Cross‑platform bootstrap script with embedded Python 3.14#3
Conversation
Reviewer's GuideIntroduces a new cross‑platform bootstrapper (main.py) that provisions an embedded Python 3.14 environment, installs dependencies, prefers a native portablemc binary when available, and launches the existing Flask/SocketIO Minecraft launcher (renamed to portablemc.py), which is updated to handle both the portablemc binary and Python module modes and to simplify/normalize various server‑side behaviors and logging. Sequence diagram for bootstrap and launcher execution with portablemc modessequenceDiagram
actor User
participant SystemPython as system_python
participant Main as main_py
participant Embedded as embedded_python_3_14
participant Pip as pip
participant PmcBin as portablemc_binary
participant PmcMod as portablemc_module
participant Launcher as portablemc_py
participant MCServer as minecraft_server
User->>SystemPython: run main_py
SystemPython->>Main: execute main()
Main->>Main: ensure_embedded_python()
Main->>Main: fix_pth_file()
Main->>Embedded: check -m pip --version
alt pip not installed
Main->>Embedded: run get_pip_py
Embedded->>Pip: bootstrap pip
end
Main->>Embedded: pip install base packages
Main->>Embedded: ensure_portablemc()
alt portablemc binary available
Embedded->>PmcBin: test --help
Main->>Main: method = binary
else portablemc module via pip
Embedded->>Pip: pip install portablemc
Embedded->>PmcMod: python -m portablemc --help
Main->>Main: method = module
end
Main->>Embedded: launch_launcher(method)
Embedded->>Launcher: run portablemc_py
note right of Launcher: PORTABLEMC_METHOD env set to binary or module
alt method is binary
Launcher->>PmcBin: portablemc --main-dir . start --join-server SERVER_IP --jvm-arg=opts -u user
else method is module
Launcher->>Embedded: python -m portablemc --main-dir . --timeout 60 --output human-color start --server SERVER_IP --jvm-args opts -u user
Embedded->>PmcMod: start game
end
par game session
PmcBin-->>MCServer: connect and run Minecraft
PmcMod-->>MCServer: connect and run Minecraft
end
Sequence diagram for portablemc_py stream route launching portablemcsequenceDiagram
participant Browser as web_client
participant Flask as flask_app_portablemc_py
participant Gen as stream_generator
participant Sub as subprocess_portablemc
participant MC as minecraft_server
Browser->>Flask: GET /stream?user=...
Flask->>Flask: validate username and password
Flask->>Flask: check active_processes for user
alt core busy
Flask-->>Browser: SSE error CORE BUSY and CLOSE
else core free
Flask->>Gen: create generator(generate)
Flask-->>Browser: SSE stream from Gen
note right of Flask: PORTABLEMC_METHOD env controls
note right of Flask: binary vs module command
Gen->>Flask: build launcher_cmd
alt PORTABLEMC_METHOD == binary
Gen->>Gen: cmd = [portablemc, --main-dir ., start, --join-server SERVER_IP, --jvm-arg=opts, fabric:, -u user]
else module mode
Gen->>Gen: cmd = [python_exe, -m portablemc, --main-dir ., --timeout 60, --output human-color, start, --server SERVER_IP, --jvm-args opts, fabric:, -u user]
end
Gen->>Sub: subprocess_popen(cmd, stdout=PIPE)
Gen->>Sub: read stdout lines
loop forward console output
Sub-->>Gen: line
Gen-->>Browser: SSE data payload (ansi or html)
end
Sub-->>MC: connect to minecraft_server and run game
alt client disconnects
Browser--xFlask: close SSE connection
Gen->>Sub: terminate or kill process tree
else game exits normally
Sub-->>Gen: process exit
Gen-->>Browser: SSE SESSION ENDED and CLOSE
end
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
| env["PYTHONNOUSERSITE"] = "1" | ||
| env["PYTHONPATH"] = "" | ||
| cmd = [str(EMBEDDED_PYTHON)] + args | ||
| result = subprocess.run(cmd, env=env, capture_output=True, text=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| cmd = [str(EMBEDDED_PYTHON), str(pip_script), | ||
| "--trusted-host=files.pythonhosted.org", | ||
| "--trusted-host=pypi.org"] | ||
| result = subprocess.run(cmd, env=env, capture_output=True, text=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| result = subprocess.run([str(binary_path), "--help"], env=env, | ||
| capture_output=True, text=True, timeout=5) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| env["PYTHONNOUSERSITE"] = "1" | ||
| env["PYTHONPATH"] = "" | ||
| cmd = [str(EMBEDDED_PYTHON), "-m", "portablemc", "--help"] | ||
| result = subprocess.run(cmd, env=env, capture_output=True, text=True, timeout=5) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| cmd = [str(EMBEDDED_PYTHON), str(launcher_script)] | ||
| print(f"🚀 Launching: {' '.join(cmd)}") | ||
| try: | ||
| subprocess.run(cmd, env=env, check=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| pip_check = subprocess.run([str(EMBEDDED_PYTHON), "-m", "pip", "--version"], | ||
| env=env_check, capture_output=True, text=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
There was a problem hiding this comment.
Hey - I've found 6 security issues, 2 other issues, and left some high level feedback:
Security issues:
- Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
- Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
- Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
- Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
- Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
- Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. (link)
General comments:
- The bootstrap script hardcodes the Windows embeddable Python URL and
python.exepath but is labeled cross‑platform; on non‑Windows systems this will fail—consider gating the embedded-Python flow to Windows only or adding OS-specific download/exec logic. - In
portablemc.py,launcher_cmdis chosen solely viashutil.which("portablemc")/module fallback, while argument selection depends onPORTABLEMC_METHOD; this can result in using binary-style arguments with a module CLI (or vice versa) if multipleportablemcexecutables are on PATH—tie launcher selection directly toPORTABLEMC_METHODto avoid mismatches. - In
test_portablemc, the module check usessubprocess.run(..., timeout=5)without catchingsubprocess.TimeoutExpired, so a slow or hungportablemcmodule will crash the bootstrapper; wrap this call in a try/except similar to the binary branch.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The bootstrap script hardcodes the Windows embeddable Python URL and `python.exe` path but is labeled cross‑platform; on non‑Windows systems this will fail—consider gating the embedded-Python flow to Windows only or adding OS-specific download/exec logic.
- In `portablemc.py`, `launcher_cmd` is chosen solely via `shutil.which("portablemc")`/module fallback, while argument selection depends on `PORTABLEMC_METHOD`; this can result in using binary-style arguments with a module CLI (or vice versa) if multiple `portablemc` executables are on PATH—tie launcher selection directly to `PORTABLEMC_METHOD` to avoid mismatches.
- In `test_portablemc`, the module check uses `subprocess.run(..., timeout=5)` without catching `subprocess.TimeoutExpired`, so a slow or hung `portablemc` module will crash the bootstrapper; wrap this call in a try/except similar to the binary branch.
## Individual Comments
### Comment 1
<location path="main.py" line_range="19-22" />
<code_context>
+from pathlib import Path
+
+# --- Configuration ---
+EMBEDDED_DIR = Path(__file__).parent / "python"
+EMBEDDED_PYTHON = EMBEDDED_DIR / "python.exe"
+PYTHON_VERSION = "3.14.3"
+PYTHON_URL = f"https://www.python.org/ftp/python/{PYTHON_VERSION}/python-{PYTHON_VERSION}-embed-amd64.zip"
+GET_PIP_URL = "https://bootstrap.pypa.io/get-pip.py"
+BASE_PACKAGES = ["flask", "flask-socketio", "psutil", "ansi2html"]
</code_context>
<issue_to_address>
**issue (bug_risk):** Bootstrap is described as cross‑platform but uses a Windows‑only embedded Python distribution.
`EMBEDDED_PYTHON` is fixed to `python.exe` and `PYTHON_URL` targets the Windows embedded ZIP, so `ensure_embedded_python()` and any use of `EMBEDDED_PYTHON` will fail on non‑Windows systems. To align with the cross‑platform claim, you’ll need OS‑specific Python downloads/paths or reuse system Python on non‑Windows. If this bootstrap is meant to be Windows‑only, add an early, explicit OS check and fail fast with a clear message on other platforms.
</issue_to_address>
### Comment 2
<location path="main.py" line_range="214" />
<code_context>
+ env = os.environ.copy()
+ env["PYTHONNOUSERSITE"] = "1"
+ env["PYTHONPATH"] = ""
+ cmd = [str(EMBEDDED_PYTHON), "-m", "portablemc", "--help"]
+ result = subprocess.run(cmd, env=env, capture_output=True, text=True, timeout=5)
+ if result.returncode == 0:
</code_context>
<issue_to_address>
**issue (bug_risk):** Module `portablemc` probe uses a timeout but doesn’t catch `TimeoutExpired` like the binary probe does.
Unlike the binary probe, this path doesn’t catch `subprocess.TimeoutExpired` around `subprocess.run(..., timeout=5)`. If `-m portablemc --help` hangs, the bootstrap will crash instead of simply treating the module as unavailable. Please wrap this call in `try/except TimeoutExpired` and handle it the same way as the binary branch so timeouts are treated as a probe failure, not a hard error.
</issue_to_address>
### Comment 3
<location path="main.py" line_range="122" />
<code_context>
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>
### Comment 4
<location path="main.py" line_range="140" />
<code_context>
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>
### Comment 5
<location path="main.py" line_range="203-204" />
<code_context>
result = subprocess.run([str(binary_path), "--help"], env=env,
capture_output=True, text=True, timeout=5)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>
### Comment 6
<location path="main.py" line_range="215" />
<code_context>
result = subprocess.run(cmd, env=env, capture_output=True, text=True, timeout=5)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>
### Comment 7
<location path="main.py" line_range="258" />
<code_context>
subprocess.run(cmd, env=env, check=True)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>
### Comment 8
<location path="main.py" line_range="276-277" />
<code_context>
pip_check = subprocess.run([str(EMBEDDED_PYTHON), "-m", "pip", "--version"],
env=env_check, capture_output=True, text=True)
</code_context>
<issue_to_address>
**security (python.lang.security.audit.dangerous-subprocess-use-audit):** Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| env["PYTHONNOUSERSITE"] = "1" | ||
| env["PYTHONPATH"] = "" | ||
| cmd = [str(EMBEDDED_PYTHON)] + args | ||
| result = subprocess.run(cmd, env=env, capture_output=True, text=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| cmd = [str(EMBEDDED_PYTHON), str(pip_script), | ||
| "--trusted-host=files.pythonhosted.org", | ||
| "--trusted-host=pypi.org"] | ||
| result = subprocess.run(cmd, env=env, capture_output=True, text=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| result = subprocess.run([str(binary_path), "--help"], env=env, | ||
| capture_output=True, text=True, timeout=5) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| env["PYTHONNOUSERSITE"] = "1" | ||
| env["PYTHONPATH"] = "" | ||
| cmd = [str(EMBEDDED_PYTHON), "-m", "portablemc", "--help"] | ||
| result = subprocess.run(cmd, env=env, capture_output=True, text=True, timeout=5) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| cmd = [str(EMBEDDED_PYTHON), str(launcher_script)] | ||
| print(f"🚀 Launching: {' '.join(cmd)}") | ||
| try: | ||
| subprocess.run(cmd, env=env, check=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| pip_check = subprocess.run([str(EMBEDDED_PYTHON), "-m", "pip", "--version"], | ||
| env=env_check, capture_output=True, text=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| cmd = [str(EMBEDDED_PYTHON), str(launcher_script)] | ||
| print(f"🚀 Launching: {' '.join(cmd)}") | ||
| try: | ||
| subprocess.run(cmd, env=env, check=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
| pip_check = subprocess.run([str(EMBEDDED_PYTHON), "-m", "pip", "--version"], | ||
| env=env_check, capture_output=True, text=True) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
|
Fully works, but does not bypass group policy, this will be merged, but the main pull request is with .NET |
1 participant
Cross‑platform bootstrap script with embedded Python 3.14
Attempts to download the native portablemc binary, falls back to pip.
Run with any Python (e.g., system 3.11) to set up and launch the launcher.
This main.py file will run "launch.py" will try the following things:
curl -o get-pip.py https://bootstrap.pypa.io/get-pip.py/python/python.exe get-pip.py --trusted-host=files.pythonhosted.org --trusted-host=pypi.org/python/python.exe -m pip install --upgrade pipand use "--user" argument if requiredpython -m pip install flask flask-socketio psutil ansi2html portablemc__compat_layer = runasinvokerwith embedded.Summary by Sourcery
Introduce a cross-platform bootstrapper that provisions an embedded Python runtime and launches the web-based PortableMC launcher, which now supports both native binary and Python module execution modes.
New Features:
Enhancements: