Update windows setup

Author: lukeplewa

README.md

@@ -83,7 +83,7 @@ python3 agents/agent_creator/agent.py --update agents/<your_workflow>
 | Flag | Default | Description |
 |------|---------|-------------|
 | `--streaming-url URL` | *(required)* | AppStream streaming URL for the desktop session |
-| `--model-id ID` | `us.anthropic.claude-sonnet-4-6` | Bedrock model ID |
+| `--model-id ID` | `global.anthropic.claude-sonnet-4-6` | Bedrock model ID |
 | `--no-computer-use-tool` | off | Disable Claude's computer-use training optimizations |
 | `--mcp-timeout SECS` | `180` | MCP client startup timeout |
 | `--mcp-retries N` | `3` | Number of MCP connection retries |

THIRD_PARTY_LICENSES

@@ -5920,3 +5920,103 @@ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTI
 USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
+
+colorama
+0.4.6
+BSD-3-Clause
+BSD 3-Clause License
+
+Copyright (c) 2010 Jonathan Hartley
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of the copyright holders, nor those of its contributors
+  may be used to endorse or promote products derived from this software without
+  specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+pywin32
+311
+PSF-2.0
+Unless stated in the specific source file, this work is
+Copyright (c) 1994-2008, Mark Hammond
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in
+the documentation and/or other materials provided with the distribution.
+
+Neither name of Mark Hammond nor the name of contributors may be used
+to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+pywin32-ctypes
+0.2.3
+BSD-3-Clause
+Copyright (c) 2014, Enthought, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of Enthought, Inc. nor the names of its contributors may be
+  used to endorse or promote products derived from this software without
+  specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

agents/agent_creator/agent.py

@@ -490,8 +490,8 @@ def progress_handler(**kwargs):
 
 def main():
     parser = argparse.ArgumentParser(description='Workspace Agent Creator')
-    parser.add_argument('--model-id', default='us.anthropic.claude-sonnet-4-6',
-                       help='Bedrock model ID (default: us.anthropic.claude-sonnet-4-6)')
+    parser.add_argument('--model-id', default='global.anthropic.claude-sonnet-4-6',
+                       help='Bedrock model ID (default: global.anthropic.claude-sonnet-4-6)')
     parser.add_argument('--no-prompt', action='store_true',
                        help='Skip interview and read from stdin as JSON')
     parser.add_argument('--update', metavar='AGENT_DIR',

agents/generic_cua/README.md

@@ -24,7 +24,7 @@ python3 agents/generic_cua/agent.py --streaming-url "<STREAMING_URL>" \
 
 # With a specific model and region
 python3 agents/generic_cua/agent.py --streaming-url "<STREAMING_URL>" \
-  --model-id us.anthropic.claude-sonnet-4-6 \
+  --model-id global.anthropic.claude-sonnet-4-6 \
   --region us-east-1
 ```
 
@@ -36,7 +36,7 @@ python3 agents/generic_cua/agent.py --streaming-url "<STREAMING_URL>" \
 | `--system-prompt` | No | `prompts/system_prompt.md` | Path to a custom system prompt markdown file |
 | `--task-prompt` | No | None | Path to a task prompt file; triggers single-shot mode |
 | `--skill` | No | None | Path to a skill JSON file to append to the system prompt |
-| `--model-id` | No | `us.anthropic.claude-sonnet-4-6` | Bedrock model ID |
+| `--model-id` | No | `global.anthropic.claude-sonnet-4-6` | Bedrock model ID |
 | `--region` | No | `us-west-2` | AWS region for Bedrock |
 | `--no-computer-use-tool` | No | off | Disable Claude's computer-use training optimizations |
 | `--mcp-timeout` | No | `180` | MCP client startup timeout in seconds |

lib/agent_common.py

@@ -128,8 +128,8 @@ def create_base_parser(description):
     parser = argparse.ArgumentParser(description=description)
     parser.add_argument('--streaming-url',
                        help='AppStream streaming URL for the desktop session')
-    parser.add_argument('--model-id', default='us.anthropic.claude-sonnet-4-6',
-                       help='Bedrock model ID (default: us.anthropic.claude-sonnet-4-6)')
+    parser.add_argument('--model-id', default='global.anthropic.claude-sonnet-4-6',
+                       help='Bedrock model ID (default: global.anthropic.claude-sonnet-4-6)')
     parser.add_argument('--mcp-timeout', type=int, default=180,
                        help='MCP client startup timeout in seconds (default: 180)')
     parser.add_argument('--mcp-retries', type=int, default=3,
@@ -184,10 +184,10 @@ def resolve_streaming_url(parser, args):
 # work out of the box, but reject anything unexpected so a caller-supplied
 # `model_id` can't steer the agent toward an unreviewed model or region.
 ALLOWED_MODELS = frozenset({
-    "us.anthropic.claude-sonnet-4-6",
-    "us.anthropic.claude-sonnet-4-5",
-    "us.anthropic.claude-opus-4-6",
-    "us.anthropic.claude-opus-4-7",
+    "global.anthropic.claude-sonnet-4-6",
+    "global.anthropic.claude-sonnet-4-5",
+    "global.anthropic.claude-opus-4-6",
+    "global.anthropic.claude-opus-4-7",
 })
 ALLOWED_REGIONS = frozenset({
     # Americas

requirements.txt

@@ -218,6 +218,10 @@ click==8.3.3 \
     --hash=sha256:398329ad4837b2ff7cbe1dd166a4c0f8900c3ca3a218de04466f38f6497f18a2 \
     --hash=sha256:a2bf429bb3033c89fa4936ffb35d5cb471e3719e1f3c8a7c3fff0b8314305613
     # via uvicorn
+colorama==0.4.6 ; sys_platform == "win32" \
+    --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
+    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+    # via click
 cryptography==46.0.7 \
     --hash=sha256:04959522f938493042d595a736e7dbdff6eb6cc2339c11465b3ff89343b65f65 \
     --hash=sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832 \
@@ -614,6 +618,32 @@ pyperclip==1.11.0 \
     --hash=sha256:244035963e4428530d9e3a6101a1ef97209c6825edab1567beac148ccc1db1b6 \
     --hash=sha256:299403e9ff44581cb9ba2ffeed69c7aa96a008622ad0c46cb575ca75b5b84273
     # via fastmcp
+pywin32==311 ; sys_platform == "win32" \
+    --hash=sha256:0502d1facf1fed4839a9a51ccbcc63d952cf318f78ffc00a7e78528ac27d7a2b \
+    --hash=sha256:184eb5e436dea364dcd3d2316d577d625c0351bf237c4e9a5fabbcfa5a58b151 \
+    --hash=sha256:3aca44c046bd2ed8c90de9cb8427f581c479e594e99b5c0bb19b29c10fd6cb87 \
+    --hash=sha256:3ce80b34b22b17ccbd937a6e78e7225d80c52f5ab9940fe0506a1a16f3dab503 \
+    --hash=sha256:62ea666235135fee79bb154e695f3ff67370afefd71bd7fea7512fc70ef31e3d \
+    --hash=sha256:6c6f2969607b5023b0d9ce2541f8d2cbb01c4f46bc87456017cf63b73f1e2d8c \
+    --hash=sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d \
+    --hash=sha256:750ec6e621af2b948540032557b10a2d43b0cee2ae9758c54154d711cc852d31 \
+    --hash=sha256:797c2772017851984b97180b0bebe4b620bb86328e8a884bb626156295a63b3b \
+    --hash=sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a \
+    --hash=sha256:a508e2d9025764a8270f93111a970e1d0fbfc33f4153b388bb649b7eec4f9b42 \
+    --hash=sha256:a733f1388e1a842abb67ffa8e7aad0e70ac519e09b0f6a784e65a136ec7cefd2 \
+    --hash=sha256:aba8f82d551a942cb20d4a83413ccbac30790b50efb89a75e4f586ac0bb8056b \
+    --hash=sha256:b7a2c10b93f8986666d0c803ee19b5990885872a7de910fc460f9b0c2fbf92ee \
+    --hash=sha256:b8c095edad5c211ff31c05223658e71bf7116daa0ecf3ad85f3201ea3190d067 \
+    --hash=sha256:c8015b09fb9a5e188f83b7b04de91ddca4658cee2ae6f3bc483f0b21a77ef6cd \
+    --hash=sha256:d03ff496d2a0cd4a5893504789d4a15399133fe82517455e78bad62efbb7f0a3 \
+    --hash=sha256:e0c4cfb0621281fe40387df582097fd796e80430597cb9944f0ae70447bacd91 \
+    --hash=sha256:e286f46a9a39c4a18b319c28f59b61de793654af2f395c102b4f819e584b5852 \
+    --hash=sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d
+    # via mcp
+pywin32-ctypes==0.2.3 ; sys_platform == "win32" \
+    --hash=sha256:8a1513379d709975552d202d942d9837758905c8d01eb82b8bcc30918929e7b8 \
+    --hash=sha256:d162dc04946d704503b2edc4d55f3dba5c1d539ead017afa00142c38b9885755
+    # via keyring
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427

scripts/analyze_prompts.py

@@ -23,7 +23,7 @@
 # experimentation without editing the script.
 ANALYSIS_MODEL_ID = os.environ.get(
     "ANALYSIS_MODEL_ID",
-    "us.anthropic.claude-sonnet-4-20250514-v1:0",
+    "global.anthropic.claude-sonnet-4-6",
 )
 
 

scripts/deploy.sh

@@ -13,6 +13,13 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CONFIG="$SCRIPT_DIR/config.json"
 
+# Under MSYS/Cygwin (Git Bash), bash paths like /d/Users/... are not
+# understood by native Windows Python. Convert to a Windows path so
+# tools we invoke can actually open the file.
+if command -v cygpath &>/dev/null; then
+  CONFIG="$(cygpath -w "$CONFIG")"
+fi
+
 if [ ! -f "$CONFIG" ]; then
   echo "ERROR: config.json not found at $CONFIG" >&2
   exit 1
@@ -23,16 +30,46 @@ if ! command -v aws &>/dev/null; then
   exit 1
 fi
 
-if ! command -v python3 &>/dev/null && ! command -v jq &>/dev/null; then
-  echo "ERROR: Need either python3 or jq to parse config.json." >&2
+if ! command -v python3 &>/dev/null && ! command -v python &>/dev/null && ! command -v jq &>/dev/null; then
+  echo "ERROR: Need python3, python, or jq to parse config.json." >&2
+  exit 1
+fi
+
+# Pick a usable Python: prefer python3, fall back to python (common on Windows
+# where the python.org installer only provides `python.exe`). We also skip
+# anything under WindowsApps since those are the Microsoft Store stubs that
+# print "Python was not found" to stderr instead of running.
+_find_python() {
+  for c in python3 python; do
+    local path
+    path=$(command -v "$c" 2>/dev/null || true)
+    [ -z "$path" ] && continue
+    case "$path" in
+      *WindowsApps*|*windowsapps*) continue ;;
+    esac
+    if "$c" -c 'import sys; sys.exit(0 if sys.version_info>=(3,8) else 1)' &>/dev/null; then
+      echo "$c"
+      return 0
+    fi
+  done
+  return 1
+}
+PYTHON_BIN=$(_find_python || true)
+if [ -z "$PYTHON_BIN" ]; then
+  echo "ERROR: No working Python 3.8+ found on PATH." >&2
+  echo "  If you are on Windows, install Python from https://www.python.org/" >&2
+  echo "  or disable the Microsoft Store 'python' alias under Settings >" >&2
+  echo "  Manage App Execution Aliases." >&2
   exit 1
 fi
 
 # ── Helper: read config values ────────────────────────────────
+# We pass CONFIG through sys.argv (not interpolated into the Python source) so
+# paths with backslashes or special chars don't break the Python string literal.
 cfg() {
-  python3 -c "
+  "$PYTHON_BIN" -c "
 import json,re,sys
-raw=open('$CONFIG').read()
+raw=open(sys.argv[1]).read()
 raw=re.sub(r'(?m)^\s*//.*$','',raw)
 raw=re.sub(r',\s*//[^\n]*','',raw)
 d=json.loads(raw)
@@ -43,7 +80,7 @@ elif isinstance(v, bool):
     print(str(v))
 else:
     print(v)
-" 2>/dev/null || echo ""
+" "$CONFIG" 2>/dev/null || echo ""
 }
 
 # ── Read config ───────────────────────────────────────────────
@@ -57,12 +94,12 @@ if [ "$USE_EXISTING" = "True" ]; then
   REGION="${ENV_REGION:-${CFG_REGION:-us-east-1}}"
   VPC_ID=$(cfg '["vpc"]["existing"]["vpcId"]')
   SUBNET_ID=$(cfg '["vpc"]["existing"]["subnetId"]')
-  SG_IDS=$(python3 -c "
-import json
-cfg=json.load(open('$CONFIG'))
+  SG_IDS=$("$PYTHON_BIN" -c "
+import json, sys
+cfg=json.load(open(sys.argv[1]))
 sgs=cfg['vpc']['existing'].get('securityGroupIds',[])
 print(sgs[0] if sgs else '')
-")
+" "$CONFIG")
 else
   CFG_REGION=$(cfg '["vpc"]["new"]["region"]')
   REGION="${ENV_REGION:-${CFG_REGION:-us-east-1}}"
@@ -345,10 +382,26 @@ if [ "$STACK_EXISTS" != "None" ] && [ -n "$STACK_EXISTS" ]; then
 else
   # AgentAccessConfig is not yet in the public AWS CLI, so we send a
   # SigV4-signed PhotonAdminProxyService.CreateStack request directly.
+  # This requires botocore. Prefer a project venv Python if available
+  # (install.sh/.ps1 put it there); otherwise fall back to $PYTHON_BIN.
+  SIGV4_PYTHON="$PYTHON_BIN"
+  _venv_python_unix="$SCRIPT_DIR/../venv/bin/python"
+  _venv_python_win="$SCRIPT_DIR/../venv/Scripts/python.exe"
+  if [ -x "$_venv_python_unix" ]; then
+    SIGV4_PYTHON="$_venv_python_unix"
+  elif [ -x "$_venv_python_win" ]; then
+    SIGV4_PYTHON="$_venv_python_win"
+  fi
+  if ! "$SIGV4_PYTHON" -c 'import botocore' &>/dev/null; then
+    echo "ERROR: botocore is not importable by $SIGV4_PYTHON." >&2
+    echo "  Run scripts/install.sh (or install.ps1) first to create the project venv." >&2
+    exit 1
+  fi
+
   # We fail hard on any error: creating a stack without AgentAccessConfig
   # would silently break the Agent Access MCP flow at runtime.
   echo "Creating agent stack with AgentAccessConfig..."
-  python3 -c "
+  "$SIGV4_PYTHON" -c "
 import json, sys, urllib.request, urllib.error
 from botocore.auth import SigV4Auth
 from botocore.awsrequest import AWSRequest

scripts/deploy_agentcore.sh

@@ -349,7 +349,7 @@ def _build_agent(body):
     except ValueError as e:
         raise ValueError(f"invalid endpoint/region: {e}") from e
     task_prompt_override = body.get("task_prompt") or body.get("prompt")
-    model_id = body.get("model_id", "us.anthropic.claude-sonnet-4-6")
+    model_id = body.get("model_id", "global.anthropic.claude-sonnet-4-6")
 
     if not streaming_url:
         raise ValueError(
@@ -613,12 +613,14 @@ if [ -n "$EXEC_ROLE" ] && [ "$EXEC_ROLE" != "None" ]; then
 
   # Scope Bedrock / AppStream / logs actions to the specific resources this
   # runtime needs. Operators should export these before running the deploy:
-  #   ALLOWED_MODEL_ARNS  = "arn:aws:bedrock:...::foundation-model/us.anthropic.claude-sonnet-4-6,..."
+  #   ALLOWED_MODEL_ARNS  = "arn:aws:bedrock:...::foundation-model/global.anthropic.claude-sonnet-4-6,..."
   #   STACK_ARN           = "arn:aws:appstream:us-west-2:123:stack/WorkspacesAgentDemo"
   #   FLEET_ARN           = "arn:aws:appstream:us-west-2:123:fleet/WorkspacesAgentDemo"
   # Defaults below are permissive to keep the demo working out of the box;
-  # harden them before any production use.
-  ALLOWED_MODEL_ARNS="${ALLOWED_MODEL_ARNS:-arn:aws:bedrock:*::foundation-model/us.anthropic.claude-*}"
+  # harden them before any production use. We allow both the global.* and us.*
+  # inference-profile prefixes plus the underlying foundation-model ARNs so
+  # Bedrock can resolve the profile to a target model in any routed region.
+  ALLOWED_MODEL_ARNS="${ALLOWED_MODEL_ARNS:-arn:aws:bedrock:*::foundation-model/anthropic.claude-*,arn:aws:bedrock:*:*:inference-profile/global.anthropic.claude-*,arn:aws:bedrock:*:*:inference-profile/us.anthropic.claude-*}"
   STACK_ARN="${STACK_ARN:-arn:aws:appstream:*:*:stack/*}"
   FLEET_ARN="${FLEET_ARN:-arn:aws:appstream:*:*:fleet/*}"
   LOG_GROUP_ARN="${LOG_GROUP_ARN:-arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/runtimes/*:*}"

scripts/install.ps1

@@ -27,7 +27,16 @@ $PythonCmd = $null
 foreach ($candidate in @('python3.12', 'python3.11', 'python3.10', 'python3', 'python')) {
     $cmd = Get-Command $candidate -ErrorAction SilentlyContinue
     if ($cmd) {
-        $versionOutput = & $candidate --version 2>&1
+        # Skip Microsoft Store python stubs — they print "not found" to stderr.
+        if ($cmd.Source -and $cmd.Source -match '\\WindowsApps\\') {
+            continue
+        }
+        $versionOutput = ''
+        try {
+            $versionOutput = & $candidate --version 2>&1 | Out-String
+        } catch {
+            continue
+        }
         if ($versionOutput -match 'Python\s+(\d+)\.(\d+)') {
             $major = [int]$Matches[1]
             $minor = [int]$Matches[2]
@@ -62,7 +71,9 @@ if (-not (Test-Path $VenvPython)) {
 }
 
 & $VenvPython -m pip install --upgrade pip *> $null
-& $VenvPython -m pip install -r requirements.txt *> $null
+# Run pip with output visible so any failures (missing hashes, network, etc.)
+# surface to the user instead of being swallowed.
+& $VenvPython -m pip install -r requirements.txt
 if ($LASTEXITCODE -ne 0) { Write-Fail "Failed to install Python dependencies" }
 Write-Ok "Python dependencies installed"