Léo
33fa27b4c8
Agent-reachable execution has 25 independent spawn sites and no single place deciding where a process runs or under what limits. All three consequences are visible on this SHA. When bwrap is absent the workspace namespace degrades to a regex that rewrites /workspace to the real path, and nothing in the tool result says which one you got. No spawn site passes start_new_session, so a wall-clock kill reaches the wrapper shell and leaves its backgrounded grandchildren running while reporting the process killed. Teardown stops at SIGTERM without ever checking death. src/containment.py gives those paths one boundary. acquire() establishes containment or refuses -- a string rewrite is not a mechanism it can select -- and the grant states which dimensions actually hold, which were best-effort and are missing, and which were required and are missing. run() enforces the wall clock and the output cap. release() signals the process group, escalates to SIGKILL, and reports dead only for a group it observed go empty. Containment never sees the command: acquire() takes a workspace and limits, and the command text only reaches run(). Nothing in a request can widen a boundary it is never shown. CONTAINMENT_MODE chooses between refusing an unestablishable required dimension and recording it. It ships report-only, so landing this changes no behaviour on a host without bwrap -- which is every host today. No call sites move here; they follow on this branch. The configuration reference is regenerated because the page records src/constants.py line numbers and the new path constant shifts two of them.
A self-hosted AI workspace for chat, agents, research, documents, email, notes, calendar, and local model workflows.
Quick Start · Setup Guide · Contributing · Roadmap
Quick Start
devis the default branch and gets the newest changes first. Usemainif you want the more curated branch.
git clone https://github.com/odysseus-dev/odysseus.git
cd odysseus
cp .env.example .env
docker compose up -d --build
Open http://localhost:7011 when the containers are healthy. The first admin password is printed in docker compose logs odysseus.
Native installs, GPU notes, Windows/macOS instructions, HTTPS, and configuration live in the setup guide.
Features
- Chat + Agents — local/API models, tools, MCP, files, shell, skills, and memory.
- Cookbook — hardware-aware model recommendations, downloads, and serving.
- Deep Research — multi-step web research with source reading and report generation.
- Compare — blind side-by-side model testing and synthesis.
- Documents — writing-first editor with AI edits, suggestions, Markdown, HTML, CSV, and syntax highlighting.
- Email — IMAP/SMTP inbox with triage, tags, summaries, reminders, and reply drafts.
- Notes, Tasks + Calendar — reminders, todos, scheduled agent tasks, and CalDAV sync.
- Extras — gallery/image editor, themes, uploads, web search, presets, sessions, and 2FA.
Demo
A full hover-to-play tour lives on the Odysseus landing page. Its source lives under website/.
Contributing
Help is welcome. The best entry points are fresh-install testing, provider setup bugs, mobile/editor polish, docs, and small focused refactors. See CONTRIBUTING.md and ROADMAP.md.
Security
Odysseus is a self-hosted workspace with powerful local tools. Keep auth enabled, keep private data out of Git, and do not expose raw model/service ports publicly.
- Keep
AUTH_ENABLED=truefor any network-accessible deployment. - Keep
LOCALHOST_BYPASS=falseoutside local development.
Deployment details are in the setup guide.
Star History
License
AGPL-3.0-or-later -- see LICENSE and ACKNOWLEDGMENTS.md.