diff --git a/.env.example b/.env.example index d23276eb8..2d1be3373 100644 --- a/.env.example +++ b/.env.example @@ -189,6 +189,7 @@ SEARXNG_INSTANCE=http://localhost:8080 # ODYSSEUS_EMAIL_COMPOSE_UPLOAD_MAX_BYTES=26214400 # email compose attachment (25 MB) # ODYSSEUS_STT_MAX_AUDIO_BYTES=26214400 # speech-to-text audio (25 MB) # ODYSSEUS_ICS_MAX_BYTES=10485760 # calendar .ics import (10 MB) +# ODYSSEUS_TTS_CACHE_MAX_BYTES=524288000 # TTS cache (500 MB) # ============================================================ # Host Docker access (explicit opt-in) diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml index ae8d18f3f..4ee603ee9 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.yml +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -8,8 +8,8 @@ body: value: | **Before submitting:** search [open issues](https://github.com/odysseus-dev/odysseus/issues) and [discussions](https://github.com/odysseus-dev/odysseus/discussions) first. - The [roadmap](https://github.com/odysseus-dev/odysseus/blob/main/ROADMAP.md) is directional rather than a complete backlog. - Feature requests that duplicate an existing issue or accepted proposal may be closed as duplicates. + Feature requests that duplicate [ROADMAP.md](https://github.com/odysseus-dev/odysseus/blob/main/ROADMAP.md) + or an existing open issue will be closed as duplicates. If your idea needs community input before it becomes a concrete proposal, start a [discussion](https://github.com/odysseus-dev/odysseus/discussions/categories/ideas) instead. diff --git a/.github/scripts/check-issue-description.js b/.github/scripts/check-issue-description.js index a76ca29ab..63162b0d7 100644 --- a/.github/scripts/check-issue-description.js +++ b/.github/scripts/check-issue-description.js @@ -153,6 +153,16 @@ module.exports = async ({ github, context, core }) => { } } + const LABEL_BAD = 'needs more info'; + const LABEL_GOOD = 'ready for review'; + + // Closed issues are no longer awaiting review. + // This also prevents later edits to closed issues from restoring the label. + if (issue.state === 'closed') { + await dropLabel(LABEL_GOOD); + return; + } + // ── Find existing bot comment to update in-place ────────────────────────── const MARKER = ''; const { data: comments } = await github.rest.issues.listComments({ @@ -160,9 +170,6 @@ module.exports = async ({ github, context, core }) => { }); const existing = comments.find(c => c.user.type === 'Bot' && c.body.includes(MARKER)); - const LABEL_BAD = 'needs more info'; - const LABEL_GOOD = 'ready for review'; - if (failures.length === 0) { if (existing) { await github.rest.issues.deleteComment({ owner, repo, comment_id: existing.id }); diff --git a/.github/workflows/issue-description-check.yml b/.github/workflows/issue-description-check.yml index 52e9dddae..5ce6037f0 100644 --- a/.github/workflows/issue-description-check.yml +++ b/.github/workflows/issue-description-check.yml @@ -2,7 +2,7 @@ name: ci / issue description check on: issues: - types: [opened, edited, reopened] + types: [opened, edited, reopened, closed] permissions: issues: write diff --git a/README.md b/README.md index b790f4e2d..705ec6b68 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,3 @@ -# Odysseus -

Odysseus

@@ -11,8 +9,6 @@

Quick Start · Setup Guide · - Architecture · - Security · Contributing · Roadmap

@@ -55,15 +51,15 @@ Native installs, GPU notes, Windows/macOS instructions, HTTPS, and configuration ## Demo -Explore the interface through the [interactive product tour](docs/index.html). +A full hover-to-play tour lives on the landing page: [`docs/index.html`](docs/index.html). ## Contributing -Help is welcome. The best entry points are fresh-install testing, provider setup bugs, mobile/editor polish, documentation, and small focused refactors. Read the [contributing guide](CONTRIBUTING.md), review the [public roadmap](ROADMAP.md), and browse the open [GitHub issues](https://github.com/odysseus-dev/odysseus/issues). +Help is welcome. The best entry points are fresh-install testing, provider setup bugs, mobile/editor polish, docs, and small focused refactors. See [CONTRIBUTING.md](CONTRIBUTING.md) and [ROADMAP.md](ROADMAP.md). ## Security -Odysseus is a self-hosted workspace with powerful local tools. Keep auth enabled, keep private data out of Git, and do not expose raw model or service ports publicly. Read the [security policy](SECURITY.md) and the [deployment security guidance](docs/setup.md#security-notes). +Odysseus is a self-hosted workspace with powerful local tools. Keep auth enabled, keep private data out of Git, and do not expose raw model/service ports publicly. Deployment details are in the [setup guide](docs/setup.md#security-notes). ## Star History @@ -77,4 +73,4 @@ Odysseus is a self-hosted workspace with powerful local tools. Keep auth enabled ## License -Licensed under AGPL-3.0-or-later. See the [license](LICENSE) and [acknowledgments](ACKNOWLEDGMENTS.md). +AGPL-3.0-or-later -- see [LICENSE](LICENSE) and [ACKNOWLEDGMENTS.md](ACKNOWLEDGMENTS.md). diff --git a/ROADMAP.md b/ROADMAP.md index bcf0c155c..f5c47ae18 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -1,55 +1,87 @@ -# Roadmap +# Roadmap / Help Wanted -This document provides a high-level view of the areas Odysseus is currently improving. +Odysseus is on a voyage, but not home yet. It works great for me (lol), but this ship is moving fast and feedback/help would be appreciated! (I don't know what I'm doing, help). -It is directional rather than exhaustive. Priorities may change as the project evolves, defects are discovered, and maintainers learn more from implementation work and user feedback. +If you see weird CSS, strange layout behavior, or a suspiciously murky corner of +the codebase, you are probably right to stay away. -For current implementation work, see the open [GitHub issues](https://github.com/odysseus-dev/odysseus/issues). Accepted behaviour should be documented in the repository alongside the code. +## High Priority -## Current priorities +- SQUASH BUGS +- Fresh install smoke tests on Linux, macOS, and Windows. Docker, native Python, + and WSL all need coverage. -### Reliability and setup +- Integration audit: do integrations even work? Confirm what works, what needs setup docs, and what should be removed or hidden. +- Cookbook reliability on other computers. This is probably the area most likely to need work across different machines, GPUs, drivers, shells, and Python environments. +- Cookbook SGLang support across platforms. Make sure SGLang setup/serve works + predictably on Linux, Windows/WSL, macOS where possible, Docker, and common + NVIDIA/AMD hardware paths. +- Deep Research model presets by hardware. Recommend approved model/parameter + profiles for small, medium, and large local setups so people with different + hardware can use Deep Research without guessing. Surface this either in Deep + Research settings or as a Cookbook scan/dropdown suggestion. +- Cookbook model scan/download ranking. Prioritize newer architectures and + better hardware-fit models instead of scoring everything almost the same. + Ranking should account for architecture age, quant format, VRAM/RAM fit, + backend support, vision/mmproj requirements, and likely serve reliability. +- Cookbook error feedback and logging. Failed downloads, dependency installs, + preflights, and serve jobs should show the actual command/output/error in the + UI, with copyable logs and clear next steps instead of just "crashed". +- Agent prompt/context bloat. Agent mode is too heavy for smaller local models: + tool schemas, skills, memory, documents, and instructions can eat the context + before the user request really starts. We need slimmer prompts, better tool + selection, smaller default tool sets, and clearer guidance for models with + 4k/8k/16k context windows. +- Local model speculative decoding support. For Odysseus-tuned local models, + plan to ship or recommend a small same-tokenizer draft model when the serving + backend supports it. Early vLLM testing showed a generic `Qwen3-0.6B` draft + beside `Qwen3-8B` can materially reduce wall time, while an unsupported + DSpark conversion performed poorly. Treat this as a supported draft-model lane + first; keep MTP-specific packaging as future work only when the architecture + and runtime support are real. Judge this by time-to-success, tool correctness, + grammar, and unchanged target output, not tokens/sec alone. +- Skill/tool prompt-injection audit. User-editable skills, notes, documents, + fetched pages, and memories should be treated as untrusted data. Keep testing + whether models follow malicious instructions from those surfaces. +- Better degraded-state reporting for ChromaDB, SearXNG, email, ntfy, and provider probes. +- Email performance audit. Fetching, searching, opening, deleting, and sending + email can feel slow, especially over IMAP/SMTP providers with high latency. + Need someone who knows mail performance to profile the current flow, identify + whether the bottleneck is IMAP folder select/fetch, cache invalidation, + attachment/body loading, SMTP handshakes, or frontend refresh behavior, then + propose safer caching/prefetch/batching without breaking multi-account state. +- Provider setup/probing audit for Anthropic, Gemini, Groq, xAI, OpenRouter, OpenAI, and DeepSeek. -- Improve fresh-install and smoke-test coverage across supported environments. -- Make provider setup, probing, and failure states more predictable. -- Improve Cookbook reliability across hardware, operating systems, drivers, shells, and serving backends. -- Improve degraded-state reporting and recovery guidance when optional services are unavailable. +## Refactor Targets +- CSS cleanup. `static/style.css` basically Calypso's island atm. +- Tour core helper. The onboarding tours have too much copy-pasted scaffolding; promote a shared `tour-core.js` helper before adding more tours. +- Modal/window positioning cleanup. Some window controls have improved, but the + underlying popup/dropdown/fixed-position behavior is still too fragile. +- Mobile media override discoverability. A lot of "CSS did not move" bugs are mobile `@media` overrides of the same selector; comments or linting around desktop/mobile paired rules would help. +- Dead code pass for old routes, stale feature flags, and unused UI states. -### Local model workflows +## Frontend -- Improve hardware-aware model recommendations and compatibility guidance. -- Evaluate serving optimizations, including speculative decoding, through reproducible benchmarks. -- Improve installation, preflight checks, logging, and error reporting for local model serving. -- Reduce prompt and context overhead for smaller local models. +- Expand the Editor for quicker, more robust everyday use. Better file/document + handling, smoother window behavior, clearer save/export flows, stronger image + editing affordances, and fewer brittle edge cases. +- Better AI integration for Notes and Todos. Notes should be easier for the + agent to read, update, summarize, and turn into actions. Todos should be + assignable to an agent from the UI, possibly through a button, task action, + or dedicated skill/tool flow. +- Mobile gallery/editor polish. Easier to launch/download inpaint model or any missing pieces. +- Accessibility pass: keyboard navigation, focus states, contrast, reduced motion. +- Improve empty states and error messages on fresh installs. +- Tighten first-run setup, hints, and tours so they do not repeat or fight each other. +- Vendor CDN assets eventually for a more fully self-hosted/offline mode. -### Safety and resilience +## Backend -- Continue hardening tool execution, filesystem access, credentials, networking, and destructive operations. -- Treat content from documents, notes, memories, skills, and fetched pages as potentially untrusted. -- Improve security-focused regression coverage and operational guidance. -- Review integrations that expand access to sensitive data or privileged operations. +- More tests around endpoint probing and provider setup. +- Better task scheduler defaults and visibility. +- Backup/restore guide and helper flow for `data/`. +- Security hardening around admin-only tools and clear docs for their risk. -### Product usability +## Not The Focus Right Now -- Improve first-run setup, onboarding, hints, and tours. -- Improve accessibility, keyboard navigation, focus behaviour, contrast, and reduced-motion support. -- Improve empty states, error messages, and recovery paths. -- Strengthen Notes, Todos, Editor, mobile, and everyday workspace flows. - -### Architecture and maintainability - -- Reduce duplication and technical debt through focused, reviewable refactors. -- Improve subsystem documentation as behaviour and architecture become stable. -- Remove stale code, obsolete feature flags, and unsupported integrations. -- Keep implementation decisions grounded in current code and verified behaviour. - -## Tracking work - -Concrete implementation tasks, defects, proposals, and technical investigations are tracked in: - -- [GitHub Issues](https://github.com/odysseus-dev/odysseus/issues) -- [Contributing Guide](CONTRIBUTING.md) - -Maintainers may use additional private coordination tools for ownership, planning, and unresolved decisions. - -This roadmap is not a complete backlog or a guarantee that a particular item will be delivered. +I prob shouldnt add more themes. diff --git a/SECURITY.md b/SECURITY.md index 38265a1da..1fa5b0b3b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -37,6 +37,4 @@ Only `.env.example`, docs, source, tests, and static assets should be committed. ## Reporting -Report security vulnerabilities privately through [GitHub Security Advisories](https://github.com/odysseus-dev/odysseus/security/advisories/new). - -Do not open a public issue or discussion, and do not disclose exploit details publicly. +Please report vulnerabilities privately via GitHub security advisories if available, or by opening a minimal issue that does not disclose exploit details. diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md index ec10cd105..48665a61d 100644 --- a/THREAT_MODEL.md +++ b/THREAT_MODEL.md @@ -68,14 +68,14 @@ External content that reaches the LLM is treated as untrusted via `src/prompt_se - `X-Content-Type-Options: nosniff` and `Referrer-Policy: no-referrer` everywhere. - **CSP:** nonce-based `script-src 'self' 'nonce-{nonce}' https://cdn.jsdelivr.net`. `style-src 'unsafe-inline'` is intentionally kept — `static/index.html` ships inline `