Conversation
…d version alignment - Add kvcache-ai/sglang as git submodule at third_party/sglang (branch = main) - Add top-level install.sh for one-click source installation (sglang + kt-kernel) - Add sglang-kt as hard dependency in kt-kernel/pyproject.toml - Add CI workflow to auto-sync sglang submodule daily and create PR - Add CI workflow to build and publish sglang-kt to PyPI - Integrate sglang-kt build into release-pypi.yml (version.py bump publishes both packages) - Align sglang-kt version with ktransformers via SGLANG_KT_VERSION env var injection - Update Dockerfile to use submodule and inject aligned version - Update all 13 doc files, CLI hints, and i18n strings to reference new install methods Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Users can now `pip install ktransformers` to get everything (sglang-kt is auto-installed as a dependency). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This reverts commit e0cbbf6.
`pip install ktransformers` now works as a single install command. It pulls kt-kernel (which in turn pulls sglang-kt). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Prioritize sglang-kt package version (aligned with ktransformers) over sglang internal __version__ - Update display name from "sglang" to "sglang-kt" Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Recognize sglang-kt package name as proof of kvcache-ai fork installation. Previously both commands fell through to "PyPI (not recommended)" for non-editable local source installs. Now version.py reuses the centralized check_sglang_installation() logic. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly refactors the integration and installation process for SGLang within the ktransformers ecosystem. By adopting SGLang as a Git submodule and introducing a unified Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request significantly refactors the installation and dependency management process, introducing sglang as a git submodule, a unified install.sh script, and a ktransformers meta-package to simplify setup and improve maintainability. However, a critical security concern has been identified: a potential code injection vulnerability in the install.sh script where a directory path is unsafely embedded into a Python command string. While the overall code quality is high, this vulnerability requires immediate attention.
| read_kt_version() { | ||
| local version_file="$REPO_ROOT/version.py" | ||
| if [ -f "$version_file" ]; then | ||
| KT_VERSION=$(python3 -c "exec(open('$version_file').read()); print(__version__)") |
There was a problem hiding this comment.
The script uses python3 -c to extract the version from version.py by embedding the absolute path directly into the Python script string. This can lead to arbitrary code execution if the repository is cloned into a directory with a name that contains malicious Python code (e.g., ');import os;os.system('id')#).
To remediate this, pass the file path as a command-line argument to the Python script instead of embedding it in the script string.
| KT_VERSION=$(python3 -c "exec(open('$version_file').read()); print(__version__)") | |
| KT_VERSION=$(python3 -c "import sys; ns={}; exec(open(sys.argv[1]).read(), ns); print(ns['__version__'])" "$version_file") |
1 participant
What does this PR do?
Fixes # (issue)
Before submitting