chore(release): Release version 1.3.3

This patch release includes critical fixes to the security scanner's accuracy and the reliability of the multiverse analysis test. It also improves the user experience for the 'run' command with better live output streaming.

Author: 1minds3t

omnipkg/commands/run.py

@@ -97,13 +97,34 @@ def execute_run_command(cmd_args: list, config_manager: ConfigManager):
     initial_cmd = ['uv', 'run', '--no-project', '--python', python_exe, '--'] + cmd_args
 
     start_time_ns = time.perf_counter_ns()
-    process = subprocess.Popen(initial_cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, encoding='utf-8', cwd=Path.cwd())
 
-    # FIXED: Stream output live instead of collecting it all first
+    # CRITICAL FIX: Use stderr=subprocess.STDOUT and set bufsize=1 for line buffering
+    # Also add universal_newlines=True for better text handling
+    process = subprocess.Popen(
+        initial_cmd, 
+        stdout=subprocess.PIPE, 
+        stderr=subprocess.STDOUT,  # Merge stderr into stdout
+        text=True, 
+        encoding='utf-8', 
+        cwd=Path.cwd(),
+        bufsize=1,  # Line buffered
+        universal_newlines=True  # Ensures proper line ending handling
+    )
+    
+    # FIXED: Stream output live with immediate flushing
     output_lines = []
-    for line in iter(process.stdout.readline, ''):
-        print(line, end='')  # Print each line immediately as it comes
-        output_lines.append(line)  # Still collect for error analysis
+    try:
+        while True:
+            line = process.stdout.readline()
+            if not line:  # EOF reached
+                break
+            print(line, end='', flush=True)  # CRITICAL: Add flush=True for immediate output
+            output_lines.append(line)
+    except KeyboardInterrupt:
+        print("\n🛑 Process interrupted by user")
+        process.terminate()
+        process.wait()
+        return 130  # Standard exit code for SIGINT
 
     return_code = process.wait()
     end_time_ns = time.perf_counter_ns()

omnipkg/package_meta_builder.py

@@ -231,107 +231,149 @@ def _store_active_versions(self, active_packages: Dict[str, str]):
 
     def _perform_security_scan(self, packages: Dict[str, str]):
         """
-        FIXED: Runs a security check using `safety`. The log output is now
-        context-aware and gracefully handles cases where `safety` is not
-        installed in the target Python interpreter. It is resilient to non-JSON output.
+        FIXED: Runs a security check using `safety`. Now properly handles the JSON
+        output wrapped with deprecation warnings and correctly counts vulnerabilities.
         """
         scan_type = 'bulk' if len(packages) > 1 else 'targeted'
         if len(packages) == 0:
             scan_type = 'targeted'
+        
         print(f'🛡️ Performing {scan_type} security scan for {len(packages)} active package(s)...')
+        
         if not packages:
             print(_(' - No active packages found to scan.'))
             self.security_report = {}
             return
+        
         python_exe = self.config.get('python_executable', sys.executable)
+        
+        # Check if safety is available
         try:
             subprocess.run([python_exe, '-m', 'safety', '--version'], check=True, capture_output=True, timeout=10)
         except (subprocess.CalledProcessError, FileNotFoundError, subprocess.TimeoutExpired):
             print(f" ⚠️ Warning: The 'safety' package is not installed for the active Python interpreter ({Path(python_exe).name}).")
             print(_(" 💡 To enable this feature, run: '{} -m pip install safety'").format(python_exe))
             self.security_report = {}
             return
+        
+        # Create requirements file
         with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.txt', encoding='utf-8') as reqs_file:
             reqs_file_path = reqs_file.name
             for name, version in packages.items():
                 reqs_file.write(f'{name}=={version}\n')
+        
         try:
             cmd = [python_exe, '-m', 'safety', 'check', '-r', reqs_file_path, '--json']
             result = subprocess.run(cmd, capture_output=True, text=True, timeout=120, encoding='utf-8')
+            
             if result.stdout:
                 raw_output = result.stdout.strip()
-                json_start_index = raw_output.find('[')
-                if json_start_index == -1:
-                    json_start_index = raw_output.find('{')
-                if json_start_index != -1:
-                    json_string = raw_output[json_start_index:]
-                    bracket_count = 0
-                    brace_count = 0
-                    json_end_index = 0
+                
+                # Find JSON boundaries - safety wraps JSON with deprecation warnings
+                json_start = -1
+                json_end = -1
+                
+                # Look for the opening brace/bracket
+                brace_pos = raw_output.find('{')
+                bracket_pos = raw_output.find('[')
+                
+                if brace_pos != -1 and bracket_pos != -1:
+                    json_start = min(brace_pos, bracket_pos)
+                elif brace_pos != -1:
+                    json_start = brace_pos
+                elif bracket_pos != -1:
+                    json_start = bracket_pos
+                
+                if json_start != -1:
+                    # Find the matching closing brace/bracket
+                    opening_char = raw_output[json_start]
+                    closing_char = '}' if opening_char == '{' else ']'
+                    
+                    # Count nesting to find the proper end
+                    count = 0
                     in_string = False
                     escape_next = False
-                    for i, char in enumerate(json_string):
+                    
+                    for i in range(json_start, len(raw_output)):
+                        char = raw_output[i]
+                        
                         if escape_next:
                             escape_next = False
                             continue
+                        
                         if char == '\\':
                             escape_next = True
                             continue
-                        if char == '"' and (not escape_next):
+                        
+                        if char == '"' and not escape_next:
                             in_string = not in_string
                             continue
+                        
                         if not in_string:
-                            if char == '[':
-                                bracket_count += 1
-                            elif char == ']':
-                                bracket_count -= 1
-                            elif char == '{':
-                                brace_count += 1
-                            elif char == '}':
-                                brace_count -= 1
-                            if bracket_count == 0 and brace_count == 0 and (i > 0):
-                                json_end_index = i + 1
-                                break
-                    if json_end_index > 0:
-                        clean_json = json_string[:json_end_index]
-                    else:
-                        clean_json = json_string
-                    try:
-                        self.security_report = json.loads(clean_json)
-                    except json.JSONDecodeError:
-                        lines = raw_output.split('\n')
-                        json_lines = []
-                        collecting = False
-                        for line in lines:
-                            if line.strip().startswith('[') or line.strip().startswith('{'):
-                                collecting = True
-                            if collecting:
-                                json_lines.append(line)
-                                try:
-                                    potential_json = '\n'.join(json_lines)
-                                    self.security_report = json.loads(potential_json)
+                            if char == opening_char:
+                                count += 1
+                            elif char == closing_char:
+                                count -= 1
+                                if count == 0:
+                                    json_end = i + 1
                                     break
-                                except json.JSONDecodeError:
-                                    continue
-                        if not hasattr(self, 'security_report') or not self.security_report:
+                    
+                    if json_end > json_start:
+                        json_content = raw_output[json_start:json_end]
+                        try:
+                            self.security_report = json.loads(json_content)
+                        except json.JSONDecodeError as e:
+                            print(f' ⚠️ Could not parse safety JSON output: {e}')
+                            self.security_report = {}
+                    else:
+                        # Fallback: try parsing from json_start to end and let json.loads find the boundary
+                        try:
+                            # This will likely fail due to extra content, but worth trying
+                            self.security_report = json.loads(raw_output[json_start:])
+                        except json.JSONDecodeError:
+                            print(' ⚠️ Could not determine JSON boundaries')
                             self.security_report = {}
                 else:
+                    print(' ⚠️ No JSON found in safety output')
                     self.security_report = {}
+                
                 if result.stderr:
                     print(_(' ⚠️ Safety command produced warnings. Stderr: {}').format(result.stderr.strip()))
             else:
                 self.security_report = {}
                 if result.stderr:
                     print(_(' ⚠️ Safety command failed. Stderr: {}').format(result.stderr.strip()))
-        except json.JSONDecodeError as e:
-            print(f' ⚠️ Could not parse safety JSON output. This can happen with very old versions of `safety`. Error: {e}')
-            self.security_report = {}
+                    
         except Exception as e:
             print(_(' ⚠️ An unexpected error occurred during the security scan: {}').format(e))
             self.security_report = {}
         finally:
-            os.unlink(reqs_file_path)
-        issue_count = len(self.security_report) if isinstance(self.security_report, (list, dict)) else 0
+            if os.path.exists(reqs_file_path):
+                os.unlink(reqs_file_path)
+        
+        # Count actual vulnerabilities from the parsed safety report
+        issue_count = 0
+        
+        if isinstance(self.security_report, dict):
+            # Modern safety format has a 'vulnerabilities' key with the actual vulnerabilities
+            if 'vulnerabilities' in self.security_report:
+                vulnerabilities = self.security_report['vulnerabilities']
+                if isinstance(vulnerabilities, list):
+                    issue_count = len(vulnerabilities)
+            # Also check report_meta for vulnerabilities_found (more reliable)
+            elif 'report_meta' in self.security_report:
+                meta = self.security_report['report_meta']
+                if isinstance(meta, dict) and 'vulnerabilities_found' in meta:
+                    issue_count = int(meta['vulnerabilities_found'])
+            # Legacy format fallback
+            else:
+                for key, value in self.security_report.items():
+                    if isinstance(value, list) and key not in [
+                        'scanned_packages', 'scanned', 'scanned_full_path', 
+                        'target_languages', 'announcements', 'ignored_vulnerabilities'
+                    ]:
+                        issue_count += len(value)
+        
         print(_('✅ Security scan complete. Found {} potential issues.').format(issue_count))
 
     def run(self, targeted_packages: Optional[List[str]]=None, newly_active_packages: Optional[Dict[str, str]]=None):

tests/multiverse_analysis.py

@@ -82,21 +82,29 @@ def get_interpreter_path(version: str) -> str:
                 return path
     raise RuntimeError(f"Could not find managed Python {version} via 'omnipkg info python'.")
 
-def prepare_dimension_in_context(packages: list):
-    """Installs packages into the CURRENTLY ACTIVE dimension (must be called after swap)."""
-    print(f"   PREPARING CURRENT DIMENSION: Installing {', '.join(packages)}...")
+def prepare_dimension_with_packages(version: str, packages: list):
+    """Swaps to a dimension and installs packages in that context."""
+    print(f"   PREPARING DIMENSION {version}: Installing {', '.join(packages)}...")
+    
+    # First, swap to the target dimension
+    swap_dimension(version)
 
     start_time = time.perf_counter()
 
     original_strategy = get_config_value("install_strategy")
     try:
+        # Ensure we're using latest-active strategy for current dimension installs
         if original_strategy != 'latest-active':
+            print(f"   SETTING STRATEGY: Temporarily setting install_strategy to 'latest-active'...")
             subprocess.run(["omnipkg", "config", "set", "install_strategy", "latest-active"], check=True, capture_output=True)
 
+        # Install packages in the current (swapped) dimension
         cmd = ["omnipkg", "install"] + packages
-        subprocess.run(cmd, check=True) 
+        print(f"   INSTALLING: Running {' '.join(cmd)} in Python {version} context...")
+        subprocess.run(cmd, check=True, capture_output=True, text=True) 
 
     finally:
+        # Always restore the original install strategy
         current_strategy = get_config_value("install_strategy")
         if current_strategy != original_strategy:
             print(f"   RESTORING STRATEGY: Setting install_strategy back to '{original_strategy}'...")
@@ -105,7 +113,7 @@ def prepare_dimension_in_context(packages: list):
     end_time = time.perf_counter()
     duration_ms = (end_time - start_time) * 1000
 
-    print(f"   PREPARATION COMPLETE: {', '.join(packages)} are now available in current context.")
+    print(f"   ✅ PREPARATION COMPLETE: {', '.join(packages)} are now available in Python {version} context.")
     print(f"   ⏱️  Package installation took: {duration_ms:.2f} ms")
 
 def multiverse_analysis():
@@ -124,10 +132,10 @@ def multiverse_analysis():
         print("✅ All required dimensions are available.")
 
         # ===============================================================
-        #  MISSION STEP 1: JUMP TO PYTHON 3.9 DIMENSION & PREPARE IT
+        #  MISSION STEP 1: PREPARE PYTHON 3.9 DIMENSION WITH PACKAGES
         # ===============================================================
-        swap_dimension("3.9")  # CRITICAL: Swap BEFORE preparing
-        prepare_dimension_in_context(["numpy", "scipy"])  # Now installs in 3.9 context
+        print("\n📦 MISSION STEP 1: Setting up Python 3.9 dimension...")
+        prepare_dimension_with_packages("3.9", ["numpy", "scipy"])
         python_3_9_exe = get_interpreter_path("3.9")
 
         print("   EXECUTING PAYLOAD in 3.9 dimension...")
@@ -141,10 +149,10 @@ def multiverse_analysis():
         print(f"   ⏱️  3.9 payload execution took: {(end_time - start_time) * 1000:.2f} ms")
 
         # ===============================================================
-        #  MISSION STEP 2: JUMP TO PYTHON 3.11 DIMENSION & PREPARE IT
+        #  MISSION STEP 2: PREPARE PYTHON 3.11 DIMENSION WITH PACKAGES
         # ===============================================================
-        swap_dimension("3.11")  # CRITICAL: Swap BEFORE preparing
-        prepare_dimension_in_context(["tensorflow"])  # Now installs in 3.11 context
+        print("\n📦 MISSION STEP 2: Setting up Python 3.11 dimension...")
+        prepare_dimension_with_packages("3.11", ["tensorflow"])
         python_3_11_exe = get_interpreter_path("3.11")
 
         print("   EXECUTING PAYLOAD in 3.11 dimension...")