fix(install): remove flask/werkzeug pins, clean stale pip packages (v0.2.18)

Previous pip --user installs left werkzeug 2.0.3 in ~/.local which
shadows the system werkzeug and breaks the system onionshare-cli
(Flask 2.2.2 requires werkzeug >= 2.2 for LocalProxy.unbound_message).

Changes:
- Remove flask, werkzeug, and onionshare-cli from voxvera's own
  dependencies — they are onionshare's transitive deps, not ours
- Install script now cleans up stale user-local packages (werkzeug,
  flask, flask-socketio, onionshare-cli, voxvera) before installing
- Prevents pip --user packages from poisoning system Python environment

Co-Authored-By: Claude Opus 4.6 <[email protected]>

install.sh

@@ -96,6 +96,28 @@ else
   msg "onionshare-cli found (system package), skipping pipx install. Run 'pipx install --force ...' if you want the latest git version."
 fi
 
+# Clean up stale user-local packages from prior pip --user installs of voxvera.
+# These can shadow system packages (e.g. Werkzeug) and break onionshare-cli.
+msg "Cleaning up stale user-local packages that may conflict with system onionshare-cli..."
+PIP_CLEANUP_OPTS=""
+if [ -f /etc/debian_version ]; then
+  DEB_VER=$(cat /etc/debian_version | cut -d. -f1)
+  if [[ "$DEB_VER" =~ ^[0-9]+$ ]] && [ "$DEB_VER" -ge 12 ]; then
+    PIP_CLEANUP_OPTS="--break-system-packages"
+  fi
+fi
+for pkg in werkzeug flask flask-socketio onionshare-cli; do
+  if pip3 show --quiet "$pkg" 2>/dev/null && \
+     pip3 show "$pkg" 2>/dev/null | grep -q "Location.*\.local"; then
+    pip3 uninstall -y $PIP_CLEANUP_OPTS "$pkg" 2>/dev/null || true
+  fi
+done
+# Also uninstall any previous pip --user install of voxvera itself
+if pip3 show --quiet voxvera 2>/dev/null && \
+   pip3 show voxvera 2>/dev/null | grep -q "Location.*\.local"; then
+  pip3 uninstall -y $PIP_CLEANUP_OPTS voxvera 2>/dev/null || true
+fi
+
 download_binary() {
   local url=$1
   local dest=$2

pyproject.toml

@@ -14,7 +14,7 @@ voxvera = ["templates/**", "src/**", "resources/**", "locales/**", "resources/bi
 
 [project]
 name = "voxvera"
-version = "0.2.17"
+version = "0.2.18"
 description = "VoxVera CLI utilities"
 readme = "README.md"
 authors = [{name = "VoxVera"}]
@@ -28,10 +28,7 @@ dependencies = [
     "htmlmin2",
     "pypdf",
     "wcwidth",
-    "onionshare-cli",
     "setuptools",
-    "flask<2.3.0",
-    "werkzeug<3.0.0",
 ]
 [project.optional-dependencies]
 test = [

voxvera/__init__.py

@@ -1,7 +1,7 @@
 import sys
 from pathlib import Path
 
-__version__ = "0.2.17"
+__version__ = "0.2.18"
 
 # Add the vendor directory to sys.path ONLY for PyInstaller (frozen) builds.
 # For pip/pipx installs the system/venv packages are correct and the vendored