Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/core/utils/pip_installer.py" line_range="137-146" />
<code_context>
     return names


+def _split_package_install_input(raw_input: str) -> list[str]:
+    normalized = raw_input.strip()
+    if not normalized:
+        return []
+
+    if "\n" in normalized or "\r" in normalized:
+        return _split_multiline_package_input(normalized)
+
+    if _is_valid_install_requirement(normalized):
+        return [normalized]
+
+    split_tokens = shlex.split(normalized)
+    if split_tokens and all(_is_valid_install_token(token) for token in split_tokens):
+        return split_tokens
</code_context>
<issue_to_address>
**issue (bug_risk):** Single-line input with options and arguments (e.g. `-e .` or `--index-url URL`) can be misclassified and passed as a single pip arg.

Because `_is_valid_install_token` only auto-accepts tokens starting with `-` and otherwise requires them to be `Requirement`-parsable, any option+value pair (e.g. `-e .`, `--index-url https://…`) fails the `all(_is_valid_install_token(...))` check. The code then falls back to `[normalized]`, so pip sees a single argument with spaces (`"-e ."`), which is invalid. To avoid this, either relax validation for option arguments (so option+value pairs are allowed) or bypass per-token requirement validation whenever the input starts with `-` and just use `shlex.split` as-is.
</issue_to_address>

### Comment 2
<location path="astrbot/core/utils/pip_installer.py" line_range="163-167" />
<code_context>
+    return True
+
+
+def _is_valid_install_token(token: str) -> bool:
+    if token.startswith("-"):
+        return True
+
+    return _is_valid_install_requirement(token)
+
+
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Path-like or file-based specs (e.g. `.` or `../pkg`) are rejected as invalid tokens even when used with valid options.

Since non-option tokens are passed to `_is_valid_install_requirement`, path-like values such as `.` or `../pkg` will be rejected and the whole split discarded. This breaks editable installs (`-e .`) and similar option+path usages. Consider either special-casing common patterns (e.g. `.` after `-e`) or relaxing validation for tokens that clearly look like paths/URLs. Another option is to apply strict validation only for single-package specs and otherwise treat any fragment containing `-` as a full pip CLI invocation to pass through unchanged.
</issue_to_address>

### Comment 3
<location path="tests/test_pip_installer.py" line_range="127-136" />
<code_context>
+
+
+@pytest.mark.asyncio
+async def test_install_keeps_single_requirement_with_version_range_intact(monkeypatch):
+    run_pip = AsyncMock(return_value=0)
+
+    monkeypatch.setattr(PipInstaller, "_run_pip_in_process", run_pip)
+
+    installer = PipInstaller("")
+    await installer.install(package_name="demo-package >= 1.0, < 2.0")
+
+    run_pip.assert_awaited_once()
+    recorded_args = run_pip.await_args_list[0].args[0]
+
+    assert recorded_args[0:2] == ["install", "demo-package >= 1.0, < 2.0"]
+
+
</code_context>
<issue_to_address>
**suggestion (testing):** Consider a regression test for partially-invalid space-separated input to verify fallback behavior.

Current tests cover valid space-separated input, multiline input, and single complex requirement strings, but they never exercise the branch where `_split_package_install_input` encounters an invalid token and falls back to treating the whole string as one spec. Please add a regression test with a mixed/partially invalid string (e.g. `"demo-package another package with spaces"`) to confirm we fall back to `[raw_input]` instead of dropping or mis-splitting tokens.
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- In `reload_failed_plugin` you now call `_install_plugin_requirements` without a `try/except`, which is inconsistent with `_check_plugin_dept_update` and means a dependency install error will abort the reload path entirely; consider wrapping this call in the same error-logging pattern so a bad requirements install doesn’t unexpectedly break recovery logic.
- The index override detection in `_package_specs_override_index` doesn’t catch short-form options like `-ihttps://example.com/simple`, so users can still inadvertently get your default index even when they think they’ve specified their own; consider handling the concatenated `-i<url>` form as well.

## Individual Comments

### Comment 1
<location path="astrbot/core/utils/pip_installer.py" line_range="137-146" />
<code_context>
     return names


+def _split_package_install_input(raw_input: str) -> list[str]:
+    normalized = raw_input.strip()
+    if not normalized:
+        return []
+
+    if "\n" in normalized or "\r" in normalized:
+        return _split_multiline_package_input(normalized)
+
+    if _is_valid_install_requirement(normalized):
+        return [normalized]
+
+    split_tokens = shlex.split(normalized)
</code_context>
<issue_to_address>
**issue (bug_risk):** Single-line inputs with inline comments are treated as a single invalid requirement rather than being parsed token-wise.

For a single-line input like `"requests==2.31.0  # latest"`, we first fail `_is_valid_install_requirement`, then `shlex.split` returns tokens where the `#`/comment part is not a valid requirement. Because `all(_is_valid_install_token(...))` then fails, we fall back to returning `[normalized]`, sending the full string (including the comment) to pip and likely causing a parse error. Multiline inputs already strip `#` comments, but single-line inputs don’t. Consider either reusing the multiline comment-stripping for single-line inputs or relaxing the `all(...)` condition so we still return the split tokens even if one token is invalid, letting pip handle it.
</issue_to_address>

### Comment 2
<location path="tests/test_pip_installer.py" line_range="272-281" />
<code_context>
+
+
+@pytest.mark.asyncio
+async def test_install_falls_back_to_raw_input_for_invalid_token_string(monkeypatch):
+    run_pip = AsyncMock(return_value=0)
+
+    monkeypatch.setattr(PipInstaller, "_run_pip_in_process", run_pip)
+
+    installer = PipInstaller("")
+    raw_input = "demo-package !!! another-package"
+    await installer.install(package_name=raw_input)
+
+    run_pip.assert_awaited_once()
+    recorded_args = run_pip.await_args_list[0].args[0]
+
+    assert recorded_args[0:2] == ["install", raw_input]
</code_context>
<issue_to_address>
**suggestion (testing):** You may want a small test for empty/whitespace-only package input to lock in `_split_package_install_input` behavior.

One remaining gap is when `package_name` is empty or whitespace-only:
- `_split_package_install_input` returns `[]`.
- `install` then skips the `package_name` branch and, without a `requirements_path`, effectively runs a bare `pip install` with only index args.

A test like `test_install_ignores_empty_package_string` (e.g. `package_name='   '`) that asserts only index-related args are passed would lock in this behavior and catch regressions in input normalization.
</issue_to_address>

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/core/utils/pip_installer.py" line_range="137" />
<code_context>
     return names


+def _split_package_install_input(raw_input: str) -> list[str]:
+    normalized = raw_input.strip()
+    if not normalized:
</code_context>
<issue_to_address>
**issue (complexity):** Consider simplifying the new pip argument‑parsing helpers by making index override checks explicit, inlining trivial helpers, and centralizing line-cleaning logic to reduce cognitive load.

You can reduce the cognitive load here without changing behavior by:

1. **Making `_package_specs_override_index` linear and explicit**

Same semantics, but easier to scan and reason about:

```python
def _package_specs_override_index(package_specs: list[str]) -> bool:
    for spec in package_specs:
        if spec in {"-i", "--index-url"}:
            return True
        if spec.startswith("--index-url="):
            return True
        if spec.startswith("-i"):
            return True
    return False
```

This keeps the exact logic (`spec.startswith("-i")` still matches `-ignore-something`) but removes the compound `any(...)` expression.

---

2. **Removing tiny indirection for `_is_valid_install_token`**

`_is_valid_install_token` is a one-liner used only in one place. Inlining the logic reduces helper hopping without changing behavior:

```python
def _split_package_install_input(raw_input: str) -> list[str]:
    normalized = raw_input.strip()
    if not normalized:
        return []

    if "\n" in normalized or "\r" in normalized:
        return _split_multiline_package_input(normalized)

    normalized = _strip_inline_requirement_comment(normalized)
    if not normalized:
        return []

    if _is_valid_install_requirement(normalized):
        return [normalized]

    split_tokens = shlex.split(normalized)
    if split_tokens and split_tokens[0].startswith("-"):
        return split_tokens

    if split_tokens and all(
        token.startswith("-") or _is_valid_install_requirement(token)
        for token in split_tokens
    ):
        return split_tokens

    return [normalized]
```

Then you can drop `_is_valid_install_token` completely.

---

3. **Sharing the comment‑stripping/splitting path for single‑line and multi‑line input**

You already have `_strip_inline_requirement_comment`; you can centralize the common “per-line -> cleaned candidate” logic and reuse it in both `_split_package_install_input` and `_split_multiline_package_input` so the behavior is defined in one place:

```python
def _iter_clean_requirement_lines(raw_input: str) -> list[str]:
    for line in raw_input.splitlines():
        candidate = _strip_inline_requirement_comment(line)
        if not candidate or candidate.startswith("#"):
            continue
        yield candidate

def _split_multiline_package_input(raw_input: str) -> list[str]:
    requirements: list[str] = []
    for candidate in _iter_clean_requirement_lines(raw_input):
        if candidate.startswith("-"):
            requirements.extend(shlex.split(candidate))
        else:
            requirements.append(candidate)
    return requirements
```

Then `_split_package_install_input`’s multiline path becomes:

```python
if "\n" in normalized or "\r" in normalized:
    return _split_multiline_package_input(normalized)
```

Behavior stays the same, but the rules for per-line cleaning and comment handling live in one helper, which makes the flow easier to follow.
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- In `_strip_inline_requirement_comment`, splitting on `[ \t]+#` will also strip legitimate `#` fragments in URLs (e.g. `--extra-index-url https://example.com/simple#frag`); consider limiting comment stripping to lines that are not options or using a more precise heuristic.
- The new `_install_plugin_requirements` helper is wrapped in try/except in some flows (`_check_plugin_dept_update`, `reload_failed_plugin`) but not in others (`install_plugin`, `install_plugin_from_file`), which changes failure behavior; consider aligning error handling across these call sites so plugin installs behave consistently when dependency installation fails.

## Individual Comments

### Comment 1
<location path="astrbot/core/utils/pip_installer.py" line_range="183" />
<code_context>
+    return requirements
+
+
+def _package_specs_override_index(package_specs: list[str]) -> bool:
+    for spec in package_specs:
+        if spec in {"-i", "--index-url"}:
</code_context>
<issue_to_address>
**issue (complexity):** Consider tightening `_package_specs_override_index` and inlining the multiline parsing helper to make the index-override logic and multiline requirement handling more explicit and easier to follow.

You can reduce complexity in two focused spots without changing the public behavior of `install` or removing any features.

### 1. Tighten and simplify `_package_specs_override_index`

The current prefix-based `-i` detection is both non-obvious and over-general:

```python
def _package_specs_override_index(package_specs: list[str]) -> bool:
    for spec in package_specs:
        if spec in {"-i", "--index-url"}:
            return True
        if spec.startswith("--index-url="):
            return True
        if spec.startswith("-i"):
            return True
    return False
```

You can make this more explicit and safer by scanning with index-aware logic and handling only valid `pip` shapes:

```python
def _package_specs_override_index(package_specs: list[str]) -> bool:
    for i, spec in enumerate(package_specs):
        if spec in {"-i", "--index-url"}:
            # require a following value, like pip does
            if i + 1 < len(package_specs):
                return True
            continue

        # inline values: --index-url=https://... or -ihttps://...
        if spec.startswith("--index-url="):
            return True
        if spec.startswith("-i") and spec != "-i":
            return True

    return False
```

This keeps all capabilities (short/long options, inline forms) but removes the “any string starting with `-i`” ambiguity and makes the intent easier to reason about.

### 2. Merge `_split_multiline_package_input` and `_iter_clean_requirement_lines`

Right now the multiline path has two layers:

```python
def _split_multiline_package_input(raw_input: str) -> list[str]:
    requirements: list[str] = []
    for candidate in _iter_clean_requirement_lines(raw_input):
        if candidate.startswith("-"):
            requirements.extend(shlex.split(candidate))
            continue
        requirements.append(candidate)
    return requirements


def _iter_clean_requirement_lines(raw_input: str):
    for line in raw_input.splitlines():
        candidate = _strip_inline_requirement_comment(line)
        if not candidate or candidate.startswith("#"):
            continue
        yield candidate
```

You can inline `_iter_clean_requirement_lines` into `_split_multiline_package_input` to reduce indirection and branching without changing behavior:

```python
def _split_multiline_package_input(raw_input: str) -> list[str]:
    requirements: list[str] = []
    for line in raw_input.splitlines():
        candidate = _strip_inline_requirement_comment(line)
        if not candidate or candidate.startswith("#"):
            continue
        if candidate.startswith("-"):
            requirements.extend(shlex.split(candidate))
        else:
            requirements.append(candidate)
    return requirements
```

This keeps the same semantics (blank lines, comments, inline comments, options support) while making the flow easier to follow and localizing all multiline handling to one function.
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- The error log in `_install_plugin_requirements_with_logging` always says `更新插件 {plugin_label} 的依赖失败`, which is misleading when called from install or reload paths; consider making the message generic or passing in the operation type so logs accurately reflect the workflow.
- In `PipInstaller.install`, `_package_specs_override_index` only inspects `args[1:]` before `pip_install_arg` is appended, so a user-specified `--index-url` in `pip_install_arg` will not suppress the default `-i`/`--trusted-host`; if that’s not intentional, consider including `pip_install_arg` in the override check.

## Individual Comments

### Comment 1
<location path="astrbot/core/utils/pip_installer.py" line_range="173-182" />
<code_context>
+    return True
+
+
+def _split_multiline_package_input(raw_input: str) -> list[str]:
+    requirements: list[str] = []
+    for line in raw_input.splitlines():
+        candidate = _strip_inline_requirement_comment(line)
+        if not candidate or candidate.startswith("#"):
+            continue
+        if candidate.startswith("-"):
+            requirements.extend(_split_option_input(candidate))
+            continue
+        requirements.append(candidate)
+    return requirements
+
</code_context>
<issue_to_address>
**issue (bug_risk):** Multiline input with multiple packages on the same line is handled inconsistently vs single-line input.

Here, a line like `"foo bar"` becomes a single requirement, while the single-line path uses `shlex.split` to treat `foo` and `bar` as separate requirements and validate each token. For input like `"foo bar\nspam"`, the first line would be passed to pip as `"foo bar"`, which is likely invalid. To keep behavior consistent, either shlex-split non-option lines here as well or reject lines that contain multiple tokens.
</issue_to_address>

### Comment 2
<location path="astrbot/core/star/star_manager.py" line_range="216-224" />
<code_context>
+        logger.info(f"正在安装插件 {plugin_label} 所需的依赖库: {requirements_path}")
+        await pip_installer.install(requirements_path=requirements_path)
+
+    async def _install_plugin_requirements_with_logging(
+        self,
+        plugin_dir_path: str,
+        plugin_label: str,
+    ) -> None:
+        try:
+            await self._install_plugin_requirements(plugin_dir_path, plugin_label)
+        except Exception as e:
+            logger.error(f"更新插件 {plugin_label} 的依赖失败。Code: {e!s}")
+
     async def _import_plugin_with_dependency_recovery(
</code_context>
<issue_to_address>
**issue (bug_risk):** Swallowing all exceptions during requirement installation may hide actionable errors and makes debugging harder.

`_install_plugin_requirements_with_logging` catches `Exception` and only logs `e!s`, after which callers assume installation succeeded. In flows like `reload_failed_plugin` or `install_plugin`, this can leave a plugin partially updated with no clear diagnostics. At least use `logger.exception` to retain the traceback, and consider re‑raising or returning a structured error so callers can abort plugin load/update when dependencies fail.
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- Several of the new plugin manager tests follow the pattern of recording `events` for success vs. dependency-install failure (e.g., install, install_from_file, reload_failed_plugin, update_plugin) and assert the same sequence; consider parametrizing these cases to reduce duplication and make it easier to add/modify scenarios in one place.

## Individual Comments

### Comment 1
<location path="astrbot/core/star/star_manager.py" line_range="216-224" />
<code_context>
+        logger.info(f"正在安装插件 {plugin_label} 所需的依赖库: {requirements_path}")
+        await pip_installer.install(requirements_path=requirements_path)
+
+    async def _install_plugin_requirements_with_logging(
+        self,
+        plugin_dir_path: str,
+        plugin_label: str,
+    ) -> None:
+        try:
+            await self._install_plugin_requirements(plugin_dir_path, plugin_label)
+        except Exception as e:
+            logger.exception(f"插件 {plugin_label} 依赖安装失败: {e!s}")
+
     async def _import_plugin_with_dependency_recovery(
</code_context>
<issue_to_address>
**issue (bug_risk):** Catching broad `Exception` here may inadvertently swallow `asyncio.CancelledError` and other critical exceptions.

Because this wrapper logs and suppresses every `Exception` from `_install_plugin_requirements`, it may treat task cancellation as a normal plugin failure and then ignore it, which can break shutdown/timeout behavior. Consider explicitly re-raising `asyncio.CancelledError` (and any other critical exceptions you care about) before the generic `Exception` handler, for example:

```python
try:
    await self._install_plugin_requirements(...)
except asyncio.CancelledError:
    raise
except Exception as e:
    logger.exception("插件 %s 依赖安装失败: %s", plugin_label, e)
```

This preserves cancellation semantics while still logging real install errors.
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- In the plugin flows (`install_plugin`, `install_plugin_from_file`, `reload_failed_plugin`, `update_plugin`), `_install_plugin_requirements_with_logging` intentionally swallows dependency installation failures (other than `CancelledError`) and still proceeds to `load`/`reload`; if dependency install failure should block plugin activation, consider returning a status from the helper and short‑circuiting the load/reload on failure so the behavior is explicit.
- The new package parsing helpers `_split_package_install_input` and `_split_multiline_package_input` call each other (e.g. multiline → per‑line → `_split_package_install_input` again), which works but is a bit hard to follow; consider refactoring into a small, non‑recursive line parser plus a top‑level multiline handler to make the control flow and precedence rules (marker vs options vs comments) easier to reason about.

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/core/utils/pip_installer.py" line_range="55-71" />
<code_context>
+        self._buffer += text.replace("\r", "\n")
+        while "\n" in self._buffer:
+            line, self._buffer = self._buffer.split("\n", 1)
+            line = line.strip()
+            if line:
+                self._log_func(line)
+        return len(text)
+
+    def flush(self) -> None:
+        line = self._buffer.strip()
+        if line:
+            self._log_func(line)
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Trimming lines in `_StreamingLogWriter` may drop meaningful leading/trailing whitespace and alter pip output formatting.

Both `write()` and `flush()` call `strip()` on each line, which removes leading/trailing spaces, collapses intentionally indented lines (e.g. `'  WARNING:'`), and drops blank lines entirely. If you want to preserve pip’s output while just normalizing newlines, use `rstrip("\n")`/`rstrip("\r\n")` instead of `strip()`, and use `if line.strip():` only for the emptiness check while logging the original line.

```suggestion
    def write(self, text: str) -> int:
        if not text:
            return 0

        # Normalize Windows newlines to Unix style but preserve other whitespace
        self._buffer += text.replace("\r", "\n")
        while "\n" in self._buffer:
            raw_line, self._buffer = self._buffer.split("\n", 1)
            # Ensure any trailing newline characters are removed without
            # touching other leading/trailing whitespace
            line = raw_line.rstrip("\r\n")
            if line.strip():
                self._log_func(line)
        return len(text)

    def flush(self) -> None:
        # Flush any remaining buffered text, preserving leading/trailing spaces
        line = self._buffer.rstrip("\r\n")
        if line.strip():
            self._log_func(line)
        self._buffer = ""
```
</issue_to_address>

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="tests/test_pip_installer.py" line_range="648-657" />
<code_context>
+
+
+@pytest.mark.asyncio
+async def test_install_respects_index_override_in_pip_install_arg(monkeypatch):
+    run_pip = AsyncMock(return_value=(0, []))
+
+    monkeypatch.setattr(PipInstaller, "_run_pip_in_process", run_pip)
+
+    installer = PipInstaller("--index-url https://example.com/simple")
+    await installer.install(package_name="demo-package")
+
+    run_pip.assert_awaited_once()
+    recorded_args = run_pip.await_args_list[0].args[0]
+
+    assert "install" in recorded_args
+    assert "demo-package" in recorded_args
+    assert "--index-url" in recorded_args
+    assert "https://example.com/simple" in recorded_args
</code_context>
<issue_to_address>
**suggestion (testing):** Strengthen the index override test to ensure the default index is not added when overridden via pip_install_arg.

Right now the test only verifies that the custom `--index-url` is present. To fully cover the override behavior, it should also assert that the default index settings are *absent* from `recorded_args` when `pip_install_arg` specifies an index, e.g.:

```python
assert "mirrors.aliyun.com" not in recorded_args
assert "https://pypi.org/simple" not in recorded_args
```

This will ensure `_package_specs_override_index` truly prevents adding the default index configuration in this scenario.
</issue_to_address>

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/core/utils/pip_installer.py" line_range="50" />
<code_context>
-def _run_pip_main_with_output(pip_main, args: list[str]) -> tuple[int, str]:
-    stream = io.StringIO()
-    with contextlib.redirect_stdout(stream), contextlib.redirect_stderr(stream):
+class _StreamingLogWriter(io.TextIOBase):
+    def __init__(self, log_func) -> None:
+        self._log_func = log_func
</code_context>
<issue_to_address>
**issue (complexity):** Consider refactoring the new pip install logic by extracting focused helpers for streaming, argument building, constraints handling, and conflict error construction to simplify `install` and related code paths.

You can reduce the complexity without losing any functionality by separating responsibilities and extracting a few focused helpers.

### 1. Decouple streaming from error parsing

Right now `_StreamingLogWriter` both streams logs and classifies errors. You can keep streaming behavior but return *all* lines and move classification into a pure function.

```python
class _StreamingLogWriter(io.TextIOBase):
    def __init__(self, log_func) -> None:
        self._log_func = log_func
        self._buffer = ""
        self.lines: list[str] = []  # store all lines in order

    def write(self, text: str) -> int:
        if not text:
            return 0

        self._buffer += text.replace("\r", "\n")
        while "\n" in self._buffer:
            raw_line, self._buffer = self._buffer.split("\n", 1)
            line = raw_line.rstrip("\r\n")
            if line.strip():
                self._log_func(line)
                self.lines.append(line)
        return len(text)

    def flush(self) -> None:
        line = self._buffer.rstrip("\r\n")
        if line.strip():
            self._log_func(line)
            self.lines.append(line)
        self._buffer = ""
```

```python
def _run_pip_main_streaming(pip_main, args: list[str]) -> tuple[int, list[str]]:
    stream = _StreamingLogWriter(logger.info)
    with contextlib.redirect_stdout(stream), contextlib.redirect_stderr(stream):
        result_code = pip_main(args)
    stream.flush()
    return result_code, stream.lines
```

Then error/conflict detection lives in one place:

```python
def _classify_pip_errors(lines: list[str]) -> tuple[list[str], bool, bool]:
    """Return (error_lines, is_conflict, is_core_conflict)."""
    error_lines = [
        line for line in lines
        if (
            line.startswith("ERROR:")
            or "The user requested" in line
            or "ResolutionImpossible" in line
        )
    ]
    is_conflict = any(
        "conflict" in line.lower() or "resolutionimpossible" in line.lower()
        for line in error_lines
    )
    is_core_conflict = any("(constraint)" in line for line in error_lines)
    return error_lines, is_conflict, is_core_conflict
```

And `install` becomes simpler:

```python
result_code, lines = await self._run_pip_in_process(args)
error_lines, is_conflict, is_core_conflict = _classify_pip_errors(lines)

if result_code != 0:
    if is_conflict:
        raise _build_dependency_conflict_error(error_lines, is_core_conflict)
    raise Exception(f"安装失败，错误码：{result_code}")
```

### 2. Extract argument building from `install`

Most of the `install` body is building `args`. You can move that into a helper so `install` reads as orchestration only:

```python
def _build_pip_args(
    self,
    package_name: str | None,
    requirements_path: str | None,
    mirror: str | None,
) -> tuple[list[str], set[str], str | None]:
    args = ["install"]
    requested_requirements: set[str] = set()
    pip_install_args = shlex.split(self.pip_install_arg) if self.pip_install_arg else []

    if package_name:
        package_specs = _split_package_install_input(package_name)
        args.extend(package_specs)
        for spec in package_specs:
            name = _extract_requirement_name(spec)
            if name:
                requested_requirements.add(name)
    elif requirements_path:
        args.extend(["-r", requirements_path])
        requested_requirements = _extract_requirement_names(requirements_path)

    if not _package_specs_override_index([*args[1:], *pip_install_args]):
        index_url = mirror or self.pypi_index_url or "https://pypi.org/simple"
        args.extend(["--trusted-host", "mirrors.aliyun.com", "-i", index_url])

    return args, requested_requirements, " ".join(pip_install_args)
```

Then `install` can do:

```python
args, requested_requirements, _ = self._build_pip_args(
    package_name, requirements_path, mirror
)

target_site_packages = None
if is_packaged_desktop_runtime():
    target_site_packages = get_astrbot_site_packages_path()
    os.makedirs(target_site_packages, exist_ok=True)
    _prepend_sys_path(target_site_packages)
    args.extend(["--target", target_site_packages])
    args.extend(["--upgrade", "--upgrade-strategy", "only-if-needed"])

pip_install_args = shlex.split(self.pip_install_arg) if self.pip_install_arg else []
if pip_install_args:
    args.extend(pip_install_args)
```

### 3. Isolate constraints file handling

The constraints logic can be pulled into a tiny helper to shorten `install` and make cleanup consistent:

```python
def _attach_core_constraints(args: list[str]) -> str | None:
    core_constraints = _get_core_constraints()
    if not core_constraints:
        return None

    try:
        import tempfile

        with tempfile.NamedTemporaryFile(
            mode="w", suffix="_constraints.txt", delete=False, encoding="utf-8"
        ) as f:
            f.write("\n".join(core_constraints))
        constraints_file_path = f.name
        args.extend(["-c", constraints_file_path])
        logger.info("已启用核心依赖版本保护 (%d 个约束)", len(core_constraints))
        return constraints_file_path
    except Exception as exc:
        logger.warning("创建临时约束文件失败: %s", exc)
        return None
```

Use it in `install`:

```python
constraints_file_path = _attach_core_constraints(args)
try:
    # run pip, interpret errors, etc.
    ...
finally:
    if constraints_file_path and os.path.exists(constraints_file_path):
        with contextlib.suppress(Exception):
            os.remove(constraints_file_path)
```

### 4. Centralize conflict error construction

The message-building logic is currently inline in `install`. Moving it into a small helper makes the happy-path shorter:

```python
def _build_dependency_conflict_error(
    error_lines: list[str], is_core_conflict: bool
) -> DependencyConflictError:
    constraints = [l.strip() for l in error_lines if "(constraint)" in l]
    requested = [
        l.strip()
        for l in error_lines
        if "The user requested" in l and "(constraint)" not in l
    ]

    detail = ""
    if constraints and requested:
        detail = (
            " 冲突详情: "
            f"{requested[0].replace('The user requested ', '')} vs "
            f"{constraints[0].replace('The user requested ', '')}。"
        )

    if is_core_conflict:
        msg = (
            f"检测到核心依赖版本保护冲突。{detail}"
            "插件要求的依赖版本与 AstrBot 核心不兼容，"
            "为了系统稳定，已阻止该降级行为。请联系插件作者或调整 requirements.txt。"
        )
    else:
        msg = f"检测到依赖冲突。{detail}"

    return DependencyConflictError(msg, error_lines)
```

Then `install` just calls this helper.

### 5. Group requirement helpers as a subsystem

You already have a coherent set of helpers: `_iter_requirement_specs`, `_strip_inline_requirement_comment`, `_split_package_install_input`, `_package_specs_override_index`, `_find_missing_requirements`, `_specifier_contains_version`. Even if you keep them in this file, a small section header and grouping makes intent clearer:

```python
# === Requirements parsing and analysis utilities ===
# These helpers are responsible for:
# - parsing requirements files (including nested -r),
# - extracting normalized requirement names/specifiers,
# - checking installed versions vs SpecifierSet,
# - detecting when user-provided specs override the index URL.

def _strip_inline_requirement_comment(...): ...
def _split_package_install_input(...): ...
def _iter_requirement_specs(...): ...
def _specifier_contains_version(...): ...
def _find_missing_requirements(...): ...
def _package_specs_override_index(...): ...
```

Or, if you prefer, move them into a `requirements_utils.py` while keeping the public behavior identical.
</issue_to_address>