引入插件依赖机制，插件需要依赖时，可以在插件目录下添加requirements.txt

插件市场小型插件投稿可以在path中填写依赖文件
例如："path": ["alone/字符字.py", "alone/requirements.txt"]

Author: lengxi-root

core/base/pip_helper.py

@@ -9,12 +9,14 @@
 """
 
 import asyncio
+import contextlib
 import importlib
 import importlib.metadata as _metadata
 import os
 import re
 import subprocess
 import sys
+import tempfile
 import threading
 
 from core.base.config import cfg
@@ -73,24 +75,83 @@ def _pip_install_sync(cmd, name, deps_summary=''):
     return result.returncode, stderr
 
 
-def all_requirements_met(req_path):
-    """检查 requirements.txt 中所有包是否已安装 (纯本地, 不联网)。"""
+_REQ_RE = re.compile(r'^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*(.*)$')  # 包名 + 可选 extras + 其余
+
+
+def _norm_pkg(name):
+    """PEP 503 规范化包名 (跨清单去重用)。"""
+    return re.sub(r'[-_.]+', '-', name).lower()
+
+
+def _parse_req(line):
+    """解析一行依赖 → (包名, 版本元组, 原始 spec); 无效行返回 None。"""
+    s = line.split('#', 1)[0].strip()
+    if not s or s.startswith('-'):
+        return None
+    m = _REQ_RE.match(s)
+    if not m:
+        return None
+    name, rest = m.group(1), m.group(2).split(';', 1)[0]
+    vm = re.search(r'([0-9]+(?:\.[0-9]+)*)', rest)
+    try:
+        ver = tuple(int(x) for x in vm.group(1).split('.')) if vm else ()
+    except ValueError:
+        ver = ()
+    return name, ver, s
+
+
+def _merge_requirements(req_files):
+    """合并多份依赖清单, 同包版本冲突取最高版本, 保持首次出现顺序。"""
+    best, order = {}, []
+    for fp in req_files:
+        try:
+            with open(fp, encoding='utf-8') as f:
+                lines = f.readlines()
+        except Exception:
+            continue
+        for raw in lines:
+            parsed = _parse_req(raw)
+            if not parsed:
+                continue
+            name, ver, spec = parsed
+            key = _norm_pkg(name)
+            if key not in best:
+                best[key] = (ver, spec)
+                order.append(key)
+            elif ver > best[key][0]:
+                best[key] = (ver, spec)
+    return [best[k][1] for k in order]
+
+
+def _discover_req_files(target_dir):
+    """目录下所有依赖清单: requirements.txt + *_requirements.txt。"""
     try:
-        with open(req_path, encoding='utf-8') as f:
-            lines = f.readlines()
-    except Exception:
-        return False
-    for raw in lines:
-        pkg = re.split(r'[>=<!\[;]', raw.strip())[0].strip()
-        if not pkg or pkg.startswith(('#', '-')):
+        names = sorted(os.listdir(target_dir))
+    except OSError:
+        return []
+    return [os.path.join(target_dir, f) for f in names
+            if (f == 'requirements.txt' or f.endswith('_requirements.txt'))
+            and os.path.isfile(os.path.join(target_dir, f))]
+
+
+def _specs_met(specs):
+    """检查依赖 spec 是否都已安装 (纯本地)。"""
+    for spec in specs:
+        parsed = _parse_req(spec)
+        if not parsed:
             continue
         try:
-            _metadata.distribution(pkg)
+            _metadata.distribution(parsed[0])
         except _metadata.PackageNotFoundError:
             return False
     return True
 
 
+def all_requirements_met(req_path):
+    """检查单份 requirements.txt 中所有包是否已安装 (纯本地)。"""
+    return _specs_met(_merge_requirements([req_path]))
+
+
 def _mirror_attempts():
     """返回按优先级排列的镜像参数列表; '' 表示官方源 (不带 -i)。
 
@@ -128,27 +189,25 @@ def _build_cmd(req_path, mirror, no_cache, target=None):
 
 
 async def install_requirements(name, target_dir, *, skip_if_met=False, no_cache=False):
-    """检查并安装 requirements.txt 依赖 (venv 原生, 无 root 时 --user 兜底, 多镜像兜底)。
-
-    全程在独立线程池里跑, 不阻塞事件循环。
-    """
-    req_path = os.path.join(target_dir, 'requirements.txt')
-    if not os.path.isfile(req_path):
-        return
+    """安装目录下所有依赖清单 (合并后装齐, venv原生/.pydeps免root/多镜像兜底, 独立线程池不阻塞)。"""
     if not cfg.get('settings', 'pip.auto_install', True):
         return
-    if skip_if_met and all_requirements_met(req_path):
+    req_files = _discover_req_files(target_dir)
+    if not req_files:
         return
-
-    try:
-        with open(req_path, encoding='utf-8') as f:
-            deps = [line.strip() for line in f if line.strip() and not line.startswith(('#', '-'))]
-        deps_summary = ', '.join(deps)
-    except Exception:
-        deps_summary = ''
+    specs = _merge_requirements(req_files)
+    if not specs:
+        return
+    if skip_if_met and _specs_met(specs):
+        return
+    deps_summary = ', '.join(specs)
 
     loop = asyncio.get_running_loop()
     mirrors = _mirror_attempts()
+    # 合并结果写临时清单交给 pip, 不污染插件目录
+    fd, req_path = tempfile.mkstemp(prefix='elaina-req-', suffix='.txt')
+    with os.fdopen(fd, 'w', encoding='utf-8') as f:
+        f.write('\n'.join(specs) + '\n')
 
     async def _try(target=None):
         """按镜像顺序尝试安装; 返回 (成功?, 最后错误, 是否疑似权限问题)。"""
@@ -172,16 +231,19 @@ async def _try(target=None):
                 log.warning(f'[{name}] pip 失败 (源: {tag}): {stderr[:200]}')
         return False, last, perm
 
-    ok, last_stderr, perm = await _try()
-    if ok:
-        return
-    # site-packages 不可写 (无 root / venv 属主为 root) → 改装到可写的 .pydeps 并注入 sys.path
-    if perm:
-        os.makedirs(_DEPS_DIR, exist_ok=True)
-        _ensure_deps_dir_on_path()
-        log.info(f'[{name}] site-packages 不可写, 依赖改装到 {_DEPS_DIR} (免 root)...')
-        ok, last_stderr, _ = await _try(target=_DEPS_DIR)
+    try:
+        ok, last_stderr, perm = await _try()
         if ok:
             return
-
-    log.warning(f'[{name}] 依赖安装失败, 已尝试全部镜像/兜底; 最后错误: {last_stderr[:200]}')
+        # site-packages 不可写 (无 root / venv 属主为 root) → 改装到可写的 .pydeps 并注入 sys.path
+        if perm:
+            os.makedirs(_DEPS_DIR, exist_ok=True)
+            _ensure_deps_dir_on_path()
+            log.info(f'[{name}] site-packages 不可写, 依赖改装到 {_DEPS_DIR} (免 root)...')
+            ok, last_stderr, _ = await _try(target=_DEPS_DIR)
+            if ok:
+                return
+        log.warning(f'[{name}] 依赖安装失败, 已尝试全部镜像/兜底; 最后错误: {last_stderr[:200]}')
+    finally:
+        with contextlib.suppress(OSError):
+            os.remove(req_path)

tests/core/test_pip_helper_merge.py

@@ -0,0 +1,50 @@
+"""单元测试: pip_helper 多依赖清单发现 + 合并 + 版本冲突取最高版本"""
+
+import os
+import tempfile
+
+from core.base import pip_helper
+
+
+def _write(d, name, text):
+    with open(os.path.join(d, name), 'w', encoding='utf-8') as f:
+        f.write(text)
+
+
+def test_parse_req():
+    assert pip_helper._parse_req('openai>=1.0.0')[0] == 'openai'
+    assert pip_helper._parse_req('openai>=1.0.0')[1] == (1, 0, 0)
+    assert pip_helper._parse_req('# comment') is None
+    assert pip_helper._parse_req('-r other.txt') is None
+    assert pip_helper._parse_req('  ') is None
+    # extras + marker 不影响包名
+    assert pip_helper._parse_req('uvicorn[standard]>=0.30; python_version>="3.8"')[0] == 'uvicorn'
+
+
+def test_norm_pkg():
+    assert pip_helper._norm_pkg('Nonebot_Plugin.Foo') == 'nonebot-plugin-foo'
+
+
+def test_discover_and_merge_highest_version():
+    d = tempfile.mkdtemp()
+    # 共享 alone 目录: 两个插件各一份, 都声明 openai 但版本不同
+    _write(d, '今日猪猪_requirements.txt', 'openai>=1.0.0\nhttpx>=0.27\n')
+    _write(d, '字符字_requirements.txt', 'openai>=1.3.0\nnumpy>=1.24\n')
+    _write(d, 'requirements.txt', 'pillow>=10.0\n')
+    # 非依赖清单不应被发现
+    _write(d, 'config.txt', 'ignore me\n')
+
+    files = pip_helper._discover_req_files(d)
+    names = {os.path.basename(f) for f in files}
+    assert names == {'今日猪猪_requirements.txt', '字符字_requirements.txt', 'requirements.txt'}
+
+    merged = pip_helper._merge_requirements(files)
+    # openai 取最高版本 1.3.0
+    assert 'openai>=1.3.0' in merged
+    assert 'openai>=1.0.0' not in merged
+    # 其它包保留
+    assert any(s.startswith('httpx') for s in merged)
+    assert any(s.startswith('numpy') for s in merged)
+    assert any(s.startswith('pillow') for s in merged)
+    # openai 只出现一次
+    assert sum(1 for s in merged if s.startswith('openai')) == 1

tests/test_market_multi_install.py

@@ -161,3 +161,56 @@ async def fake_dl(url, **kw):
     assert os.path.isfile(os.path.join(pdir, 'index.py'))
     assert os.path.isfile(os.path.join(pdir, 'x.html'))
     assert not os.path.exists(os.path.join(pdir, 'index.py').replace('A', 'B'))
+
+
+# ==================== single(alone): path 声明 requirements.txt ====================
+
+
+async def test_alone_path_with_requirements(base, monkeypatch):
+    """path 为数组: .py 装到 alone/<名>.py, 声明的 requirements.txt → alone/<名>_requirements.txt"""
+    async def fake_dl(url, **kw):
+        if url.endswith('requirements.txt'):
+            return b'openai>=1.0.0\n'
+        return b'"""x"""\n__plugin_meta__ = {"version": "1.0.0"}\n'
+
+    monkeypatch.setattr(install, '_download_file', fake_dl)
+    result, target = await install._install_single(
+        'https://github.com/u/r', '今日猪猪',
+        path=['alone/今日猪猪.py', 'alone/requirements.txt'], alone=True)
+    assert result['success'], result
+    assert target == install._ALONE_DIR
+    alone = os.path.join(base, 'plugins', 'alone')
+    assert os.path.isfile(os.path.join(alone, '今日猪猪.py'))
+    # 默认名 requirements.txt 加前缀
+    assert os.path.isfile(os.path.join(alone, '今日猪猪_requirements.txt'))
+    assert not os.path.exists(os.path.join(alone, 'requirements.txt'))
+
+
+async def test_alone_path_named_requirements_kept(base, monkeypatch):
+    """作者声明的文件本就是 xxx_requirements.txt → 原样保存, 不加前缀"""
+    async def fake_dl(url, **kw):
+        if url.endswith('.txt'):
+            return b'httpx>=0.27\n'
+        return b'__plugin_meta__ = {"version": "1.0.0"}\n'
+
+    monkeypatch.setattr(install, '_download_file', fake_dl)
+    result, _ = await install._install_single(
+        'https://github.com/u/r', '字符字',
+        path='alone/字符字.py, alone/字符字_requirements.txt', alone=True)
+    assert result['success'], result
+    alone = os.path.join(base, 'plugins', 'alone')
+    assert os.path.isfile(os.path.join(alone, '字符字.py'))
+    assert os.path.isfile(os.path.join(alone, '字符字_requirements.txt'))
+
+
+def test_split_paths_forms():
+    assert install._split_paths(['a.py', 'b.txt']) == ['a.py', 'b.txt']
+    assert install._split_paths('a.py, b.txt') == ['a.py', 'b.txt']
+    assert install._split_paths('/alone/a.py/') == ['alone/a.py']
+    assert install._split_paths('') == []
+
+
+def test_alone_dep_dest_name():
+    assert install._alone_dep_dest_name('requirements.txt', '猪猪') == '猪猪_requirements.txt'
+    assert install._alone_dep_dest_name('字符字_requirements.txt', '猪猪') == '字符字_requirements.txt'
+    assert install._alone_dep_dest_name('config.json', '猪猪') is None