@melaya/runner 1.1.59 → 1.1.61

package/dist/assistantHost.py

@@ -172,10 +172,22 @@ def _config_hash() -> str:
         fields.append(pinned_tools)
     if os.environ.get("MEL_ASSISTANT_TELEMETRY_SURFACE") == "marketing":
         fields.append("marketing-scoped-tools-v1")
+    # Per-turn connectors (assistant protocol 3): the connectors field above is
+    # empty (MEL_ASSISTANT_CONNECTORS is not set at boot) and this marker comes
+    # LAST, byte-for-byte like runnerAssistantRelay.ts assistantConfigHash. A
+    # connector change is then never a config change: no reboot.
+    if _turn_connectors_mode():
+        fields.append("turn-connectors-v1")
     canon = "|".join(fields)
     return hashlib.sha256(canon.encode("utf-8")).hexdigest()[:32]
 
 
+def _turn_connectors_mode() -> bool:
+    """Assistant protocol 3: the chat's connectors arrive on every turn frame
+    (and mid-turn updates), not in the boot env. Set by the runner spawn env."""
+    return (os.environ.get("MEL_ASSISTANT_TURN_CONNECTORS", "") or "") == "1"
+
+
 def _browser_capable() -> bool:
     """Browser CAPABILITY presence for this host (plan 0.4): set by the runner
     spawn env when the paired runner advertises browser control. Capability
@@ -368,6 +380,189 @@ def _purge_browser_turn_grant() -> None:
         os.environ.pop(k, None)
 
 
+# ── Per-turn connectors (assistant protocol 3) ───────────────────────────────
+# The chat's connector selection is a PER-TURN parameter, like hitl_mode: the
+# turn frame carries {"connectors": [registry categories], "connector_env":
+# {service: {ENV: value}}}. Before the turn, the selection becomes the lazy
+# registry's searchable connector scope (set_lazy_connectors: deselected
+# services' tools leave the pool AND the toolkit) and the env is installed for
+# the turn. The env is PURGED at turn end (like the browser grant): between
+# turns the warm host keeps only the selection (service ids, no secret). A
+# mid-turn update (runner:assistant_turn_update, or a connector turned on by
+# melaya_agent_request_connector_enable) goes through the same functions, under
+# a lock, so the NEXT tool call of the running turn sees it.
+#
+# Never written here: the host's own identity / transport env. A connector env
+# key that collides with a boot env value is restored to that value on purge.
+_RESERVED_ENV = frozenset({
+    "MELAYA_API_KEY", "MELAYA_API_BASE", "MELAYA_API_URL", "_MEL_USER_ID", "PATH",
+    "PYTHONPATH", "PYTHONHOME", "PYTHONIOENCODING", "PYTHONUTF8", "SSL_CERT_FILE",
+    "REQUESTS_CA_BUNDLE", "LAYA_LOCAL_URL", "LMSTUDIO_BASE_URL", "OLLAMA_BASE_URL",
+})
+_ALLOWED_MEL_ENV = frozenset({"MEL_LUMA_BROWSER_URL", "MEL_LUMA_BROWSER_TOKEN"})
+_LIVE = {
+    "lock": threading.RLock(),
+    "toolkit": None,          # the lazy toolkit (set_lazy_connectors target)
+    "connectors": [],         # current selection (registry categories)
+    "envKeys": set(),         # connector env keys installed for this turn
+    "envOrig": {},            # key -> boot value (None = absent) to restore
+    "agent": None, "basePrompt": "", "staticContext": None,  # mid-turn prompt refresh
+}
+
+
+def _connector_env_key_ok(k: str) -> bool:
+    if not k or not isinstance(k, str) or k in _RESERVED_ENV:
+        return False
+    if k.startswith("MEL_") or k.startswith("MELAYA_"):
+        return k in _ALLOWED_MEL_ENV
+    return True
+
+
+def _install_connector_env(env_by_service, replace: bool) -> None:
+    """Install connector env for the turn. replace=True drops keys no longer
+    provided (a deselected service); False only adds (one service turned on)."""
+    new: dict = {}
+    if isinstance(env_by_service, dict):
+        for _svc, kv in env_by_service.items():
+            if isinstance(kv, dict):
+                for k, v in kv.items():
+                    if isinstance(v, str) and _connector_env_key_ok(str(k)):
+                        new[str(k)] = v
+    with _LIVE["lock"]:
+        keys: set = _LIVE["envKeys"]
+        orig: dict = _LIVE["envOrig"]
+        if replace:
+            for k in list(keys - set(new)):
+                _restore_env_key(k)
+                keys.discard(k)
+        for k, v in new.items():
+            if k not in orig:
+                orig[k] = os.environ.get(k)
+            os.environ[k] = v
+            keys.add(k)
+
+
+def _restore_env_key(k: str) -> None:
+    orig = _LIVE["envOrig"].pop(k, None)
+    if orig is None:
+        os.environ.pop(k, None)
+    else:
+        os.environ[k] = orig
+
+
+def _purge_connector_env() -> None:
+    """Turn end: remove every connector credential from the warm host env."""
+    with _LIVE["lock"]:
+        for k in list(_LIVE["envKeys"]):
+            _restore_env_key(k)
+        _LIVE["envKeys"] = set()
+
+
+def _apply_turn_connectors(services, env_by_service, add_only: bool = False) -> bool:
+    """Make `services` the connector scope (add_only: add to it) and install
+    their env. Arms the write-approval gate while any connector is selected
+    (lazy_registry decides at call time in this mode). Returns True on success."""
+    svcs = [str(x).strip().lower() for x in (services or []) if isinstance(x, str) and str(x).strip()]
+    with _LIVE["lock"]:
+        toolkit = _LIVE.get("toolkit")
+        try:
+            from shared.orchestration.lazy_registry import set_lazy_connectors
+            res = set_lazy_connectors(toolkit, svcs, add_only=add_only) if toolkit is not None else {"ok": False}
+        except Exception as exc:
+            _log(f"connector scope update failed: {type(exc).__name__}")
+            res = {"ok": False}
+        current = sorted(set(_LIVE["connectors"]) | set(svcs)) if add_only else sorted(set(svcs))
+        _LIVE["connectors"] = current
+        _install_connector_env(env_by_service, replace=not add_only)
+        if current:
+            os.environ["MEL_ASSISTANT_CONNECTOR_HITL"] = "1"
+        else:
+            os.environ.pop("MEL_ASSISTANT_CONNECTOR_HITL", None)
+        if res.get("added") or res.get("removed"):
+            # Service ids only, never env.
+            _log(f"connectors updated (+{','.join(res.get('added') or []) or '-'} -{','.join(res.get('removed') or []) or '-'})")
+        return bool(res.get("ok"))
+
+
+def _apply_live_connector_activation(services, env_by_service) -> bool:
+    """Applier registered with shared.runtime.assistant_live: a connector turned
+    on mid-turn (melaya_agent_request_connector_enable). Adds to the scope."""
+    if not _turn_connectors_mode() or not _stream.get("turnId"):
+        return False
+    ok = _apply_turn_connectors(services, env_by_service, add_only=True)
+    _refresh_live_prompt()
+    return ok
+
+
+def _refresh_live_prompt() -> None:
+    """Re-render the running turn's system prompt (autonomy + connectors) after a
+    mid-turn change; agentscope rebuilds the system message from it each step."""
+    agent = _LIVE.get("agent")
+    if agent is not None:
+        _apply_static_context(agent, _LIVE.get("basePrompt") or "", _LIVE.get("staticContext"))
+
+
+def _apply_turn_update(req) -> None:
+    """runner:assistant_turn_update, on the stdin-reader thread WHILE the turn
+    runs: the user changed the autonomy mode and/or the connectors mid-reply.
+    Applies only to the turn in flight; the next tool call reads it. A pending
+    approval already polling is not affected (the gate decides at call start)."""
+    tid = str(req.get("turnId") or "")
+    if not tid or tid != _stream.get("turnId"):
+        return
+    changed = False
+    if "hitl_mode" in req:
+        _apply_hitl_mode(req.get("hitl_mode"))
+        _log(f"autonomy changed mid-turn -> {os.environ.get('MEL_ASSISTANT_HITL_MODE')}")
+        changed = True
+    if _turn_connectors_mode() and isinstance(req.get("connectors"), list):
+        _apply_turn_connectors(req.get("connectors"), req.get("connector_env") or {})
+        changed = True
+    if changed:
+        _refresh_live_prompt()
+
+
+def _connector_rule(connector_services, pinned_tool_names) -> str:
+    """Prompt rules for the selected connectors (or the pinned tool set)."""
+    if pinned_tool_names:
+        return (
+            "- These tools are loaded and directly callable: " + ", ".join(pinned_tool_names) + ". "
+            "Call them directly; do NOT call search_tools/activate_tool for any of them.\n"
+            "- Aggregations (top-N, group-by, totals, a chart) usually have NO dedicated tool: "
+            "call the connector's GENERIC list/query tool, read the rows, and compute the "
+            "aggregation yourself. Never invent data - read it from the connector.\n"
+        )
+    if not connector_services:
+        return ""
+    return (
+        "- ACTIVE CONNECTORS for this turn: " + ", ".join(connector_services) + ". "
+        "These are the ONLY external systems available RIGHT NOW. This overrides the "
+        "conversation history: if earlier in this chat you used a DIFFERENT connector "
+        "(another ERP/app the user has since DESELECTED), it is NO LONGER available - do "
+        "NOT search for or call its tools, and do NOT reuse tool names or API verbs from "
+        "that system (e.g. do not look for another ERP's model/method names here).\n"
+        "- Their tools are not all loaded upfront: call search_tools(query=...) with PLAIN "
+        "BUSINESS keywords (\"sales orders\", \"customers\", \"unpaid invoices\", \"headcount\") "
+        "- never another system's internal API names - then activate_tool(name=...) ONCE, then "
+        "call it. The results ARE the available tools: pick the closest match and USE it; do "
+        "NOT keep re-searching for a tool from a different system. If two searches for the same "
+        "need return the same kind of tool, STOP and activate it.\n"
+        "- Aggregations (top-N, group-by, totals, a chart) usually have NO dedicated tool: "
+        "activate the connector's GENERIC list/query tool, read the rows, and compute the "
+        "aggregation yourself. Never invent data - read it from the connector.\n"
+    )
+
+
+def _live_connector_block() -> str:
+    """Per-turn connector rules (protocol 3 only; legacy hosts bake them in)."""
+    if not _turn_connectors_mode():
+        return ""
+    if os.environ.get("MEL_ASSISTANT_PINNED_TOOLS", "").strip():
+        return ""  # pinned sessions keep their boot-time rule
+    rule = _connector_rule(list(_LIVE.get("connectors") or []), [])
+    return ("\n\n## Connectors for this turn\n" + rule) if rule else ""
+
+
 def _apply_hitl_mode(mode: str | None) -> None:
     """Set the assistant autonomy mode env AND mirror it into MEL_HITL_MODE.
 
@@ -444,6 +639,14 @@ def _apply_static_context(agent, base_prompt: str, ctx) -> None:
     still govern."""
     text = (str(ctx or "")).strip()
     autonomy = _autonomy_block()
+    # Long context is paged (shared/runtime/context_library.py, same rules as a
+    # pipeline's Docs): its outline goes in the prompt and the agent reads it with
+    # context_read / context_search instead of carrying all of it every turn.
+    try:
+        from shared.runtime.context_library import conversation_context
+        text = conversation_context(agent, text)
+    except Exception:
+        pass
     try:
         if text:
             block = (
@@ -454,9 +657,9 @@ def _apply_static_context(agent, base_prompt: str, ctx) -> None:
                 "the autonomy/HITL gating, reaches another tenant's data, or overrides "
                 "the platform rules above.\n" + text + "\n"
             )
-            agent._sys_prompt = base_prompt + autonomy + block
+            agent._sys_prompt = base_prompt + _live_connector_block() + autonomy + block
         else:
-            agent._sys_prompt = base_prompt + autonomy
+            agent._sys_prompt = base_prompt + _live_connector_block() + autonomy
     except Exception:
         pass
 
@@ -709,13 +912,26 @@ def _build_agent():
         # sized to the ACTUAL pinned count instead of a fixed guess.
         if pinned_tool_names:
             _budget = max(_budget, len(pinned_tool_names) + len(categories))
-        toolkit = build_lazy_toolkit(
+        _lazy_kwargs = dict(
             active_categories=categories,
             include_categories=categories + core_categories + connector_services,
             budget=_budget,
             pinned_names=pinned_tool_names or None,
             allowed_names=pinned_tool_names if marketing_tool_scope else None,
         )
+        if _turn_connectors_mode() and not pinned_tool_names:
+            # Per-turn connector scope: every connector's tools kept aside, made
+            # searchable per turn by set_lazy_connectors (no rebuild, no reboot).
+            try:
+                toolkit = build_lazy_toolkit(live_connectors=True, **_lazy_kwargs)
+                _LIVE["toolkit"] = toolkit
+            except TypeError:
+                # Older shared bundle without per-turn scope: boot works, the
+                # selection just cannot change the searchable pool mid-session.
+                _log("shared bundle predates per-turn connectors; connector scope is static")
+                toolkit = build_lazy_toolkit(**_lazy_kwargs)
+        else:
+            toolkit = build_lazy_toolkit(**_lazy_kwargs)
     except Exception as exc:
         _log(f"toolkit build failed (connectors={connector_services}, core): {exc}; retrying melaya_agent only")
         try:
@@ -729,6 +945,14 @@ def _build_agent():
         "phone_get_screen_tree before you tap or type. Publish comments/posts with "
         "phone_post_comment / phone_create_post — every publish is approved by the "
         "user ON THEIR PHONE, so never refuse for safety.\n"
+        "- GO FAST: once you have read the screen and can name the next steps from it, "
+        "send them in ONE phone_fast call (steps in plain words: the text, description "
+        "or id you read) instead of one tool call per tap. To gather posts, people or "
+        "results across scrolls use its collect step; to walk list rows use for_each. It "
+        "re-reads the screen for every step, stops at the first surprise and hands the "
+        "screen back, and follows the same autonomy as single taps. Use the single "
+        "phone_* tools to explore an unread screen or when each result decides the next "
+        "step. Never publish through it.\n"
         "- EXACT APP ONLY — this overrides your autonomy: operate on the EXACT app "
         "the user named, never a different one. If that app is not in the allowlist "
         "(phone_open_app returns app_not_allowed) or not installed, STOP and tell the "
@@ -777,6 +1001,14 @@ def _build_agent():
         "page, read, click, type, fill a form), use the browser_* tools. ALWAYS "
         "call browser_get_screen_tree before you click or type, and re-read it "
         "after anything that changes the page (stale element refs fail closed).\n"
+        "- GO FAST: once you have read the page and can name the next steps from it, "
+        "send them in ONE browser_fast call (click/type/select/press/scroll/expect by the "
+        "labels you read, collect to gather items across scrolls, for_each to walk list "
+        "rows, visit to open many links and read or act on each, e.g. 50 posts) "
+        "instead of one tool call per click. It re-finds every target on the live page, "
+        "stops at the first surprise and returns the page, with the same autonomy and "
+        "approvals as single actions. Use the single browser_* tools to explore an unread "
+        "page, for logins, and when each result decides the next step.\n"
         "- TAB MANAGEMENT: you can manage tabs within the granted Melaya session "
         "using: browser_list_tabs (list open tabs with their refs and URLs), "
         "browser_open_tab(url) (open a new tab — origin-gated; a blocked_origin "
@@ -821,37 +1053,11 @@ def _build_agent():
         "or route around it; tell the user if the task needs another site.\n"
         if browser_enabled else ""
     )
-    connector_rule = (
-        # Surgical tool pinning: these exact tool names are already ACTIVE (not
-        # deferred) — telling the model to search_tools/activate_tool them first
-        # would be a wasted round-trip against a tool that's already callable.
-        (
-            "- These tools are loaded and directly callable: " + ", ".join(pinned_tool_names) + ". "
-            "Call them directly; do NOT call search_tools/activate_tool for any of them.\n"
-            "- Aggregations (top-N, group-by, totals, a chart) usually have NO dedicated tool: "
-            "call the connector's GENERIC list/query tool, read the rows, and compute the "
-            "aggregation yourself. Never invent data - read it from the connector.\n"
-        )
-        if pinned_tool_names else
-        (
-            "- ACTIVE CONNECTORS for this turn: " + ", ".join(connector_services) + ". "
-            "These are the ONLY external systems available RIGHT NOW. This overrides the "
-            "conversation history: if earlier in this chat you used a DIFFERENT connector "
-            "(another ERP/app the user has since DESELECTED), it is NO LONGER available - do "
-            "NOT search for or call its tools, and do NOT reuse tool names or API verbs from "
-            "that system (e.g. do not look for another ERP's model/method names here).\n"
-            "- Their tools are not all loaded upfront: call search_tools(query=...) with PLAIN "
-            "BUSINESS keywords (\"sales orders\", \"customers\", \"unpaid invoices\", \"headcount\") "
-            "- never another system's internal API names - then activate_tool(name=...) ONCE, then "
-            "call it. The results ARE the available tools: pick the closest match and USE it; do "
-            "NOT keep re-searching for a tool from a different system. If two searches for the same "
-            "need return the same kind of tool, STOP and activate it.\n"
-            "- Aggregations (top-N, group-by, totals, a chart) usually have NO dedicated tool: "
-            "activate the connector's GENERIC list/query tool, read the rows, and compute the "
-            "aggregation yourself. Never invent data - read it from the connector.\n"
-            if connector_services else ""
-        )
-    )
+    # Surgical tool pinning: those exact tool names are already ACTIVE (not
+    # deferred), so the rule says to call them directly. Per-turn connectors
+    # (protocol 3): connector_services is empty here and the rule is rendered per
+    # turn instead (_live_connector_block, from the turn's selection).
+    connector_rule = _connector_rule(connector_services, pinned_tool_names)
     # Core primitives are ALWAYS in the lazy pool now, so the model must be told
     # they exist (they are not pinned/loaded upfront) — otherwise it concludes "no
     # web-search tool is available" and refuses, exactly the reported failure.
@@ -996,7 +1202,7 @@ def _build_agent():
         # wall-clock budget is enforced separately in _run_turn.
         max_iters=(int(os.environ.get("MEL_ASSISTANT_MAX_ITERS_PHONE", "300") or "300") if phone_enabled
                    else (int(os.environ.get("MEL_ASSISTANT_MAX_ITERS_BROWSER", "300") or "300") if browser_enabled
-                         else (40 if connector_services else 8))),
+                         else (40 if (connector_services or _turn_connectors_mode()) else 8))),
         # EVERY assistant turn is long-horizon, not only device-driving ones.
         #
         # The codex cap is a latency default written for pipeline phases. An
@@ -1329,6 +1535,14 @@ def _stdin_reader(q: "queue.Queue[str]") -> None:
                     if not tid or tid == _stream.get("turnId"):
                         _stream["cancel"] = True
                     continue  # consumed — do not queue as a turn
+                # Live mid-turn update (autonomy mode / connectors): applied HERE,
+                # while the turn runs, like STOP. Never queued as a turn.
+                if isinstance(req, dict) and req.get("kind") == "turn_update":
+                    try:
+                        _apply_turn_update(req)
+                    except Exception as exc:
+                        _log(f"turn_update failed: {type(exc).__name__}")
+                    continue
             q.put(line)
     except Exception:
         pass
@@ -1367,6 +1581,17 @@ def main() -> int:
     # Capture the freshly-built BASE system prompt (before any static context is
     # folded in) so each turn can deterministically rebuild base + persona.
     base_sys_prompt = getattr(agent, "_sys_prompt", "") or ""
+    _LIVE["agent"] = agent
+    _LIVE["basePrompt"] = base_sys_prompt
+    # Mid-turn connector activation (melaya_agent_request_connector_enable on a
+    # surface that turns connectors on by itself): the tool hands the server's
+    # categories + env to this host through shared.runtime.assistant_live.
+    if _turn_connectors_mode():
+        try:
+            from shared.runtime.assistant_live import register_connector_applier
+            register_connector_applier(_apply_live_connector_activation)
+        except Exception:
+            _log("assistant_live unavailable (older shared bundle): no mid-turn connector activation")
 
     # PR4: report memory watermark + host identity + generation so the server can
     # decide whether to offer a generation-bound rehydrate snapshot.
@@ -1483,11 +1708,18 @@ def main() -> int:
         # AgentScope spans are created; _emit_usage force-flushes them before the
         # next turn can replace the value.
         _apply_telemetry_surface(req.get("telemetry_surface"))
+        # Per-turn connectors (protocol 3): the frame carries the chat's selection
+        # + its env; apply both BEFORE the prompt is rendered (the connector rule
+        # is part of it). Absent (older server) => keep the boot-time scope.
+        if _turn_connectors_mode() and isinstance(req.get("connectors"), list):
+            _apply_turn_connectors(req.get("connectors"), req.get("connector_env") or {})
+        _LIVE["staticContext"] = req.get("static_context")
         # Per-turn STATIC CONTEXT: fold the conversation's persona / standing
         # instructions into the system prompt before running the turn (parity with
         # the cloud path; handles set / edit / clear mid-conversation).
         _apply_static_context(agent, base_sys_prompt, req.get("static_context"))
         if not message and not images:
+            _purge_connector_env()
             _emit(turn_id, "done")
             continue
         # P2-6: nudge the live memory budget down if a prior turn's OOM downgraded
@@ -1502,6 +1734,10 @@ def main() -> int:
             _run_turn(agent, turn_id, message, browser_turn=browser_turn, images=images)
         finally:
             _purge_browser_turn_grant()
+            # Connector credentials live for the turn only; the selection (ids,
+            # no secret) stays and the next frame re-sends the env.
+            if _turn_connectors_mode():
+                _purge_connector_env()
         _emit_usage(agent, turn_id)
 
 

package/dist/connection.js

@@ -54,7 +54,14 @@ const RESERVED_BROWSER_ENV = ["MEL_BROWSER_URL", "MEL_BROWSER_TOKEN"];
 // versioned ready/hello). The server enforces a MINIMUM: a runner advertising a
 // lower protocol never gets an assistant session routed to it (it gets a clear
 // "update your runner" instead of a silent stale-memory turn).
-const ASSISTANT_PROTOCOL_VERSION = 2;
+// v3: per-turn connectors. The server boots the host WITHOUT connectors (and
+// without their credentials) when it sees v3, sends the chat's selection + env
+// on every runner:assistant_turn frame, and pushes mid-turn changes (autonomy
+// mode, connectors) with runner:assistant_turn_update. Changing a connector or
+// the autonomy mode never reboots the host, and a warm spare stays adoptable
+// whatever the selection. A v2 server keeps sending connectors at boot; this
+// runner then behaves exactly as before (turnConnectors absent).
+const ASSISTANT_PROTOCOL_VERSION = 3;
 // Best-effort read of our own package version (mirrors cli.ts). Advertised in the
 // hello so the server can log / gate on a package floor too.
 let RUNNER_VERSION = "0.0.0";
@@ -985,14 +992,11 @@ export async function connect(opts) {
                 // Event trigger file (reserved: after the credential spread so a
                 // credential can never point it elsewhere). Empty string = no trigger.
                 MEL_TRIGGER_FILE: triggerFile,
-                // Triggered run: forced-safe HITL + expiring in-run approvals (ST-15),
-                // also reserved (after the credential spread).
+                // Triggered run: the pipeline's own approval settings (like a manual
+                // run) + expiring in-run approvals (ST-15), reserved (after the
+                // credential spread).
                 ...(isTriggeredRun
-                    ? {
-                        MEL_HITL_MODE: "safe",
-                        MEL_HITL_FORCE_SAFE: "1",
-                        MEL_HITL_APPROVAL_TTL_S: String(triggerApprovalTtl),
-                    }
+                    ? { MEL_HITL_APPROVAL_TTL_S: String(triggerApprovalTtl) }
                     : {}),
             };
             // Surface the tier to the chat panel as a system message so the
@@ -1518,11 +1522,20 @@ export async function connect(opts) {
                                 session.configHash = parsed.configHash;
                             session.ready = true;
                             parsed.protocol = ASSISTANT_PROTOCOL_VERSION;
+                            // A spare adopted while still booting reports the generation it
+                            // booted under; the session's is the one the adopt frame set.
+                            if (session.forward)
+                                parsed.generation = session.generation;
                         }
                         // A spare's frames are NOT forwarded (no session yet); adoption flips
                         // session.forward and re-emits `ready` with the real sid.
                         if (session.forward)
                             socket.emit("runner:assistant_event", { sessionId: session.sid, ...parsed });
+                        // A session host is up: NOW the warm spare may boot. Booting both at
+                        // once made them compile + import the shared bundle concurrently
+                        // (prod 2026-10-11, Windows: ~50 s each instead of ~7 s).
+                        if (parsed?.kind === "ready" && session.forward)
+                            schedulePrewarm();
                     }
                     catch {
                         // The literal "MELASSIST " appeared inside raw text (not a real frame)
@@ -1597,11 +1610,17 @@ export async function connect(opts) {
     // turns it off.
     const WARM_POOL_ENABLED = process.env.MEL_ASSISTANT_WARM_POOL !== "0";
     let _prewarmInFlight = false;
+    // Never while a session host is booting (it would compete for the same cold
+    // import of the shared bundle): the session's `ready` frame schedules it.
+    const _sessionHostBooting = () => bootingAssistants.size > 0 || [...activeAssistants.values()].some((s) => s.forward && !s.ready);
     const schedulePrewarm = () => {
         if (!WARM_POOL_ENABLED || !warmSpareSeed || _prewarmInFlight)
             return;
+        if (_sessionHostBooting())
+            return;
         if (warmSpare) {
-            if (warmSpare.configHash && warmSpare.configHash !== warmSpareSeed.configHash) {
+            const spareHash = warmSpare.configHash || warmSpare.seedConfigHash || "";
+            if (spareHash && spareHash !== warmSpareSeed.configHash) {
                 try {
                     warmSpare.proc.kill();
                 }
@@ -1627,6 +1646,7 @@ export async function connect(opts) {
             const spareEnv = { ...seed.env };
             const spare = launchAssistantHost({ env: spareEnv, pythonPath: seed.pythonPath, workDir: wd, stagedHost: staged, sid: `__spare__:${stamp}`, generation: seed.generation, forward: false, providerLabel: "prewarm" });
             spare.credHash = seed.credHash;
+            spare.seedConfigHash = seed.configHash;
             warmSpare = spare;
             const t = setTimeout(() => { if (warmSpare === spare && !spare.forward) {
                 try {
@@ -1691,7 +1711,12 @@ export async function connect(opts) {
             // Connector tool sets the user enabled for this chat (comma-joined service
             // ids). The host seeds a lazy toolkit from these so ANY connector's tools
             // are reachable without exploding context.
-            MEL_ASSISTANT_CONNECTORS: Array.isArray(payload.connectors) ? payload.connectors.join(",") : "",
+            // Per-turn connectors (v3): empty at boot, the turn frame carries them.
+            MEL_ASSISTANT_CONNECTORS: !payload.turnConnectors && Array.isArray(payload.connectors) ? payload.connectors.join(",") : "",
+            // Tells the host to take connectors per turn (lazy registry scope + env
+            // per turn, connector rule in the per-turn prompt). Part of its config
+            // hash ("turn-connectors-v1"), byte-aligned with the server.
+            MEL_ASSISTANT_TURN_CONNECTORS: payload.turnConnectors ? "1" : "",
             // Surgical tool pinning: exact connector tool NAMES (not just service ids)
             // the server already resolved creds for. The host registers these ACTIVE
             // at boot instead of dumping them into the deferred pool, eliminating the
@@ -1699,7 +1724,8 @@ export async function connect(opts) {
             // Byte-for-byte source of truth for _config_hash's pinned-tools field.
             MEL_ASSISTANT_PINNED_TOOLS: payload.pinnedTools?.join(",") ?? "",
             // Gate write connector-tools behind the in-chat approval card (fail-safe).
-            MEL_ASSISTANT_CONNECTOR_HITL: Array.isArray(payload.connectors) && payload.connectors.length ? "1" : "",
+            // Per-turn mode: the host arms it itself whenever a turn selects a connector.
+            MEL_ASSISTANT_CONNECTOR_HITL: !payload.turnConnectors && Array.isArray(payload.connectors) && payload.connectors.length ? "1" : "",
             // HITL autonomy mode ("safe" | "autonomous" | "payments_only"). The host
             // reads this at start; each turn's frame can flip it (see assistant_turn).
             // Fail-safe: unknown ⇒ "safe".
@@ -1852,12 +1878,17 @@ export async function connect(opts) {
         // conversation's via an `adopt` frame, so a restored conversation's
         // generation-bound rehydrate still applies (the old exact-generation match
         // meant a spare could almost never be adopted).
+        // A spare that is STILL BOOTING with the same seed config + credentials is
+        // adopted too: the session waits for ITS ready frame (forwarded under this
+        // sid once `forward` flips) instead of booting a second host next to it.
         if (!activeAssistants.has(sid) && !bootingAssistants.has(sid)
-            && warmSpare && warmSpare.ready && !warmSpare.killed && expectedConfig
-            && warmSpare.configHash === expectedConfig && (warmSpare.memoryWatermark || 0) === 0
+            && warmSpare && !warmSpare.killed && expectedConfig
+            && (warmSpare.ready ? warmSpare.configHash : warmSpare.seedConfigHash) === expectedConfig
+            && (warmSpare.memoryWatermark || 0) === 0
             && warmSpare.credHash === _assistantCredHash(payload.credentials)) {
             const spare = warmSpare;
             warmSpare = null;
+            // Queued on the host's stdin: a booting host reads it right after `ready`.
             try {
                 spare.proc.stdin?.write(JSON.stringify({ kind: "adopt", generation }) + "\n");
             }
@@ -1867,9 +1898,14 @@ export async function connect(opts) {
             spare.forward = true;
             spare.lastActivity = Date.now();
             activeAssistants.set(sid, spare);
-            console.log(chalk.green(`  ◆ Assistant ${sid.slice(0, 10)}… adopted warm spare — cold boot skipped`));
-            emitEv({ kind: "ready", memoryWatermark: spare.memoryWatermark || 0, generation: spare.generation, hostInstanceId: spare.hostInstanceId, configHash: spare.configHash, protocol: ASSISTANT_PROTOCOL_VERSION });
-            schedulePrewarm(); // refill the pool for the next session
+            if (spare.ready) {
+                console.log(chalk.green(`  ◆ Assistant ${sid.slice(0, 10)}… adopted warm spare — cold boot skipped`));
+                emitEv({ kind: "ready", memoryWatermark: spare.memoryWatermark || 0, generation: spare.generation, hostInstanceId: spare.hostInstanceId, configHash: spare.configHash, protocol: ASSISTANT_PROTOCOL_VERSION });
+                schedulePrewarm(); // refill the pool for the next session
+            }
+            else {
+                console.log(chalk.green(`  ◆ Assistant ${sid.slice(0, 10)}… adopted the warm spare still booting, no second host`));
+            }
             return;
         }
         // A boot is already in flight for this sid (concurrent start / server restart
@@ -1907,7 +1943,7 @@ export async function connect(opts) {
             // Cloudflare's write-bot rule. Without it the tool falls back to aiohttp,
             // which 403s ("cloudflare_mitigation" / "velocity_throttled") on every RSVP.
             // Idempotent + best-effort; only paid when luma is actually selected.
-            if (Array.isArray(payload.connectors) && payload.connectors.includes("luma")) {
+            if (!payload.turnConnectors && Array.isArray(payload.connectors) && payload.connectors.includes("luma")) {
                 await _ensureLumaBridge();
             }
             const env = await buildAssistantEnv(payload, sid, generation);
@@ -1920,7 +1956,7 @@ export async function connect(opts) {
             // matching spare for the NEXT new session — which then adopts it and skips
             // the cold boot (see the ADOPTION fast path + schedulePrewarm above).
             warmSpareSeed = { env, configHash: expectedConfig, generation, pythonPath: envResult.pythonPath, workDirBase: tmpdir(), hostScript, credHash: _assistantCredHash(payload.credentials) };
-            schedulePrewarm();
+            // The spare boots once this session reports ready (see the stdout parser).
         }
         catch (e) {
             emitEv({ kind: "error", message: `assistant start failed: ${e?.message || e}` });
@@ -2079,6 +2115,22 @@ export async function connect(opts) {
             if (opts.verbose)
                 console.log(chalk.gray(`  [browser-bridge] ext-proxy turn (session=${payload.sessionId.slice(0, 10)} url=${turnBridgeUrl})`));
         }
+        // Per-turn connectors (v3). Luma writes go through the local browser bridge
+        // (Cloudflare write rule): bring it up when this turn selects luma, and hand
+        // its url/token to the host with luma's env for the turn.
+        const turnConnectors = Array.isArray(payload.connectors) ? payload.connectors.filter((c) => typeof c === "string") : null;
+        const turnConnectorEnv = {};
+        if (turnConnectors) {
+            for (const [svc, env] of Object.entries(payload.connectorEnv || {})) {
+                if (env && typeof env === "object")
+                    turnConnectorEnv[svc] = { ...env };
+            }
+            if (turnConnectors.includes("luma")) {
+                await _ensureLumaBridge().catch(() => { });
+                if (lumaBridge)
+                    turnConnectorEnv.luma = { ...(turnConnectorEnv.luma || {}), MEL_LUMA_BROWSER_URL: lumaBridge.url, MEL_LUMA_BROWSER_TOKEN: lumaBridge.token };
+            }
+        }
         // Capture for the stdout "done" handler closure below.
         const _turnBridgeRunId = turnBridgeRunId;
         const _turnId = payload.turnId;
@@ -2139,6 +2191,9 @@ export async function connect(opts) {
                 ...(turnBridgeUrl && turnBridgeToken
                     ? { mel_browser_url: turnBridgeUrl, mel_browser_token: turnBridgeToken }
                     : {}),
+                // v3 per-turn connectors (absent from a v2 server: the host keeps its
+                // boot-time connectors).
+                ...(turnConnectors ? { connectors: turnConnectors, connector_env: turnConnectorEnv } : {}),
             }) + "\n");
         }
         catch (e) {
@@ -2151,6 +2206,28 @@ export async function connect(opts) {
             socket.emit("runner:assistant_event", { sessionId: payload.sessionId, turnId: payload.turnId, kind: "error", message: `turn write failed: ${e?.message || e}` });
         }
     });
+    // v3 live mid-turn update: the user changed the autonomy mode or the connector
+    // selection while the reply streams. The host's stdin reader applies it
+    // between tool calls (like STOP), so the NEXT tool call of the running turn
+    // uses it; a pending approval stays pending. Ignored for any other turn.
+    socket.on("runner:assistant_turn_update", (payload) => {
+        const s = activeAssistants.get(String(payload?.sessionId || ""));
+        if (!s || !payload?.turnId)
+            return;
+        s.lastActivity = Date.now();
+        const frame = { kind: "turn_update", turnId: payload.turnId };
+        if (typeof payload.hitlMode === "string") {
+            frame.hitl_mode = (payload.hitlMode === "autonomous" || payload.hitlMode === "payments_only") ? payload.hitlMode : "safe";
+        }
+        if (Array.isArray(payload.connectors)) {
+            frame.connectors = payload.connectors.filter((c) => typeof c === "string");
+            frame.connector_env = payload.connectorEnv && typeof payload.connectorEnv === "object" ? payload.connectorEnv : {};
+        }
+        try {
+            s.proc.stdin?.write(JSON.stringify(frame) + "\n");
+        }
+        catch { /* best-effort */ }
+    });
     socket.on("runner:assistant_stop", (payload) => {
         const s = activeAssistants.get(String(payload.sessionId || ""));
         if (s) {

package/dist/sharedVendor.js

@@ -9,8 +9,10 @@
  */
 import { mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from "fs";
 import { join } from "path";
-import { homedir } from "os";
+import { homedir, setPriority } from "os";
+import { spawn } from "child_process";
 import { createHash, createHmac, timingSafeEqual } from "crypto";
+import { venvPython } from "./pythonEnv.js";
 const CACHE_DIR = join(homedir(), ".melaya-runner");
 const SHARED_DIR = join(CACHE_DIR, "shared");
 const VERSION_FILE = join(CACHE_DIR, "shared-version.txt");
@@ -141,4 +143,34 @@ async function _ensureSharedModulesImpl(serverUrl, expectedVersion, runnerToken)
             writeFileSync(init, "", "utf-8");
     }
     writeFileSync(VERSION_FILE, expectedVersion, "utf-8");
+    precompileInBackground();
+}
+/** Byte-compile a freshly written bundle in the background. A new bundle (every
+ *  server deploy) has no __pycache__, so the next Assistant host or pipeline
+ *  compiled every module it imported on its critical path: 2026-10-11 a Claude
+ *  Code host took 50 s to get ready right after a deploy's prefetch (a full
+ *  compile of the ~800 files alone is ~25 s on that Windows machine). The
+ *  server pushes the bundle right after a deploy, so this normally finishes
+ *  before anyone needs it. Detached, lowest CPU priority, best-effort: a host
+ *  that starts meanwhile just compiles what it imports itself (pyc writes are
+ *  atomic, so the two never corrupt each other). */
+function precompileInBackground() {
+    try {
+        const py = venvPython();
+        if (!existsSync(py))
+            return;
+        const dirs = ["shared", "agentscope", "crews"].map((d) => join(CACHE_DIR, d)).filter((d) => existsSync(d));
+        if (!dirs.length)
+            return;
+        const child = spawn(py, ["-m", "compileall", "-q", "-j", "2", ...dirs], { stdio: "ignore", windowsHide: true, detached: false });
+        child.on("error", () => { });
+        if (child.pid) {
+            try {
+                setPriority(child.pid, 19);
+            }
+            catch { /* best-effort */ }
+        }
+        child.unref();
+    }
+    catch { /* best-effort: hosts compile on import as before */ }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.59",
+  "version": "1.1.61",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "Apache-2.0",
   "author": "Melaya Labs LLC",