fix: make CI green — ruff/pyright violations, reflex module resolution, export working-directory

- Split 46 E701/E702 compound one-liners (if/raise, semicolon-chained
  statements) across auth_adapter.py, migrations/env.py, 0001_application_spine.py,
  analysis.py, auth.py, cli.py, models.py, services.py, worker.py — cosmetic,
  no behavior change.
- auth_adapter.py: add missing @rx.event on do_logout (fixes pyright
  reportIncompatibleVariableOverride — parent's do_logout is @rx.event,
  the override wasn't); capture require()'s return in create_user instead of
  discarding it (fixes reportOptionalMemberAccess on principal.user_id, and
  was a real narrowing bug, not just a type-checker complaint).
- rxconfig.py: add app_module_import="starter_web.app" — Reflex's default
  convention expects starter_web/starter_web.py, but the app lives in
  src/starter_web/app.py (src-layout). Without this, `reflex export`/`reflex run`
  never worked at all: "Module starter_web.starter_web not found". This was
  never caught because no CI run ever got past the earlier ruff/pyright gap
  to reach this step.
- ci.yml: add working-directory: apps/web to the reflex export step —
  rxconfig.py lives there, not at repo root, so the step 404'd on
  "rxconfig.py not found" even with the module fix applied.
- apps/web/.gitignore, apps/web/reflex.lock/: first successful `reflex init`
  in this repo's history generated these; committing the lockfile for
  reproducible frontend builds (same rationale as uv.lock).

Verified locally: ruff check, pyright, pytest -m "not database", and
reflex export --frontend-only --no-zip (from apps/web) all pass clean.

Author: CI Runner

.github/workflows/ci.yml

@@ -13,3 +13,4 @@ jobs:
       - run: uv run pyright apps packages
       - run: uv run pytest -m "not database"
       - run: uv run reflex export --frontend-only --no-zip
+        working-directory: apps/web

apps/web/.gitignore

@@ -0,0 +1,6 @@
+.states
+__pycache__/
+.web
+*.py[cod]
+*.db
+assets/external/

apps/web/reflex.lock/bun.lock

@@ -0,0 +1,36 @@
+{
+  "name": "reflex",
+  "type": "module",
+  "scripts": {
+    "dev": "react-router dev --host",
+    "export": "react-router build"
+  },
+  "dependencies": {
+    "@radix-ui/react-form": "0.1.8",
+    "@radix-ui/themes": "3.3.0",
+    "@react-router/node": "7.15.0",
+    "isbot": "5.1.40",
+    "lucide-react": "1.14.0",
+    "react": "19.2.6",
+    "react-dom": "19.2.6",
+    "react-error-boundary": "6.1.1",
+    "react-helmet": "6.1.0",
+    "react-router": "7.15.0",
+    "react-router-dom": "7.15.0",
+    "socket.io-client": "4.8.3",
+    "sonner": "2.0.7",
+    "universal-cookie": "7.2.2"
+  },
+  "devDependencies": {
+    "@emotion/react": "11.14.0",
+    "@react-router/dev": "7.15.0",
+    "@react-router/fs-routes": "7.15.0",
+    "autoprefixer": "10.5.0",
+    "postcss": "8.5.14",
+    "postcss-import": "16.1.1",
+    "vite": "8.0.12"
+  },
+  "overrides": {
+    "cookie": "1.1.1"
+  }
+}

apps/web/reflex.lock/package.json

@@ -1,3 +1,3 @@
 import os
 import reflex as rx
-config = rx.Config(app_name="starter_web", db_url=os.environ.get("DATABASE_URL"))
+config = rx.Config(app_name="starter_web", app_module_import="starter_web.app", db_url=os.environ.get("DATABASE_URL"))

apps/web/rxconfig.py

@@ -11,21 +11,25 @@ class AppAuthState(reflex_local_auth.LocalAuthState):
     @rx.var(cache=False)
     def principal(self) -> Principal | None:
         user = self.authenticated_user
-        if user.id is None or user.id < 0 or not user.enabled: return None
+        if user.id is None or user.id < 0 or not user.enabled:
+            return None
         with rx.session() as session:
             profile = session.exec(select(UserProfile).where(UserProfile.local_user_id == user.id)).one_or_none()
-        if profile is None: return None
+        if profile is None:
+            return None
         return Principal(user_id=user.id, email=profile.email or user.username, role=Role(profile.role), is_active=True)
+
+    @rx.event
     def do_logout(self):
         return reflex_local_auth.LocalAuthState.do_logout
 
     def create_user(self, username: str, password: str, email: str | None, role: Role) -> None:
         """Admin-only account flow; role is checked server-side, never accepted from a client as authority."""
-        principal = self.principal
-        require(principal, Capability.MANAGE_USERS)
+        principal = require(self.principal, Capability.MANAGE_USERS)
         validate_password(password)
         with rx.session() as session:
             user = reflex_local_auth.LocalUser(username=username, password_hash=reflex_local_auth.LocalUser.hash_password(password), enabled=True)
-            session.add(user); session.flush()
+            session.add(user)
+            session.flush()
             session.add(UserProfile(local_user_id=user.id, email=email, role=role, created_by_user_id=principal.user_id))
             session.commit()

apps/web/src/starter_web/auth_adapter.py

@@ -5,11 +5,15 @@
 target_metadata = Base.metadata
 def run_migrations_offline() -> None:
     context.configure(url=config.get_main_option("sqlalchemy.url"), target_metadata=target_metadata, literal_binds=True)
-    with context.begin_transaction(): context.run_migrations()
+    with context.begin_transaction():
+        context.run_migrations()
 def run_migrations_online() -> None:
     connectable = engine_from_config(config.get_section(config.config_ini_section, {}), prefix="sqlalchemy.", poolclass=pool.NullPool)
     with connectable.connect() as connection:
         context.configure(connection=connection, target_metadata=target_metadata)
-        with context.begin_transaction(): context.run_migrations()
-if context.is_offline_mode(): run_migrations_offline()
-else: run_migrations_online()
+        with context.begin_transaction():
+            context.run_migrations()
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()

migrations/env.py

@@ -25,4 +25,7 @@ def upgrade() -> None:
     op.create_table("analysis_jobs", sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True), sa.Column("dataset_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("datasets.id"), nullable=False), sa.Column("submitted_by_user_id", sa.Integer(), sa.ForeignKey("localuser.id"), nullable=False), sa.Column("prompt", sa.Text(), nullable=False), sa.Column("status", sa.String(20), nullable=False), sa.Column("result", postgresql.JSONB()), sa.Column("error", sa.Text()), sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()), sa.Column("completed_at", sa.DateTime(timezone=True)))
     op.create_table("audit_events", sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True), sa.Column("actor_user_id", sa.Integer(), sa.ForeignKey("localuser.id")), sa.Column("action", sa.String(100), nullable=False), sa.Column("subject", sa.String(255), nullable=False), sa.Column("details", postgresql.JSONB()), sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()))
 def downgrade() -> None:
-    op.drop_table("audit_events"); op.drop_table("analysis_jobs"); op.drop_table("datasets"); op.drop_table("user_profiles")
+    op.drop_table("audit_events")
+    op.drop_table("analysis_jobs")
+    op.drop_table("datasets")
+    op.drop_table("user_profiles")

migrations/versions/0001_application_spine.py

@@ -1,7 +1,9 @@
 from dataclasses import dataclass
 from typing import Protocol
 @dataclass(frozen=True, slots=True)
-class AnalysisResult: summary: str; rows_examined: int
+class AnalysisResult:
+    summary: str
+    rows_examined: int
 class AnalysisEngine(Protocol):
     async def analyze(self, *, dataset_name: str, prompt: str) -> AnalysisResult: ...
 class MockAnalysisEngine:

packages/core/src/starter_core/analysis.py

@@ -1,13 +1,24 @@
 from dataclasses import dataclass
 from enum import StrEnum
 from .types import Role
-class AuthorizationError(PermissionError): pass
-class Capability(StrEnum): MANAGE_USERS = "manage_users"; CREATE_DATASET = "create_dataset"; SUBMIT_ANALYSIS = "submit_analysis"; VIEW_RESULTS = "view_results"
+class AuthorizationError(PermissionError):
+    pass
+class Capability(StrEnum):
+    MANAGE_USERS = "manage_users"
+    CREATE_DATASET = "create_dataset"
+    SUBMIT_ANALYSIS = "submit_analysis"
+    VIEW_RESULTS = "view_results"
 @dataclass(frozen=True, slots=True)
-class Principal: user_id: int; email: str; role: Role; is_active: bool
+class Principal:
+    user_id: int
+    email: str
+    role: Role
+    is_active: bool
 PERMISSIONS = {Role.ADMIN: frozenset(Capability), Role.MEMBER: frozenset({Capability.CREATE_DATASET, Capability.SUBMIT_ANALYSIS, Capability.VIEW_RESULTS}), Role.VIEWER: frozenset({Capability.VIEW_RESULTS})}
 def require(principal: Principal | None, capability: Capability) -> Principal:
-    if principal is None or not principal.is_active or capability not in PERMISSIONS[principal.role]: raise AuthorizationError("not authorized")
+    if principal is None or not principal.is_active or capability not in PERMISSIONS[principal.role]:
+        raise AuthorizationError("not authorized")
     return principal
 def validate_password(password: str) -> None:
-    if not 12 <= len(password) <= 256: raise ValueError("password must be between 12 and 256 characters")
+    if not 12 <= len(password) <= 256:
+        raise ValueError("password must be between 12 and 256 characters")