build: add pyproject.toml and Python packaging infrastructure (closes #45)#49
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughAdds a Hatch-based ChangesPython packaging infrastructure setup
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Around line 50-59: The wheel package currently omits the Flask runtime asset
directories; update the wheel target's include list in pyproject.toml to add the
"templates/" and "static/" directories so that app.py's Flask configuration
(static_folder="static", template_folder="templates") and calls like
render_template() and send_from_directory() will find the runtime assets after
installation.
In `@requirements.txt`:
- Around line 6-11: Remove the desktop-only dependency pywebview from
requirements.txt so CI/web-server installs and pip install -r requirements.txt
no longer pull GUI libraries; update requirements.txt to exclude the line
"pywebview>=5.0" and ensure README or the header comments point users to install
desktop extras with pip install -e ".[desktop]" (pywebview is only used by
launcher.py, so keep it in [project.optional-dependencies].desktop in
pyproject.toml).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 02b8e2e4-795d-454a-af85-a0a9e0afa29b
📒 Files selected for processing (2)
pyproject.tomlrequirements.txt
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Around line 18-21: The project dependencies list in pyproject.toml does not
explicitly constrain Pillow, allowing resolvers to pick known-vulnerable
versions; update project.dependencies (the dependencies array containing
"flask>=3.0,<4" and "fpdf2>=2.7,<3") to include an explicit safe Pillow
constraint such as "pillow>=10.0.0,<11" (or "pillow>=10.0.0" if you prefer no
upper bound) so transitive resolution cannot select vulnerable Pillow releases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2e83303a-5bcb-45e5-a35f-3b64f3ed1c1e
📒 Files selected for processing (2)
pyproject.tomlrequirements.txt
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/tests.yml (1)
43-49: ⚡ Quick winConsider adding a step to verify package installation.
The manual dependency installation approach means CI doesn't verify that
pip install -e .succeeds or that the console-script entry points (cursor-chat-export,cursor-chat-browser) are installed and functional. While the pywebview exclusion is reasonable (system dependencies), a lightweight packaging verification step would catch include-list errors, import issues, or broken entry points.📦 Proposed addition: package installation test
Add a step after line 49 to verify the package installs and entry points are callable:
- name: Verify package installation run: | python -m pip install -e . cursor-chat-export --help # cursor-chat-browser requires pywebview, skip hereThis ensures packaging config remains valid across Python versions without adding heavy dependencies.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tests.yml around lines 43 - 49, Add a CI step after the dependency install that verifies the package installs and entry points work: run python -m pip install -e . and invoke the console script cursor-chat-export --help (skip cursor-chat-browser due to pywebview) so installation/import/entry-point failures surface as job failures; place this new step after the existing "Install runtime + test dependencies" step and ensure failures are not ignored so the workflow fails on packaging errors.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Around line 18-21: Add an explicit Pillow constraint to the dependencies list
to avoid transitive installation of vulnerable Pillow releases: update the
dependencies array (near the existing "flask" and "fpdf2" entries) to include a
safe Pillow version constraint such as "pillow>=10.0" (or a later safe minimum)
so that the "fpdf2" dependency cannot pull in vulnerable 9.x releases; ensure
the new entry is added alongside "fpdf2>=2.7,<3" in the same dependencies block.
---
Nitpick comments:
In @.github/workflows/tests.yml:
- Around line 43-49: Add a CI step after the dependency install that verifies
the package installs and entry points work: run python -m pip install -e . and
invoke the console script cursor-chat-export --help (skip cursor-chat-browser
due to pywebview) so installation/import/entry-point failures surface as job
failures; place this new step after the existing "Install runtime + test
dependencies" step and ensure failures are not ignored so the workflow fails on
packaging errors.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: da2b3d37-ea68-4784-b35d-d4ec871da793
📒 Files selected for processing (4)
.github/workflows/tests.ymllauncher.pypyproject.tomlrequirements.txt
3 participants
Closes #45 .
Problem
The project had no
pyproject.toml,setup.py, orsetup.cfg, making it a non-installable Python package. This forcedscripts/export.pyto use a fragilesys.path.insert(0, project_root)hack to import shared modules, and blocked using proper console-script entry points. It also madepywebview(a desktop-only system dependency) silently entangled with the web-server install path.Changes
pyproject.toml(new)hatchling>=1.21(modern flat-layout support; nosrc/restructuring needed)requires-python = ">=3.11"flask>=3.0,<4,fpdf2>=2.7,<3— deterministic CI resolution and early detection of breaking major releases[desktop]—pywebview>=5.0,<6(heavy system libs intentionally excluded from web-server and CI installs)[dev]—pytest>=8,<9,mypy>=1.10,<2cursor-chat-export = "scripts.export:main"(primary CLI),cursor-chat-browser = "launcher:main"(desktop, requires[desktop])api/,models/,scripts/,services/,utils/,app.py,launcher.py[tool.mypy]config mirroring CI flags;excludeforvenv//build//dist/so localmypy .matches CI outputrequirements.txt(updated)pyproject.tomlas the canonical source of truth; existing lower-bound pins retained for backward compatibilityVerification
Notes
sys.path.inserthack inscripts/export.pyis intentionally left in place for this PR — it will be removed when the export script is refactored to delegate to the service layer (issue Export Script Reimplements Service Layer (~700 LOC) #42 , planned Wednesday).requirements.txtand the lock file generation are tracked separately in issue Unbounded Dependency Pins in requirements.txt #47 .Summary by CodeRabbit
New Features
Chores
Documentation
Tests
Behavior