || "en"),
-                MEL_ASSISTANT_SURFACE: String(payload.surface || ""),
-                // Product attribution is deliberately separate from MEL_ASSISTANT_SURFACE,
-                // which controls runtime capabilities such as mobile-native phone tools.
-                MEL_ASSISTANT_TELEMETRY_SURFACE: String(payload.telemetrySurface || "assistant"),
-                // Phone toolkit unlocks when the user has a paired phone, on ANY surface
-                // (desktop drives the paired phone remotely). The host ORs this with the
-                // mobile-native surface check. Empty ⇒ not paired ⇒ no phone tools.
-                MEL_ASSISTANT_PHONE_READY: payload.phoneReady ? "1" : "",
-                // Melaya Browser (plan 0.4): the CAPABILITY flag. Presence means the
-                // runner advertises browser control and the browser toolkit should be
-                // included in the host's toolkit. The TARGET GRANT is NEVER in the boot
-                // env; it arrives per-turn on the turn frame and is purged at turn end.
-                // This is part of the config hash so the host reboots if capability
-                // presence changes (a runner that gains/loses browser control restarts
-                // the host automatically via config-drift detection above). MUST follow
-                // payload.browserCapable, not a hardcoded "1": the host's _config_hash
-                // appends "browser" only when this is set, and the server's hash does the
-                // same only when cfg.browserCapable is true. Hardcoding "1" made the host
-                // always hash "browser" while a non-browser server hash omitted it, which
-                // pinned every turn to a permanent runner_host_config_stale.
-                MEL_ASSISTANT_BROWSER_CAPABLE: payload.browserCapable ? "1" : "",
-                // Connector tool sets the user enabled for this chat (comma-joined service
-                // ids). The host seeds a lazy toolkit from these so ANY connector's tools
-                // are reachable without exploding context.
-                MEL_ASSISTANT_CONNECTORS: Array.isArray(payload.connectors) ? payload.connectors.join(",") : "",
-                // Surgical tool pinning: exact connector tool NAMES (not just service ids)
-                // the server already resolved creds for. The host registers these ACTIVE
-                // at boot instead of dumping them into the deferred pool, eliminating the
-                // search_tools -> activate_tool round-trip for known marketing tools.
-                // Byte-for-byte source of truth for _config_hash's pinned-tools field.
-                MEL_ASSISTANT_PINNED_TOOLS: payload.pinnedTools?.join(",") ?? "",
-                // Gate write connector-tools behind the in-chat approval card (fail-safe).
-                MEL_ASSISTANT_CONNECTOR_HITL: Array.isArray(payload.connectors) && payload.connectors.length ? "1" : "",
-                // HITL autonomy mode ("safe" | "autonomous" | "payments_only"). The host
-                // reads this at start; each turn's frame can flip it (see assistant_turn).
-                // Fail-safe: unknown ⇒ "safe".
-                MEL_ASSISTANT_HITL_MODE: (payload.hitlMode === "autonomous" || payload.hitlMode === "payments_only") ? payload.hitlMode : "safe",
-                // PR4: the DB-authoritative generation this host boots under. The host
-                // echoes it in `ready` and stamps events; an older boot self-terminates
-                // on a generation mismatch.
-                MEL_ASSISTANT_GENERATION: String(generation),
-                // Run context for phone-driving assistant turns. The assistant host has
-                // no pipeline MEL_RUN_ID, so without this phone.py._cmd omits `run_id`,
-                // the server's arm block (phone.ts, `if (runId)`) never fires, and the
-                // device never receives `hitlMode` — Autonomous still shows publish
-                // cards on the runner-assistant surface. Use the SAME stable
-                // `assistant:{userId}` runId the cloud assistant path uses (sid is
-                // `userId:conversationId`) so the arm / kill / active-run plumbing stays
-                // consistent across surfaces. assistantHost mirrors MEL_ASSISTANT_HITL_MODE
-                // → MEL_HITL_MODE so phone.py stamps the mode on the command body.
-                MEL_RUN_ID: `assistant:${sid.split(":")[0]}`,
-                // Span tracing → agents.spans. tracing_exporter.MelayaSpanExporter only
-                // exports when BOTH MEL_RUN_ID and MEL_BUILDER_URL are present (it POSTs
-                // batches through this same local relay the pipeline spawns use, lines
-                // ~463/853). The assistant host was missing these two, so — even with
-                // @trace_llm wired — every claude_code/codex assistant turn recorded ZERO
-                // token spans. Spans land under conversation_id = MEL_RUN_ID
-                // (`assistant:<userId>`); the server trigger resolves user_id from it.
-                MEL_BUILDER_URL: `http://127.0.0.1:${relay.port}`,
-                MEL_RELAY_NONCE: relay.nonce,
-                MEL_PIPELINE_NAME: "Melaya · Assistant",
-                // Luma browser bridge (same injection as pipeline runs, line ~431): lets
-                // shared/tools/luma.py route /event/register through Playwright and bypass
-                // Cloudflare's write rule. Reads keep using aiohttp. Empty when no signed-in
-                // Luma session exists (bridge not started) — reads still work, writes 403.
-                ...(lumaBridge
-                    ? { MEL_LUMA_BROWSER_URL: lumaBridge.url, MEL_LUMA_BROWSER_TOKEN: lumaBridge.token }
-                    : {}),
-                // Per-user creds (incl. MELAYA_API_KEY + the selected connectors' env).
-                ...(payload.credentials || {}),
-                // laya-local (decide_* built-in tools, always-on core): the runner can't
-                // see the box's private 127.0.0.1:8770, so point LAYA_LOCAL_URL at the
-                // server's PER-USER-gated proxy. AFTER creds so it can't be overridden.
-                // The proxy authenticates with this user's MELAYA_API_KEY (in the
-                // projected creds) - never a shared secret - and meters per user.
-                LAYA_LOCAL_URL: httpBase.replace(/\/$/, "") + "/api/v1/internal/laya",
-            };
+            const env = await buildAssistantEnv(payload, sid, generation);
             const session = launchAssistantHost({
                 env, pythonPath: envResult.pythonPath, workDir, stagedHost,
                 sid, generation, forward: true, providerLabel: String(payload.provider || ""),
@@ -1777,7 +1919,7 @@ export async function connect(opts) {
             // Teach the pool this exact (env, config, generation) so it prewarms a
             // matching spare for the NEXT new session — which then adopts it and skips
             // the cold boot (see the ADOPTION fast path + schedulePrewarm above).
-            warmSpareSeed = { env, configHash: expectedConfig, generation, pythonPath: envResult.pythonPath, workDirBase: tmpdir(), hostScript };
+            warmSpareSeed = { env, configHash: expectedConfig, generation, pythonPath: envResult.pythonPath, workDirBase: tmpdir(), hostScript, credHash: _assistantCredHash(payload.credentials) };
             schedulePrewarm();
         }
         catch (e) {

package/dist/detect.js

@@ -32,7 +32,7 @@ async function fetchClaudeFamilies(token) {
                 "anthropic-version": "2023-06-01",
                 "anthropic-beta": "oauth-2025-04-20",
                 "x-app": "cli",
-                "User-Agent": "claude-code/2.1.81",
+                "User-Agent": `claude-code/${process.env.MEL_CLAUDE_CODE_VERSION || "2.1.280"}`,
             },
             signal: AbortSignal.timeout(6000),
         });

package/dist/localDbProbe.py

@@ -205,13 +205,20 @@ def probe_snowflake(creds):
 
 
 # ── Databricks (PAT or OAuth M2M, mirrors the server handler) ────────────────
-def probe_databricks(creds):
-    host = _pick(creds, "workspace_url", "DATABRICKS_HOST").rstrip("/")
+def probe_databricks(creds):
+    import re
+    from urllib.parse import urlsplit
+    host = _pick(creds, "workspace_url", "DATABRICKS_HOST").rstrip("/")
     pat = _pick(creds, "token", "DATABRICKS_TOKEN")
     cid = _pick(creds, "client_id", "DATABRICKS_CLIENT_ID")
     sec = _pick(creds, "client_secret", "DATABRICKS_CLIENT_SECRET")
-    if not host:
-        _out(False, "Workspace URL required")
+    if not host:
+        _out(False, "Workspace URL required")
+    url = urlsplit(host)
+    if (url.scheme != "https" or url.username or url.password or url.port or url.path or url.query or url.fragment
+        or not re.fullmatch(r"(?!accounts(?:\.|-))[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:cloud\.databricks\.com|azuredatabricks\.net|gcp\.databricks\.com)", url.hostname or "")):
+        _out(False, "Use an HTTPS Databricks workspace URL without a path or query")
+    telemetry = {"User-Agent": "MelayaLabs_Melaya/2.0.0"}
     try:
         import requests  # type: ignore
     except ImportError:
@@ -224,7 +231,8 @@ def probe_databricks(creds):
             tr = requests.post(
                 f"{host}/oidc/v1/token",
                 auth=(cid, sec),
-                data={"grant_type": "client_credentials", "scope": "all-apis"},
+                data={"grant_type": "client_credentials", "scope": "all-apis"},
+                headers=telemetry, allow_redirects=False,
                 timeout=12,
             )
             tj = {}
@@ -232,15 +240,15 @@ def probe_databricks(creds):
                 tj = tr.json()
             except Exception:  # noqa: BLE001
                 pass
-            if not tr.ok or not tj.get("access_token"):
-                _out(False, f"Databricks OAuth failed: {tj.get('error_description') or tj.get('error') or ('HTTP ' + str(tr.status_code))}")
+            if tr.status_code != 200 or not tj.get("access_token"):
+                _out(False, f"Databricks OAuth failed: HTTP {tr.status_code}")
             bearer = tj["access_token"]
         r = requests.get(
             f"{host}/api/2.1/clusters/list?page_size=1",
-            headers={"Authorization": f"Bearer {bearer}"},
+            headers={"Authorization": f"Bearer {bearer}", **telemetry}, allow_redirects=False,
             timeout=12,
         )
-        if r.ok:
+        if r.status_code == 200:
             _out(True, f"Connected to Databricks ({host.replace('https://', '').replace('http://', '')})")
         _out(False, f"Databricks unreachable: HTTP {r.status_code} {r.text[:120]}")
     except Exception as e:  # noqa: BLE001

package/dist/pythonEnv.js

@@ -193,6 +193,10 @@ const PIP_DEPS = [
     // "pandas is not installed". Numpy is already in PIP_DEPS (line 57) so
     // the wheel install is fast.
     "pandas",
+    // matplotlib — branded chart PNGs rendered locally by msoffice.chart_image
+    // and the word_create `chart` block (no third-party chart API for client
+    // data). Mirrors the cloud image lock (matplotlib 3.10.8 + closure).
+    "matplotlib",
     // certifi — provides the CA root bundle that tools like gmail_send /
     // any other HTTPS API rely on for cert verification. On macOS Python
     // 3.x doesn't read the system keychain by default; without certifi +
@@ -341,18 +345,19 @@ async function _resolveAndCacheCertBundle(onProgress) {
         onProgress("(warn: certifi.where() did not resolve a valid path — HTTPS calls may fail with cert verify errors)");
     }
 }
-// The marker is keyed on sharedVersion + a hash of PIP_DEPS so changes
-// to either invalidate the venv. Without the PIP_DEPS half, a runner
-// update that adds a dep (e.g. scrapling[fetchers] in 1.0.32) would
-// silently skip the reinstall on any box whose sharedVersion hadn't
-// also changed — operators would update the runner but never see the
-// new deps. Hashing the full deps list catches additions, removals,
-// AND version-pin changes within deps.
+// The marker is keyed on a hash of PIP_DEPS only: additions, removals and
+// version-pin changes (e.g. scrapling[fetchers] in 1.0.32) invalidate the venv.
+// It used to also include sharedVersion, a hash of every shared .py file, so
+// EVERY agents deploy forced the full rebuild (pip upgrade, 67-dep install,
+// scrapling browsers, nltk, certs: 1-2 min on the first assistant turn) even
+// though the venv holds no shared code (the bundle is read from its own cache
+// dir) and the dep list had not changed. The `_expectedVersion` parameter is
+// kept so callers stay unchanged.
 function _pipDepsHash() {
     return createHash("sha256").update(JSON.stringify(PIP_DEPS)).digest("hex").slice(0, 12);
 }
-function venvMarkerValue(expectedVersion) {
-    return `${expectedVersion}::${_pipDepsHash()}`;
+function venvMarkerValue(_expectedVersion) {
+    return `deps::${_pipDepsHash()}`;
 }
 function venvIsValid(expectedVersion) {
     if (!existsSync(venvPython()))

package/dist/sharedVendor.js

@@ -51,7 +51,21 @@ const CANARY_FILES = [
 function cacheLooksValid() {
     return CANARY_FILES.every((p) => existsSync(p));
 }
-export async function ensureSharedModules(serverUrl, expectedVersion, runnerToken) {
+// Single-flight per version: the server now also pushes `runner:prefetch_bundle`
+// after a deploy and on connect, so a background prefetch can overlap a real
+// assistant/pipeline start. Two concurrent downloads would write the same cache
+// dir at once; callers for the same version share one download instead.
+const _sharedInFlight = new Map();
+export function ensureSharedModules(serverUrl, expectedVersion, runnerToken) {
+    const existing = _sharedInFlight.get(expectedVersion);
+    if (existing)
+        return existing;
+    const p = _ensureSharedModulesImpl(serverUrl, expectedVersion, runnerToken)
+        .finally(() => { _sharedInFlight.delete(expectedVersion); });
+    _sharedInFlight.set(expectedVersion, p);
+    return p;
+}
+async function _ensureSharedModulesImpl(serverUrl, expectedVersion, runnerToken) {
     mkdirSync(CACHE_DIR, { recursive: true });
     // Check cached version. We require BOTH a version match AND a valid nested
     // layout — older runner versions wrote flat filenames into shared/, and

package/localDbProbe.py

@@ -205,13 +205,20 @@ def probe_snowflake(creds):
 
 
 # ── Databricks (PAT or OAuth M2M, mirrors the server handler) ────────────────
-def probe_databricks(creds):
-    host = _pick(creds, "workspace_url", "DATABRICKS_HOST").rstrip("/")
+def probe_databricks(creds):
+    import re
+    from urllib.parse import urlsplit
+    host = _pick(creds, "workspace_url", "DATABRICKS_HOST").rstrip("/")
     pat = _pick(creds, "token", "DATABRICKS_TOKEN")
     cid = _pick(creds, "client_id", "DATABRICKS_CLIENT_ID")
     sec = _pick(creds, "client_secret", "DATABRICKS_CLIENT_SECRET")
-    if not host:
-        _out(False, "Workspace URL required")
+    if not host:
+        _out(False, "Workspace URL required")
+    url = urlsplit(host)
+    if (url.scheme != "https" or url.username or url.password or url.port or url.path or url.query or url.fragment
+        or not re.fullmatch(r"(?!accounts(?:\.|-))[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:cloud\.databricks\.com|azuredatabricks\.net|gcp\.databricks\.com)", url.hostname or "")):
+        _out(False, "Use an HTTPS Databricks workspace URL without a path or query")
+    telemetry = {"User-Agent": "MelayaLabs_Melaya/2.0.0"}
     try:
         import requests  # type: ignore
     except ImportError:
@@ -224,7 +231,8 @@ def probe_databricks(creds):
             tr = requests.post(
                 f"{host}/oidc/v1/token",
                 auth=(cid, sec),
-                data={"grant_type": "client_credentials", "scope": "all-apis"},
+                data={"grant_type": "client_credentials", "scope": "all-apis"},
+                headers=telemetry, allow_redirects=False,
                 timeout=12,
             )
             tj = {}
@@ -232,15 +240,15 @@ def probe_databricks(creds):
                 tj = tr.json()
             except Exception:  # noqa: BLE001
                 pass
-            if not tr.ok or not tj.get("access_token"):
-                _out(False, f"Databricks OAuth failed: {tj.get('error_description') or tj.get('error') or ('HTTP ' + str(tr.status_code))}")
+            if tr.status_code != 200 or not tj.get("access_token"):
+                _out(False, f"Databricks OAuth failed: HTTP {tr.status_code}")
             bearer = tj["access_token"]
         r = requests.get(
             f"{host}/api/2.1/clusters/list?page_size=1",
-            headers={"Authorization": f"Bearer {bearer}"},
+            headers={"Authorization": f"Bearer {bearer}", **telemetry}, allow_redirects=False,
             timeout=12,
         )
-        if r.ok:
+        if r.status_code == 200:
             _out(True, f"Connected to Databricks ({host.replace('https://', '').replace('http://', '')})")
         _out(False, f"Databricks unreachable: HTTP {r.status_code} {r.text[:120]}")
     except Exception as e:  # noqa: BLE001

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.56",
+  "version": "1.1.59",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "Apache-2.0",
   "author": "Melaya Labs LLC",