fix: integrate all open pull requests and fix test regressions

.devcontainer/.env.example

@@ -0,0 +1,158 @@
+# Odysseus UI — Dev Container environment
+# Copy this file to .devcontainer/.env and fill in your values.
+
+# ============================================================
+# LLM Configuration
+# ============================================================
+
+# Primary LLM host (default: localhost)
+LLM_HOST=localhost
+
+# Additional LLM hosts, comma-separated (for model discovery)
+# Use hostnames/IPs only; Odysseus scans common serve ports, including Ollama's 11434.
+# LLM_HOSTS=llm-host.local,backup-llm.local
+
+# Optional Ollama base URL. In Docker, host Ollama is usually reachable here
+# when started with OLLAMA_HOST=0.0.0.0:11434.
+# OLLAMA_BASE_URL=http://host.docker.internal:11434/v1
+
+# OpenAI API key (only needed if using OpenAI models).
+# Do not commit real keys. Keep this commented until needed.
+# OPENAI_API_KEY=your_openai_api_key_here
+
+# Research service LLM endpoint
+# RESEARCH_LLM_ENDPOINT=http://localhost:8000/v1/chat/completions
+
+# Extra CA bundle for LLM providers whose TLS chain isn't in the default
+# trust store. Layered ON TOP of the system / certifi bundle — verification
+# stays on for every host, the trust set just gets larger. Useful for:
+#   - GigaChat / Sber (Russian Trusted Root CA): without this the endpoint
+#     shows offline with CERTIFICATE_VERIFY_FAILED — self-signed certificate
+#     in certificate chain.
+#   - On-premise / corporate LLM gateways with an internal CA.
+# Point at a PEM file containing the missing root(s).
+# LLM_CA_BUNDLE=/etc/odysseus/ca/extra-roots.pem
+
+# ============================================================
+# Search & Web
+# ============================================================
+
+# SearXNG instance URL (self-hosted, for web search).
+# Docker Compose overrides this to http://searxng:8080 for in-network access.
+SEARXNG_INSTANCE=http://localhost:8080
+
+# Optional SearXNG cookie/CSRF secret. If blank, Docker generates one on first boot
+# and stores it in the searxng-data volume.
+# SEARXNG_SECRET=
+
+# ============================================================
+# Database
+# ============================================================
+
+# SQLite database path (default: sqlite:///./data/app.db)
+# DATABASE_URL=sqlite:///./data/app.db
+
+# ============================================================
+# Auth & Security
+# ============================================================
+
+# Enable authentication (default: true)
+# AUTH_ENABLED=true
+
+# Host bind address and port for the Odysseus web UI in Docker Compose.
+# Keep APP_BIND on loopback unless you intentionally want LAN/reverse-proxy access.
+# APP_BIND=127.0.0.1
+# Change this if another local service already uses 7000 (macOS AirPlay often does).
+# APP_PORT=7000
+
+# Development-only auth bypass for loopback requests.
+# Keep false for Docker, LAN, reverse proxy, and any shared deployment.
+# LOCALHOST_BYPASS=false
+
+# Optional: pre-seed the first admin password during setup.
+# Do not commit a real password.
+# ODYSSEUS_ADMIN_PASSWORD=change_me_before_first_boot
+
+# CORS allowed origins (default: localhost-only; restrict to your public origin in production)
+# ALLOWED_ORIGINS=http://localhost:7000,http://localhost:8000
+
+# ============================================================
+# ChromaDB (vector store)
+# ============================================================
+
+# ChromaDB service host.
+# Manual host run: localhost:8100 when using `docker run -p 8100:8000 chromadb/chroma`.
+# Docker Compose overrides these to chromadb:8000 for in-network access.
+# CHROMADB_HOST=localhost
+# CHROMADB_PORT=8100
+
+# Docker Compose host-port bind addresses for bundled services.
+# Defaults are loopback-only for safety. To expose ntfy only on Tailscale,
+# set NTFY_BIND to your host's Tailscale IP and update NTFY_BASE_URL.
+# CHROMADB_BIND=127.0.0.1
+# NTFY_BIND=127.0.0.1
+# NTFY_BASE_URL=http://localhost:8091
+# Example:
+# NTFY_BIND=100.x.y.z
+# NTFY_BASE_URL=http://100.x.y.z:8091
+
+# ============================================================
+# RAG / Embeddings
+# ============================================================
+
+# Embedding API endpoint (OpenAI-compatible /v1/embeddings)
+# Default: http://{LLM_HOST}:11434/v1/embeddings (ollama)
+# EMBEDDING_URL=http://localhost:11434/v1/embeddings
+
+# Embedding model name (must be available at the endpoint above)
+# EMBEDDING_MODEL=all-minilm:l6-v2
+
+# Local fallback embedding model (used when no HTTP embedding API is available)
+# Uses fastembed (ONNX) — downloads model on first run (~50MB)
+# FASTEMBED_MODEL=sentence-transformers/all-MiniLM-L6-v2
+# FASTEMBED_CACHE_PATH=  # defaults to ~/.cache/fastembed
+
+# ============================================================
+# Misc
+# ============================================================
+
+# Cleanup interval in hours (default: 24)
+# CLEANUP_INTERVAL_HOURS=24
+
+# In-process email pollers (default: on). Set to 0 if you're driving
+# polling from cron / systemd via `scripts/odysseus-mail poll-scheduled`
+# and `scripts/odysseus-mail poll-summary`, otherwise both schedulers
+# race on the same SQLite.
+# ODYSSEUS_INPROCESS_POLLERS=1
+
+# In-process scheduled-task runner (default: on). Set to 0 to let an
+# external driver fire scheduled tasks. Calendar reminders are
+# frontend-driven (polling /api/notes from the browser) so no gate is
+# needed there.
+# ODYSSEUS_INPROCESS_TASKS=1
+
+# Host used by the built-in "run_script" scheduled-task action.
+# Empty/local/localhost runs scripts on the app host. Set to an SSH host alias
+# if you intentionally want scheduled scripts to run remotely.
+# ODYSSEUS_SCRIPT_HOST=localhost
+
+# ============================================================
+# GPU support (Docker Compose)
+# ============================================================
+# Pass the host GPU into the odysseus container. Default (unset) = CPU.
+# COMPOSE_FILE is a native `docker compose` feature: a colon-separated
+# list of files merged left-to-right. Pick ONE GPU line below, or leave
+# all commented for CPU.
+#
+# NVIDIA (requires nvidia-container-toolkit + `nvidia-ctk runtime
+# configure --runtime=docker` on the host):
+# COMPOSE_FILE=docker-compose.yml:docker/gpu.nvidia.yml
+# COMPOSE_FILE=docker-compose.yml;docker/gpu.nvidia.yml    #(Windows)
+#
+# AMD ROCm (requires ROCm drivers on the host and the GID of the render group):
+# COMPOSE_FILE=docker-compose.yml:docker/gpu.amd.yml
+# RENDER_GID=992
+#
+# These overlays only expose the GPU devices. The slim Odysseus image
+# still needs CUDA/ROCm userspace via Cookbook -> Dependencies (vLLM,
+# llama-cpp-python, etc.) before models can actually serve on GPU.

.devcontainer/README.md

@@ -0,0 +1,12 @@
+# Dev Containers
+
+## What is a Devcontainer?
+
+A devcontainer runs Odysseus and its project files inside Docker so your editor, terminal, and app all live in the same Linux environment. You can use it from any IDE with Dev Containers support — VS Code, Cursor, and similar editors. It will deploy Odysseus plus ChromaDB, SearXNG, and ntfy — with code reload while you edit. Pick **Ubuntu** or **Fedora** when you open the folder in a container.
+
+## Setup
+
+1. Copy `.devcontainer/.env.example` to `.devcontainer/.env`.
+2. Copy the profile env too: `ubuntu/.env.example` → `ubuntu/.env` (or `fedora/` for Fedora).
+3. In VS Code, Cursor, or another supported IDE: **Dev Containers: Open Folder in Container** — choose Ubuntu or Fedora.
+4. Open `http://localhost:7000`. First boot prints an admin password in the logs.

.devcontainer/docker-compose.dev.yml

@@ -0,0 +1,80 @@
+# Shared Dev Container sidecar stack (no odysseus — each profile defines its own).
+# Env: .devcontainer/.env only (not repo-root .env).
+services:
+  chromadb:
+    image: docker.io/chromadb/chroma:latest
+    ports:
+      - "${CHROMADB_BIND:-127.0.0.1}:8100:8000"
+    volumes:
+      - chromadb-data:/chroma/chroma
+    environment:
+      - ANONYMIZED_TELEMETRY=FALSE
+    env_file:
+      - .env
+    networks:
+      - odysseus-dev
+    restart: unless-stopped
+
+  searxng:
+    # Pinned, not :latest — odysseus waits on searxng's healthcheck
+    # (depends_on: condition: service_healthy), so a broken upstream `latest`
+    # tag blocks the whole app from starting. 2026.6.2 crashes on boot with
+    # `KeyError: 'default_doi_resolver'`, failing the healthcheck (issue #1414).
+    # Bump this deliberately after verifying a newer tag boots clean.
+    image: docker.io/searxng/searxng:2026.5.31-7159b8aed
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        set -eu
+        if [ ! -s /etc/searxng/settings.yml ] || grep -q 'odysseus-local-searxng-json-2026-05-30\|__SEARXNG_SECRET__' /etc/searxng/settings.yml; then
+          secret="$${SEARXNG_SECRET:-}"
+          if [ -z "$$secret" ]; then
+            secret="$$(python -c 'import secrets; print(secrets.token_urlsafe(48))')"
+          fi
+          sed "s|__SEARXNG_SECRET__|$$secret|g" /tmp/searxng-settings.yml.template > /etc/searxng/settings.yml
+        fi
+        exec /usr/local/searxng/entrypoint.sh
+    ports:
+      - "127.0.0.1:8080:8080"
+    volumes:
+      - searxng-data:/etc/searxng
+      - ../config/searxng/settings.yml:/tmp/searxng-settings.yml.template:ro
+    environment:
+      - SEARXNG_BASE_URL=http://localhost:8080/
+      - SEARXNG_SECRET=${SEARXNG_SECRET:-}
+    env_file:
+      - .env
+    healthcheck:
+      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8080/', timeout=5).read(1)\""]
+      interval: 5s
+      timeout: 6s
+      retries: 20
+      start_period: 10s
+    networks:
+      - odysseus-dev
+    restart: unless-stopped
+
+  ntfy:
+    image: docker.io/binwiederhier/ntfy
+    command: serve
+    ports:
+      - "${NTFY_BIND:-127.0.0.1}:8091:80"
+    volumes:
+      - ntfy-cache:/var/cache/ntfy
+    environment:
+      - NTFY_BASE_URL=${NTFY_BASE_URL:-http://localhost:8091}
+    env_file:
+      - .env
+    networks:
+      - odysseus-dev
+    restart: unless-stopped
+
+networks:
+  odysseus-dev:
+    driver: bridge
+
+volumes:
+  searxng-data:
+  chromadb-data:
+  ntfy-cache:

.devcontainer/fedora/.env.example

@@ -0,0 +1,21 @@
+# Odysseus Dev Container — Fedora profile
+# Copy to .devcontainer/fedora/.env
+
+# Match the container drop-user to your host UID/GID so bind-mounted
+# ./data and ./logs stay editable from the host.
+# Find yours with:  id -u  /  id -g
+PUID=1000
+PGID=1000
+
+# SELinux: fedora/docker-compose.yml adds :z on data/log bind mounts so
+# Enforcing hosts can write to ./data and ./logs from inside the container.
+
+# GPU overlay — NVIDIA (requires nvidia-container-toolkit on the Fedora host):
+#   sudo dnf install nvidia-container-toolkit
+#   sudo nvidia-ctk runtime configure --runtime=docker
+#   sudo systemctl restart docker
+# COMPOSE_FILE=.devcontainer/docker-compose.dev.yml:.devcontainer/fedora/docker-compose.yml:docker/gpu.nvidia.yml
+
+# GPU overlay — AMD ROCm (requires ROCm drivers and render group GID):
+# COMPOSE_FILE=.devcontainer/docker-compose.dev.yml:.devcontainer/fedora/docker-compose.yml:docker/gpu.amd.yml
+# RENDER_GID=992

.devcontainer/fedora/Dockerfile

@@ -0,0 +1,43 @@
+FROM fedora:41
+
+ENV PIP_BREAK_SYSTEM_PACKAGES=1
+
+# System deps mirror the production Dockerfile; gosu is installed from upstream
+# because Fedora does not ship it in the base repos.
+RUN dnf install -y \
+    python3.12 \
+    python3.12-devel \
+    gcc \
+    gcc-c++ \
+    make \
+    cmake \
+    git \
+    nodejs \
+    npm \
+    tmux \
+    openssh-clients \
+    && dnf clean all \
+    && ln -sf /usr/bin/python3.12 /usr/bin/python3 \
+    && ln -sf /usr/bin/python3.12 /usr/bin/python \
+    && python3.12 -m ensurepip --upgrade
+
+RUN curl -fsSL -o /usr/local/bin/gosu \
+    "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" \
+    && chmod +x /usr/local/bin/gosu
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN python3 -m pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+RUN mkdir -p data logs services/cache/search
+
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+EXPOSE 7000
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7000"]

.devcontainer/fedora/devcontainer.json

@@ -0,0 +1,18 @@
+{
+  "name": "Odysseus (Fedora)",
+  "dockerComposeFile": [
+    "../docker-compose.dev.yml",
+    "docker-compose.yml"
+  ],
+  "service": "odysseus",
+  "workspaceFolder": "/app",
+  "remoteUser": "root",
+  "postCreateCommand": "python setup.py",
+  "customizations": {
+    "vscode": {
+      "settings": {
+        "python.defaultInterpreterPath": "/usr/bin/python3"
+      }
+    }
+  }
+}

.devcontainer/fedora/docker-compose.yml

@@ -0,0 +1,34 @@
+services:
+  odysseus:
+    build:
+      context: ../
+      dockerfile: .devcontainer/fedora/Dockerfile
+    ports:
+      - "${APP_BIND:-127.0.0.1}:${APP_PORT:-7000}:7000"
+    volumes:
+      - ../:/app:cached
+      - ../data:/app/data:z
+      - ../logs:/app/logs:z
+      - ../data/ssh:/app/.ssh:z
+      - ../data/huggingface:/app/.cache/huggingface:z
+      - ../data/local:/app/.local:z
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    env_file:
+      - .env
+      - ./fedora/.env
+    environment:
+      - SEARXNG_INSTANCE=http://searxng:8080
+      - CHROMADB_HOST=chromadb
+      - CHROMADB_PORT=8000
+      - PUID=${PUID:-1000}
+      - PGID=${PGID:-1000}
+    command: uvicorn app:app --host 0.0.0.0 --port 7000 --reload
+    depends_on:
+      searxng:
+        condition: service_healthy
+      chromadb:
+        condition: service_started
+    networks:
+      - odysseus-dev
+    restart: unless-stopped

.devcontainer/ubuntu/.env.example

@@ -0,0 +1,14 @@
+# Odysseus Dev Container — Ubuntu profile
+# Copy to .devcontainer/ubuntu/.env
+
+# Match the container drop-user to your host UID/GID so bind-mounted
+# ./data and ./logs stay editable from the host.
+# Find yours with:  id -u  /  id -g
+PUID=1000
+PGID=1000
+
+# GPU overlay (requires nvidia-container-toolkit on the Ubuntu host):
+#   sudo apt install nvidia-container-toolkit
+#   sudo nvidia-ctk runtime configure --runtime=docker
+#   sudo systemctl restart docker
+# COMPOSE_FILE=.devcontainer/docker-compose.dev.yml:.devcontainer/ubuntu/docker-compose.yml:docker/gpu.nvidia.yml