不再直接使用pip install 而是使用uv管理venv并安装依赖,避免破坏linux系统依赖#147
Open
Uber-Eins wants to merge 10 commits into
Open
Conversation
## Summary by Sourcery 跟踪并暴露用于 CL1/meow 的详细 Siren Research Device（crane）统计信息，并优化图像卡死检测逻辑。 New Features: - 新增 Siren Research Device 出现情况的持久化按月跟踪与查询能力，包括按来源（source）和按 hazard-level 的细分统计。 - 在 short-cat (meow) 统计中暴露 Siren Research Device 的计数和速率，并支持按 hazard level 可选过滤。 - 提供异步方法，用于记录 Siren Research Device 事件，并在获取 meow 统计时支持按 hazard-level 过滤。 Enhancements: - 通过从基于帧数的检查切换到基于时间的定时器来改进图像卡死检测逻辑，并在截图变化时适当重置。 - 扩展 meow 统计，在请求 hazard level 过滤时，在顶层展示对应 hazard-level 的聚合统计数据。 <details> <summary>Original summary in English</summary> ## Summary by Sourcery Track and expose detailed Siren Research Device (crane) stats for CL1/meow and refine image-stuck detection logic. New Features: - Add persistent monthly tracking and retrieval of Siren Research Device appearances, including per-source and per-hazard-level breakdowns. - Expose Siren Research Device count and rate in short-cat (meow) statistics, with optional filtering by hazard level. - Provide asynchronous methods for recording Siren Research Device events and fetching meow statistics with hazard-level filtering. Enhancements: - Improve image-stuck detection by switching from frame-count based checks to a time-based timer, resetting appropriately with screenshot changes. - Extend meow statistics to surface hazard-level specific aggregates at the top level when a hazard level filter is requested. </details>
## Summary by Sourcery 错误修复： - 通过从各个关卡配置中移除不一致的 `MAP_SWIPE_MULTIPLY` 覆盖设置，统一 20260520 CN 所有活动关卡的滑动行为。 <details> <summary>Original summary in English</summary> ## Summary by Sourcery Bug Fixes: - Align swipe behavior for all 20260520 CN event stages by removing inconsistent MAP_SWIPE_MULTIPLY overrides from individual stage configs. </details>
## Summary by Sourcery 增强内容： - 放宽在 B3、C3 和 D3 地图上的移动阻挡，通过将部分此前被阻挡的地块转换为可通行地形，以改善路径规划和视野。 <details> <summary>Original summary in English</summary> ## Summary by Sourcery Enhancements: - Relax movement blocking on B3, C3, and D3 maps by converting some previously blocked tiles into passable terrain to improve pathing and visibility. </details>
* Fix: story option detection pre_process (#5669) * Revert "Upd: [JP] TEMPLATE_COMBAT_LOADING (#5393)" This reverts commit e51aed9. * Add: Event Alliance Before the Hagiobull (event_20260520_cn) (#5675) * Opt: camera data in event_20260520_cn * Fix: Handle big pillar covers map grids * Upd: Battle UI GildedReverie * Fix: Handle big pillar in SP * 将应用标题从 "Alas" 更新为 "AzurPilot" * OOBE * Revert "战斗学院蓝书代替红书使用，不使用t4书" This reverts commit 7ca4f6b. --------- Co-authored-by: guoh064 <50830808+guoh064@users.noreply.github.com> Co-authored-by: ArecaSapling <115386623+sui-feng-cb@users.noreply.github.com> Co-authored-by: LmeSzinc <37934724+LmeSzinc@users.noreply.github.com> Co-authored-by: LmeSzinc <lmeszincsales@gmail.com>
Reviewer's Guide将依赖管理切换为由 uv 管理的项目本地虚拟环境，新增 Linux/macOS 上自动 .venv 引导（bootstrap），优先使用 uv pip/sync 而不是直接 pip install，并在避免修改 Linux 上系统 Python 的前提下，让配置/文档和模板与新的工作流保持一致。 通过 ensure_uv_environment 引导 uv 环境的时序图sequenceDiagram
participant gui_py
participant ensure_uv_environment
participant sync_project_venv
participant uv_cli
participant venv_python
gui_py->>ensure_uv_environment: ensure_uv_environment
ensure_uv_environment-->>ensure_uv_environment: in_project_venv
alt already in project venv or NO_BOOTSTRAP_ENV
ensure_uv_environment-->>gui_py: return
else needs bootstrap
ensure_uv_environment->>sync_project_venv: sync_project_venv
sync_project_venv-->>sync_project_venv: venv_path / venv_python
sync_project_venv-->>sync_project_venv: requirements_path
sync_project_venv-->>sync_project_venv: _needs_sync
alt venv missing or out of date
sync_project_venv->>uv_cli: _run [uv venv]
sync_project_venv->>uv_cli: _run [uv pip sync]
end
sync_project_venv-->>ensure_uv_environment: complete
ensure_uv_environment-->>venv_python: execv
end
在 pip_install 中优先使用 execute_uv_pip 而不是 execute_pip 的时序图sequenceDiagram
participant PipManager as deploy_pip_py
participant execute_uv_pip
participant execute_pip
participant uv_cli
participant pip_module
PipManager-->>PipManager: pip_install
PipManager-->>PipManager: build uv_arg / pip_arg
alt self.uv is available
PipManager->>execute_uv_pip: execute_uv_pip(install --python self.python -r requirements_file + uv_arg)
execute_uv_pip->>uv_cli: uv pip install
alt uv returns error
execute_uv_pip-->>PipManager: raise ExecutionError
else success
execute_uv_pip-->>PipManager: True
end
else uv not available
alt sys.platform == win32
PipManager->>execute_uv_pip: execute_uv_pip(install -r requirements_file + pip_arg)
execute_uv_pip->>execute_pip: execute_pip(install -r requirements_file + pip_arg)
execute_pip->>pip_module: python -m pip install
else non-Windows
PipManager->>execute_uv_pip: execute_uv_pip(install -r requirements_file + pip_arg)
execute_uv_pip-->>PipManager: raise ExecutionError
end
end
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your Experience访问你的 dashboard 以：
Getting HelpOriginal review guide in EnglishReviewer's GuideSwitches dependency management to a uv-managed project-local virtualenv, adds automatic .venv bootstrapping on Linux/macOS, prefers uv pip/sync over direct pip install, and aligns configs/docs and templates with the new workflow while avoiding mutations to system Python on Linux. Sequence diagram for uv environment bootstrap via ensure_uv_environmentsequenceDiagram
participant gui_py
participant ensure_uv_environment
participant sync_project_venv
participant uv_cli
participant venv_python
gui_py->>ensure_uv_environment: ensure_uv_environment
ensure_uv_environment-->>ensure_uv_environment: in_project_venv
alt already in project venv or NO_BOOTSTRAP_ENV
ensure_uv_environment-->>gui_py: return
else needs bootstrap
ensure_uv_environment->>sync_project_venv: sync_project_venv
sync_project_venv-->>sync_project_venv: venv_path / venv_python
sync_project_venv-->>sync_project_venv: requirements_path
sync_project_venv-->>sync_project_venv: _needs_sync
alt venv missing or out of date
sync_project_venv->>uv_cli: _run [uv venv]
sync_project_venv->>uv_cli: _run [uv pip sync]
end
sync_project_venv-->>ensure_uv_environment: complete
ensure_uv_environment-->>venv_python: execv
end
Sequence diagram for pip_install preferring execute_uv_pip over execute_pipsequenceDiagram
participant PipManager as deploy_pip_py
participant execute_uv_pip
participant execute_pip
participant uv_cli
participant pip_module
PipManager-->>PipManager: pip_install
PipManager-->>PipManager: build uv_arg / pip_arg
alt self.uv is available
PipManager->>execute_uv_pip: execute_uv_pip(install --python self.python -r requirements_file + uv_arg)
execute_uv_pip->>uv_cli: uv pip install
alt uv returns error
execute_uv_pip-->>PipManager: raise ExecutionError
else success
execute_uv_pip-->>PipManager: True
end
else uv not available
alt sys.platform == win32
PipManager->>execute_uv_pip: execute_uv_pip(install -r requirements_file + pip_arg)
execute_uv_pip->>execute_pip: execute_pip(install -r requirements_file + pip_arg)
execute_pip->>pip_module: python -m pip install
else non-Windows
PipManager->>execute_uv_pip: execute_uv_pip(install -r requirements_file + pip_arg)
execute_uv_pip-->>PipManager: raise ExecutionError
end
end
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - 我找到了 4 个安全问题和 1 个其他问题，并留下了一些高层面的反馈：
安全问题：
- 检测到子进程函数
list2cmdline在使用时没有使用静态字符串。如果这些数据可能被恶意行为者控制，那么可能会造成命令注入风险。请审计该调用的使用场景，确保它不能被外部资源控制。你可以考虑使用shlex.escape()。(链接) - 检测到子进程函数
Popen在使用时没有使用静态字符串。如果这些数据可能被恶意行为者控制，那么可能会造成命令注入风险。请审计该调用的使用场景，确保它不能被外部资源控制。你可以考虑使用shlex.escape()。(链接) - 检测到子进程函数
list2cmdline在使用时没有使用静态字符串。如果这些数据可能被恶意行为者控制，那么可能会造成命令注入风险。请审计该调用的使用场景，确保它不能被外部资源控制。你可以考虑使用shlex.escape()。(链接) - 检测到子进程函数
run在使用时没有使用静态字符串。如果这些数据可能被恶意行为者控制，那么可能会造成命令注入风险。请审计该调用的使用场景，确保它不能被外部资源控制。你可以考虑使用shlex.escape()。(链接)
总体评论：
- 在
DeployPython.pip_install中，if self.uv:的else分支在self.uv为假时仍然调用self.execute_uv_pip；在非 Windows 平台上，这将总是触发logger.critical并抛出异常，而不是回退到execute_pip。并且它还把pip_arg（包括--disable-pip-version-check）传给了uv pip而不是python -m pip，这看起来像是 uv 路径和旧版路径之间的逻辑混用。 - 更新后的 ADB
show_fix_tip消息将requirements-linux.txt和类 Unix 的 venv 路径写死，这可能会让 macOS 或 Windows 用户感到困惑；建议按平台区分指令，或者使用requirements_path/venv 辅助方法，让给出的命令与当前操作系统相匹配。
面向 AI Agent 的提示
请根据这次代码评审中的评论进行修改：
## 总体评论
- 在 `DeployPython.pip_install` 中，`if self.uv:` 的 `else` 分支在 `self.uv` 为假时仍然调用 `self.execute_uv_pip`；在非 Windows 平台上，这将总是触发 `logger.critical` 并抛出异常，而不是回退到 `execute_pip`。并且它还把 `pip_arg`（包括 `--disable-pip-version-check`）传给了 `uv pip` 而不是 `python -m pip`，这看起来像是 uv 路径和旧版路径之间的逻辑混用。
- 更新后的 ADB `show_fix_tip` 消息将 `requirements-linux.txt` 和类 Unix 的 venv 路径写死，这可能会让 macOS 或 Windows 用户感到困惑；建议按平台区分指令，或者使用 `requirements_path`/venv 辅助方法，让给出的命令与当前操作系统相匹配。
## 单独评论
### 评论 1
<location path="deploy/adb.py" line_range="21-22" />
<code_context>
- 3. Re-open Alas.exe
+ 1. Re-run the launcher so uv can refresh the local .venv
+ 2. If the problem persists, run:
+ uv pip install --python ./.venv/bin/python --reinstall-package {module} -r requirements-linux.txt
+ 3. Re-open AzurPilot
""")
</code_context>
<issue_to_address>
**suggestion:** 修复提示中硬编码的 Unix 风格 venv 路径可能会让 Windows 用户感到困惑。
这个提示使用了仅适用于 POSIX 的解释器路径（`./.venv/bin/python`），在 Windows 上会失败（应为 `.venv\\Scripts\\python.exe`）。如果这条消息在 Windows 上也会显示，就可能误导用户。请要么让路径/提示按平台区分，要么去掉 `--python`，让 `uv` 自行选择解释器。
```suggestion
2. If the problem persists, run:
uv pip install --reinstall-package {module} -r requirements-linux.txt
```
</issue_to_address>
### 评论 2
<location path="deploy/pip.py" line_range="98" />
<code_context>
command = subprocess.list2cmdline(cmd)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** 检测到子进程函数 `list2cmdline` 在使用时没有使用静态字符串。如果这些数据可能被恶意行为者控制，那么可能会造成命令注入风险。请审计该调用的使用场景，确保它不能被外部资源控制。你可以考虑使用 `shlex.escape()`。
*Source: opengrep*
</issue_to_address>
### 评论 3
<location path="deploy/pip.py" line_range="100" />
<code_context>
process = subprocess.Popen(cmd, shell=False)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** 检测到子进程函数 `Popen` 在使用时没有使用静态字符串。如果这些数据可能被恶意行为者控制，那么可能会造成命令注入风险。请审计该调用的使用场景，确保它不能被外部资源控制。你可以考虑使用 `shlex.escape()`。
*Source: opengrep*
</issue_to_address>
### 评论 4
<location path="deploy/uv.py" line_range="159" />
<code_context>
print("+ " + subprocess.list2cmdline([str(part) for part in command]))
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** 检测到子进程函数 `list2cmdline` 在使用时没有使用静态字符串。如果这些数据可能被恶意行为者控制，那么可能会造成命令注入风险。请审计该调用的使用场景，确保它不能被外部资源控制。你可以考虑使用 `shlex.escape()`。
*Source: opengrep*
</issue_to_address>
### 评论 5
<location path="deploy/uv.py" line_range="160" />
<code_context>
subprocess.run(command, cwd=str(root), check=True)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** 检测到子进程函数 `run` 在使用时没有使用静态字符串。如果这些数据可能被恶意行为者控制，那么可能会造成命令注入风险。请审计该调用的使用场景，确保它不能被外部资源控制。你可以考虑使用 `shlex.escape()`。
*Source: opengrep*
</issue_to_address>帮我变得更有用！请在每条评论上点击 👍 或 👎，我会根据你的反馈改进后续评审。
Original comment in English
Hey - I've found 4 security issues, 1 other issue, and left some high level feedback:
Security issues:
- Detected subprocess function 'list2cmdline' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
- Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
- Detected subprocess function 'list2cmdline' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
- Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
General comments:
- In
DeployPython.pip_install, theelsebranch forif self.uv:still callsself.execute_uv_pipwhenself.uvis falsy; on non-Windows platforms this will alwayslogger.criticaland raise instead of falling back toexecute_pip, and it also passespip_arg(including--disable-pip-version-check) touv piprather than topython -m pip, which looks like a logic mix-up between the uv and legacy paths. - The updated ADB
show_fix_tipmessage hardcodesrequirements-linux.txtand a Unix-style venv path, which may confuse macOS or Windows users; consider branching the instructions by platform or using therequirements_path/venv helpers so the suggested command matches the current OS.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `DeployPython.pip_install`, the `else` branch for `if self.uv:` still calls `self.execute_uv_pip` when `self.uv` is falsy; on non-Windows platforms this will always `logger.critical` and raise instead of falling back to `execute_pip`, and it also passes `pip_arg` (including `--disable-pip-version-check`) to `uv pip` rather than to `python -m pip`, which looks like a logic mix-up between the uv and legacy paths.
- The updated ADB `show_fix_tip` message hardcodes `requirements-linux.txt` and a Unix-style venv path, which may confuse macOS or Windows users; consider branching the instructions by platform or using the `requirements_path`/venv helpers so the suggested command matches the current OS.
## Individual Comments
### Comment 1
<location path="deploy/adb.py" line_range="21-22" />
<code_context>
- 3. Re-open Alas.exe
+ 1. Re-run the launcher so uv can refresh the local .venv
+ 2. If the problem persists, run:
+ uv pip install --python ./.venv/bin/python --reinstall-package {module} -r requirements-linux.txt
+ 3. Re-open AzurPilot
""")
</code_context>
<issue_to_address>
**suggestion:** Hardcoded Unix-style venv path in the remediation tip may confuse Windows users.
This tip uses a POSIX-only interpreter path (`./.venv/bin/python`), which will fail on Windows (where it would be `.venv\Scripts\python.exe`). If this message is shown on Windows too, it could mislead users. Please either make the path/platform-specific or omit `--python` and rely on `uv` to choose the interpreter.
```suggestion
2. If the problem persists, run:
uv pip install --reinstall-package {module} -r requirements-linux.txt
```
</issue_to_address>
### Comment 2
<location path="deploy/pip.py" line_range="98" />
<code_context>
command = subprocess.list2cmdline(cmd)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'list2cmdline' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>
### Comment 3
<location path="deploy/pip.py" line_range="100" />
<code_context>
process = subprocess.Popen(cmd, shell=False)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>
### Comment 4
<location path="deploy/uv.py" line_range="159" />
<code_context>
print("+ " + subprocess.list2cmdline([str(part) for part in command]))
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'list2cmdline' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>
### Comment 5
<location path="deploy/uv.py" line_range="160" />
<code_context>
subprocess.run(command, cwd=str(root), check=True)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces uv for dependency management on Linux and macOS, implementing automatic .venv bootstrapping across the project's entry points. Key additions include deploy/uv.py for environment synchronization and updates to deploy/pip.py to utilize uv for package installation. Deployment templates and documentation have been updated to reflect the shift toward a managed local environment. Review feedback suggests adopting subprocess.run for more concise command execution, improving the robustness of configuration parsing, and clarifying the naming of dependency management methods.
Comment on lines
+100
to
+101
| process = subprocess.Popen(cmd, shell=False) | ||
| process.communicate() |
Contributor
There was a problem hiding this comment.
Using subprocess.run is generally preferred over Popen and communicate for simple command execution as it is more concise and handles process cleanup automatically.
Suggested change
| process = subprocess.Popen(cmd, shell=False) | |
| process.communicate() | |
| process = subprocess.run(cmd, shell=False) |
| line = raw_line.strip() | ||
| if not line or line.startswith("#") or ":" not in line: | ||
| continue | ||
| current_key, value = line.split(":", 1) |
Contributor
There was a problem hiding this comment.
The manual YAML parsing using split(':', 1) is fragile. While it matches the 'poor yaml' style used elsewhere in the deployment scripts, it could fail if keys are not at the top level or if the file structure changes. Consider using a more robust parsing method if the configuration file complexity increases.
Comment on lines
+200
to
+205
| if self.uv: | ||
| self.execute_uv_pip( | ||
| ['install', '--python', self.python, '-r', self.requirements_file] + uv_arg | ||
| ) | ||
| else: | ||
| self.execute_uv_pip(['install', '-r', self.requirements_file] + pip_arg) |
Contributor
There was a problem hiding this comment.
The logic here calls execute_uv_pip regardless of whether uv was found. While execute_uv_pip handles the fallback to pip on Windows, the naming is slightly confusing. It might be clearer to rename execute_uv_pip to something more generic like execute_dependency_manager or explicitly call execute_pip here when self.uv is None.
Collaborator
|
提交到dev分支，master分支不能直接推送 |
Owner
|
Owner
|
现在这种方法算是临时的 因为adb什么的还是在 toolkit 里的 工作流也没大改 主要还是为了兼容性考虑 /deploy 基本上是pip的逻辑 uv是直接在启动器里搞的 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
因为遇到了这个问题，一看代码发现看起来像是uv pip compile的风格，但是残留了一些直接pip install 的部分；在linux上（如Arch Linux）这可能破坏由包管理器管理的系统层级依赖；使用uv的venv是更加现代化的解决方式
2026-05-23_launcher.txt
Summary by Sourcery
将 Linux 和 macOS 的依赖管理切换为使用由 uv 管理的虚拟环境，而不是将包安装到系统自带的 Python 中，并将启动器/图形界面（GUI）接入这一流程。
New Features:
.venv，并根据平台安装对应的依赖。.venv的 Python 可执行文件和平台锁定文件（lockfiles），而不是无界面（headless）requirements。Enhancements:
.venv的方式。Original summary in English
Summary by Sourcery
Switch Linux and macOS dependency management to uv-managed virtual environments instead of installing packages into the system Python, and wire the launcher/GUI into this flow.
New Features:
Enhancements: