fix(install): restrict vendor sys.path and PyInstaller imports to frozen builds only (v0.2.15)

The vendor directory was unconditionally prepended to sys.path, causing
pip/pipx installs to load incomplete vendored setuptools (missing data
files like Lorem ipsum.txt) instead of the system package. Now the
vendor path is only added for PyInstaller frozen builds, and the
force-import block in cli.py is similarly guarded behind sys.frozen.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

.github/workflows/binaries.yml

@@ -34,6 +34,7 @@ jobs:
 
       - name: Install dependencies
         run: |
+          pip install --upgrade setuptools pkg_resources || pip install --upgrade setuptools
           pip install -r requirements.txt
           pip install .
           pip install pyinstaller pyinstaller-hooks-contrib
@@ -49,8 +50,16 @@ jobs:
         run: |
           if [ "$RUNNER_OS" == "Windows" ]; then SEP=";"; else SEP=":"; fi
           pyinstaller --onefile \
+            --collect-all pkg_resources \
+            --collect-all setuptools \
             --hidden-import pkg_resources \
             --hidden-import setuptools \
+            --hidden-import jaraco.text \
+            --hidden-import jaraco.functools \
+            --hidden-import jaraco.context \
+            --hidden-import more_itertools \
+            --hidden-import packaging \
+            --hidden-import platformdirs \
             --collect-all onionshare_cli \
             --collect-all flask_socketio \
             --collect-all engineio \

UPCOMING_RELEASE.md

@@ -1,11 +1 @@
-# VoxVera v0.2.11
 
-## Changes and Improvements
-
-### Logic and UI Fixes
-- **Attachment overriding URL:** Modified the core HTML template and config generation so that a provided file attachment fully replaces the external URL in the main content area and QR codes, eliminating redundancy. The "Download Attachment" button at the bottom was removed, keeping the main interface clean and focusing on the attachment directly via the primary URL slot.
-- **Interactive Prompt:** The interactive CLI now treats the URL and attachment path as an "either/or" choice conditionally, improving clarity.
-
-### Stability and Bug Fixes
-- **Nano Terminal Crash:** Fixed an issue where the `nano` editor would crash with "Code: 11" when launched from the interactive interface within a PyInstaller binary. The application now properly inherits standard input/output streams for standard terminal editors.
-- **ModuleNotFoundError Fix:** Added explicit `pkg_resources` and `setuptools` hidden imports to the PyInstaller build configuration, permanently fixing an error where `onionshare-cli` would fail to initialize in the standalone binary with a `ModuleNotFoundError: No module named 'pkg_resources'`.

install.sh

@@ -156,6 +156,9 @@ fi
 if command_exists pipx; then
   msg "Falling back to pipx installation (this may take a few minutes)..."
   if pipx install --force 'voxvera@git+https://github.com/PR0M3TH3AN/VoxVera.git@main'; then
+    # Ensure setuptools (pkg_resources) is available in the venv — pipx can
+    # sometimes skip it if the resolver thinks the build-system copy suffices.
+    pipx inject voxvera setuptools 2>/dev/null || true
     pipx ensurepath --force
     msg "\nVoxVera installed/updated successfully via pipx."
     msg "IMPORTANT: Please restart your terminal or run 'source ~/.bashrc' (or your shell config) to use 'voxvera'."

pyproject.toml

@@ -14,7 +14,7 @@ voxvera = ["templates/**", "src/**", "resources/**", "locales/**", "resources/bi
 
 [project]
 name = "voxvera"
-version = "0.2.11"
+version = "0.2.15"
 description = "VoxVera CLI utilities"
 readme = "README.md"
 authors = [{name = "VoxVera"}]
@@ -29,6 +29,7 @@ dependencies = [
     "pypdf",
     "wcwidth",
     "onionshare-cli",
+    "setuptools",
     "flask<2.3.0",
     "werkzeug<3.0.0",
 ]

test_cli_import.py

@@ -0,0 +1,12 @@
+import sys
+import os
+
+try:
+    import pkg_resources
+    import setuptools
+    print("pkg_resources available")
+except ImportError as e:
+    print(f"Failed to import: {e}")
+
+from voxvera import cli
+cli._internal_onionshare()

test_pkg.py

@@ -0,0 +1,2 @@
+import pkg_resources
+print("Success")

test_pkg2.py

@@ -0,0 +1,2 @@
+import pkg_resources
+print("Success")

voxvera/__init__.py

@@ -1,16 +1,12 @@
 import sys
 from pathlib import Path
 
-__version__ = "0.2.11"
+__version__ = "0.2.15"
 
-# Add the vendor directory to sys.path. We prepend it to ensure our bundled
-# dependencies take priority over potentially incompatible system packages
-# (e.g. Flask/Werkzeug version mismatches on Debian).
+# Add the vendor directory to sys.path ONLY for PyInstaller (frozen) builds.
+# For pip/pipx installs the system/venv packages are correct and the vendored
+# copies are incomplete (missing data files), so we must not shadow them.
 if getattr(sys, 'frozen', False):
     vendor_dir = Path(sys._MEIPASS).joinpath("voxvera", "vendor")
-else:
-    vendor_dir = Path(__file__).parent / "vendor"
-
-if vendor_dir.exists():
-    if str(vendor_dir) not in sys.path:
+    if vendor_dir.exists() and str(vendor_dir) not in sys.path:
         sys.path.insert(0, str(vendor_dir))

voxvera/cli.py

@@ -10,6 +10,20 @@ import time
 from pathlib import Path
 from importlib import resources
 from importlib.resources.abc import Traversable
+
+# Force PyInstaller to bundle these critical dependencies for onionshare-cli.
+# Only needed at freeze-time analysis; skip for normal pip/pipx installs to
+# avoid pulling in vendored copies that may be incomplete.
+if getattr(sys, 'frozen', False):
+    try:
+        import pkg_resources
+        import setuptools
+        import jaraco
+        import platformdirs
+        import packaging
+    except Exception:
+        pass
+
 from InquirerPy import prompt, inquirer
 from rich.console import Console
 from voxvera import __version__