fix: package and run generated scaffold profiles - #1080
Conversation
Hypermedia surface change (
|
Core benchmark comparisonSynthetic in-process regression workloads run sequentially on the same GitHub-hosted runner. These numbers are not production or cross-framework evidence.
Gate passed: no workload exceeded the regression budget. Warnings begin above 5%; CI fails above 20%. Metric: |
There was a problem hiding this comment.
🟡 Changes recommended
The generated streaming scaffold’s response template can render an undefined variable under strict template settings, and the generated packaging metadata currently writes OS-dependent path separators that can break wheels on Windows.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR fixes chirp new scaffolds so generated projects are installable/packageable (wheel contains modules + assets), align on the canonical secure_stack middleware wiring, and avoid starter runtime failures across the supported scaffold profiles, with expanded tests to validate packaging + runtime behavior.
Changes:
- Generate missing project metadata (README,
.python-version, packaging metadata) and ensure wheels include flat modules plus namespaced assets that resolve outside the source checkout. - Standardize scaffolds on
secure_stack(...)and make shell/SSE/streaming profiles render and behave correctly under CSRF + streaming. - Expand CLI scaffold tests to cover runtime flows, authentication, OOB targets, smoke tests, and wheel contents across profiles.
File summaries
| File | Description |
|---|---|
| tests/test_cli_new.py | Updates assertions for canonical secure_stack wiring; fixes skill scaffold import-path isolation. |
| tests/cli/test_scaffold_runtime.py | Adds runtime assertions for the dashboard refresh target wiring. |
| tests/cli/test_scaffold_patterns.py | Updates expected dependency floor to include bengal-chirp[sessions]. |
| tests/cli/test_scaffold_packaging.py | New test suite for scaffold packaging/metadata correctness and dev-only demo identity. |
| tests/cli/test_scaffold_modularity.py | Adjusts expectation for component directory path usage. |
| src/chirp/cli/templates/v2.py | Migrates v2 scaffolds to secure_stack, project-rooted paths, packaged static/pages, dev-only demo user, and improved htmx behavior. |
| src/chirp/cli/templates/stream.py | Updates streaming scaffold for secure stack + CSRF, chunk naming, and expanded smoke tests. |
| src/chirp/cli/templates/sse.py | Aligns SSE smoke tests with generated app wiring and async TestClient usage. |
| src/chirp/cli/templates/skill.py | Roots assets via project_paths, enables CSP nonce, and tightens dependency metadata. |
| src/chirp/cli/templates/shell.py | Updates shell scaffold to secure stack + packaged paths and correct Page-based negotiation for shell routing (incl. chirp-ui variant). |
| src/chirp/cli/templates/scaffold.py | Bounds Python requirement and bengal-chirp extras; adds generated README and project_paths.py templates. |
| src/chirp/cli/templates/minimal.py | Migrates minimal scaffold to secure stack, CSP nonce, and packaged template_dir pathing. |
| src/chirp/cli/templates/ai.py | Improves AI scaffold secure posture (htmx/CSP nonce) and SSE contract + fragment payload naming. |
| src/chirp/cli/_new.py | Adds a post-generation metadata/packaging finalization step and shell+chirpui generation fixes. |
| changelog.d/1060.fixed.md | Documents the scaffold packaging/runtime fixes and the remaining lock-generation follow-up. |
Review details
- Files reviewed: 15/15 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| for directory in sorted(project_dir.rglob("*")): | ||
| if not directory.is_dir() or directory.parts[-1] == "tests": | ||
| continue | ||
| files = sorted( | ||
| str(path.relative_to(project_dir)) for path in directory.iterdir() if path.is_file() | ||
| ) | ||
| if files: | ||
| source += ( | ||
| json.dumps("share/" + args.name + "/" + str(directory.relative_to(project_dir))) | ||
| + " = " | ||
| + json.dumps(files) | ||
| + "\n" | ||
| ) |
| <p class="prompt">Prompt: {{ prompt }}</p> | ||
| <div class="response">{% async for token in stream %}{{ token }}{% end %}</div> | ||
| <div class="response">{% async for chunk in stream %}{{ chunk }}{% end %}</div> | ||
| <p><a href="/">← Back</a></p> | ||
| {% block token %}{% if (token ?? '') %}<span>{{ token }}</span>{% end %}{% endblock %} | ||
| {% block token %}<span>{{ text_chunk }}</span>{% endblock %} | ||
| </main> |
Generated starters had missing package metadata/assets, inconsistent middleware setup, and runtime failures in shell and streaming profiles. This fixes those defects across all nine profiles, includes README and interpreter metadata, packages modules and namespaced assets for installed use, bounds framework dependencies with profile extras, and restricts the demo account to development.
Behavioral tests exercise generated apps, authentication, shell routes, the UI counter target, streaming response content, generated smoke suites, and wheel contents. All nine profiles were built, actually installed with uv pip, and served GET / successfully from an unrelated directory. The complete tests/cli plus test_cli_new suite passes; focused packaging/runtime tests pass with 97.7% coverage of the changed generator/templates. All 46 GitHub CI checks pass, including the full suite, browser smoke, and PostgreSQL compatibility. Ruff and format pass, and Ty exits successfully with one pre-existing unused suppression warning.
This is a partial implementation, and #1060 remains open:
Refs #1060
Acceptance #1060: partial; generated-project regressions carry @pytest.mark.issue(1060). No issue closure requested.