The original change removed atomacos from dependencies but left it
bundled in the same try/except as AppKit. Without atomacos installed,
the ImportError made MACOS_LIBS_AVAILABLE=False, silently disabling
every macOS feature (screenshots, window control, etc.) even though
they never use atomacos.
- Split import into independent try/except blocks
- Guard get_accessibility_tree() with ATOMACOS_AVAILABLE
- Condense redundant comments in requirements files
- Tighten README note into a blockquote
Versions 1.82.7 and 1.82.8 of litellm were published on March 24, 2026
and contained malicious code that exfiltrated credentials (SSH keys,
cloud credentials, .env files, API keys) to an attacker-controlled domain.
Pin the dependency to >=1.70.0,<1.82.7 in both pyproject.toml and
requirements.txt as a stopgap until litellm can be replaced with direct
provider SDK calls.
See: https://github.com/HKUDS/OpenSpace/issues/31
Ref: PYSEC-2026-2, BerriAI/litellm#24521
