fix: review comments

Author: bradjin8

.github/workflows/tests.yml

@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
       # Pinned to immutable commit SHAs (not @v4 / @v5) so a compromised tag
       # cannot silently swap the underlying action code on this CI runner.

launcher.py

@@ -5,12 +5,18 @@
 directly in-process.
 """
 
-import webview
-
 from app import create_app
 
 
 def main():
+    try:
+        import webview
+    except ImportError:
+        raise SystemExit(
+            "pywebview is not installed. Install the [desktop] extra, e.g.\n"
+            '  pip install -e ".[desktop]"'
+        ) from None
+
     app = create_app()
     webview.create_window(
         "Cursor Chat Browser",

pyproject.toml

@@ -9,7 +9,7 @@ description = "Flask web application for browsing and exporting Cursor AI chat h
 readme = "README.md"
 license = { file = "LICENSE" }
 authors = [{ name = "C++ Alliance", email = "admin@cppalliance.org" }]
-requires-python = ">=3.11"
+requires-python = ">=3.10"
 
 # Runtime dependencies — bounded on both sides so CI resolves deterministically
 # and breaking major releases are caught at install time rather than at runtime.
@@ -18,9 +18,6 @@ requires-python = ">=3.11"
 dependencies = [
     "flask>=3.0,<4",
     "fpdf2>=2.7,<3",
-    # fpdf2 depends on Pillow; declare a floor + cap so resolvers cannot pick
-    # known-vulnerable Pillow releases while staying on Pillow 10.x.
-    "pillow>=10.0.0,<11",
 ]
 
 [project.optional-dependencies]
@@ -63,6 +60,7 @@ include = [
     "launcher.py",
 ]
 
+# sdist includes tests + ancillary files; wheel is runtime-only.
 [tool.hatch.build.targets.sdist]
 include = [
     "api/",
@@ -90,4 +88,5 @@ no_strict_optional = true
 pretty = true
 # Exclude virtual-env and build artefact directories so that `mypy .` from the
 # repo root matches CI behaviour (CI runs in a clean runner without a local venv).
-exclude = ["venv/", "\\.venv/", "build/", "dist/"]
+# Anchored regexes — unanchored `venv/` would match any path segment containing "venv/".
+exclude = ["^venv/", "^\\.venv/", "^build/", "^dist/"]

requirements.txt

@@ -1,11 +1,9 @@
-# Backward-compatibility shim — pyproject.toml is the canonical source of
-# truth for dependencies.  This file is retained so that
-# legacy workflows running `pip install -r requirements.txt` keep working,
-# but bounded version specifiers and the lock file live in pyproject.toml.
+# Backward-compatibility shim — mirrors [project.dependencies] in pyproject.toml.
+# Keep version specifiers in sync when runtime deps change.
 #
 # Prefer: pip install -e .           (installs the package + runtime deps)
 #         pip install -e ".[dev]"    (+ pytest and mypy)
 #         pip install -e ".[desktop]" (+ pywebview for the GUI launcher)
-flask>=3.0
-fpdf2>=2.7
+flask>=3.0,<4
+fpdf2>=2.7,<3
 # pywebview is desktop-only — install with: pip install -e ".[desktop]"