88772b3278
Some checks are pending
CI / JS syntax (node --check) (push) Waiting to run
CI / Python tests (pytest 1/4) (push) Waiting to run
CI / Python tests (pytest 2/4) (push) Waiting to run
CI / Python tests (pytest 3/4) (push) Waiting to run
CI / Python tests (pytest 4/4) (push) Waiting to run
CI / Focused test guidance (report-only) (push) Waiting to run
CI / Python syntax (compileall) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
ci / docker publish / build (amd64) (push) Waiting to run
ci / docker publish / build (arm64) (push) Waiting to run
ci / docker publish / merge manifest + tag (push) Blocked by required conditions
POST /api/tasks and the scheduler both refuse action tasks whose action is in ADMIN_ONLY_TASK_ACTIONS (run_local, run_script, ssh_command, cookbook_serve) for owners without admin task privileges: those actions reach subprocess.run(shell=True) or SSH with no sandbox. The model-facing manage_tasks tool applied neither check, so an agent could create or edit such a task, resume it, or trigger it, and only the scheduler's execution-time guard stood in the way (pausing the task after the fact). Route the tool through the same src.task_action_policy helpers the HTTP route uses: create checks the requested type/action, edit checks the task as it would be after the edit (so an llm task cannot be flipped into a shell action), and resume/run check the stored task. Admins, non- privileged actions and llm/research tasks are unaffected; pause still works for everyone since it only narrows. Fixes #6021 Claude-Session: https://claude.ai/code/session_01UAB5sz5srMKR7rbeDFtdMH Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Alexandre Teixeira <111787685+alteixeira20@users.noreply.github.com> |
||
|---|---|---|
| .github | ||
| assets/branding | ||
| companion | ||
| config/searxng | ||
| core | ||
| docker | ||
| docs | ||
| frontend | ||
| integrations | ||
| licenses | ||
| mcp_servers | ||
| plans | ||
| resources/skills | ||
| routes | ||
| scripts | ||
| services | ||
| specs | ||
| src | ||
| static | ||
| swift/odysseus-mlx-image-bridge | ||
| tests | ||
| website | ||
| .dockerignore | ||
| .env.example | ||
| .gitattributes | ||
| .gitignore | ||
| .gitleaks.toml | ||
| ACKNOWLEDGMENTS.md | ||
| app.py | ||
| build-macos-app.sh | ||
| build-windows-portable.ps1 | ||
| CONTRIBUTING.md | ||
| docker-compose.gpu-amd.yml | ||
| docker-compose.gpu-nvidia.yml | ||
| docker-compose.yml | ||
| Dockerfile | ||
| HARNESS_VERSION | ||
| install-service.sh | ||
| launch-windows.ps1 | ||
| launcher.py | ||
| LICENSE | ||
| odysseus-ui.service | ||
| Odysseus.spec | ||
| package-lock.json | ||
| package.json | ||
| PUBLICATION_ASSET_DECISIONS.md | ||
| pyproject.toml | ||
| README.md | ||
| requirements-dev.txt | ||
| requirements-optional.txt | ||
| requirements.txt | ||
| ROADMAP.md | ||
| SECURITY.md | ||
| setup.py | ||
| start-macos.sh | ||
| THIRD_PARTY_PROVENANCE.json | ||
| THREAT_MODEL.md | ||
| update_windows.bat | ||
A self-hosted AI workspace for chat, agents, research, documents, email, notes, calendar, and local model workflows.
Quick Start · Setup Guide · Contributing · Roadmap
Quick Start
devis the default branch and gets the newest changes first. Usemainif you want the more curated branch.
git clone https://github.com/odysseus-dev/odysseus.git
cd odysseus
cp .env.example .env
docker compose up -d --build
Open http://localhost:7011 when the containers are healthy. The first admin password is printed in docker compose logs odysseus.
The compose files pull the official multi-arch image ghcr.io/odysseus-dev/odysseus (published by CI on every push to main and dev) and only build locally if the pull fails — so this also works on hosts without a build toolchain, e.g. as a Portainer stack.
Production deployments: pin the immutable tag instead of :latest. :latest and bare :X.Y.Z tags move on every push to main, but :X.Y.Z-<sha> (e.g. 1.0.2-7c8070f) always refers to one specific build:
ODYSSEUS_IMAGE=ghcr.io/odysseus-dev/odysseus:1.0.2-7c8070f docker compose up -d
Native installs, GPU notes, Windows/macOS instructions, HTTPS, and configuration live in the setup guide.
Features
- Chat + Agents — local/API models, tools, MCP, files, shell, skills, and memory.
- Cookbook — hardware-aware model recommendations, downloads, and serving.
- Deep Research — multi-step web research with source reading and report generation.
- Compare — blind side-by-side model testing and synthesis.
- Documents — writing-first editor with AI edits, suggestions, Markdown, HTML, CSV, and syntax highlighting.
- Email — IMAP/SMTP inbox with triage, tags, summaries, reminders, and reply drafts.
- Notes, Tasks + Calendar — reminders, todos, scheduled agent tasks, and CalDAV sync.
- Extras — gallery/image editor, themes, uploads, web search, presets, sessions, and 2FA.
Demo
A full hover-to-play tour lives on the Odysseus landing page. Its source lives under website/.
Contributing
Help is welcome. The best entry points are fresh-install testing, provider setup bugs, mobile/editor polish, docs, and small focused refactors. See CONTRIBUTING.md and ROADMAP.md.
Security
Odysseus is a self-hosted workspace with powerful local tools. Keep auth enabled, keep private data out of Git, and do not expose raw model/service ports publicly.
- Keep
AUTH_ENABLED=truefor any network-accessible deployment. - Keep
LOCALHOST_BYPASS=falseoutside local development.
Deployment details are in the setup guide.
Community & Growth
License
AGPL-3.0-or-later -- see LICENSE and ACKNOWLEDGMENTS.md.