From 011dd9cb956b86d4b1c11887273752009c0e4052 Mon Sep 17 00:00:00 2001
From: ymq <ymq@opencomputing.net>
Date: Thu, 13 Aug 2026 18:07:16 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20bwrap=20=E5=A4=9A=E8=B7=AF=E5=BE=84?=
 =?UTF-8?q?=E6=A3=80=E6=B5=8B=EF=BC=88=E7=8E=AF=E5=A2=83=E5=8F=98=E9=87=8F?=
 =?UTF-8?q?+=E5=B7=B2=E7=9F=A5=E4=BD=8D=E7=BD=AE=E5=85=9C=E5=BA=95?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pipeline_service/deploy_account.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pipeline_service/deploy_account.py b/pipeline_service/deploy_account.py
index de9d859..0e15b5d 100644
--- a/pipeline_service/deploy_account.py
+++ b/pipeline_service/deploy_account.py
@@ -23,9 +23,15 @@ logger = logging.getLogger("pipeline.deploy_account")
 DEPLOY_ENV_BASE = "/d/pipeline/deploy_envs"
 
 # bwrap 可执行文件（未安装时为 None，降级为目录隔离）
+# 检测顺序：系统 PATH → 环境变量 → 已知安装位置
 BWRAP = shutil.which("bwrap")
-if not BWRAP and os.path.exists("/d/pipeline/bin/bwrap"):
-    BWRAP = "/d/pipeline/bin/bwrap"
+for _p in (
+    os.environ.get("BWRAP_PATH", ""),
+    "/d/pipeline/bin/bwrap",
+    "/d/pipeline/pipeline-app/bin/bwrap",
+):
+    if not BWRAP and _p and os.path.exists(_p):
+        BWRAP = _p
 
 # 账号名合法字符（目录安全，防路径穿越）
 _SAFE_RE = re.compile(r"[^a-zA-Z0-9_-]")