fix(install): restrict vendor sys.path and PyInstaller imports to frozen builds only (v0.2.15)

The vendor directory was unconditionally prepended to sys.path, causing
pip/pipx installs to load incomplete vendored setuptools (missing data
files like Lorem ipsum.txt) instead of the system package. Now the
vendor path is only added for PyInstaller frozen builds, and the
force-import block in cli.py is similarly guarded behind sys.frozen.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

.github/workflows/binaries.yml

@@ -34,6 +34,7 @@ jobs:
 
       - name: Install dependencies
         run: |
+          pip install --upgrade setuptools pkg_resources || pip install --upgrade setuptools
           pip install -r requirements.txt
           pip install .
           pip install pyinstaller pyinstaller-hooks-contrib
@@ -49,6 +50,16 @@ jobs:
         run: |
           if [ "$RUNNER_OS" == "Windows" ]; then SEP=";"; else SEP=":"; fi
           pyinstaller --onefile \
+            --collect-all pkg_resources \
+            --collect-all setuptools \
+            --hidden-import pkg_resources \
+            --hidden-import setuptools \
+            --hidden-import jaraco.text \
+            --hidden-import jaraco.functools \
+            --hidden-import jaraco.context \
+            --hidden-import more_itertools \
+            --hidden-import packaging \
+            --hidden-import platformdirs \
             --collect-all onionshare_cli \
             --collect-all flask_socketio \
             --collect-all engineio \

UPCOMING_RELEASE.md

@@ -1,8 +1 @@
-# VoxVera v0.2.4
 
-## New Features
-- **Optional File Attachment:** Users can now attach a file (e.g., a .torrent, image, or document) to their flyers. This file is packaged into the Tor-hosted site and made available via a "Download Attachment" button on the landing page.
-- **Interactive Attachment Selection:** Added a prompt during `voxvera init` to easily specify the path to an attachment.
-
-## Localization
-- Added new tokens for attachment handling across all 14+ supported languages.

install.sh

@@ -156,6 +156,9 @@ fi
 if command_exists pipx; then
   msg "Falling back to pipx installation (this may take a few minutes)..."
   if pipx install --force 'voxvera@git+https://github.com/PR0M3TH3AN/VoxVera.git@main'; then
+    # Ensure setuptools (pkg_resources) is available in the venv — pipx can
+    # sometimes skip it if the resolver thinks the build-system copy suffices.
+    pipx inject voxvera setuptools 2>/dev/null || true
     pipx ensurepath --force
     msg "\nVoxVera installed/updated successfully via pipx."
     msg "IMPORTANT: Please restart your terminal or run 'source ~/.bashrc' (or your shell config) to use 'voxvera'."

pyproject.toml

@@ -14,7 +14,7 @@ voxvera = ["templates/**", "src/**", "resources/**", "locales/**", "resources/bi
 
 [project]
 name = "voxvera"
-version = "0.2.9"
+version = "0.2.15"
 description = "VoxVera CLI utilities"
 readme = "README.md"
 authors = [{name = "VoxVera"}]
@@ -29,6 +29,7 @@ dependencies = [
     "pypdf",
     "wcwidth",
     "onionshare-cli",
+    "setuptools",
     "flask<2.3.0",
     "werkzeug<3.0.0",
 ]

test_cli_import.py

@@ -0,0 +1,12 @@
+import sys
+import os
+
+try:
+    import pkg_resources
+    import setuptools
+    print("pkg_resources available")
+except ImportError as e:
+    print(f"Failed to import: {e}")
+
+from voxvera import cli
+cli._internal_onionshare()

test_pkg.py

@@ -0,0 +1,2 @@
+import pkg_resources
+print("Success")

test_pkg2.py

@@ -0,0 +1,2 @@
+import pkg_resources
+print("Success")

tests/test_integrity.py

@@ -51,6 +51,7 @@ def test_export_import_roundtrip(tmp_path, monkeypatch):
     shutil.copytree(REPO_ROOT / "voxvera" / "src", tmp_path / "src")
     shutil.copytree(REPO_ROOT / "voxvera" / "locales", tmp_path / "locales")
     monkeypatch.setattr(cli, "ROOT", tmp_path)
+    monkeypatch.setattr(cli, "DATA_DIR", tmp_path)
     monkeypatch.setattr(cli, "_src_res", lambda *p: tmp_path / "src" / Path(*p))
     monkeypatch.setattr(cli, "_locale_res", lambda *p: tmp_path / "locales" / Path(*p))
     

voxvera/__init__.py

@@ -1,16 +1,12 @@
 import sys
 from pathlib import Path
 
-__version__ = "0.2.9"
+__version__ = "0.2.15"
 
-# Add the vendor directory to sys.path. We prepend it to ensure our bundled
-# dependencies take priority over potentially incompatible system packages
-# (e.g. Flask/Werkzeug version mismatches on Debian).
+# Add the vendor directory to sys.path ONLY for PyInstaller (frozen) builds.
+# For pip/pipx installs the system/venv packages are correct and the vendored
+# copies are incomplete (missing data files), so we must not shadow them.
 if getattr(sys, 'frozen', False):
     vendor_dir = Path(sys._MEIPASS).joinpath("voxvera", "vendor")
-else:
-    vendor_dir = Path(__file__).parent / "vendor"
-
-if vendor_dir.exists():
-    if str(vendor_dir) not in sys.path:
+    if vendor_dir.exists() and str(vendor_dir) not in sys.path:
         sys.path.insert(0, str(vendor_dir))

voxvera/cli.py

@@ -10,6 +10,20 @@ import time
 from pathlib import Path
 from importlib import resources
 from importlib.resources.abc import Traversable
+
+# Force PyInstaller to bundle these critical dependencies for onionshare-cli.
+# Only needed at freeze-time analysis; skip for normal pip/pipx installs to
+# avoid pulling in vendored copies that may be incomplete.
+if getattr(sys, 'frozen', False):
+    try:
+        import pkg_resources
+        import setuptools
+        import jaraco
+        import platformdirs
+        import packaging
+    except Exception:
+        pass
+
 from InquirerPy import prompt, inquirer
 from rich.console import Console
 from voxvera import __version__
@@ -180,7 +194,7 @@ def _open_editor_terminal(initial: str) -> str:
     try:
         with os.fdopen(fd, "w", encoding="utf-8") as fh:
             fh.write(initial or "")
-        subprocess.call([editor, path])
+        subprocess.run([editor, path], stdin=sys.stdin, stdout=sys.stdout, stderr=sys.stderr)
         with open(path, "r", encoding="utf-8") as fh:
             return fh.read()
     except Exception as e:
@@ -375,11 +389,18 @@ def interactive_update(config_path: str):
 
     console.rule(t("cli.init_links"))
     link_qs = [
+        {
+            "type": "input",
+            "message": t("cli.attachment_path_label"),
+            "name": "attachment_path",
+            "default": data.get("attachment_path", ""),
+        },
         {
             "type": "input",
             "message": t("cli.url_label"),
             "name": "url",
-            "default": data.get("url", "https://voxvera.org/"),
+            "default": data.get("url", "https://voxvera.org/") if not data.get("url", "").startswith("download/") else "",
+            "when": lambda result: not result.get("attachment_path", "").strip(),
             "transformer": _len_transform(200),
             "validate": _len_validator(200),
         },
@@ -391,21 +412,6 @@ def interactive_update(config_path: str):
             "transformer": _len_transform(120),
             "validate": _len_validator(120),
         },
-
-        {
-            "type": "input",
-            "message": t("cli.binary_message_label"),
-            "name": "binary_message",
-            "default": data.get("binary_message", ""),
-            "transformer": _len_transform(120),
-            "validate": _len_validator(120),
-        },
-        {
-            "type": "input",
-            "message": t("cli.attachment_path_label"),
-            "name": "attachment_path",
-            "default": data.get("attachment_path", ""),
-        },
     ]
     data.update(prompt(link_qs))
 
@@ -542,18 +548,19 @@ def build_assets(
             val_str = re.sub(r"~~(.*?)~~", r'<span class="redacted">\1</span>', val_str)
             html = html.replace(f"{{{{{key}}}}}", val_str)
 
-        # Handle optional file attachment
+        # Handle optional file attachment logic
         attachment_path = data.get("attachment_path")
-        attachment_url = ""
-        attachment_display = "none"
         if attachment_path and os.path.isfile(attachment_path):
             att_filename = os.path.basename(attachment_path)
-            attachment_url = f"download/{att_filename}"
-            attachment_display = "inline-block"
-
-        html = html.replace("{{attachment_url}}", attachment_url)
-        html = html.replace("{{attachment_display}}", attachment_display)
-
+            # We don't replace the URL here if it's already an onion link (e.g. during serve rebuild)
+            if not data.get("url", "").startswith("http://") or ".onion" not in data.get("url", ""):
+                data["url"] = f"download/{att_filename}"
+                # Must write back to config so generate_qr uses the new URL
+                save_config(data, config_path)
+                
+                # Also update the HTML we just replaced if we changed it
+                html = html.replace("{{url}}", data["url"])
+                
         folder_name = data["folder_name"]
         dest = DATA_DIR / "host" / folder_name
         os.makedirs(dest, exist_ok=True)
@@ -803,9 +810,9 @@ def get_export_dir() -> Path:
 
 def export_site(folder_name: str, output_path: str = None):
     """Export a site folder and its keys into a zip archive."""
-    source_dir = ROOT / "host" / folder_name
+    source_dir = DATA_DIR / "host" / folder_name
     if not source_dir.exists():
-        print(f"Error: Site folder '{folder_name}' not found in {ROOT / 'host'}")
+        print(f"Error: Site folder '{folder_name}' not found in {DATA_DIR / 'host'}")
         return
 
     if not output_path:
@@ -861,7 +868,7 @@ def import_site(zip_path: str):
             print("Error: Invalid config.json. Missing 'folder_name'.")
             return
 
-        dest_dir = ROOT / "host" / folder_name
+        dest_dir = DATA_DIR / "host" / folder_name
         if dest_dir.exists():
             confirm = inquirer.confirm(message=f"Site '{folder_name}' already exists. Overwrite?").execute()
             if not confirm:

voxvera/src/index-master.html

@@ -579,9 +579,6 @@
         <a id="download-link" href="download/voxvera-source.zip" download>
             <button class="download-button" data-i18n="web.download_button">{{t_web_download_button}}</button>
         </a>
-        <a id="attachment-link" href="{{attachment_url}}" download style="display: {{attachment_display}};">
-            <button class="download-button" data-i18n="web.download_attachment">{{t_web_download_attachment}}</button>
-        </a>
         <select class="lang-select" id="lang-selector" onchange="setLanguage(this.value)"></select>
     </div>
 </body>