feat: uv_ffi version enforcement + worker daemon hardening

- sync_interpreter now upgrades uv_ffi to pyproject.toml minimum on every
  interpreter sync, not just omnipkg itself
- stale omnipkg dist-info dirs cleaned up after successful sync
- worker pool warm-worker selection fixed (sort-then-pop vs broken temp-requeue)
- worker task timeout lifted to OMNIPKG_WORKER_TIMEOUT (default 360s) from hardcoded 60s
- execute_with_timeout default raised to 240s
- pygments>=2.20.0 added (ReDoS CVE in AdlLexer)
- uv_ffi minimum bumped to post4

Modified:
  • src/omnipkg/core.py (+66/-9 lines)
  • src/omnipkg/isolation/worker_daemon.py (+17/-20 lines)
  • pyproject.toml (+5/-2 lines)
  • requirements-trace.txt (+4/-2 lines)

[gitship-generated]

Author: 1minds3t

pyproject.toml

@@ -6,7 +6,7 @@ backend-path = ["."]
 
 [project]
 name = "omnipkg"
-version = "2.5.1"
+version = "2.6.0"
 authors = [
   { name = "1minds3t", email = "1minds3t@proton.me" },
 ]
@@ -39,12 +39,15 @@ classifiers = [
 ]
 
 dependencies = [
-    "uv_ffi>=0.10.8.post3 ; python_version >= '3.8' and python_version <= '3.14'",
+    "uv_ffi>=0.10.8.post4 ; python_version >= '3.8' and python_version <= '3.14'",
     "requests>=2.20",
     "psutil>=5.9.0",
     "typer>=0.4.0",
     "rich>=10.0.0",
 
+    # Pygments - ReDoS CVE in AdlLexer, fixed in 2.20.0
+    "pygments>=2.20.0",
+
     # werkzeug - pinned to last available per Python, CVEs unresolved due to Python constraints
     # TODO: werkzeug-lts needed for py37/py38 to backport CVE-2026-27199, CVE-2026-21860, CVE-2025-66221
     "werkzeug>=3.0.6; python_version == '3.8'",  # stuck - upstream dropped 3.8 before 3.1.x

requirements-trace.txt

@@ -106,8 +106,10 @@ py-serializable==2.1.0
     # via cyclonedx-python-lib
 pycparser==3.0
     # via cffi
-pygments==2.19.2
-    # via rich
+pygments==2.20.0
+    # via
+    #   omnipkg (pyproject.toml)
+    #   rich
 pyparsing==3.3.2
     # via pip-requirements-parser
 requests==2.33.1

src/omnipkg/core.py

@@ -6355,12 +6355,36 @@ def _self_heal_omnipkg_installation(self):
             # === TIER 2: PATH-BASED SYNC CHECK (1-2ms) ===
             sync_needed = self._check_sync_status_ultra_fast(master_version_str)
 
-            if not sync_needed:
+            # Always collect ALL managed interpreters for uv_ffi check,
+            # even if omnipkg version is already current on all of them.
+            all_managed = []
+            try:
+                interp_dir = self.config_manager.venv_path / ".omnipkg" / "interpreters"
+                if interp_dir.exists():
+                    import glob as _iglob
+                    bin_sub = "Scripts" if platform.system() == "Windows" else "bin"
+                    for _idir in sorted(interp_dir.iterdir()):
+                        _bin = _idir / bin_sub
+                        if not _bin.exists():
+                            continue
+                        _py = next(
+                            (p for p in sorted(_bin.iterdir())
+                             if p.name.startswith("python3.") and p.suffix == "" and p.is_file()),
+                            None
+                        )
+                        if _py:
+                            import re as _re2
+                            _m = _re2.search(r"python(\d+\.\d+)", _py.name)
+                            if _m:
+                                all_managed.append((_m.group(1), str(_py)))
+            except Exception:
+                pass
+
+            if not sync_needed and not all_managed:
                 # Write cache for next time
                 self._write_heal_cache(
                     {"master_version": master_version_str, "timestamp": time.time()}
                 )
-
                 if "--verbose" in sys.argv or "-V" in sys.argv:
                     elapsed_ns = time.perf_counter_ns() - overall_start
                     elapsed_ms = elapsed_ns / 1_000_000
@@ -6369,6 +6393,12 @@ def _self_heal_omnipkg_installation(self):
                     )
                 return
 
+            # Merge: sync_needed takes priority; add remaining from all_managed for uv_ffi-only check
+            sync_needed_exes = {exe for _, exe in sync_needed}
+            for ver, exe in all_managed:
+                if exe not in sync_needed_exes:
+                    sync_needed.append((ver, exe))
+
             # === TIER 3: HEALING REQUIRED (ONLY WHEN NECESSARY) ===
             # Extra safety: Warn on Windows
             if platform.system() == "Windows":
@@ -6667,10 +6697,15 @@ def _perform_concurrent_healing(
         native_needs_sync = False
         native_was_synced = False
         _sync_marker = native_exe.parent / f".omnipkg_synced_{master_version}"
-        if _sync_marker.exists():
-            return  # already synced this version, nothing to do
-
-        if is_current_native:
+        _native_already_synced = _sync_marker.exists()
+        if _native_already_synced and os.environ.get("OMNIPKG_DEBUG"):
+            safe_print(f"   [HEAL] Native marker exists for v{master_version}, skipping native sync only")
+
+        if _native_already_synced:
+            native_needs_sync = False
+            if os.environ.get("OMNIPKG_DEBUG"):
+                safe_print(f"   [HEAL] Native already at v{master_version}, skipping native sync")
+        elif is_current_native:
             # We ARE the native interpreter - check if we need sync
             try:
                 native_site_packages = site.getsitepackages()[0]
@@ -6763,8 +6798,11 @@ def _perform_concurrent_healing(
 
             def sync_interpreter(py_ver, target_exe):
                 _marker = Path(target_exe).parent / f".omnipkg_synced_{master_version}"
-                if _marker.exists():
-                    return (py_ver, True)
+                _already_synced = _marker.exists()
+                if _already_synced:
+                    # Still need to check uv_ffi even if omnipkg is already synced
+                    if os.environ.get("OMNIPKG_DEBUG"):
+                        safe_print(f"   [HEAL] {py_ver} omnipkg marker exists, checking uv_ffi only...")
                 # Detect egg-based pip (e.g. pip 20.2.2 on Python 3.7)
                 # and inject it into PYTHONPATH so -m pip works in subprocess
                 import glob, os
@@ -6811,6 +6849,25 @@ def sync_interpreter(py_ver, target_exe):
                                     easy_pth.unlink()
                     except Exception:
                         pass
+                # Clean up stale omnipkg dist-info dirs (leave only current version)
+                if result.returncode == 0:
+                    try:
+                        sp_path = Path(target_exe).parent.parent / "lib"
+                        import glob as _glob2
+                        for sp_dir in _glob2.glob(str(sp_path / "python*/site-packages")):
+                            sp_dir = Path(sp_dir)
+                            for di in sp_dir.glob("omnipkg-*.dist-info"):
+                                ver_in_name = di.name.replace("omnipkg-", "").replace(".dist-info", "")
+                                if ver_in_name != master_version:
+                                    import shutil as _shutil
+                                    _shutil.rmtree(str(di), ignore_errors=True)
+                    except Exception:
+                        pass
+                # uv_ffi check runs whether we just synced OR were already synced
+                if _already_synced or result.returncode == 0:
+                    pass  # fall through to uv_ffi check below
+                else:
+                    return (py_ver, False)
                 # Read uv_ffi min version from pyproject.toml once, in main process
                 _uv_ffi_min = "0.10.8.post2"  # fallback
                 try:
@@ -6848,7 +6905,7 @@ def sync_interpreter(py_ver, target_exe):
                     needs_upgrade = True
                 if needs_upgrade:
                     subprocess.run([target_exe, "-m", "pip", "install", "--upgrade", "--no-cache-dir", "-q", f"uv_ffi>={_uv_ffi_min}"], capture_output=True, text=True, timeout=60, env=env)
-                return (py_ver, result.returncode == 0)
+                return (py_ver, _already_synced or result.returncode == 0)
 
             with concurrent.futures.ThreadPoolExecutor(max_workers=6) as executor:
                 futures = [executor.submit(sync_interpreter, ver, exe) for ver, exe in sync_needed]

src/omnipkg/isolation/worker_daemon.py

@@ -2732,7 +2732,7 @@ def execute_shm_task(
         code: str,
         shm_in: Dict[str, Any],
         shm_out: Dict[str, Any],
-        timeout: float = 30.0,
+        timeout: float = 240.0,
     ) -> Dict[str, Any]:
         """Execute task with timeout."""
         with self.lock:
@@ -3766,25 +3766,19 @@ def _run_cli(self, req, conn):
         try:
             pool = self.idle_pools.get(python_exe)
             if pool:
-                # Prefer warm workers — scan pool for one with _is_warm set
+                # Drain pool, prefer a warm worker, put the rest back
                 all_workers = []
-                warm_worker = None
                 while not pool.empty():
                     try:
-                        w = pool.get_nowait()
-                        if getattr(w, "_is_warm", False) and warm_worker is None:
-                            warm_worker = w
-                        else:
-                            all_workers.append(w)
+                        all_workers.append(pool.get_nowait())
                     except: break
-                # Put non-selected workers back
-                selected = warm_worker or (all_workers.pop(0) if all_workers else None)
+                # Sort: warm first
+                all_workers.sort(key=lambda w: 0 if getattr(w, "_is_warm", False) else 1)
+                selected = all_workers.pop(0) if all_workers else None
+                # Return unselected workers to pool
                 for w in all_workers:
                     try: pool.put_nowait(w)
                     except: pass
-                if warm_worker:
-                    try: pool.put_nowait(warm_worker)  # temp
-                    except: pass
                 worker = selected
                 if worker is None: raise queue.Empty()
                 safe_print(f"[RUN-CLI] got idle worker pid={worker.process.pid}", file=sys.stderr)
@@ -3812,7 +3806,7 @@ def _run_cli(self, req, conn):
         safe_print(f"[RUN-CLI] worker acquired in {(_t_got_worker-_t0)*1000:.2f}ms", file=sys.stderr)
 
         try:
-            safe_print(f"[RUN-CLI] sending req to worker", file=sys.stderr)
+            safe_print(f"[RUN-CLI] sending req to worker pid={worker.process.pid}", file=sys.stderr)
             worker.process.stdin.write(json.dumps(req) + "\n")
             worker.process.stdin.flush()
 
@@ -4006,10 +4000,13 @@ def _run_cli(self, req, conn):
                         pass
                 if worker is not None:
                     worker.force_shutdown()
-            # Only replenish if pool is below configured target
+            # Only replenish if pool is STILL below configured target after recycling.
+            # Give recycled worker a moment to land in the queue before checking.
             _target = self.idle_config.get(python_exe, 0)
-            if self.idle_pools[python_exe].qsize() < _target:
-                self._replenish_idle_pool(python_exe)
+            if _target > 0:
+                time.sleep(0.02)  # let recycle put_nowait propagate
+                if self.idle_pools[python_exe].qsize() < _target:
+                    self._replenish_idle_pool(python_exe)
 
     def _run_uv(self, req: dict, conn: socket.socket):
         """
@@ -4317,7 +4314,7 @@ def _execute_code(
                     code,
                     shm_in,
                     shm_out,
-                    timeout=60.0,
+                    timeout=worker_info.get("task_timeout", int(os.environ.get("OMNIPKG_WORKER_TIMEOUT", 360))),
                 )
                 # ── IMMEDIATE EVICTION IF NESTED SWITCHING OCCURRED ────────
                 _has_tag = bool(worker_tag)
@@ -4359,7 +4356,7 @@ def _execute_code(
                             code,
                             shm_in,
                             shm_out,
-                            timeout=60.0,
+                            timeout=worker_info.get("task_timeout", int(os.environ.get("OMNIPKG_WORKER_TIMEOUT", 360))),
                         )
                         return result
                     except Exception as e:
@@ -4451,7 +4448,7 @@ def _execute_code(
                 code,
                 shm_in,
                 shm_out,
-                timeout=60.0,
+                timeout=worker_info.get("task_timeout", int(os.environ.get("OMNIPKG_WORKER_TIMEOUT", 360))),
             )
             return result
         except Exception as e: