fix: restore published docker and license coverage

docker/build_from_pip/Dockerfile.build_from_pip

@@ -3,6 +3,8 @@ FROM $UV_IMAGE AS uvbin
 
 FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
+ARG LITELLM_VERSION=1.83.0
+
 WORKDIR /app
 
 COPY --from=uvbin /uv /usr/local/bin/uv
@@ -16,13 +18,18 @@ ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
     UV_LINK_MODE=copy \
     PATH="/app/.venv/bin:${PATH}"
 
-COPY . .
+COPY schema.prisma .
 
-RUN uv sync --frozen --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --python python
+# This image is specifically for validating/installing the published PyPI
+# artifact, not the checked-out source tree.
+RUN uv venv --python python && \
+    uv pip install --python /app/.venv/bin/python \
+      "litellm[proxy]==${LITELLM_VERSION}" \
+      "prometheus-client==0.20.0" \
+      "langfuse==2.59.7" \
+      "prisma==0.11.0" \
+      "openai==2.24.0" \
+      "ddtrace==2.19.0"
 
 RUN prisma generate --schema=./schema.prisma
 

scripts/install.sh

@@ -75,6 +75,7 @@ fi
 
 # ── uv detection / install ────────────────────────────────────────────────
 UV_BIN=""
+CURRENT_UV_VERSION=""
 for candidate in uv "$HOME/.local/bin/uv"; do
   if command -v "$candidate" >/dev/null 2>&1; then
     UV_BIN="$(command -v "$candidate")"
@@ -85,8 +86,15 @@ for candidate in uv "$HOME/.local/bin/uv"; do
   fi
 done
 
-if [ -z "$UV_BIN" ]; then
+if [ -n "$UV_BIN" ]; then
+  CURRENT_UV_VERSION="$("$UV_BIN" --version 2>/dev/null | awk '{print $2}' | head -1 || true)"
+fi
+
+if [ -z "$UV_BIN" ] || [ "${CURRENT_UV_VERSION:-}" != "$UV_VERSION" ]; then
   header "Installing uv…"
+  if [ -n "${CURRENT_UV_VERSION:-}" ]; then
+    info "Upgrading uv from ${CURRENT_UV_VERSION} to ${UV_VERSION}"
+  fi
   curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | env UV_NO_MODIFY_PATH=1 sh \
     || die "uv installation failed. Try manually: curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh"
   UV_BIN="$HOME/.local/bin/uv"

tests/code_coverage_tests/check_licenses.py

@@ -1,15 +1,35 @@
 #!/usr/bin/env python3
+import configparser
+from dataclasses import dataclass
+import json
+from pathlib import Path
+import re
 import sys
 import tomllib
-
-import requests
-from packaging.requirements import Requirement
-from pathlib import Path
-import json
 from typing import Dict, List, Optional, Set, Tuple
-import configparser
-import re
-from dataclasses import dataclass
+
+from packaging.requirements import Requirement
+import requests
+
+DEFAULT_TRANSITIVE_PIN_PACKAGES = (
+    "aiofiles",
+    "anyio",
+    "async-generator",
+    "azure-keyvault",
+    "colorlog",
+    "filelock",
+    "grpc-google-iam-v1",
+    "h11",
+    "hf-xet",
+    "jaraco-context",
+    "redis",
+    "requests-toolbelt",
+    "starlette",
+    "tornado",
+    "tzdata",
+    "urllib3",
+    "wheel",
+)
 
 
 @dataclass
@@ -216,7 +236,7 @@ class LicenseChecker:
     def _load_requirements(
         self, requirements_file: Optional[Path] = None
     ) -> List[Requirement]:
-        """Load pinned requirements from a file or from the root pyproject.toml."""
+        """Load pinned requirements from a file or from the repo defaults."""
         try:
             if requirements_file is not None:
                 with open(requirements_file) as f:
@@ -224,12 +244,37 @@ class LicenseChecker:
             else:
                 with open("pyproject.toml", "rb") as f:
                     pyproject = tomllib.load(f)
+                with open("uv.lock", "rb") as f:
+                    lock_data = tomllib.load(f)
 
                 requirement_lines = list(pyproject["project"].get("dependencies", []))
                 for extra_reqs in pyproject["project"].get(
                     "optional-dependencies", {}
                 ).values():
                     requirement_lines.extend(extra_reqs)
+                for group_reqs in pyproject.get("dependency-groups", {}).values():
+                    requirement_lines.extend(group_reqs)
+
+                lock_versions: Dict[str, List[str]] = {}
+                for package in lock_data.get("package", []):
+                    source = package.get("source", {})
+                    if "registry" not in source:
+                        continue
+
+                    normalized_name = self._normalize_package_name(package["name"])
+                    version = package.get("version")
+                    if not version:
+                        continue
+                    versions = lock_versions.setdefault(normalized_name, [])
+                    if version not in versions:
+                        versions.append(version)
+
+                # Preserve the coverage that used to come from requirements.txt for
+                # explicitly pinned transitives/security fixes without broadening the
+                # default check to every package variant in the lockfile.
+                for package_name in DEFAULT_TRANSITIVE_PIN_PACKAGES:
+                    for version in lock_versions.get(package_name, []):
+                        requirement_lines.append(f"{package_name}=={version}")
 
                 # Preserve declaration order while removing duplicates.
                 requirement_lines = list(dict.fromkeys(requirement_lines))
@@ -240,12 +285,12 @@ class LicenseChecker:
                 if line.split("#")[0].strip() and not line.startswith("#")
             ]
         except Exception as e:
-            source = requirements_file or "uv export"
+            source = requirements_file or "pyproject.toml + uv.lock"
             raise RuntimeError(f"Error parsing requirements from {source}: {str(e)}") from e
 
     def check_requirements(self, requirements_file: Optional[Path] = None) -> bool:
-        """Check all packages from a requirements file or the root pyproject."""
-        source = requirements_file or "pyproject.toml"
+        """Check all packages from a requirements file or the default repo deps."""
+        source = requirements_file or "pyproject.toml + uv.lock"
         print(f"\nChecking licenses for packages in {source}...")
 
         try:

tests/code_coverage_tests/liccheck.ini

@@ -148,3 +148,22 @@ grpcio: >=1.69.0 # Apache License 2.0
 jaraco.context: >=6.1.0 # Unknown license
 pypdf: >=6.6.2 # BSD-3-Clause license - https://github.com/py-pdf/pypdf/blob/main/LICENSE
 hf-xet: >=1.4.2 # Apache 2.0 License - https://github.com/huggingface/xet-tools/blob/main/LICENSE
+pytest-asyncio: >=1.2.0 # Apache 2.0 license
+pytest-postgresql: >=7.0.2 # LGPLv3+ license
+pytest-xdist: >=3.8.0 # MIT License
+ruff: >=0.15.3 # MIT License
+types-requests: >=2.32.4.20260107 # Apache 2.0 license (typeshed)
+types-pyyaml: >=6.0.12.20250915 # Apache 2.0 license (typeshed)
+fakeredis: >=2.34.1 # BSD license
+psycopg: >=3.2.13 # LGPL-3.0 license
+psycopg-binary: >=3.2.13 # LGPL-3.0 license
+psycopg2-binary: >=2.9.11 # LGPL with exceptions
+lunary: >=1.0.36 # Unknown license manually verified
+logfire: >=4.6.0 # MIT License
+pygithub: >=2.8.1 # LGPL license
+argon2-cffi: >=25.1.0 # MIT License
+blockbuster: >=1.5.26 # Apache 2.0 license
+pylint: >=3.3.9 # GPLv2 license
+langchain-mcp-adapters: >=0.2.1 # MIT License
+langgraph: >=1.0.10 # MIT License
+pytest-rerunfailures: >=15.1 # MPL 2.0 license