refactor(routes): move search domain into routes/search/ subpackage

.dockerignore

@@ -9,6 +9,17 @@ __pycache__/
 dist/
 build/
 .env
+.env.bak.*
+# Secrets: keep plaintext and every transient secrets.env variant out of
+# the build context. If an encrypted secrets.env is used, it is mounted
+# at runtime — never baked into the image. Mirrored in .gitignore.
+secrets.env
+secrets.env.*
+secrets.env~
+.secrets.env.swp
+.secrets.env.swo
+**/#secrets.env#
+!secrets.env.example
 /data/
 /logs/
 .git/
@@ -18,6 +29,8 @@ build/
 .vscode/
 .idea/
 dev-docs/
+docs/
+*.md
 *.db
 *.sqlite
 *.sqlite3

.env.example

@@ -16,13 +16,27 @@ LLM_HOST=localhost
 # when started with OLLAMA_HOST=0.0.0.0:11434.
 # OLLAMA_BASE_URL=http://host.docker.internal:11434/v1
 
+# Optional LM Studio URL. In Docker, host LM Studio is reachable here
+# when LM Studio is set to serve on all interfaces (0.0.0.0).
+# LM_STUDIO_URL=http://host.docker.internal:1234
+
 # OpenAI API key (only needed if using OpenAI models).
 # Do not commit real keys. Keep this commented until needed.
 # OPENAI_API_KEY=your_openai_api_key_here
 
 # Research service LLM endpoint
 # RESEARCH_LLM_ENDPOINT=http://localhost:8000/v1/chat/completions
 
+# Extra CA bundle for LLM providers whose TLS chain isn't in the default
+# trust store. Layered ON TOP of the system / certifi bundle — verification
+# stays on for every host, the trust set just gets larger. Useful for:
+#   - GigaChat / Sber (Russian Trusted Root CA): without this the endpoint
+#     shows offline with CERTIFICATE_VERIFY_FAILED — self-signed certificate
+#     in certificate chain.
+#   - On-premise / corporate LLM gateways with an internal CA.
+# Point at a PEM file containing the missing root(s).
+# LLM_CA_BUNDLE=/etc/odysseus/ca/extra-roots.pem
+
 # ============================================================
 # Search & Web
 # ============================================================
@@ -42,17 +56,34 @@ SEARXNG_INSTANCE=http://localhost:8080
 # SQLite database path (default: sqlite:///./data/app.db)
 # DATABASE_URL=sqlite:///./data/app.db
 
+# ============================================================
+# Data directory
+# ============================================================
+# Move everything that lives under data/ - settings, sessions, database, auth,
+# cache, uploads, etc. - to another path:
+# ODYSSEUS_DATA_DIR=C:\path\to\dir
+
 # ============================================================
 # Auth & Security
 # ============================================================
 
 # Enable authentication (default: true)
 # AUTH_ENABLED=true
 
+# Host bind address and port for the Odysseus web UI in Docker Compose.
+# Keep APP_BIND on loopback unless you intentionally want LAN/reverse-proxy access.
+# APP_BIND=127.0.0.1
+# Change this if another local service already uses 7000 (macOS AirPlay often does).
+# APP_PORT=7000
+
 # Development-only auth bypass for loopback requests.
 # Keep false for Docker, LAN, reverse proxy, and any shared deployment.
 # LOCALHOST_BYPASS=false
 
+# Mark session cookies Secure. Set true when Odysseus is served through HTTPS
+# by a trusted reverse proxy or private access gateway.
+# SECURE_COOKIES=true
+
 # Optional: pre-seed the first admin password during setup.
 # Do not commit a real password.
 # ODYSSEUS_ADMIN_PASSWORD=change_me_before_first_boot
@@ -88,6 +119,9 @@ SEARXNG_INSTANCE=http://localhost:8080
 # Default: http://{LLM_HOST}:11434/v1/embeddings (ollama)
 # EMBEDDING_URL=http://localhost:11434/v1/embeddings
 
+# Embedding API key (if there's one)
+# EMBEDDING_API_KEY=embedding_api_key_here
+
 # Embedding model name (must be available at the endpoint above)
 # EMBEDDING_MODEL=all-minilm:l6-v2
 
@@ -119,3 +153,67 @@ SEARXNG_INSTANCE=http://localhost:8080
 # Empty/local/localhost runs scripts on the app host. Set to an SSH host alias
 # if you intentionally want scheduled scripts to run remotely.
 # ODYSSEUS_SCRIPT_HOST=localhost
+
+# Chat / agent attachment size cap in bytes (default: 10 MB).
+# Raise this for local installs that need larger PDFs or text documents.
+# Example: 52428800 = 50 MB.
+# ODYSSEUS_CHAT_UPLOAD_MAX_BYTES=10485760
+
+# Other per-feature upload size caps in bytes. All are validated and optional;
+# defaults shown. An invalid value (non-integer or < 1) fails fast at startup.
+# ODYSSEUS_GALLERY_UPLOAD_MAX_BYTES=104857600            # gallery image upload (100 MB)
+# ODYSSEUS_GALLERY_TRANSFORM_UPLOAD_MAX_BYTES=26214400   # gallery transform input (25 MB)
+# ODYSSEUS_MEMORY_IMPORT_MAX_BYTES=10485760              # memory import file (10 MB)
+# ODYSSEUS_PERSONAL_UPLOAD_MAX_BYTES=26214400            # personal document upload (25 MB)
+# ODYSSEUS_EMAIL_COMPOSE_UPLOAD_MAX_BYTES=26214400       # email compose attachment (25 MB)
+# ODYSSEUS_STT_MAX_AUDIO_BYTES=26214400                  # speech-to-text audio (25 MB)
+# ODYSSEUS_ICS_MAX_BYTES=10485760                        # calendar .ics import (10 MB)
+
+# ============================================================
+# Host Docker access (explicit opt-in)
+# ============================================================
+# Default Docker Compose does not mount /var/run/docker.sock. Existing
+# Ollama, vLLM, and other OpenAI-compatible endpoints remain usable without it.
+#
+# Enable this only for intentional Cookbook/local Docker-daemon management.
+# Raw socket access is high-trust and can grant broad control over the host
+# Docker daemon. Set DOCKER_GID to the host docker group's numeric GID.
+# Put these values in .env, or export them before running docker compose.
+# COMPOSE_FILE=docker-compose.yml:docker/host-docker.yml
+# DOCKER_GID=963
+# docker/host-docker.yml sets this inside the container. Keep it paired
+# with the socket overlay; setting it alone is not sufficient.
+# ODYSSEUS_ENABLE_HOST_DOCKER=true
+#
+# Host Docker access can be combined with one GPU overlay:
+# COMPOSE_FILE=docker-compose.yml:docker/gpu.nvidia.yml:docker/host-docker.yml
+# COMPOSE_FILE=docker-compose.yml:docker/gpu.amd.yml:docker/host-docker.yml
+
+# ============================================================
+# GPU support (Docker Compose)
+# ============================================================
+# Pass the host GPU into the odysseus container. Default (unset) = CPU.
+# COMPOSE_FILE is a native `docker compose` feature: a colon-separated
+# list of files merged left-to-right. Pick ONE GPU line below, or leave
+# all commented for CPU.
+#
+# NVIDIA (requires nvidia-container-toolkit + `nvidia-ctk runtime
+# configure --runtime=docker` on the host):
+# COMPOSE_FILE=docker-compose.yml:docker/gpu.nvidia.yml
+# COMPOSE_FILE=docker-compose.yml;docker/gpu.nvidia.yml    #(Windows)
+#
+# AMD ROCm (requires ROCm drivers on the host and the GID of the render group):
+# COMPOSE_FILE=docker-compose.yml:docker/gpu.amd.yml
+# Find the render GID with: getent group render | cut -d: -f3
+# RENDER_GID=989
+#
+# These overlays only expose the GPU devices. The slim Odysseus image
+# still needs CUDA/ROCm userspace via Cookbook -> Dependencies (vLLM,
+# llama-cpp-python, etc.) before models can actually serve on GPU.
+
+# ============================================================
+# Storage Paths (Docker Compose)
+# ============================================================
+
+# APP_DATA_DIR=./data
+# APP_LOGS_DIR=./logs

.gitattributes

@@ -1,2 +1,27 @@
-*.sh text eol=lf
+# Normalize line endings so a Windows checkout (git core.autocrlf=true) can't
+# corrupt shell-script shebangs. A CRLF `#!/bin/sh\r` makes the kernel look for
+# an interpreter literally named "/bin/sh\r", producing the Docker startup error
+# "exec /usr/local/bin/entrypoint.sh: no such file or directory" (issues #150, #77).
+* text=auto
+
+# Shell scripts must stay LF on every platform (run by sh/bash, incl. in Docker).
+*.sh   text eol=lf
+*.bash text eol=lf
+entrypoint.sh text eol=lf
 docker/entrypoint.sh text eol=lf
+
+# Windows-native scripts stay CRLF.
+*.ps1 text eol=crlf
+*.cmd text eol=crlf
+*.bat text eol=crlf
+
+# Binary assets — never normalize.
+*.png  binary
+*.jpg  binary
+*.jpeg binary
+*.gif  binary
+*.webp binary
+*.pdf  binary
+*.ico  binary
+*.woff binary
+*.woff2 binary

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# Code owners.
+#
+# Intentionally empty for now. The catch-all rule that mapped every path to a
+# single owner froze all merges the moment "Require review from Code Owners"
+# was enabled, because no other maintainer's approval could satisfy the gate.
+# A per-area ownership map (security/auth, CI, frontend, agent internals, with
+# multiple named owners per line) is being worked out in issue #593; once
+# agreed it replaces this file. Until then, required reviews and the security
+# CI gate (docs/security-ci.md) remain in force via branch protection.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,114 @@
+name: Bug Report
+description: Report a reproducible bug in Odysseus.
+labels: ["bug"]
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Before submitting:** search [open issues](https://github.com/odysseus-dev/odysseus/issues)
+        and [discussions](https://github.com/odysseus-dev/odysseus/discussions) first.
+        Duplicate reports slow things down.
+
+        For security vulnerabilities, **do not open a public issue** —
+        use [GitHub Security Advisories](https://github.com/odysseus-dev/odysseus/security/advisories/new)
+        and read [SECURITY.md](https://github.com/odysseus-dev/odysseus/blob/main/SECURITY.md) first.
+
+  - type: checkboxes
+    id: prerequisites
+    attributes:
+      label: Prerequisites
+      options:
+        - label: I searched [open issues](https://github.com/odysseus-dev/odysseus/issues?q=is%3Aissue+is%3Aopen) and [discussions](https://github.com/odysseus-dev/odysseus/discussions) and did not find an existing report of this bug.
+          required: true
+        - label: This is **not** a security vulnerability. (Vulnerabilities go to [GitHub Security Advisories](https://github.com/odysseus-dev/odysseus/security/advisories/new) — see [SECURITY.md](https://github.com/odysseus-dev/odysseus/blob/main/SECURITY.md).)
+          required: true
+        - label: I am running the latest code from the `dev` branch (the default branch you get on clone, where fixes land first) and the bug still reproduces there. Please `git pull` the latest `dev` before filing.
+          required: true
+
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Install Method
+      options:
+        - "-- Please Select --"
+        - Docker (docker compose up)
+        - Manual Python install (pip / venv)
+        - Windows native (launch-windows.ps1)
+        - macOS app (build-macos-app.sh / start-macos.sh)
+        - Other (describe in the reproduction steps below)
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating System
+      options:
+        - "-- Please Select --"
+        - Linux
+        - macOS
+        - Windows
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: Exact steps that reliably trigger the bug. The more specific, the faster this gets fixed.
+      placeholder: |
+        1. Go to ...
+        2. Click / type ...
+        3. Observe ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behaviour
+      description: What should have happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behaviour
+      description: What actually happened? Include the full error message if there is one.
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / Screenshots
+      description: Paste relevant terminal output or attach screenshots. Remove API keys, passwords, and personal data before pasting.
+      render: text
+
+  - type: input
+    id: model-backend
+    attributes:
+      label: Model / Backend (if relevant)
+      description: "e.g. Ollama + llama3.2:latest, vLLM + mistral-7b, OpenAI API, Anthropic API"
+      placeholder: "Ollama + llama3.2:latest"
+
+  - type: dropdown
+    id: willing_to_fix
+    attributes:
+      label: Are you willing to submit a fix?
+      options:
+        - "-- Please Select --"
+        - "Yes — I can open a PR"
+        - "Partially — I can help but need guidance"
+        - "No — I am only filing the report"
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional-info
+    attributes:
+      label: Additional Information
+      description: Anything else that might help — browser console errors, related issues, things you already tried, or environment quirks.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question / Need Help
+    url: https://github.com/odysseus-dev/odysseus/discussions/categories/q-a
+    about: Ask how-to questions, setup help, and model configuration questions here. Issues are for confirmed bugs and concrete proposals only.
+
+  - name: Idea or Suggestion
+    url: https://github.com/odysseus-dev/odysseus/discussions/categories/ideas
+    about: Discuss ideas and gauge interest before opening a formal feature request. If there is already a discussion, link it in your feature request.
+
+  - name: Security Vulnerability
+    url: https://github.com/odysseus-dev/odysseus/security/advisories/new
+    about: Report vulnerabilities privately via GitHub Security Advisories — never as a public issue. Read SECURITY.md before reporting.