@melaya/runner 1.1.65 → 1.1.67

package/dist/assistantHost.py

@@ -20,7 +20,10 @@ stdout (one JSON per line, prefixed): MELASSIST {"turnId","kind",...}
 Tenant safety: the toolkit is the read-only `melaya_agent_*` tools, which POST to
 the server's assistant-tool bridge authed by MELAYA_API_KEY — every query is
 tenant-gated SERVER-side, so this host gains no data authority beyond the user's
-own mk_ key. Identity is never taken from tool args.
+own mk_ key. Identity is never taken from tool args. Workspace actions
+(melaya_tools / melaya_tool_call) go through the server's workspace-tool bridge,
+which checks, asks for approval in Safe mode and executes; the host only carries
+the call.
 """
 from __future__ import annotations
 
@@ -1183,10 +1186,16 @@ def _build_agent():
         "agent-orchestration platform.\n\n"
         + melaya_product
         + "\n"
-        "IN THIS CHAT you additionally hold READ-ONLY tools over the data "
-        "this user is allowed to see: pipelines, runs, LLM costs, plan usage, "
-        "validated workflow templates and eval results. That is your CURRENT "
-        "TOOLBOX, not a description of Melaya"
+        "IN THIS CHAT you additionally hold tools over the data this user is "
+        "allowed to see (pipelines, runs, LLM costs, plan usage, validated "
+        "workflow templates, eval results) and melaya_tools / melaya_tool_call "
+        "to ACT on their workspace: create a pipeline (from a template or a "
+        "config), preview, save, run, schedule, add triggers, inspect runs, "
+        "delete, manage projects and the team. Search with melaya_tools, load "
+        "the tools you need to see their arguments, then call them with "
+        "melaya_tool_call; changes follow the chat's autonomy mode (in Safe "
+        "mode the user approves each one). That is your CURRENT TOOLBOX, not a "
+        "description of Melaya"
         + (" — plus phone-control tools to drive the user's paired phone." if phone_enabled else ".")
         + "\nRules:\n"
         "- Use tools to answer questions about the user's pipelines, spend, usage, "

package/dist/pythonEnv.js

@@ -100,6 +100,7 @@ const PIP_DEPS = [
     "aiohttp>=3.14", // google-genai 2.4+ streams with readline(max_line_length=)
     "requests",
     "python-dotenv",
+    "sether==0.2.0", // local PII/secret redaction boundary; includes phonenumbers
     // google-genai — the native Gemini SDK agentscope's GeminiChatModel imports
     // for provider google/gemini. Missing = every Gemini agent in a runner
     // pipeline died at construction ("cannot import name 'genai' from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.65",
+  "version": "1.1.67",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "Apache-2.0",
   "author": "Melaya Labs LLC",