no more reindexing

Reviewed-on: #16

.env.example

@@ -14,16 +14,22 @@ JWT_SECRET_KEY=your-secret-key-here
 PAPERLESS_TOKEN=your-paperless-token
 BASE_URL=192.168.1.5:8000
 
-# Ollama Configuration
+# llama-server Configuration (OpenAI-compatible API)
-OLLAMA_URL=http://192.168.1.14:11434
+# If set, uses llama-server as the primary LLM backend with OpenAI as fallback
-OLLAMA_HOST=http://192.168.1.14:11434
+LLAMA_SERVER_URL=http://192.168.1.213:8080/v1
+LLAMA_MODEL_NAME=llama-3.1-8b-instruct
 
 # ChromaDB Configuration
-CHROMADB_PATH=/path/to/chromadb
+# For Docker: This is automatically set to /app/data/chromadb
+# For local development: Set to a local directory path
+CHROMADB_PATH=./data/chromadb
 
 # OpenAI Configuration
 OPENAI_API_KEY=your-openai-api-key
 
+# Tavily Configuration (for web search)
+TAVILY_API_KEY=your-tavily-api-key
+
 # Immich Configuration
 IMMICH_URL=http://192.168.1.5:2283
 IMMICH_API_KEY=your-immich-api-key
@@ -42,3 +48,49 @@ OIDC_USE_DISCOVERY=true
 # OIDC_TOKEN_ENDPOINT=https://auth.example.com/api/oidc/token
 # OIDC_USERINFO_ENDPOINT=https://auth.example.com/api/oidc/userinfo
 # OIDC_JWKS_URI=https://auth.example.com/api/oidc/jwks
+
+# YNAB Configuration
+# Get your Personal Access Token from https://app.ynab.com/settings/developer
+YNAB_ACCESS_TOKEN=your-ynab-personal-access-token
+# Optional: Specify a budget ID, or leave empty to use the default/first budget
+YNAB_BUDGET_ID=
+
+# Twilio Configuration (WhatsApp)
+TWILIO_ACCOUNT_SID=your-twilio-account-sid
+TWILIO_AUTH_TOKEN=your-twilio-auth-token
+TWILIO_WHATSAPP_NUMBER=whatsapp:+14155238886
+# Comma-separated list of WhatsApp numbers allowed to use the service (e.g., whatsapp:+1234567890)
+# Use * to allow any number
+ALLOWED_WHATSAPP_NUMBERS=
+# Set to false to disable Twilio signature validation in development
+TWILIO_SIGNATURE_VALIDATION=true
+# If behind a reverse proxy, set this to your public webhook URL so signature validation works
+# TWILIO_WEBHOOK_URL=https://your-domain.com/api/whatsapp/webhook
+# Rate limiting: max messages per window (default: 10 messages per 60 seconds)
+# WHATSAPP_RATE_LIMIT_MAX=10
+# WHATSAPP_RATE_LIMIT_WINDOW=60
+
+# Mailgun Configuration (Email channel)
+MAILGUN_API_KEY=
+MAILGUN_DOMAIN=
+MAILGUN_WEBHOOK_SIGNING_KEY=
+EMAIL_HMAC_SECRET=
+# Rate limiting: max emails per window (default: 5 per 300 seconds)
+# EMAIL_RATE_LIMIT_MAX=5
+# EMAIL_RATE_LIMIT_WINDOW=300
+# Set to false to disable Mailgun signature validation in development
+MAILGUN_SIGNATURE_VALIDATION=true
+
+# Obsidian Configuration (headless sync)
+# Auth token from Obsidian account (Settings → Account → API token)
+OBSIDIAN_AUTH_TOKEN=your-obsidian-auth-token
+# Vault ID to sync (found in Obsidian sync settings)
+OBSIDIAN_VAULT_ID=your-vault-id
+# End-to-end encryption password (if vault uses E2E encryption)
+OBSIDIAN_E2E_PASSWORD=
+# Device name shown in Obsidian sync activity
+OBSIDIAN_DEVICE_NAME=simbarag
+# Set to true to run continuous sync in the background
+OBSIDIAN_CONTINUOUS_SYNC=false
+# Local path to Obsidian vault (where files are synced)
+OBSIDIAN_VAULT_PATH=/app/data/obsidian

.envrc

@@ -0,0 +1 @@
+dotenv_if_exists

.gitignore

@@ -14,5 +14,10 @@ wheels/
 
 # Database files
 chromadb/
+chromadb_openai/
+chroma_db/
 database/
 *.db
+
+obvault/
+.claude

.pre-commit-config.yaml

@@ -0,0 +1,6 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.8.2
+    hooks:
+      - id: ruff # Linter
+      - id: ruff-format # Formatter

CLAUDE.md

@@ -0,0 +1,109 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+SimbaRAG is a RAG (Retrieval-Augmented Generation) conversational AI system for querying information about Simba (a cat). It ingests documents from Paperless-NGX, stores embeddings in ChromaDB, and uses LLMs (Ollama or OpenAI) to answer questions.
+
+## Commands
+
+### Development
+
+```bash
+# Start environment
+docker compose up --build
+
+# View logs
+docker compose logs -f raggr
+```
+
+### Database Migrations (Aerich/Tortoise ORM)
+
+```bash
+# Generate migration (must run in Docker with DB access)
+docker compose exec raggr aerich migrate --name describe_change
+
+# Apply migrations (auto-runs on startup, manual if needed)
+docker compose exec raggr aerich upgrade
+
+# View migration history
+docker compose exec raggr aerich history
+```
+
+### Frontend
+
+```bash
+cd raggr-frontend
+yarn install
+yarn build      # Production build
+yarn dev        # Dev server (rarely needed, backend serves frontend)
+```
+
+### Production
+
+```bash
+docker compose build raggr
+docker compose up -d
+```
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                     Docker Compose                          │
+├─────────────────────────────────────────────────────────────┤
+│  raggr (port 8080)              │  postgres (port 5432)    │
+│  ├── Quart backend              │  PostgreSQL 16           │
+│  ├── React frontend (served)    │                          │
+│  └── ChromaDB (volume)          │                          │
+└─────────────────────────────────────────────────────────────┘
+```
+
+**Backend** (root directory):
+- `app.py` - Quart application entry, serves API and static frontend
+- `main.py` - RAG logic, document indexing, LLM interaction, LangChain agent
+- `llm.py` - LLM client with Ollama primary, OpenAI fallback
+- `aerich_config.py` - Database migration configuration
+- `blueprints/` - API routes organized as Quart blueprints
+  - `users/` - OIDC auth, JWT tokens, RBAC with LDAP groups
+  - `conversation/` - Chat conversations and message history
+  - `rag/` - Document indexing endpoints (admin-only)
+- `config/` - Configuration modules
+  - `oidc_config.py` - OIDC authentication configuration
+- `utils/` - Reusable utilities
+  - `chunker.py` - Document chunking for embeddings
+  - `cleaner.py` - PDF cleaning and summarization
+  - `image_process.py` - Image description with LLM
+  - `request.py` - Paperless-NGX API client
+- `scripts/` - Administrative and utility scripts
+  - `add_user.py` - Create users manually
+  - `user_message_stats.py` - User message statistics
+  - `manage_vectorstore.py` - Vector store management CLI
+  - `inspect_vector_store.py` - Inspect ChromaDB contents
+  - `query.py` - Query generation utilities
+- `migrations/` - Database migration files
+
+**Frontend** (`raggr-frontend/`):
+- React 19 with Rsbuild bundler
+- Tailwind CSS for styling
+- Built to `dist/`, served by backend at `/`
+
+**Auth Flow**: LLDAP → Authelia (OIDC) → Backend JWT → Frontend localStorage
+
+## Key Patterns
+
+- All endpoints are async (`async def`)
+- Use `@jwt_refresh_token_required` for authenticated endpoints
+- Use `@admin_required` for admin-only endpoints (checks `lldap_admin` group)
+- Tortoise ORM models in `blueprints/*/models.py`
+- Frontend API services in `raggr-frontend/src/api/`
+
+## Environment Variables
+
+See `.env.example`. Key ones:
+- `DATABASE_URL` - PostgreSQL connection
+- `OIDC_*` - Authelia OIDC configuration
+- `OLLAMA_URL` - Local LLM server
+- `OPENAI_API_KEY` - Fallback LLM
+- `PAPERLESS_TOKEN` / `BASE_URL` - Document source

DEV-README.md

@@ -1,110 +0,0 @@
-# Development Environment Setup
-
-This guide explains how to run the application in development mode with hot reload enabled.
-
-## Quick Start
-
-### Development Mode (Hot Reload)
-
-```bash
-# Start all services in development mode
-docker-compose -f docker-compose.dev.yml up --build
-
-# Or run in detached mode
-docker-compose -f docker-compose.dev.yml up -d --build
-```
-
-### Production Mode
-
-```bash
-# Start production services
-docker-compose up --build
-```
-
-## What's Different in Dev Mode?
-
-### Backend (Quart/Flask)
-- **Hot Reload**: Python code changes are automatically detected and the server restarts
-- **Source Mounted**: Your local `services/raggr` directory is mounted as a volume
-- **Debug Mode**: Flask runs with `debug=True` for better error messages
-- **Environment**: `FLASK_ENV=development` and `PYTHONUNBUFFERED=1` for immediate log output
-
-### Frontend (React + rsbuild)
-- **Auto Rebuild**: Frontend automatically rebuilds when files change
-- **Watch Mode**: rsbuild runs in watch mode, rebuilding to `dist/` on save
-- **Source Mounted**: Your local `services/raggr/raggr-frontend` directory is mounted as a volume
-- **Served by Backend**: Built files are served by the backend, no separate dev server
-
-## Ports
-
-- **Application**: 8080 (accessible at `http://localhost:8080` or `http://YOUR_IP:8080`)
-
-The backend serves both the API and the auto-rebuilt frontend, making it accessible from other machines on your network.
-
-## Useful Commands
-
-```bash
-# View logs
-docker-compose -f docker-compose.dev.yml logs -f
-
-# View logs for specific service
-docker-compose -f docker-compose.dev.yml logs -f raggr-backend
-docker-compose -f docker-compose.dev.yml logs -f raggr-frontend
-
-# Rebuild after dependency changes
-docker-compose -f docker-compose.dev.yml up --build
-
-# Stop all services
-docker-compose -f docker-compose.dev.yml down
-
-# Stop and remove volumes (fresh start)
-docker-compose -f docker-compose.dev.yml down -v
-```
-
-## Making Changes
-
-### Backend Changes
-1. Edit any Python file in `services/raggr/`
-2. Save the file
-3. The Quart server will automatically restart
-4. Check logs to confirm reload
-
-### Frontend Changes
-1. Edit any file in `services/raggr/raggr-frontend/src/`
-2. Save the file
-3. The browser will automatically refresh (Hot Module Replacement)
-4. No need to rebuild
-
-### Dependency Changes
-
-**Backend** (pyproject.toml):
-```bash
-# Rebuild the backend service
-docker-compose -f docker-compose.dev.yml up --build raggr-backend
-```
-
-**Frontend** (package.json):
-```bash
-# Rebuild the frontend service
-docker-compose -f docker-compose.dev.yml up --build raggr-frontend
-```
-
-## Troubleshooting
-
-### Port Already in Use
-If you see port binding errors, make sure no other services are running on ports 8080 or 3000.
-
-### Changes Not Reflected
-1. Check if the file is properly mounted (check docker-compose.dev.yml volumes)
-2. Verify the file isn't in an excluded directory (node_modules, __pycache__)
-3. Check container logs for errors
-
-### Frontend Not Connecting to Backend
-Make sure your frontend API calls point to the correct backend URL. If accessing from the same machine, use `http://localhost:8080`. If accessing from another device on the network, use `http://YOUR_IP:8080`.
-
-## Notes
-
-- Both services bind to `0.0.0.0` and expose ports, making them accessible on your network
-- Node modules and Python cache are excluded from volume mounts to use container versions
-- Database and ChromaDB data persist in Docker volumes across restarts
-- Access the app from any device on your network using your host machine's IP address

Dockerfile

@@ -6,9 +6,9 @@ WORKDIR /app
 RUN apt-get update && apt-get install -y \
     build-essential \
     curl \
-    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y nodejs \
-    && npm install -g yarn \
+    && npm install -g yarn obsidian-headless \
     && rm -rf /var/lib/apt/lists/* \
     && curl -LsSf https://astral.sh/uv/install.sh | sh
 
@@ -25,6 +25,9 @@ RUN uv pip install --system -e .
 COPY *.py ./
 COPY blueprints ./blueprints
 COPY migrations ./migrations
+COPY utils ./utils
+COPY config ./config
+COPY scripts ./scripts
 COPY startup.sh ./
 RUN chmod +x startup.sh
 

Dockerfile.dev

@@ -2,10 +2,13 @@ FROM python:3.13-slim
 
 WORKDIR /app
 
-# Install system dependencies and uv
+# Install system dependencies, Node.js, uv, and yarn
 RUN apt-get update && apt-get install -y \
     build-essential \
     curl \
+    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y nodejs \
+    && npm install -g yarn \
     && rm -rf /var/lib/apt/lists/* \
     && curl -LsSf https://astral.sh/uv/install.sh | sh
 
@@ -18,15 +21,23 @@ COPY pyproject.toml ./
 # Install Python dependencies using uv
 RUN uv pip install --system -e .
 
-# Create ChromaDB and database directories
+# Copy frontend package files and install dependencies
-RUN mkdir -p /app/chromadb /app/database
+COPY raggr-frontend/package.json raggr-frontend/yarn.lock* raggr-frontend/
-
+WORKDIR /app/raggr-frontend
-# Expose port
+RUN yarn install
-EXPOSE 8080
 
 # Copy application source code
+WORKDIR /app
 COPY . .
 
+# Build frontend
+WORKDIR /app/raggr-frontend
+RUN yarn build
+
+# Create ChromaDB and database directories
+WORKDIR /app
+RUN mkdir -p /app/chromadb /app/database
+
 # Make startup script executable
 RUN chmod +x /app/startup-dev.sh
 
@@ -35,5 +46,8 @@ ENV PYTHONPATH=/app
 ENV CHROMADB_PATH=/app/chromadb
 ENV PYTHONUNBUFFERED=1
 
+# Expose port
+EXPOSE 8080
+
 # Default command
 CMD ["/app/startup-dev.sh"]

README.md

@@ -1,7 +1,370 @@
-# simbarag
+# SimbaRAG 🐱
 
-**Goal:** Learn how retrieval-augmented generation works and also create a neat little tool to ask about Simba's health.
+A Retrieval-Augmented Generation (RAG) conversational AI system for querying information about Simba the cat. Built with LangChain, ChromaDB, and modern web technologies.
 
-**Current objectives:**
+## Features
 
-- [ ] Successfully use RAG to ask a question about existing information (e.g. how many teeth has Simba had extracted)
+- 🤖 **Intelligent Conversations** - LangChain-powered agent with tool use and memory
+- 📚 **Document Retrieval** - RAG system using ChromaDB vector store
+- 🔍 **Web Search** - Integrated Tavily API for real-time web searches
+- 🔐 **OIDC Authentication** - Secure auth via Authelia with LDAP group support
+- 💬 **Multi-Conversation** - Manage multiple conversation threads per user
+- 🎨 **Modern UI** - React 19 frontend with Tailwind CSS
+- 🐳 **Docker Ready** - Containerized deployment with Docker Compose
+
+## System Architecture
+
+```mermaid
+graph TB
+    subgraph "Client Layer"
+        Browser[Web Browser]
+    end
+
+    subgraph "Frontend - React"
+        UI[React UI<br/>Tailwind CSS]
+        Auth[Auth Service]
+        API[API Client]
+    end
+
+    subgraph "Backend - Quart/Python"
+        App[Quart App<br/>app.py]
+
+        subgraph "Blueprints"
+            Users[Users Blueprint<br/>OIDC + JWT]
+            Conv[Conversation Blueprint<br/>Chat Management]
+            RAG[RAG Blueprint<br/>Document Indexing]
+        end
+
+        Agent[LangChain Agent<br/>main.py]
+        LLM[LLM Client<br/>llm.py]
+    end
+
+    subgraph "Tools & Utilities"
+        Search[Simba Search Tool]
+        Web[Web Search Tool<br/>Tavily]
+    end
+
+    subgraph "Data Layer"
+        Postgres[(PostgreSQL<br/>Users & Conversations)]
+        Chroma[(ChromaDB<br/>Vector Store)]
+    end
+
+    subgraph "External Services"
+        Authelia[Authelia<br/>OIDC Provider]
+        LLDAP[LLDAP<br/>User Directory]
+        Ollama[Ollama<br/>Local LLM]
+        OpenAI[OpenAI<br/>Fallback LLM]
+        Paperless[Paperless-NGX<br/>Documents]
+        TavilyAPI[Tavily API<br/>Web Search]
+    end
+
+    Browser --> UI
+    UI --> Auth
+    UI --> API
+    API --> App
+
+    App --> Users
+    App --> Conv
+    App --> RAG
+
+    Conv --> Agent
+    Agent --> Search
+    Agent --> Web
+    Agent --> LLM
+
+    Search --> Chroma
+    Web --> TavilyAPI
+    RAG --> Chroma
+    RAG --> Paperless
+
+    Users --> Postgres
+    Conv --> Postgres
+
+    Users --> Authelia
+    Authelia --> LLDAP
+
+    LLM --> Ollama
+    LLM -.Fallback.-> OpenAI
+
+    style Browser fill:#e1f5ff
+    style UI fill:#fff3cd
+    style App fill:#d4edda
+    style Agent fill:#d4edda
+    style Postgres fill:#f8d7da
+    style Chroma fill:#f8d7da
+    style Ollama fill:#e2e3e5
+    style OpenAI fill:#e2e3e5
+```
+
+## Quick Start
+
+### Prerequisites
+
+- Docker & Docker Compose
+- PostgreSQL (or use Docker)
+- Ollama (optional, for local LLM)
+- Paperless-NGX instance (for document source)
+
+### Installation
+
+1. **Clone the repository**
+
+```bash
+git clone https://github.com/yourusername/simbarag.git
+cd simbarag
+```
+
+2. **Configure environment variables**
+
+```bash
+cp .env.example .env
+# Edit .env with your configuration
+```
+
+3. **Start the services**
+
+```bash
+# Development (local PostgreSQL only)
+docker compose -f docker-compose.dev.yml up -d
+
+# Or full Docker deployment
+docker compose up -d
+```
+
+4. **Access the application**
+
+Open `http://localhost:8080` in your browser.
+
+## Development
+
+### Local Development Setup
+
+```bash
+# 1. Start PostgreSQL
+docker compose -f docker-compose.dev.yml up -d
+
+# 2. Set environment variables
+export DATABASE_URL="postgres://raggr:raggr_dev_password@localhost:5432/raggr"
+export CHROMADB_PATH="./chromadb"
+export $(grep -v '^#' .env | xargs)
+
+# 3. Install dependencies
+pip install -r requirements.txt
+cd raggr-frontend && yarn install && yarn build && cd ..
+
+# 4. Run migrations
+aerich upgrade
+
+# 5. Start the server
+python app.py
+```
+
+See [docs/development.md](docs/development.md) for detailed development guide.
+
+## Project Structure
+
+```
+simbarag/
+├── app.py                 # Quart application entry point
+├── main.py                # RAG logic & LangChain agent
+├── llm.py                 # LLM client with Ollama/OpenAI
+├── aerich_config.py       # Database migration configuration
+│
+├── blueprints/            # API route blueprints
+│   ├── users/            # Authentication & authorization
+│   ├── conversation/     # Chat conversations
+│   └── rag/              # Document indexing
+│
+├── config/               # Configuration modules
+│   └── oidc_config.py   # OIDC authentication settings
+│
+├── utils/                # Reusable utilities
+│   ├── chunker.py       # Document chunking for embeddings
+│   ├── cleaner.py       # PDF cleaning and summarization
+│   ├── image_process.py # Image description with LLM
+│   └── request.py       # Paperless-NGX API client
+│
+├── scripts/              # Administrative scripts
+│   ├── add_user.py
+│   ├── user_message_stats.py
+│   ├── manage_vectorstore.py
+│   └── inspect_vector_store.py
+│
+├── raggr-frontend/       # React frontend
+│   └── src/
+│
+├── migrations/           # Database migrations
+│
+├── docs/                 # Documentation
+│   ├── index.md         # Documentation hub
+│   ├── development.md   # Development guide
+│   ├── deployment.md    # Deployment & migrations
+│   ├── VECTORSTORE.md   # Vector store management
+│   ├── MIGRATIONS.md    # Migration reference
+│   └── authentication.md # Authentication setup
+│
+├── docker-compose.yml        # Production compose
+├── docker-compose.dev.yml    # Development compose
+├── Dockerfile                # Production Dockerfile
+├── Dockerfile.dev            # Development Dockerfile
+├── CLAUDE.md                 # AI assistant instructions
+└── README.md                 # This file
+```
+
+## Key Technologies
+
+### Backend
+- **Quart** - Async Python web framework
+- **LangChain** - Agent framework with tool use
+- **Tortoise ORM** - Async ORM for PostgreSQL
+- **Aerich** - Database migration tool
+- **ChromaDB** - Vector database for embeddings
+- **OpenAI** - Embeddings & LLM (fallback)
+- **Ollama** - Local LLM (primary)
+
+### Frontend
+- **React 19** - UI framework
+- **Rsbuild** - Fast bundler
+- **Tailwind CSS** - Utility-first styling
+- **Axios** - HTTP client
+
+### Authentication
+- **Authelia** - OIDC provider
+- **LLDAP** - Lightweight LDAP server
+- **JWT** - Token-based auth
+
+## API Endpoints
+
+### Authentication
+- `GET /api/user/oidc/login` - Initiate OIDC login
+- `GET /api/user/oidc/callback` - OIDC callback handler
+- `POST /api/user/refresh` - Refresh JWT token
+
+### Conversations
+- `POST /api/conversation/` - Create conversation
+- `GET /api/conversation/` - List conversations
+- `GET /api/conversation/<id>` - Get conversation with messages
+- `POST /api/conversation/query` - Send message and get response
+
+### RAG (Admin Only)
+- `GET /api/rag/stats` - Vector store statistics
+- `POST /api/rag/index` - Index new documents
+- `POST /api/rag/reindex` - Clear and reindex all
+
+## Configuration
+
+### Environment Variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `DATABASE_URL` | PostgreSQL connection string | `postgres://...` |
+| `CHROMADB_PATH` | ChromaDB storage path | `./chromadb` |
+| `OLLAMA_URL` | Ollama server URL | `http://localhost:11434` |
+| `OPENAI_API_KEY` | OpenAI API key | - |
+| `PAPERLESS_TOKEN` | Paperless-NGX API token | - |
+| `BASE_URL` | Paperless-NGX base URL | - |
+| `OIDC_ISSUER` | OIDC provider URL | - |
+| `OIDC_CLIENT_ID` | OIDC client ID | - |
+| `OIDC_CLIENT_SECRET` | OIDC client secret | - |
+| `JWT_SECRET_KEY` | JWT signing key | - |
+| `TAVILY_KEY` | Tavily web search API key | - |
+
+See `.env.example` for full list.
+
+## Scripts
+
+### User Management
+```bash
+# Add a new user
+python scripts/add_user.py
+
+# View message statistics
+python scripts/user_message_stats.py
+```
+
+### Vector Store Management
+```bash
+# Show vector store statistics
+python scripts/manage_vectorstore.py stats
+
+# Index new documents from Paperless
+python scripts/manage_vectorstore.py index
+
+# Clear and reindex everything
+python scripts/manage_vectorstore.py reindex
+
+# Inspect vector store contents
+python scripts/inspect_vector_store.py
+```
+
+See [docs/vectorstore.md](docs/vectorstore.md) for details.
+
+## Database Migrations
+
+```bash
+# Generate a new migration
+aerich migrate --name "describe_your_changes"
+
+# Apply pending migrations
+aerich upgrade
+
+# View migration history
+aerich history
+
+# Rollback last migration
+aerich downgrade
+```
+
+See [docs/deployment.md](docs/deployment.md) for detailed migration workflows.
+
+## LangChain Agent
+
+The conversational agent has access to two tools:
+
+1. **simba_search** - Query the vector store for Simba's documents
+   - Used for: Medical records, veterinary history, factual information
+
+2. **web_search** - Search the web via Tavily API
+   - Used for: Recent events, external knowledge, general questions
+
+The agent automatically selects the appropriate tool based on the user's query.
+
+## Authentication Flow
+
+```
+User → Authelia (OIDC) → Backend (JWT) → Frontend (localStorage)
+                ↓
+              LLDAP
+```
+
+1. User clicks "Login"
+2. Frontend redirects to Authelia
+3. User authenticates via Authelia (backed by LLDAP)
+4. Authelia redirects back with authorization code
+5. Backend exchanges code for OIDC tokens
+6. Backend issues JWT tokens
+7. Frontend stores tokens in localStorage
+
+## Contributing
+
+1. Fork the repository
+2. Create a feature branch
+3. Make your changes
+4. Run tests and linting
+5. Submit a pull request
+
+## Documentation
+
+- [Development Guide](docs/development.md) - Setup and development workflow
+- [Deployment Guide](docs/deployment.md) - Deployment and migrations
+- [Vector Store Guide](docs/vectorstore.md) - Managing the vector database
+- [Authentication Guide](docs/authentication.md) - OIDC and LDAP setup
+
+## License
+
+[Your License Here]
+
+## Acknowledgments
+
+- Built for Simba, the most important cat in the world 🐱
+- Powered by LangChain, ChromaDB, and the open-source community

app.py

@@ -1,15 +1,27 @@
+import logging
 import os
 
+from dotenv import load_dotenv
 from quart import Quart, jsonify, render_template, request, send_from_directory
 from quart_jwt_extended import JWTManager, get_jwt_identity, jwt_refresh_token_required
-from tortoise.contrib.quart import register_tortoise
+from tortoise import Tortoise
 
 import blueprints.conversation
 import blueprints.conversation.logic
+import blueprints.rag
 import blueprints.users
+import blueprints.whatsapp
+import blueprints.email
 import blueprints.users.models
+from config.db import TORTOISE_CONFIG
 from main import consult_simba_oracle
 
+# Load environment variables
+load_dotenv()
+
+# Configure logging
+logging.basicConfig(level=logging.INFO)
+
 app = Quart(
     __name__,
     static_folder="raggr-frontend/dist/static",
@@ -17,37 +29,26 @@ app = Quart(
 )
 
 app.config["JWT_SECRET_KEY"] = os.getenv("JWT_SECRET_KEY", "SECRET_KEY")
+app.config["MAX_CONTENT_LENGTH"] = 10 * 1024 * 1024  # 10 MB upload limit
 jwt = JWTManager(app)
 
 # Register blueprints
 app.register_blueprint(blueprints.users.user_blueprint)
 app.register_blueprint(blueprints.conversation.conversation_blueprint)
+app.register_blueprint(blueprints.rag.rag_blueprint)
+app.register_blueprint(blueprints.whatsapp.whatsapp_blueprint)
+app.register_blueprint(blueprints.email.email_blueprint)
 
 
-# Database configuration with environment variable support
+# Initialize Tortoise ORM with lifecycle hooks
-DATABASE_URL = os.getenv(
+@app.while_serving
-    "DATABASE_URL", "postgres://raggr:raggr_dev_password@localhost:5432/raggr"
+async def lifespan():
-)
+    logging.info("Initializing Tortoise ORM...")
-
+    await Tortoise.init(config=TORTOISE_CONFIG)
-TORTOISE_CONFIG = {
+    logging.info("Tortoise ORM initialized successfully")
-    "connections": {"default": DATABASE_URL},
+    yield
-    "apps": {
+    logging.info("Closing Tortoise ORM connections...")
-        "models": {
+    await Tortoise.close_connections()
-            "models": [
-                "blueprints.conversation.models",
-                "blueprints.users.models",
-                "aerich.models",
-            ]
-        },
-    },
-}
-
-# Initialize Tortoise ORM
-register_tortoise(
-    app,
-    config=TORTOISE_CONFIG,
-    generate_schemas=False,  # Disabled - using Aerich for migrations
-)
 
 
 # Serve React static files

blueprints/conversation/__init__.py

@@ -0,0 +1,293 @@
+import datetime
+import json
+import logging
+import uuid
+
+from quart import Blueprint, Response, jsonify, make_response, request
+from quart_jwt_extended import (
+    get_jwt_identity,
+    jwt_refresh_token_required,
+)
+
+import blueprints.users.models
+from utils.image_process import analyze_user_image
+from utils.image_upload import ImageValidationError, process_image
+from utils.s3_client import get_image as s3_get_image
+from utils.s3_client import upload_image as s3_upload_image
+
+from .agents import main_agent
+from .logic import (
+    add_message_to_conversation,
+    get_conversation_by_id,
+    rename_conversation,
+)
+from .models import (
+    Conversation,
+    PydConversation,
+    PydListConversation,
+)
+from .prompts import SIMBA_SYSTEM_PROMPT
+
+conversation_blueprint = Blueprint(
+    "conversation_api", __name__, url_prefix="/api/conversation"
+)
+
+_SYSTEM_PROMPT = SIMBA_SYSTEM_PROMPT
+
+
+def _build_messages_payload(
+    conversation, query_text: str, image_description: str | None = None
+) -> list:
+    recent_messages = (
+        conversation.messages[-10:]
+        if len(conversation.messages) > 10
+        else conversation.messages
+    )
+    messages_payload = [{"role": "system", "content": _SYSTEM_PROMPT}]
+    for msg in recent_messages[:-1]:  # Exclude the message we just added
+        role = "user" if msg.speaker == "user" else "assistant"
+        text = msg.text
+        if msg.image_key and role == "user":
+            text = f"[User sent an image]\n{text}"
+        messages_payload.append({"role": role, "content": text})
+
+    # Build the current user message with optional image description
+    if image_description:
+        content = f"[Image analysis: {image_description}]"
+        if query_text:
+            content = f"{query_text}\n\n{content}"
+    else:
+        content = query_text
+    messages_payload.append({"role": "user", "content": content})
+    return messages_payload
+
+
+@conversation_blueprint.post("/query")
+@jwt_refresh_token_required
+async def query():
+    current_user_uuid = get_jwt_identity()
+    user = await blueprints.users.models.User.get(id=current_user_uuid)
+    data = await request.get_json()
+    query = data.get("query")
+    conversation_id = data.get("conversation_id")
+    conversation = await get_conversation_by_id(conversation_id)
+    await conversation.fetch_related("messages")
+    await add_message_to_conversation(
+        conversation=conversation,
+        message=query,
+        speaker="user",
+        user=user,
+    )
+
+    messages_payload = _build_messages_payload(conversation, query)
+    payload = {"messages": messages_payload}
+
+    response = await main_agent.ainvoke(payload)
+    message = response.get("messages", [])[-1].content
+    await add_message_to_conversation(
+        conversation=conversation,
+        message=message,
+        speaker="simba",
+        user=user,
+    )
+    return jsonify({"response": message})
+
+
+@conversation_blueprint.post("/upload-image")
+@jwt_refresh_token_required
+async def upload_image():
+    current_user_uuid = get_jwt_identity()
+    await blueprints.users.models.User.get(id=current_user_uuid)
+
+    files = await request.files
+    form = await request.form
+    file = files.get("file")
+    conversation_id = form.get("conversation_id")
+
+    if not file or not conversation_id:
+        return jsonify({"error": "file and conversation_id are required"}), 400
+
+    file_bytes = file.read()
+    content_type = file.content_type or "image/jpeg"
+
+    try:
+        processed_bytes, output_content_type = process_image(file_bytes, content_type)
+    except ImageValidationError as e:
+        return jsonify({"error": str(e)}), 400
+
+    ext = output_content_type.split("/")[-1]
+    if ext == "jpeg":
+        ext = "jpg"
+    key = f"conversations/{conversation_id}/{uuid.uuid4()}.{ext}"
+
+    await s3_upload_image(processed_bytes, key, output_content_type)
+
+    return jsonify(
+        {
+            "image_key": key,
+            "image_url": f"/api/conversation/image/{key}",
+        }
+    )
+
+
+@conversation_blueprint.get("/image/<path:image_key>")
+@jwt_refresh_token_required
+async def serve_image(image_key: str):
+    try:
+        image_bytes, content_type = await s3_get_image(image_key)
+    except Exception:
+        return jsonify({"error": "Image not found"}), 404
+
+    return Response(
+        image_bytes,
+        content_type=content_type,
+        headers={"Cache-Control": "private, max-age=3600"},
+    )
+
+
+@conversation_blueprint.post("/stream-query")
+@jwt_refresh_token_required
+async def stream_query():
+    current_user_uuid = get_jwt_identity()
+    user = await blueprints.users.models.User.get(id=current_user_uuid)
+    data = await request.get_json()
+    query_text = data.get("query")
+    conversation_id = data.get("conversation_id")
+    image_key = data.get("image_key")
+    conversation = await get_conversation_by_id(conversation_id)
+    await conversation.fetch_related("messages")
+    await add_message_to_conversation(
+        conversation=conversation,
+        message=query_text or "",
+        speaker="user",
+        user=user,
+        image_key=image_key,
+    )
+
+    # If an image was uploaded, analyze it with the vision model
+    image_description = None
+    if image_key:
+        try:
+            image_bytes, _ = await s3_get_image(image_key)
+            image_description = await analyze_user_image(image_bytes)
+            logging.info(f"Image analysis complete for {image_key}")
+        except Exception as e:
+            logging.error(f"Failed to analyze image: {e}")
+            image_description = "[Image could not be analyzed]"
+
+    messages_payload = _build_messages_payload(
+        conversation, query_text or "", image_description
+    )
+    payload = {"messages": messages_payload}
+
+    async def event_generator():
+        final_message = None
+        try:
+            async for event in main_agent.astream_events(payload, version="v2"):
+                event_type = event.get("event")
+
+                if event_type == "on_tool_start":
+                    yield f"data: {json.dumps({'type': 'tool_start', 'tool': event['name']})}\n\n"
+
+                elif event_type == "on_tool_end":
+                    yield f"data: {json.dumps({'type': 'tool_end', 'tool': event['name']})}\n\n"
+
+                elif event_type == "on_chain_end":
+                    output = event.get("data", {}).get("output")
+                    if isinstance(output, dict):
+                        msgs = output.get("messages", [])
+                        if msgs:
+                            last_msg = msgs[-1]
+                            content = getattr(last_msg, "content", None)
+                            if isinstance(content, str) and content:
+                                final_message = content
+
+        except Exception as e:
+            yield f"data: {json.dumps({'type': 'error', 'message': str(e)})}\n\n"
+
+        if final_message:
+            await add_message_to_conversation(
+                conversation=conversation,
+                message=final_message,
+                speaker="simba",
+                user=user,
+            )
+            yield f"data: {json.dumps({'type': 'response', 'message': final_message})}\n\n"
+        else:
+            yield f"data: {json.dumps({'type': 'error', 'message': 'No response generated'})}\n\n"
+
+        yield "data: [DONE]\n\n"
+
+    return await make_response(
+        event_generator(),
+        200,
+        {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "X-Accel-Buffering": "no",
+        },
+    )
+
+
+@conversation_blueprint.route("/<conversation_id>")
+@jwt_refresh_token_required
+async def get_conversation(conversation_id: str):
+    conversation = await Conversation.get(id=conversation_id)
+    current_user_uuid = get_jwt_identity()
+    user = await blueprints.users.models.User.get(id=current_user_uuid)
+    await conversation.fetch_related("messages")
+
+    # Manually serialize the conversation with messages
+    messages = []
+    for msg in conversation.messages:
+        messages.append(
+            {
+                "id": str(msg.id),
+                "text": msg.text,
+                "speaker": msg.speaker.value,
+                "created_at": msg.created_at.isoformat(),
+                "image_key": msg.image_key,
+            }
+        )
+    name = conversation.name
+    if len(messages) > 8 and "datetime" in name.lower():
+        name = await rename_conversation(
+            user=user,
+            conversation=conversation,
+        )
+        print(name)
+
+    return jsonify(
+        {
+            "id": str(conversation.id),
+            "name": name,
+            "messages": messages,
+            "created_at": conversation.created_at.isoformat(),
+            "updated_at": conversation.updated_at.isoformat(),
+        }
+    )
+
+
+@conversation_blueprint.post("/")
+@jwt_refresh_token_required
+async def create_conversation():
+    user_uuid = get_jwt_identity()
+    user = await blueprints.users.models.User.get(id=user_uuid)
+    conversation = await Conversation.create(
+        name=f"{user.username} {datetime.datetime.now().timestamp}",
+        user=user,
+    )
+
+    serialized_conversation = await PydConversation.from_tortoise_orm(conversation)
+    return jsonify(serialized_conversation.model_dump())
+
+
+@conversation_blueprint.get("/")
+@jwt_refresh_token_required
+async def get_all_conversations():
+    user_uuid = get_jwt_identity()
+    user = await blueprints.users.models.User.get(id=user_uuid)
+    conversations = Conversation.filter(user=user)
+    serialized_conversations = await PydListConversation.from_queryset(conversations)
+
+    return jsonify(serialized_conversations.model_dump())

blueprints/conversation/agents.py

@@ -0,0 +1,618 @@
+import os
+from typing import cast
+
+from dotenv import load_dotenv
+from langchain.agents import create_agent
+from langchain.chat_models import BaseChatModel
+from langchain.tools import tool
+from langchain_openai import ChatOpenAI
+from tavily import AsyncTavilyClient
+
+from blueprints.rag.logic import query_vector_store
+from utils.obsidian_service import ObsidianService
+from utils.ynab_service import YNABService
+
+# Load environment variables
+load_dotenv()
+
+# Configure LLM with llama-server or OpenAI fallback
+llama_url = os.getenv("LLAMA_SERVER_URL")
+if llama_url:
+    llama_chat = ChatOpenAI(
+        base_url=llama_url,
+        api_key="not-needed",
+        model=os.getenv("LLAMA_MODEL_NAME", "llama-3.1-8b-instruct"),
+    )
+else:
+    llama_chat = None
+
+openai_fallback = ChatOpenAI(model="gpt-5-mini")
+model_with_fallback = cast(
+    BaseChatModel,
+    llama_chat.with_fallbacks([openai_fallback]) if llama_chat else openai_fallback,
+)
+client = AsyncTavilyClient(api_key=os.getenv("TAVILY_API_KEY", ""))
+
+# Initialize YNAB service (will only work if YNAB_ACCESS_TOKEN is set)
+try:
+    ynab_service = YNABService()
+    ynab_enabled = True
+except (ValueError, Exception) as e:
+    print(f"YNAB service not initialized: {e}")
+    ynab_enabled = False
+
+# Initialize Obsidian service (will only work if OBSIDIAN_VAULT_PATH is set)
+try:
+    obsidian_service = ObsidianService()
+    obsidian_enabled = True
+except (ValueError, Exception) as e:
+    print(f"Obsidian service not initialized: {e}")
+    obsidian_enabled = False
+
+
+@tool
+def get_current_date() -> str:
+    """Get today's date in a human-readable format.
+
+    Use this tool when you need to:
+    - Reference today's date in your response
+    - Answer questions like "what is today's date"
+    - Format dates in messages or documents
+    - Calculate time periods relative to today
+
+    Returns:
+        Today's date in YYYY-MM-DD format
+    """
+    from datetime import date
+
+    return date.today().isoformat()
+
+
+@tool
+async def web_search(query: str) -> str:
+    """Search the web for current information using Tavily.
+
+    Use this tool when you need to:
+    - Find current information not in the knowledge base
+    - Look up recent events, news, or updates
+    - Verify facts or get additional context
+    - Search for information outside of Simba's documents
+
+    Args:
+        query: The search query to look up on the web
+
+    Returns:
+        Search results from the web with titles, content, and source URLs
+    """
+    response = await client.search(query=query, search_depth="basic")
+    results = response.get("results", [])
+
+    if not results:
+        return "No results found for the query."
+
+    formatted = "\n\n".join(
+        [
+            f"**{result['title']}**\n{result['content']}\nSource: {result['url']}"
+            for result in results[:5]
+        ]
+    )
+    return formatted
+
+
+@tool(response_format="content_and_artifact")
+async def simba_search(query: str):
+    """Search through Simba's medical records, veterinary documents, and personal information.
+
+    Use this tool whenever the user asks questions about:
+    - Simba's health history, medical records, or veterinary visits
+    - Medications, treatments, or diagnoses
+    - Weight, diet, or physical characteristics over time
+    - Veterinary recommendations or advice
+    - Ryan's (the owner's) information related to Simba
+    - Any factual information that would be found in documents
+
+    Args:
+        query: The user's question or information need about Simba
+
+    Returns:
+        Relevant information from Simba's documents
+    """
+    print(f"[SIMBA SEARCH] Tool called with query: {query}")
+    serialized, docs = await query_vector_store(query=query)
+    print(f"[SIMBA SEARCH] Found {len(docs)} documents")
+    print(f"[SIMBA SEARCH] Serialized result length: {len(serialized)}")
+    print(f"[SIMBA SEARCH] First 200 chars: {serialized[:200]}")
+    return serialized, docs
+
+
+@tool
+def ynab_budget_summary() -> str:
+    """Get overall budget summary and health status from YNAB.
+
+    Use this tool when the user asks about:
+    - Overall budget health or status
+    - How much money is to be budgeted
+    - Total budget amounts or spending
+    - General budget overview questions
+
+    Returns:
+        Summary of budget health, to-be-budgeted amount, total budgeted,
+        total activity, and available amounts.
+    """
+    if not ynab_enabled:
+        return "YNAB integration is not configured. Please set YNAB_ACCESS_TOKEN environment variable."
+
+    try:
+        summary = ynab_service.get_budget_summary()
+        return summary["summary"]
+    except Exception as e:
+        return f"Error fetching budget summary: {str(e)}"
+
+
+@tool
+def ynab_search_transactions(
+    start_date: str = "",
+    end_date: str = "",
+    category_name: str = "",
+    payee_name: str = "",
+) -> str:
+    """Search YNAB transactions by date range, category, or payee.
+
+    Use this tool when the user asks about:
+    - Specific transactions or purchases
+    - Spending at a particular store or payee
+    - Transactions in a specific category
+    - What was spent during a time period
+
+    Args:
+        start_date: Start date in YYYY-MM-DD format (optional, defaults to 30 days ago)
+        end_date: End date in YYYY-MM-DD format (optional, defaults to today)
+        category_name: Filter by category name (optional, partial match)
+        payee_name: Filter by payee/store name (optional, partial match)
+
+    Returns:
+        List of matching transactions with dates, amounts, categories, and payees.
+    """
+    if not ynab_enabled:
+        return "YNAB integration is not configured. Please set YNAB_ACCESS_TOKEN environment variable."
+
+    try:
+        result = ynab_service.get_transactions(
+            start_date=start_date or None,
+            end_date=end_date or None,
+            category_name=category_name or None,
+            payee_name=payee_name or None,
+        )
+
+        if result["count"] == 0:
+            return "No transactions found matching the specified criteria."
+
+        # Format transactions for readability
+        txn_list = []
+        for txn in result["transactions"][:10]:  # Limit to 10 for readability
+            txn_list.append(
+                f"- {txn['date']}: {txn['payee']} - ${abs(txn['amount']):.2f} ({txn['category'] or 'Uncategorized'})"
+            )
+
+        return (
+            f"Found {result['count']} transactions from {result['start_date']} to {result['end_date']}. "
+            f"Total: ${abs(result['total_amount']):.2f}\n\n"
+            + "\n".join(txn_list)
+            + (
+                f"\n\n(Showing first 10 of {result['count']} transactions)"
+                if result["count"] > 10
+                else ""
+            )
+        )
+    except Exception as e:
+        return f"Error searching transactions: {str(e)}"
+
+
+@tool
+def ynab_category_spending(month: str = "") -> str:
+    """Get spending breakdown by category for a specific month.
+
+    Use this tool when the user asks about:
+    - Spending by category
+    - What categories were overspent
+    - Monthly spending breakdown
+    - Budget vs actual spending for a month
+
+    Args:
+        month: Month in YYYY-MM format (optional, defaults to current month)
+
+    Returns:
+        Spending breakdown by category with budgeted, spent, and available amounts.
+    """
+    if not ynab_enabled:
+        return "YNAB integration is not configured. Please set YNAB_ACCESS_TOKEN environment variable."
+
+    try:
+        result = ynab_service.get_category_spending(month=month or None)
+
+        summary = (
+            f"Budget spending for {result['month']}:\n"
+            f"Total budgeted: ${result['total_budgeted']:.2f}\n"
+            f"Total spent: ${result['total_spent']:.2f}\n"
+            f"Total available: ${result['total_available']:.2f}\n"
+        )
+
+        if result["overspent_categories"]:
+            summary += (
+                f"\nOverspent categories ({len(result['overspent_categories'])}):\n"
+            )
+            for cat in result["overspent_categories"][:5]:
+                summary += f"- {cat['name']}: Budgeted ${cat['budgeted']:.2f}, Spent ${cat['spent']:.2f}, Over by ${cat['overspent_by']:.2f}\n"
+
+        # Add top spending categories
+        summary += "\nTop spending categories:\n"
+        for cat in result["categories"][:10]:
+            if cat["activity"] < 0:  # Only show spending (negative activity)
+                summary += f"- {cat['category']}: ${abs(cat['activity']):.2f} (budgeted: ${cat['budgeted']:.2f}, available: ${cat['available']:.2f})\n"
+
+        return summary
+    except Exception as e:
+        return f"Error fetching category spending: {str(e)}"
+
+
+@tool
+def ynab_insights(months_back: int = 3) -> str:
+    """Generate insights about spending patterns and budget health over time.
+
+    Use this tool when the user asks about:
+    - Spending trends or patterns
+    - Budget recommendations
+    - Which categories are frequently overspent
+    - How current spending compares to past months
+    - Overall budget health analysis
+
+    Args:
+        months_back: Number of months to analyze (default 3, max 6)
+
+    Returns:
+        Insights about spending trends, frequently overspent categories,
+        and personalized recommendations.
+    """
+    if not ynab_enabled:
+        return "YNAB integration is not configured. Please set YNAB_ACCESS_TOKEN environment variable."
+
+    try:
+        # Limit to reasonable range
+        months_back = min(max(1, months_back), 6)
+        result = ynab_service.get_spending_insights(months_back=months_back)
+
+        if "error" in result:
+            return result["error"]
+
+        summary = (
+            f"Spending insights for the last {months_back} months:\n\n"
+            f"Average monthly spending: ${result['average_monthly_spending']:.2f}\n"
+            f"Current month spending: ${result['current_month_spending']:.2f}\n"
+            f"Spending trend: {result['spending_trend']}\n"
+        )
+
+        if result["frequently_overspent_categories"]:
+            summary += "\nFrequently overspent categories:\n"
+            for cat in result["frequently_overspent_categories"][:5]:
+                summary += f"- {cat['category']}: overspent in {cat['months_overspent']} of {months_back} months\n"
+
+        if result["recommendations"]:
+            summary += "\nRecommendations:\n"
+            for rec in result["recommendations"]:
+                summary += f"- {rec}\n"
+
+        return summary
+    except Exception as e:
+        return f"Error generating insights: {str(e)}"
+
+
+@tool
+async def obsidian_search_notes(query: str) -> str:
+    """Search through Obsidian vault notes for information.
+
+    Use this tool when you need to:
+    - Find information in personal notes
+    - Research past ideas or thoughts from your vault
+    - Look up information stored in markdown files
+    - Search for content that would be in your notes
+
+    Args:
+        query: The search query to look up in your Obsidian vault
+
+    Returns:
+        Relevant notes with their content and metadata
+    """
+    if not obsidian_enabled:
+        return "Obsidian integration is not configured. Please set OBSIDIAN_VAULT_PATH environment variable."
+
+    try:
+        # Query ChromaDB for obsidian documents
+        serialized, docs = await query_vector_store(query=query)
+        return serialized
+
+    except Exception as e:
+        return f"Error searching Obsidian notes: {str(e)}"
+
+
+@tool
+async def obsidian_read_note(relative_path: str) -> str:
+    """Read a specific note from your Obsidian vault.
+
+    Use this tool when you want to:
+    - Read the full content of a specific note
+    - Get detailed information from a particular markdown file
+    - Access content from a known note path
+
+    Args:
+        relative_path: Path to note relative to vault root (e.g., "notes/my-note.md")
+
+    Returns:
+        Full content and metadata of the requested note
+    """
+    if not obsidian_enabled:
+        return "Obsidian integration is not configured. Please set OBSIDIAN_VAULT_PATH environment variable."
+
+    try:
+        note = obsidian_service.read_note(relative_path)
+        content_data = note["content"]
+
+        result = f"File: {note['path']}\n\n"
+        result += f"Frontmatter:\n{content_data['metadata']}\n\n"
+        result += f"Content:\n{content_data['content']}\n\n"
+        result += f"Tags: {', '.join(content_data['tags'])}\n"
+        result += f"Contains {len(content_data['wikilinks'])} wikilinks and {len(content_data['embeds'])} embeds"
+
+        return result
+
+    except FileNotFoundError:
+        return f"Note not found at '{relative_path}'. Please check the path is correct."
+    except Exception as e:
+        return f"Error reading note: {str(e)}"
+
+
+@tool
+async def obsidian_create_note(
+    title: str,
+    content: str,
+    folder: str = "notes",
+    tags: str = "",
+) -> str:
+    """Create a new note in your Obsidian vault.
+
+    Use this tool when you want to:
+    - Save research findings or ideas to your vault
+    - Create a new document with a specific title
+    - Write notes for future reference
+
+    Args:
+        title: The title of the note (will be used as filename)
+        content: The body content of the note
+        folder: The folder where to create the note (default: "notes")
+        tags: Comma-separated list of tags to add (default: "")
+
+    Returns:
+        Path to the created note
+    """
+    if not obsidian_enabled:
+        return "Obsidian integration is not configured. Please set OBSIDIAN_VAULT_PATH environment variable."
+
+    try:
+        # Parse tags from comma-separated string
+        tag_list = [tag.strip() for tag in tags.split(",") if tag.strip()]
+
+        relative_path = obsidian_service.create_note(
+            title=title,
+            content=content,
+            folder=folder,
+            tags=tag_list,
+        )
+
+        return f"Successfully created note: {relative_path}"
+
+    except Exception as e:
+        return f"Error creating note: {str(e)}"
+
+
+@tool
+def journal_get_today() -> str:
+    """Get today's daily journal note, including all tasks and log entries.
+
+    Use this tool when the user asks about:
+    - What's on their plate today
+    - Today's tasks or to-do list
+    - Today's journal entry
+    - What they've logged today
+
+    Returns:
+        The full content of today's daily note, or a message if it doesn't exist.
+    """
+    if not obsidian_enabled:
+        return "Obsidian integration is not configured."
+
+    try:
+        note = obsidian_service.get_daily_note()
+        if not note["found"]:
+            return f"No daily note found for {note['date']}. Use journal_add_task to create one."
+        return f"Daily note for {note['date']}:\n\n{note['content']}"
+    except Exception as e:
+        return f"Error reading daily note: {str(e)}"
+
+
+@tool
+def journal_get_tasks(date: str = "") -> str:
+    """Get tasks from a daily journal note.
+
+    Use this tool when the user asks about:
+    - Open or pending tasks for a day
+    - What tasks are done or not done
+    - Task status for today or a specific date
+
+    Args:
+        date: Date in YYYY-MM-DD format (optional, defaults to today)
+
+    Returns:
+        List of tasks with their completion status.
+    """
+    if not obsidian_enabled:
+        return "Obsidian integration is not configured."
+
+    try:
+        from datetime import datetime as dt
+
+        parsed_date = dt.strptime(date, "%Y-%m-%d") if date else None
+        result = obsidian_service.get_daily_tasks(parsed_date)
+
+        if not result["found"]:
+            return f"No daily note found for {result['date']}."
+
+        if not result["tasks"]:
+            return f"No tasks found in the {result['date']} note."
+
+        lines = [f"Tasks for {result['date']}:"]
+        for task in result["tasks"]:
+            status = "[x]" if task["done"] else "[ ]"
+            lines.append(f"- {status} {task['text']}")
+        return "\n".join(lines)
+    except Exception as e:
+        return f"Error reading tasks: {str(e)}"
+
+
+@tool
+def journal_add_task(task: str, date: str = "") -> str:
+    """Add a task to a daily journal note.
+
+    Use this tool when the user wants to:
+    - Add a task or to-do to today's note
+    - Remind themselves to do something
+    - Track a new item in their daily note
+
+    Args:
+        task: The task description to add
+        date: Date in YYYY-MM-DD format (optional, defaults to today)
+
+    Returns:
+        Confirmation of the added task.
+    """
+    if not obsidian_enabled:
+        return "Obsidian integration is not configured."
+
+    try:
+        from datetime import datetime as dt
+
+        parsed_date = dt.strptime(date, "%Y-%m-%d") if date else None
+        result = obsidian_service.add_task_to_daily_note(task, parsed_date)
+
+        if result["success"]:
+            note_date = date or dt.now().strftime("%Y-%m-%d")
+            extra = " (created new note)" if result["created_note"] else ""
+            return f"Added task '{task}' to {note_date}{extra}."
+        return "Failed to add task."
+    except Exception as e:
+        return f"Error adding task: {str(e)}"
+
+
+@tool
+def journal_complete_task(task: str, date: str = "") -> str:
+    """Mark a task as complete in a daily journal note.
+
+    Use this tool when the user wants to:
+    - Check off a task as done
+    - Mark something as completed
+    - Update task status in their daily note
+
+    Args:
+        task: The task text to mark complete (exact or partial match)
+        date: Date in YYYY-MM-DD format (optional, defaults to today)
+
+    Returns:
+        Confirmation that the task was marked complete.
+    """
+    if not obsidian_enabled:
+        return "Obsidian integration is not configured."
+
+    try:
+        from datetime import datetime as dt
+
+        parsed_date = dt.strptime(date, "%Y-%m-%d") if date else None
+        result = obsidian_service.complete_task_in_daily_note(task, parsed_date)
+
+        if result["success"]:
+            return f"Marked '{result['completed_task']}' as complete."
+        return f"Could not complete task: {result.get('error', 'unknown error')}"
+    except Exception as e:
+        return f"Error completing task: {str(e)}"
+
+
+@tool
+async def obsidian_create_task(
+    title: str,
+    content: str = "",
+    folder: str = "tasks",
+    due_date: str = "",
+    tags: str = "",
+) -> str:
+    """Create a new task note in your Obsidian vault.
+
+    Use this tool when you want to:
+    - Create a task to remember to do something
+    - Add a task with a due date
+    - Track tasks in your vault
+
+    Args:
+        title: The title of the task
+        content: The description of the task (optional)
+        folder: The folder to place the task (default: "tasks")
+        due_date: Due date in YYYY-MM-DD format (optional)
+        tags: Comma-separated list of tags to add (optional)
+
+    Returns:
+        Path to the created task note
+    """
+    if not obsidian_enabled:
+        return "Obsidian integration is not configured. Please set OBSIDIAN_VAULT_PATH environment variable."
+
+    try:
+        # Parse tags from comma-separated string
+        tag_list = [tag.strip() for tag in tags.split(",") if tag.strip()]
+
+        relative_path = obsidian_service.create_task(
+            title=title,
+            content=content,
+            folder=folder,
+            due_date=due_date or None,
+            tags=tag_list,
+        )
+
+        return f"Successfully created task: {relative_path}"
+
+    except Exception as e:
+        return f"Error creating task: {str(e)}"
+
+
+# Create tools list based on what's available
+tools = [get_current_date, simba_search, web_search]
+if ynab_enabled:
+    tools.extend(
+        [
+            ynab_budget_summary,
+            ynab_search_transactions,
+            ynab_category_spending,
+            ynab_insights,
+        ]
+    )
+if obsidian_enabled:
+    tools.extend(
+        [
+            obsidian_search_notes,
+            obsidian_read_note,
+            obsidian_create_note,
+            obsidian_create_task,
+            journal_get_today,
+            journal_get_tasks,
+            journal_add_task,
+            journal_complete_task,
+        ]
+    )
+
+# Llama 3.1 supports native function calling via OpenAI-compatible API
+main_agent = create_agent(model=model_with_fallback, tools=tools)

blueprints/conversation/logic.py

@@ -16,12 +16,14 @@ async def add_message_to_conversation(
     message: str,
     speaker: str,
     user: blueprints.users.models.User,
+    image_key: str | None = None,
 ) -> ConversationMessage:
     print(conversation, message, speaker)
     message = await ConversationMessage.create(
         text=message,
         speaker=speaker,
         conversation=conversation,
+        image_key=image_key,
     )
 
     return message
@@ -74,7 +76,7 @@ async def rename_conversation(
 
     prompt = f"Summarize the following conversation into a sassy one-liner title:\n\n{messages}"
     response = structured_llm.invoke(prompt)
-    new_name: str = response.get("title")
+    new_name: str = response.get("title", "")
     conversation.name = new_name
     await conversation.save()
     return new_name

blueprints/conversation/models.py

@@ -41,6 +41,7 @@ class ConversationMessage(Model):
     )
     created_at = fields.DatetimeField(auto_now_add=True)
     speaker = fields.CharEnumField(enum_type=Speaker, max_length=10)
+    image_key = fields.CharField(max_length=512, null=True, default=None)
 
     class Meta:
         table = "conversation_messages"

blueprints/conversation/prompts.py

@@ -0,0 +1,57 @@
+SIMBA_SYSTEM_PROMPT = """You are a helpful cat assistant named Simba that understands veterinary terms. When there are questions to you specifically, they are referring to Simba the cat. Answer the user in as if you were a cat named Simba. Don't act too catlike. Be assertive.
+
+SIMBA FACTS (as of January 2026):
+- Name: Simba
+- Species: Feline (Domestic Short Hair / American Short Hair)
+- Sex: Male, Neutered
+- Date of Birth: August 8, 2016 (approximately 9 years 5 months old)
+- Color: Orange
+- Current Weight: 16 lbs (as of 1/8/2026)
+- Owner: Ryan Chen
+- Location: Long Island City, NY
+- Veterinarian: Court Square Animal Hospital
+
+Medical Conditions:
+- Hypertrophic Cardiomyopathy (HCM): Diagnosed 12/11/2025. Concentric left ventricular hypertrophy with no left atrial dilation. Grade II-III/VI systolic heart murmur. No cardiac medications currently needed. Must avoid Domitor, acepromazine, and ketamine during anesthesia.
+- Dental Issues: Prior extraction of teeth 307 and 407 due to resorption. Tooth 107 extracted on 1/8/2026. Early resorption lesions present on teeth 207, 309, and 409.
+
+Recent Medical Events:
+- 1/8/2026: Dental cleaning and tooth 107 extraction. Prescribed Onsior for 3 days. Oravet sealant applied.
+- 12/11/2025: Echocardiogram confirming HCM diagnosis. Pre-op bloodwork was normal.
+- 12/1/2025: Visited for decreased appetite/nausea. Received subcutaneous fluids and Cerenia.
+
+Diet & Lifestyle:
+- Diet: Hill's I/D wet and dry food
+- Supplements: Plaque Off
+- Indoor only cat, only pet in the household
+
+Upcoming Appointments:
+- Rabies Vaccine: Due 2/19/2026
+- Routine Examination: Due 6/1/2026
+- FVRCP-3yr Vaccine: Due 10/2/2026
+
+IMPORTANT: When users ask factual questions about Simba's health, medical history, veterinary visits, medications, weight, or any information that would be in documents, you MUST use the simba_search tool to retrieve accurate information before answering. Do not rely on general knowledge - always search the documents for factual questions.
+
+BUDGET & FINANCE (YNAB Integration):
+You have access to Ryan's budget data through YNAB (You Need A Budget). When users ask about financial matters, use the appropriate YNAB tools:
+- Use ynab_budget_summary for overall budget health and status questions
+- Use ynab_search_transactions to find specific purchases or spending at particular stores
+- Use ynab_category_spending to analyze spending by category for a month
+- Use ynab_insights to provide spending trends, patterns, and recommendations
+Always use these tools when asked about budgets, spending, transactions, or financial health.
+
+NOTES & RESEARCH (Obsidian Integration):
+You have access to Ryan's Obsidian vault through the Obsidian integration. When users ask about research, personal notes, or information that might be stored in markdown files, use the appropriate Obsidian tools:
+- Use obsidian_search_notes to search through your vault for relevant information
+- Use obsidian_read_note to read the full content of a specific note by path
+- Use obsidian_create_note to save new findings, ideas, or research to your vault
+- Use obsidian_create_task to create task notes with due dates
+Always use these tools when users ask about notes, research, ideas, tasks, or when you want to save information for future reference.
+
+DAILY JOURNAL (Task Tracking):
+You have access to Ryan's daily journal notes. Each note lives at journal/YYYY/YYYY-MM-DD.md and has two sections: tasks and log.
+- Use journal_get_today to read today's full daily note (tasks + log)
+- Use journal_get_tasks to list tasks (done/pending) for today or a specific date
+- Use journal_add_task to add a new task to today's (or a given date's) note
+- Use journal_complete_task to check off a task as done
+Use these tools when Ryan asks about today's tasks, wants to add something to his list, or wants to mark a task complete."""

blueprints/email/__init__.py

@@ -0,0 +1,217 @@
+import os
+import hmac
+import hashlib
+import logging
+import functools
+import time
+from collections import defaultdict
+
+import httpx
+from quart import Blueprint, request
+
+from blueprints.users.models import User
+from blueprints.conversation.logic import (
+    get_conversation_for_user,
+    add_message_to_conversation,
+    get_conversation_transcript,
+)
+from blueprints.conversation.agents import main_agent
+from blueprints.conversation.prompts import SIMBA_SYSTEM_PROMPT
+from .helpers import generate_email_token, get_user_email_address  # noqa: F401
+
+email_blueprint = Blueprint("email_api", __name__, url_prefix="/api/email")
+
+logger = logging.getLogger(__name__)
+
+# Rate limiting: per-sender message timestamps
+_rate_limit_store: dict[str, list[float]] = defaultdict(list)
+
+RATE_LIMIT_MAX = int(os.getenv("EMAIL_RATE_LIMIT_MAX", "5"))
+RATE_LIMIT_WINDOW = int(os.getenv("EMAIL_RATE_LIMIT_WINDOW", "300"))
+
+MAX_MESSAGE_LENGTH = 2000
+
+
+# --- Mailgun signature validation ---
+
+def validate_mailgun_signature(f):
+    """Decorator to validate Mailgun webhook signatures."""
+    @functools.wraps(f)
+    async def decorated_function(*args, **kwargs):
+        if os.getenv("MAILGUN_SIGNATURE_VALIDATION", "true").lower() == "false":
+            return await f(*args, **kwargs)
+
+        signing_key = os.getenv("MAILGUN_WEBHOOK_SIGNING_KEY")
+        if not signing_key:
+            logger.error("MAILGUN_WEBHOOK_SIGNING_KEY not set — rejecting request")
+            return "", 406
+
+        form_data = await request.form
+        timestamp = form_data.get("timestamp", "")
+        token = form_data.get("token", "")
+        signature = form_data.get("signature", "")
+
+        if not timestamp or not token or not signature:
+            logger.warning("Missing Mailgun signature fields")
+            return "", 406
+
+        expected = hmac.new(
+            signing_key.encode(),
+            f"{timestamp}{token}".encode(),
+            hashlib.sha256,
+        ).hexdigest()
+
+        if not hmac.compare_digest(expected, signature):
+            logger.warning("Invalid Mailgun signature")
+            return "", 406
+
+        return await f(*args, **kwargs)
+    return decorated_function
+
+
+# --- Rate limiting ---
+
+def _check_rate_limit(sender: str) -> bool:
+    """Check if a sender has exceeded the rate limit.
+
+    Returns True if the request is allowed, False if rate-limited.
+    """
+    now = time.monotonic()
+    cutoff = now - RATE_LIMIT_WINDOW
+
+    timestamps = _rate_limit_store[sender]
+    _rate_limit_store[sender] = [t for t in timestamps if t > cutoff]
+
+    if len(_rate_limit_store[sender]) >= RATE_LIMIT_MAX:
+        return False
+
+    _rate_limit_store[sender].append(now)
+    return True
+
+
+# --- Send reply via Mailgun API ---
+
+async def send_email_reply(to: str, subject: str, body: str, in_reply_to: str | None = None):
+    """Send a reply email via the Mailgun API."""
+    api_key = os.getenv("MAILGUN_API_KEY")
+    domain = os.getenv("MAILGUN_DOMAIN")
+    if not api_key or not domain:
+        logger.error("MAILGUN_API_KEY or MAILGUN_DOMAIN not configured")
+        return
+
+    data = {
+        "from": f"Simba <simba@{domain}>",
+        "to": to,
+        "subject": f"Re: {subject}" if not subject.startswith("Re:") else subject,
+        "text": body,
+    }
+    if in_reply_to:
+        data["h:In-Reply-To"] = in_reply_to
+
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            f"https://api.mailgun.net/v3/{domain}/messages",
+            auth=("api", api_key),
+            data=data,
+        )
+        if resp.status_code != 200:
+            logger.error(f"Mailgun send failed ({resp.status_code}): {resp.text}")
+        else:
+            logger.info(f"Sent email reply to {to}")
+
+
+# --- Webhook route ---
+
+@email_blueprint.route("/webhook", methods=["POST"])
+@validate_mailgun_signature
+async def webhook():
+    """Handle inbound emails forwarded by Mailgun."""
+    form_data = await request.form
+    sender = form_data.get("sender", "")
+    recipient = form_data.get("recipient", "")
+    body = form_data.get("stripped-text", "")
+    subject = form_data.get("subject", "(no subject)")
+    message_id = form_data.get("Message-Id", "")
+
+    # Extract token from recipient: ask+<token>@domain
+    local_part = recipient.split("@")[0] if "@" in recipient else ""
+    if "+" not in local_part:
+        logger.info(f"Ignoring email to {recipient} — no token in address")
+        return "", 200
+
+    token = local_part.split("+", 1)[1]
+
+    # Lookup user by token
+    user = await User.filter(email_hmac_token=token, email_enabled=True).first()
+    if not user:
+        logger.info(f"No user found for email token {token}")
+        return "", 200
+
+    # Rate limit
+    if not _check_rate_limit(sender):
+        logger.warning(f"Rate limit exceeded for email sender {sender}")
+        return "", 200
+
+    # Clean up body
+    body = (body or "").strip()
+    if not body:
+        logger.info(f"Ignoring empty email from {sender}")
+        return "", 200
+
+    if len(body) > MAX_MESSAGE_LENGTH:
+        body = body[:MAX_MESSAGE_LENGTH]
+        logger.info(f"Truncated long email from {sender} to {MAX_MESSAGE_LENGTH} chars")
+
+    logger.info(f"Processing email from {sender} for user {user.username}: {body[:100]}")
+
+    # Get or create conversation
+    try:
+        conversation = await get_conversation_for_user(user=user)
+        await conversation.fetch_related("messages")
+    except Exception as e:
+        logger.error(f"Failed to get conversation for user {user.username}: {e}")
+        return "", 200
+
+    # Add user message
+    await add_message_to_conversation(
+        conversation=conversation,
+        message=body,
+        speaker="user",
+        user=user,
+    )
+
+    # Build messages payload
+    try:
+        messages = await conversation.messages.all()
+        recent_messages = list(messages)[-10:]
+
+        messages_payload = [{"role": "system", "content": SIMBA_SYSTEM_PROMPT}]
+        for msg in recent_messages[:-1]:
+            role = "user" if msg.speaker == "user" else "assistant"
+            messages_payload.append({"role": role, "content": msg.text})
+        messages_payload.append({"role": "user", "content": body})
+
+        logger.info(f"Invoking LangChain agent with {len(messages_payload)} messages")
+        response = await main_agent.ainvoke({"messages": messages_payload})
+        response_text = response.get("messages", [])[-1].content
+    except Exception as e:
+        logger.error(f"Error invoking agent for email: {e}")
+        response_text = "Sorry, I'm having trouble thinking right now."
+
+    # Save response
+    await add_message_to_conversation(
+        conversation=conversation,
+        message=response_text,
+        speaker="simba",
+        user=user,
+    )
+
+    # Send reply email
+    await send_email_reply(
+        to=sender,
+        subject=subject,
+        body=response_text,
+        in_reply_to=message_id,
+    )
+
+    return "", 200

blueprints/email/helpers.py

@@ -0,0 +1,14 @@
+import hmac
+import hashlib
+
+
+def generate_email_token(user_id: str, secret: str) -> str:
+    """Generate a 16-char hex HMAC token for a user's email address."""
+    return hmac.new(
+        secret.encode(), str(user_id).encode(), hashlib.sha256
+    ).hexdigest()[:16]
+
+
+def get_user_email_address(token: str, domain: str) -> str:
+    """Return the routable email address for a given token."""
+    return f"ask+{token}@{domain}"

blueprints/rag/__init__.py

@@ -0,0 +1,59 @@
+from quart import Blueprint, jsonify
+from quart_jwt_extended import jwt_refresh_token_required
+
+from .logic import fetch_obsidian_documents, get_vector_store_stats, index_documents, index_obsidian_documents, vector_store
+from blueprints.users.decorators import admin_required
+
+rag_blueprint = Blueprint("rag_api", __name__, url_prefix="/api/rag")
+
+
+@rag_blueprint.get("/stats")
+@jwt_refresh_token_required
+async def get_stats():
+    """Get vector store statistics."""
+    stats = get_vector_store_stats()
+    return jsonify(stats)
+
+
+@rag_blueprint.post("/index")
+@admin_required
+async def trigger_index():
+    """Trigger indexing of documents from Paperless-NGX. Admin only."""
+    try:
+        await index_documents()
+        stats = get_vector_store_stats()
+        return jsonify({"status": "success", "stats": stats})
+    except Exception as e:
+        return jsonify({"status": "error", "message": str(e)}), 500
+
+
+@rag_blueprint.post("/reindex")
+@admin_required
+async def trigger_reindex():
+    """Clear and reindex all documents. Admin only."""
+    try:
+        # Clear existing documents
+        collection = vector_store._collection
+        all_docs = collection.get()
+
+        if all_docs["ids"]:
+            collection.delete(ids=all_docs["ids"])
+
+        # Reindex
+        await index_documents()
+        stats = get_vector_store_stats()
+        return jsonify({"status": "success", "stats": stats})
+    except Exception as e:
+        return jsonify({"status": "error", "message": str(e)}), 500
+
+
+@rag_blueprint.post("/index-obsidian")
+@admin_required
+async def trigger_obsidian_index():
+    """Index all Obsidian markdown documents into vector store. Admin only."""
+    try:
+        result = await index_obsidian_documents()
+        stats = get_vector_store_stats()
+        return jsonify({"status": "success", "result": result, "stats": stats})
+    except Exception as e:
+        return jsonify({"status": "error", "message": str(e)}), 500

blueprints/rag/fetchers.py

@@ -0,0 +1,79 @@
+import os
+import tempfile
+
+from dotenv import load_dotenv
+import httpx
+
+# Load environment variables
+load_dotenv()
+
+
+class PaperlessNGXService:
+    def __init__(self):
+        self.base_url = os.getenv("BASE_URL")
+        self.token = os.getenv("PAPERLESS_TOKEN")
+        self.url = f"http://{os.getenv('BASE_URL')}/api/documents/?tags__id=8"
+        self.headers = {"Authorization": f"Token {os.getenv('PAPERLESS_TOKEN')}"}
+
+    def get_data(self):
+        print(f"Getting data from: {self.url}")
+        r = httpx.get(self.url, headers=self.headers)
+        results = r.json()["results"]
+
+        nextLink = r.json().get("next")
+
+        while nextLink:
+            r = httpx.get(nextLink, headers=self.headers)
+            results += r.json()["results"]
+            nextLink = r.json().get("next")
+
+        return results
+
+    def get_doc_by_id(self, doc_id: int):
+        url = f"http://{os.getenv('BASE_URL')}/api/documents/{doc_id}/"
+        r = httpx.get(url, headers=self.headers)
+        return r.json()
+
+    def download_pdf_from_id(self, id: int) -> str:
+        download_url = f"http://{os.getenv('BASE_URL')}/api/documents/{id}/download/"
+        response = httpx.get(
+            download_url, headers=self.headers, follow_redirects=True, timeout=30
+        )
+        response.raise_for_status()
+        # Use a temporary file for the downloaded PDF
+        temp_file = tempfile.NamedTemporaryFile(delete=False, suffix=".pdf")
+        temp_file.write(response.content)
+        temp_file.close()
+        temp_pdf_path = temp_file.name
+        pdf_to_process = temp_pdf_path
+        return pdf_to_process
+
+    def upload_cleaned_content(self, document_id, data):
+        PUTS_URL = f"http://{os.getenv('BASE_URL')}/api/documents/{document_id}/"
+        r = httpx.put(PUTS_URL, headers=self.headers, data=data)
+        r.raise_for_status()
+
+    def upload_description(self, description_filepath, file, title, exif_date: str):
+        POST_URL = f"http://{os.getenv('BASE_URL')}/api/documents/post_document/"
+        files = {"document": ("description_filepath", file, "application/txt")}
+        data = {
+            "title": title,
+            "create": exif_date,
+            "document_type": 3,
+            "tags": [7],
+        }
+
+        r = httpx.post(POST_URL, headers=self.headers, data=data, files=files)
+        r.raise_for_status()
+
+    def get_tags(self):
+        GET_URL = f"http://{os.getenv('BASE_URL')}/api/tags/"
+        r = httpx.get(GET_URL, headers=self.headers)
+        data = r.json()
+        return {tag["id"]: tag["name"] for tag in data["results"]}
+
+    def get_doctypes(self):
+        GET_URL = f"http://{os.getenv('BASE_URL')}/api/document_types/"
+        r = httpx.get(GET_URL, headers=self.headers)
+        data = r.json()
+        return {doctype["id"]: doctype["name"] for doctype in data["results"]}

blueprints/rag/logic.py

@@ -0,0 +1,169 @@
+import datetime
+import os
+
+from dotenv import load_dotenv
+from langchain_chroma import Chroma
+from langchain_core.documents import Document
+from langchain_openai import OpenAIEmbeddings
+from langchain_text_splitters import RecursiveCharacterTextSplitter
+
+from .fetchers import PaperlessNGXService
+from utils.obsidian_service import ObsidianService
+
+# Load environment variables
+load_dotenv()
+
+embeddings = OpenAIEmbeddings(model="text-embedding-3-small")
+
+vector_store = Chroma(
+    collection_name="simba_docs",
+    embedding_function=embeddings,
+    persist_directory=os.getenv("CHROMADB_PATH", ""),
+)
+
+text_splitter = RecursiveCharacterTextSplitter(
+    chunk_size=1000,  # chunk size (characters)
+    chunk_overlap=200,  # chunk overlap (characters)
+    add_start_index=True,  # track index in original document
+)
+
+
+def date_to_epoch(date_str: str) -> float:
+    split_date = date_str.split("-")
+    date = datetime.datetime(
+        int(split_date[0]),
+        int(split_date[1]),
+        int(split_date[2]),
+        0,
+        0,
+        0,
+    )
+
+    return date.timestamp()
+
+
+async def fetch_documents_from_paperless_ngx() -> list[Document]:
+    ppngx = PaperlessNGXService()
+    data = ppngx.get_data()
+    doctypes = ppngx.get_doctypes()
+    documents = []
+    for doc in data:
+        metadata = {
+            "created_date": date_to_epoch(doc["created_date"]),
+            "filename": doc["original_file_name"],
+            "document_type": doctypes.get(doc["document_type"], ""),
+        }
+        documents.append(Document(page_content=doc["content"], metadata=metadata))
+
+    return documents
+
+
+async def index_documents():
+    """Index Paperless-NGX documents into vector store."""
+    documents = await fetch_documents_from_paperless_ngx()
+
+    splits = text_splitter.split_documents(documents)
+    await vector_store.aadd_documents(documents=splits)
+
+
+async def fetch_obsidian_documents() -> list[Document]:
+    """Fetch all markdown documents from Obsidian vault.
+
+    Returns:
+        List of LangChain Document objects with source='obsidian' metadata.
+    """
+    obsidian_service = ObsidianService()
+    documents = []
+
+    for md_path in obsidian_service.walk_vault():
+        try:
+            # Read markdown file
+            with open(md_path, "r", encoding="utf-8") as f:
+                content = f.read()
+
+            # Parse metadata
+            parsed = obsidian_service.parse_markdown(content, md_path)
+
+            # Create LangChain Document with obsidian source
+            document = Document(
+                page_content=parsed["content"],
+                metadata={
+                    "source": "obsidian",
+                    "filepath": parsed["filepath"],
+                    "tags": parsed["tags"],
+                    "created_at": parsed["metadata"].get("created_at"),
+                    **{k: v for k, v in parsed["metadata"].items() if k not in ["created_at", "created_by"]},
+                },
+            )
+            documents.append(document)
+
+        except Exception as e:
+            print(f"Error reading {md_path}: {e}")
+            continue
+
+    return documents
+
+
+async def index_obsidian_documents():
+    """Index all Obsidian markdown documents into vector store.
+
+    Deletes existing obsidian source chunks before re-indexing.
+    """
+    obsidian_service = ObsidianService()
+    documents = await fetch_obsidian_documents()
+
+    if not documents:
+        print("No Obsidian documents found to index")
+        return {"indexed": 0}
+
+    # Delete existing obsidian chunks
+    existing_results = vector_store.get(where={"source": "obsidian"})
+    if existing_results.get("ids"):
+        await vector_store.adelete(existing_results["ids"])
+
+    # Split and index documents
+    splits = text_splitter.split_documents(documents)
+    await vector_store.aadd_documents(documents=splits)
+
+    return {"indexed": len(documents)}
+
+
+async def query_vector_store(query: str):
+    retrieved_docs = await vector_store.asimilarity_search(query, k=2)
+    serialized = "\n\n".join(
+        (f"Source: {doc.metadata}\nContent: {doc.page_content}")
+        for doc in retrieved_docs
+    )
+    return serialized, retrieved_docs
+
+
+def get_vector_store_stats():
+    """Get statistics about the vector store."""
+    collection = vector_store._collection
+    count = collection.count()
+    return {
+        "total_documents": count,
+        "collection_name": collection.name,
+    }
+
+
+def list_all_documents(limit: int = 10):
+    """List documents in the vector store with their metadata."""
+    collection = vector_store._collection
+    results = collection.get(limit=limit, include=["metadatas", "documents"])
+
+    documents = []
+    for i, doc_id in enumerate(results["ids"]):
+        documents.append(
+            {
+                "id": doc_id,
+                "metadata": results["metadatas"][i]
+                if results.get("metadatas")
+                else None,
+                "content_preview": results["documents"][i][:200]
+                if results.get("documents")
+                else None,
+            }
+        )
+
+    return documents

blueprints/users/__init__.py

@@ -7,7 +7,9 @@ from quart_jwt_extended import (
 )
 from .models import User
 from .oidc_service import OIDCUserService
-from oidc_config import oidc_config
+from .decorators import admin_required
+from config.oidc_config import oidc_config
+import os
 import secrets
 import httpx
 from urllib.parse import urlencode
@@ -60,7 +62,7 @@ async def oidc_login():
             "client_id": oidc_config.client_id,
             "response_type": "code",
             "redirect_uri": oidc_config.redirect_uri,
-            "scope": "openid email profile",
+            "scope": "openid email profile groups",
             "state": state,
             "code_challenge": code_challenge,
             "code_challenge_method": "S256",
@@ -115,7 +117,9 @@ async def oidc_callback():
         token_response = await client.post(token_endpoint, data=token_data)
 
         if token_response.status_code != 200:
-            return jsonify({"error": f"Failed to exchange code for token: {token_response.text}"}), 400
+            return jsonify(
+                {"error": f"Failed to exchange code for token: {token_response.text}"}
+            ), 400
 
         tokens = token_response.json()
 
@@ -129,6 +133,21 @@ async def oidc_callback():
     except Exception as e:
         return jsonify({"error": f"ID token verification failed: {str(e)}"}), 400
 
+    # Fetch userinfo to get groups (older Authelia versions only include groups there)
+    userinfo_endpoint = discovery.get("userinfo_endpoint")
+    if userinfo_endpoint:
+        access_token_str = tokens.get("access_token")
+        if access_token_str:
+            async with httpx.AsyncClient() as client:
+                userinfo_response = await client.get(
+                    userinfo_endpoint,
+                    headers={"Authorization": f"Bearer {access_token_str}"},
+                )
+                if userinfo_response.status_code == 200:
+                    userinfo = userinfo_response.json()
+                    if "groups" in userinfo and "groups" not in claims:
+                        claims["groups"] = userinfo["groups"]
+
     # Get or create user from OIDC claims
     user = await OIDCUserService.get_or_create_user_from_oidc(claims)
 
@@ -141,7 +160,13 @@ async def oidc_callback():
     return jsonify(
         access_token=access_token,
         refresh_token=refresh_token,
-        user={"id": str(user.id), "username": user.username, "email": user.email},
+        user={
+            "id": str(user.id),
+            "username": user.username,
+            "email": user.email,
+            "groups": user.ldap_groups,
+            "is_admin": user.is_admin(),
+        },
     )
 
 
@@ -178,3 +203,122 @@ async def login():
         refresh_token=refresh_token,
         user={"id": str(user.id), "username": user.username},
     )
+
+
+@user_blueprint.route("/me", methods=["GET"])
+@jwt_refresh_token_required
+async def me():
+    user_id = get_jwt_identity()
+    user = await User.get_or_none(id=user_id)
+    if not user:
+        return jsonify({"error": "User not found"}), 404
+    return jsonify({
+        "id": str(user.id),
+        "username": user.username,
+        "email": user.email,
+        "is_admin": user.is_admin(),
+    })
+
+
+@user_blueprint.route("/admin/users", methods=["GET"])
+@admin_required
+async def list_users():
+    from blueprints.email.helpers import get_user_email_address
+    users = await User.all().order_by("username")
+    mailgun_domain = os.getenv("MAILGUN_DOMAIN", "")
+    return jsonify([
+        {
+            "id": str(u.id),
+            "username": u.username,
+            "email": u.email,
+            "whatsapp_number": u.whatsapp_number,
+            "auth_provider": u.auth_provider,
+            "email_enabled": u.email_enabled,
+            "email_address": get_user_email_address(u.email_hmac_token, mailgun_domain) if u.email_hmac_token and u.email_enabled else None,
+        }
+        for u in users
+    ])
+
+
+@user_blueprint.route("/admin/users/<user_id>/whatsapp", methods=["PUT"])
+@admin_required
+async def set_whatsapp(user_id):
+    data = await request.get_json()
+    number = (data or {}).get("whatsapp_number", "").strip()
+    if not number:
+        return jsonify({"error": "whatsapp_number is required"}), 400
+
+    user = await User.get_or_none(id=user_id)
+    if not user:
+        return jsonify({"error": "User not found"}), 404
+
+    conflict = await User.filter(whatsapp_number=number).exclude(id=user_id).first()
+    if conflict:
+        return jsonify({"error": "That WhatsApp number is already linked to another account"}), 409
+
+    user.whatsapp_number = number
+    await user.save()
+    return jsonify({
+        "id": str(user.id),
+        "username": user.username,
+        "email": user.email,
+        "whatsapp_number": user.whatsapp_number,
+        "auth_provider": user.auth_provider,
+    })
+
+
+@user_blueprint.route("/admin/users/<user_id>/whatsapp", methods=["DELETE"])
+@admin_required
+async def unlink_whatsapp(user_id):
+    user = await User.get_or_none(id=user_id)
+    if not user:
+        return jsonify({"error": "User not found"}), 404
+
+    user.whatsapp_number = None
+    await user.save()
+    return jsonify({"ok": True})
+
+
+@user_blueprint.route("/admin/users/<user_id>/email", methods=["PUT"])
+@admin_required
+async def toggle_email(user_id):
+    """Enable email channel for a user, generating an HMAC token."""
+    from blueprints.email.helpers import generate_email_token, get_user_email_address
+    user = await User.get_or_none(id=user_id)
+    if not user:
+        return jsonify({"error": "User not found"}), 404
+
+    email_secret = os.getenv("EMAIL_HMAC_SECRET")
+    if not email_secret:
+        return jsonify({"error": "EMAIL_HMAC_SECRET not configured"}), 500
+
+    mailgun_domain = os.getenv("MAILGUN_DOMAIN", "")
+
+    if not user.email_hmac_token:
+        user.email_hmac_token = generate_email_token(user.id, email_secret)
+    user.email_enabled = True
+    await user.save()
+
+    return jsonify({
+        "id": str(user.id),
+        "username": user.username,
+        "email": user.email,
+        "whatsapp_number": user.whatsapp_number,
+        "auth_provider": user.auth_provider,
+        "email_enabled": user.email_enabled,
+        "email_address": get_user_email_address(user.email_hmac_token, mailgun_domain),
+    })
+
+
+@user_blueprint.route("/admin/users/<user_id>/email", methods=["DELETE"])
+@admin_required
+async def disable_email(user_id):
+    """Disable email channel and clear the token."""
+    user = await User.get_or_none(id=user_id)
+    if not user:
+        return jsonify({"error": "User not found"}), 404
+
+    user.email_enabled = False
+    user.email_hmac_token = None
+    await user.save()
+    return jsonify({"ok": True})

blueprints/users/decorators.py

@@ -0,0 +1,26 @@
+"""
+Authentication decorators for role-based access control.
+"""
+
+from functools import wraps
+from quart import jsonify
+from quart_jwt_extended import jwt_refresh_token_required, get_jwt_identity
+from .models import User
+
+
+def admin_required(fn):
+    """
+    Decorator that requires the user to be an admin (member of lldap_admin group).
+    Must be used on async route handlers.
+    """
+
+    @wraps(fn)
+    @jwt_refresh_token_required
+    async def wrapper(*args, **kwargs):
+        user_id = get_jwt_identity()
+        user = await User.get_or_none(id=user_id)
+        if not user or not user.is_admin():
+            return jsonify({"error": "Admin access required"}), 403
+        return await fn(*args, **kwargs)
+
+    return wrapper

blueprints/users/models.py

@@ -0,0 +1,51 @@
+from tortoise.models import Model
+from tortoise import fields
+
+
+import bcrypt
+
+
+class User(Model):
+    id = fields.UUIDField(primary_key=True)
+    username = fields.CharField(max_length=255)
+    password = fields.BinaryField(null=True)  # Hashed - nullable for OIDC users
+    email = fields.CharField(max_length=100, unique=True)
+    whatsapp_number = fields.CharField(max_length=30, unique=True, null=True, index=True)
+
+    # Email channel fields
+    email_enabled = fields.BooleanField(default=False)
+    email_hmac_token = fields.CharField(max_length=16, unique=True, null=True, index=True)
+
+    # OIDC fields
+    oidc_subject = fields.CharField(
+        max_length=255, unique=True, null=True, index=True
+    )  # "sub" claim from OIDC
+    auth_provider = fields.CharField(
+        max_length=50, default="local"
+    )  # "local" or "oidc"
+    ldap_groups = fields.JSONField(default=[])  # LDAP groups from OIDC claims
+
+    created_at = fields.DatetimeField(auto_now_add=True)
+    updated_at = fields.DatetimeField(auto_now=True)
+
+    class Meta:
+        table = "users"
+
+    def has_group(self, group: str) -> bool:
+        """Check if user belongs to a specific LDAP group."""
+        return group in (self.ldap_groups or [])
+
+    def is_admin(self) -> bool:
+        """Check if user is an admin (member of lldap_admin group)."""
+        return self.has_group("lldap_admin")
+
+    def set_password(self, plain_password: str):
+        self.password = bcrypt.hashpw(
+            plain_password.encode("utf-8"),
+            bcrypt.gensalt(),
+        )
+
+    def verify_password(self, plain_password: str):
+        if not self.password:
+            return False
+        return bcrypt.checkpw(plain_password.encode("utf-8"), self.password)

blueprints/users/oidc_service.py

@@ -1,6 +1,7 @@
 """
 OIDC User Management Service
 """
+
 from typing import Dict, Any, Optional
 from uuid import uuid4
 from .models import User
@@ -31,10 +32,10 @@ class OIDCUserService:
             # Update user info from latest claims (optional)
             user.email = claims.get("email", user.email)
             user.username = (
-                claims.get("preferred_username")
+                claims.get("preferred_username") or claims.get("name") or user.username
-                or claims.get("name")
-                or user.username
             )
+            # Update LDAP groups from claims
+            user.ldap_groups = claims.get("groups", [])
             await user.save()
             return user
 
@@ -47,6 +48,7 @@ class OIDCUserService:
                 user.oidc_subject = oidc_subject
                 user.auth_provider = "oidc"
                 user.password = None  # Clear password
+                user.ldap_groups = claims.get("groups", [])
                 await user.save()
                 return user
 
@@ -58,14 +60,17 @@ class OIDCUserService:
             or f"user_{oidc_subject[:8]}"
         )
 
+        # Extract LDAP groups from claims
+        groups = claims.get("groups", [])
+
         user = await User.create(
             id=uuid4(),
             username=username,
-            email=email
+            email=email or f"{oidc_subject}@oidc.local",  # Fallback if no email claim
-            or f"{oidc_subject}@oidc.local",  # Fallback if no email claim
             oidc_subject=oidc_subject,
             auth_provider="oidc",
             password=None,
+            ldap_groups=groups,
         )
 
         return user

blueprints/whatsapp/__init__.py

@@ -0,0 +1,212 @@
+import os
+import logging
+import asyncio
+import functools
+import time
+from collections import defaultdict
+from quart import Blueprint, request, jsonify, abort
+from twilio.request_validator import RequestValidator
+from twilio.twiml.messaging_response import MessagingResponse
+
+from blueprints.users.models import User
+from blueprints.conversation.logic import (
+    get_conversation_for_user,
+    add_message_to_conversation,
+    get_conversation_transcript,
+)
+from blueprints.conversation.agents import main_agent
+from blueprints.conversation.prompts import SIMBA_SYSTEM_PROMPT
+
+whatsapp_blueprint = Blueprint("whatsapp_api", __name__, url_prefix="/api/whatsapp")
+
+# Configure logging
+logger = logging.getLogger(__name__)
+
+# Rate limiting: per-number message timestamps
+# Format: {phone_number: [timestamp1, timestamp2, ...]}
+_rate_limit_store: dict[str, list[float]] = defaultdict(list)
+
+# Configurable via env: max messages per window (default: 10 per 60s)
+RATE_LIMIT_MAX = int(os.getenv("WHATSAPP_RATE_LIMIT_MAX", "10"))
+RATE_LIMIT_WINDOW = int(os.getenv("WHATSAPP_RATE_LIMIT_WINDOW", "60"))
+
+# Max message length to process (WhatsApp max is 4096, but we cap for LLM sanity)
+MAX_MESSAGE_LENGTH = 2000
+
+
+def _twiml_response(text: str) -> tuple[str, int]:
+    """Helper to return a TwiML MessagingResponse."""
+    resp = MessagingResponse()
+    resp.message(text)
+    return str(resp), 200
+
+
+def _check_rate_limit(phone_number: str) -> bool:
+    """Check if a phone number has exceeded the rate limit.
+
+    Returns True if the request is allowed, False if rate-limited.
+    Also cleans up expired entries.
+    """
+    now = time.monotonic()
+    cutoff = now - RATE_LIMIT_WINDOW
+
+    # Remove expired timestamps
+    timestamps = _rate_limit_store[phone_number]
+    _rate_limit_store[phone_number] = [t for t in timestamps if t > cutoff]
+
+    if len(_rate_limit_store[phone_number]) >= RATE_LIMIT_MAX:
+        return False
+
+    _rate_limit_store[phone_number].append(now)
+    return True
+
+
+def validate_twilio_request(f):
+    """Decorator to validate that the request comes from Twilio.
+
+    Validates the X-Twilio-Signature header using the TWILIO_AUTH_TOKEN.
+    Set TWILIO_WEBHOOK_URL if behind a reverse proxy (e.g., ngrok, Caddy)
+    so the validated URL matches what Twilio signed against.
+    Set TWILIO_SIGNATURE_VALIDATION=false to disable in development.
+    """
+    @functools.wraps(f)
+    async def decorated_function(*args, **kwargs):
+        if os.getenv("TWILIO_SIGNATURE_VALIDATION", "true").lower() == "false":
+            return await f(*args, **kwargs)
+
+        auth_token = os.getenv("TWILIO_AUTH_TOKEN")
+        if not auth_token:
+            logger.error("TWILIO_AUTH_TOKEN not set — rejecting request")
+            abort(403)
+
+        twilio_signature = request.headers.get("X-Twilio-Signature")
+        if not twilio_signature:
+            logger.warning("Missing X-Twilio-Signature header")
+            abort(403)
+
+        # Use configured webhook URL if behind a proxy, otherwise use request URL
+        url = os.getenv("TWILIO_WEBHOOK_URL") or request.url
+        form_data = await request.form
+
+        validator = RequestValidator(auth_token)
+        if not validator.validate(url, form_data, twilio_signature):
+            logger.warning(f"Invalid Twilio signature for URL: {url}")
+            abort(403)
+
+        return await f(*args, **kwargs)
+    return decorated_function
+
+
+@whatsapp_blueprint.route("/webhook", methods=["POST"])
+@validate_twilio_request
+async def webhook():
+    """
+    Handle incoming WhatsApp messages from Twilio.
+    """
+    form_data = await request.form
+    from_number = form_data.get("From") # e.g., "whatsapp:+1234567890"
+    body = form_data.get("Body")
+
+    if not from_number or not body:
+        return _twiml_response("Invalid message received.") if from_number else ("Missing From or Body", 400)
+
+    # Strip whitespace and check for empty body
+    body = body.strip()
+    if not body:
+        return _twiml_response("I received an empty message. Please send some text!")
+
+    # Rate limiting
+    if not _check_rate_limit(from_number):
+        logger.warning(f"Rate limit exceeded for {from_number}")
+        return _twiml_response("You're sending messages too quickly. Please wait a moment and try again.")
+
+    # Truncate overly long messages
+    if len(body) > MAX_MESSAGE_LENGTH:
+        body = body[:MAX_MESSAGE_LENGTH]
+        logger.info(f"Truncated long message from {from_number} to {MAX_MESSAGE_LENGTH} chars")
+
+    logger.info(f"Received WhatsApp message from {from_number}: {body[:100]}")
+
+    # Identify or create user
+    user = await User.filter(whatsapp_number=from_number).first()
+
+    if not user:
+        # Check if number is in allowlist
+        allowed_numbers = os.getenv("ALLOWED_WHATSAPP_NUMBERS", "").split(",")
+        if from_number not in allowed_numbers and "*" not in allowed_numbers:
+            return _twiml_response("Sorry, you are not authorized to use this service.")
+
+        # Create a new user for this WhatsApp number
+        username = f"wa_{from_number.split(':')[-1]}"
+        try:
+            user = await User.create(
+                username=username,
+                email=f"{username}@whatsapp.simbarag.local",
+                whatsapp_number=from_number,
+                auth_provider="whatsapp"
+            )
+            logger.info(f"Created new user for WhatsApp: {username}")
+        except Exception as e:
+            logger.error(f"Failed to create user for {from_number}: {e}")
+            return _twiml_response("Sorry, something went wrong setting up your account. Please try again later.")
+
+    # Get or create a conversation for this user
+    try:
+        conversation = await get_conversation_for_user(user=user)
+        await conversation.fetch_related("messages")
+    except Exception as e:
+        logger.error(f"Failed to get conversation for user {user.username}: {e}")
+        return _twiml_response("Sorry, something went wrong. Please try again later.")
+
+    # Add user message to conversation
+    await add_message_to_conversation(
+        conversation=conversation,
+        message=body,
+        speaker="user",
+        user=user,
+    )
+
+    # Get transcript for context
+    transcript = await get_conversation_transcript(user=user, conversation=conversation)
+
+    # Build messages payload for LangChain agent with system prompt and conversation history
+    try:
+        # Get last 10 messages for conversation history
+        messages = await conversation.messages.all()
+        recent_messages = list(messages)[-10:]
+
+        # Build messages payload
+        messages_payload = [{"role": "system", "content": SIMBA_SYSTEM_PROMPT}]
+
+        # Add recent conversation history (exclude the message we just added)
+        for msg in recent_messages[:-1]:
+            role = "user" if msg.speaker == "user" else "assistant"
+            messages_payload.append({"role": role, "content": msg.text})
+
+        # Add current query
+        messages_payload.append({"role": "user", "content": body})
+
+        # Invoke LangChain agent
+        logger.info(f"Invoking LangChain agent with {len(messages_payload)} messages")
+        response = await main_agent.ainvoke({"messages": messages_payload})
+        response_text = response.get("messages", [])[-1].content
+
+        # Log YNAB availability
+        if os.getenv("YNAB_ACCESS_TOKEN"):
+            logger.info("YNAB integration is available for this conversation")
+        else:
+            logger.info("YNAB integration is not configured")
+
+    except Exception as e:
+        logger.error(f"Error invoking agent: {e}")
+        response_text = "Sorry, I'm having trouble thinking right now. 😿"
+
+    # Add Simba's response to conversation
+    await add_message_to_conversation(
+        conversation=conversation,
+        message=response_text,
+        speaker="simba",
+        user=user,
+    )
+
+    return _twiml_response(response_text)

config/db.py

@@ -1,11 +1,14 @@
 import os
 
-# Database configuration with environment variable support
+from dotenv import load_dotenv
-# Use DATABASE_PATH for relative paths or DATABASE_URL for full connection strings
-DATABASE_PATH = os.getenv("DATABASE_PATH", "database/raggr.db")
-DATABASE_URL = os.getenv("DATABASE_URL", f"sqlite://{DATABASE_PATH}")
 
-TORTOISE_ORM = {
+load_dotenv()
+
+DATABASE_URL = os.getenv(
+    "DATABASE_URL", "postgres://raggr:raggr_dev_password@localhost:5432/raggr"
+)
+
+TORTOISE_CONFIG = {
     "connections": {"default": DATABASE_URL},
     "apps": {
         "models": {

config/oidc_config.py

@@ -1,11 +1,16 @@
 """
 OIDC Configuration for Authelia Integration
 """
+
 import os
 from typing import Dict, Any
 from authlib.jose import jwt
 from authlib.jose.errors import JoseError
 import httpx
+from dotenv import load_dotenv
+
+# Load environment variables
+load_dotenv()
 
 
 class OIDCConfig:

docker-compose.dev.yml

@@ -1,102 +0,0 @@
-services:
-  postgres:
-    image: postgres:16-alpine
-    environment:
-      - POSTGRES_USER=raggr
-      - POSTGRES_PASSWORD=raggr_dev_password
-      - POSTGRES_DB=raggr
-    ports:
-      - "5432:5432"
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U raggr"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-
-  raggr-backend:
-    build:
-      context: ./services/raggr
-      dockerfile: Dockerfile.dev
-    image: torrtle/simbarag:dev
-    ports:
-      - "8080:8080"
-    env_file:
-      - .env
-    environment:
-      - PAPERLESS_TOKEN=${PAPERLESS_TOKEN}
-      - BASE_URL=${BASE_URL}
-      - OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
-      - CHROMADB_PATH=/app/chromadb
-      - OPENAI_API_KEY=${OPENAI_API_KEY}
-      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
-      - OIDC_ISSUER=${OIDC_ISSUER}
-      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
-      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
-      - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI}
-      - OIDC_USE_DISCOVERY=${OIDC_USE_DISCOVERY:-true}
-      - DATABASE_URL=postgres://raggr:raggr_dev_password@postgres:5432/raggr
-      - FLASK_ENV=development
-      - PYTHONUNBUFFERED=1
-    depends_on:
-      postgres:
-        condition: service_healthy
-    volumes:
-      # Persist data only
-      - chromadb_data:/app/chromadb
-      # Share frontend dist with frontend container
-      - frontend_dist:/app/raggr-frontend/dist
-    develop:
-      watch:
-        # Sync Python source files
-        - action: sync
-          path: ./services/raggr
-          target: /app
-          ignore:
-            - raggr-frontend/
-            - __pycache__/
-            - "*.pyc"
-            - "*.pyo"
-            - "*.pyd"
-            - .git/
-            - chromadb/
-        # Sync+restart on frontend dist changes
-        - action: sync+restart
-          path: ./services/raggr/raggr-frontend/dist
-          target: /app/raggr-frontend/dist
-        # Restart on dependency changes
-        - action: rebuild
-          path: ./services/raggr/pyproject.toml
-        - action: rebuild
-          path: ./services/raggr/uv.lock
-
-  raggr-frontend:
-    build:
-      context: ./services/raggr/raggr-frontend
-      dockerfile: Dockerfile.dev
-    environment:
-      - NODE_ENV=development
-    volumes:
-      # Share dist folder with backend
-      - frontend_dist:/app/dist
-    develop:
-      watch:
-        # Sync frontend source files
-        - action: sync
-          path: ./services/raggr/raggr-frontend
-          target: /app
-          ignore:
-            - node_modules/
-            - dist/
-            - .git/
-        # Rebuild on dependency changes
-        - action: rebuild
-          path: ./services/raggr/raggr-frontend/package.json
-        - action: rebuild
-          path: ./services/raggr/raggr-frontend/yarn.lock
-
-volumes:
-  chromadb_data:
-  postgres_data:
-  frontend_dist:

docker-compose.yml

@@ -3,6 +3,8 @@ version: "3.8"
 services:
   postgres:
     image: postgres:16-alpine
+    ports:
+      - "5432:5432"
     environment:
       - POSTGRES_USER=${POSTGRES_USER:-raggr}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-changeme}
@@ -18,28 +20,53 @@ services:
 
   raggr:
     build:
-      context: ./services/raggr
+      context: .
       dockerfile: Dockerfile
     image: torrtle/simbarag:latest
-    network_mode: host
+    ports:
+      - "8080:8080"
     environment:
       - PAPERLESS_TOKEN=${PAPERLESS_TOKEN}
       - BASE_URL=${BASE_URL}
       - OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
-      - CHROMADB_PATH=/app/chromadb
+      - CHROMADB_PATH=/app/data/chromadb
       - OPENAI_API_KEY=${OPENAI_API_KEY}
       - JWT_SECRET_KEY=${JWT_SECRET_KEY}
+      - LLAMA_SERVER_URL=${LLAMA_SERVER_URL}
+      - LLAMA_MODEL_NAME=${LLAMA_MODEL_NAME}
       - OIDC_ISSUER=${OIDC_ISSUER}
       - OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
       - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
       - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI}
       - OIDC_USE_DISCOVERY=${OIDC_USE_DISCOVERY:-true}
       - DATABASE_URL=${DATABASE_URL:-postgres://raggr:changeme@postgres:5432/raggr}
+      - TAVILY_API_KEY=${TAVILIY_API_KEY}
+      - YNAB_ACCESS_TOKEN=${YNAB_ACCESS_TOKEN}
+      - YNAB_BUDGET_ID=${YNAB_BUDGET_ID}
+      - TWILIO_ACCOUNT_SID=${TWILIO_ACCOUNT_SID}
+      - TWILIO_AUTH_TOKEN=${TWILIO_AUTH_TOKEN}
+      - TWILIO_WHATSAPP_NUMBER=${TWILIO_WHATSAPP_NUMBER}
+      - ALLOWED_WHATSAPP_NUMBERS=${ALLOWED_WHATSAPP_NUMBERS}
+      - TWILIO_SIGNATURE_VALIDATION=${TWILIO_SIGNATURE_VALIDATION:-true}
+      - TWILIO_WEBHOOK_URL=${TWILIO_WEBHOOK_URL:-}
+      - OBSIDIAN_AUTH_TOKEN=${OBSIDIAN_AUTH_TOKEN}
+      - OBSIDIAN_VAULT_ID=${OBSIDIAN_VAULT_ID}
+      - OBSIDIAN_E2E_PASSWORD=${OBSIDIAN_E2E_PASSWORD}
+      - OBSIDIAN_DEVICE_NAME=${OBSIDIAN_DEVICE_NAME}
+      - OBSIDIAN_CONTINUOUS_SYNC=${OBSIDIAN_CONTINUOUS_SYNC:-false}
+      - OBSIDIAN_VAULT_PATH=${OBSIDIAN_VAULT_PATH:-/app/data/obsidian}
+      - S3_ENDPOINT_URL=${S3_ENDPOINT_URL}
+      - S3_ACCESS_KEY_ID=${S3_ACCESS_KEY_ID}
+      - S3_SECRET_ACCESS_KEY=${S3_SECRET_ACCESS_KEY}
+      - S3_BUCKET_NAME=${S3_BUCKET_NAME:-asksimba-images}
+      - S3_REGION=${S3_REGION:-garage}
+      - OLLAMA_HOST=${OLLAMA_HOST:-http://localhost:11434}
     depends_on:
       postgres:
         condition: service_healthy
     volumes:
-      - chromadb_data:/app/chromadb
+      - chromadb_data:/app/data/chromadb
+      - ./obvault:/app/data/obsidian
     restart: unless-stopped
 
 volumes:

docs/TASKS.md

@@ -0,0 +1,53 @@
+# Tasks & Feature Requests
+
+## Feature Requests
+
+### YNAB Integration (Admin-Only)
+- **Description**: Integration with YNAB (You Need A Budget) API to enable financial data queries and insights
+- **Requirements**:
+  - Admin-guarded endpoint (requires `lldap_admin` group)
+  - YNAB API token configuration in environment variables
+  - Sync budget data, transactions, and categories
+  - Store YNAB data for RAG queries
+- **Endpoints**:
+  - `POST /api/admin/ynab/sync` - Trigger YNAB data sync
+  - `GET /api/admin/ynab/status` - Check sync status and last update
+  - `GET /api/admin/ynab/budgets` - List available budgets
+- **Implementation Notes**:
+  - Use YNAB API v1 (https://api.youneedabudget.com/v1)
+  - Consider rate limiting (200 requests per hour)
+  - Store transaction data in PostgreSQL with appropriate indexing
+  - Index transaction descriptions and categories in ChromaDB for RAG queries
+
+### Money Insights
+- **Description**: AI-powered financial insights and analysis based on YNAB data
+- **Features**:
+  - Spending pattern analysis
+  - Budget vs. actual comparisons
+  - Category-based spending trends
+  - Anomaly detection (unusual transactions)
+  - Natural language queries like "How much did I spend on groceries last month?"
+  - Month-over-month and year-over-year comparisons
+- **Implementation Notes**:
+  - Leverage existing LangChain agent architecture
+  - Add custom tools for financial calculations
+  - Use LLM to generate insights and summaries
+  - Create visualizations or data exports for frontend display
+
+## Backlog
+
+- [ ] YNAB API client module
+- [ ] YNAB data models (Budget, Transaction, Category, Account)
+- [ ] Database schema for financial data
+- [ ] YNAB sync background job/scheduler
+- [ ] Financial insights LangChain tools
+- [ ] Admin UI for YNAB configuration
+- [ ] Frontend components for money insights display
+
+## Technical Debt
+
+_To be added_
+
+## Bugs
+
+_To be added_

docs/VECTORSTORE.md

@@ -0,0 +1,97 @@
+# Vector Store Management
+
+This document describes how to manage the ChromaDB vector store used for RAG (Retrieval-Augmented Generation).
+
+## Configuration
+
+The vector store location is controlled by the `CHROMADB_PATH` environment variable:
+
+- **Development (local)**: Set in `.env` to a local path (e.g., `/path/to/chromadb`)
+- **Docker**: Automatically set to `/app/data/chromadb` and persisted via Docker volume
+
+## Management Commands
+
+### CLI (Command Line)
+
+Use the `scripts/manage_vectorstore.py` script for vector store operations:
+
+```bash
+# Show statistics
+python scripts/manage_vectorstore.py stats
+
+# Index documents from Paperless-NGX (incremental)
+python scripts/manage_vectorstore.py index
+
+# Clear and reindex all documents
+python scripts/manage_vectorstore.py reindex
+
+# List documents
+python scripts/manage_vectorstore.py list 10
+python scripts/manage_vectorstore.py list 20 --show-content
+```
+
+### Docker
+
+Run commands inside the Docker container:
+
+```bash
+# Show statistics
+docker compose exec raggr python scripts/manage_vectorstore.py stats
+
+# Reindex all documents
+docker compose exec raggr python scripts/manage_vectorstore.py reindex
+```
+
+### API Endpoints
+
+The following authenticated endpoints are available:
+
+- `GET /api/rag/stats` - Get vector store statistics
+- `POST /api/rag/index` - Trigger indexing of new documents
+- `POST /api/rag/reindex` - Clear and reindex all documents
+
+## How It Works
+
+1. **Document Fetching**: Documents are fetched from Paperless-NGX via the API
+2. **Chunking**: Documents are split into chunks of ~1000 characters with 200 character overlap
+3. **Embedding**: Chunks are embedded using OpenAI's `text-embedding-3-large` model
+4. **Storage**: Embeddings are stored in ChromaDB with metadata (filename, document type, date)
+5. **Retrieval**: User queries are embedded and similar chunks are retrieved for RAG
+
+## Troubleshooting
+
+### "Error creating hnsw segment reader"
+
+This indicates a corrupted index. Solution:
+
+```bash
+python scripts/manage_vectorstore.py reindex
+```
+
+### Empty results
+
+Check if documents are indexed:
+
+```bash
+python scripts/manage_vectorstore.py stats
+```
+
+If count is 0, run:
+
+```bash
+python scripts/manage_vectorstore.py index
+```
+
+### Different results in Docker vs local
+
+Docker and local environments use separate ChromaDB instances. To sync:
+
+1. Index inside Docker: `docker compose exec raggr python scripts/manage_vectorstore.py reindex`
+2. Or mount the same volume for both environments
+
+## Production Considerations
+
+1. **Volume Persistence**: Use Docker volumes or persistent storage for ChromaDB
+2. **Backup**: Regularly backup the ChromaDB data directory
+3. **Reindexing**: Schedule periodic reindexing to keep data fresh
+4. **Monitoring**: Monitor the `/api/rag/stats` endpoint for document counts

docs/authentication.md

@@ -0,0 +1,274 @@
+# Authentication Architecture
+
+This document describes the authentication stack for SimbaRAG: LLDAP → Authelia → OAuth2/OIDC.
+
+## Overview
+
+```
+┌─────────┐     ┌──────────┐     ┌──────────────┐     ┌──────────┐
+│  LLDAP  │────▶│ Authelia │────▶│ OAuth2/OIDC  │────▶│ SimbaRAG │
+│ (Users) │     │  (IdP)   │     │   (Flow)     │     │  (App)   │
+└─────────┘     └──────────┘     └──────────────┘     └──────────┘
+```
+
+| Component | Role |
+|-----------|------|
+| **LLDAP** | Lightweight LDAP server storing users and groups |
+| **Authelia** | Identity provider that authenticates against LLDAP and issues OIDC tokens |
+| **SimbaRAG** | Relying party that consumes OIDC tokens and manages sessions |
+
+## OIDC Configuration
+
+### Environment Variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `OIDC_ISSUER` | Authelia server URL | Required |
+| `OIDC_CLIENT_ID` | Client ID registered in Authelia | Required |
+| `OIDC_CLIENT_SECRET` | Client secret for token exchange | Required |
+| `OIDC_REDIRECT_URI` | Callback URL after authentication | Required |
+| `OIDC_USE_DISCOVERY` | Enable automatic discovery | `true` |
+| `JWT_SECRET_KEY` | Secret for signing backend JWTs | Required |
+
+### Discovery
+
+When `OIDC_USE_DISCOVERY=true`, the application fetches endpoints from:
+
+```
+{OIDC_ISSUER}/.well-known/openid-configuration
+```
+
+This provides:
+
+- Authorization endpoint
+- Token endpoint
+- JWKS URI for signature verification
+- Supported scopes and claims
+
+## Authentication Flow
+
+### 1. Login Initiation
+
+```
+GET /api/user/oidc/login
+```
+
+1. Generate PKCE code verifier and challenge (S256)
+2. Generate CSRF state token
+3. Store state in session storage
+4. Return authorization URL for frontend redirect
+
+### 2. Authorization
+
+User is redirected to Authelia where they:
+
+1. Enter LDAP credentials
+2. Complete MFA if configured
+3. Consent to requested scopes
+
+### 3. Callback
+
+```
+GET /api/user/oidc/callback?code=...&state=...
+```
+
+1. Validate state matches stored value (CSRF protection)
+2. Exchange authorization code for tokens using PKCE verifier
+3. Verify ID token signature using JWKS
+4. Validate claims (issuer, audience, expiration)
+5. Create or update user in database
+6. Issue backend JWT tokens (access + refresh)
+
+### 4. Token Refresh
+
+```
+POST /api/user/refresh
+Authorization: Bearer <refresh_token>
+```
+
+Issues a new access token without re-authentication.
+
+## User Model
+
+```python
+class User(Model):
+    id = UUIDField(primary_key=True)
+    username = CharField(max_length=255)
+    password = BinaryField(null=True)  # Nullable for OIDC-only users
+    email = CharField(max_length=100, unique=True)
+
+    # OIDC fields
+    oidc_subject = CharField(max_length=255, unique=True, null=True)
+    auth_provider = CharField(max_length=50, default="local")  # "local" or "oidc"
+    ldap_groups = JSONField(default=[])  # LDAP groups from OIDC claims
+
+    created_at = DatetimeField(auto_now_add=True)
+    updated_at = DatetimeField(auto_now=True)
+
+    def has_group(self, group: str) -> bool:
+        """Check if user belongs to a specific LDAP group."""
+        return group in (self.ldap_groups or [])
+
+    def is_admin(self) -> bool:
+        """Check if user is an admin (member of lldap_admin group)."""
+        return self.has_group("lldap_admin")
+```
+
+### User Provisioning
+
+The `OIDCUserService` handles automatic user creation:
+
+1. Extract claims from ID token (`sub`, `email`, `preferred_username`)
+2. Check if user exists by `oidc_subject`
+3. If not, check by email for migration from local auth
+4. Create new user or update existing
+
+## JWT Tokens
+
+Backend issues its own JWTs after OIDC authentication:
+
+| Token Type | Purpose | Typical Lifetime |
+|------------|---------|------------------|
+| Access Token | API authorization | 15 minutes |
+| Refresh Token | Obtain new access tokens | 7 days |
+
+### Claims
+
+```json
+{
+  "identity": "<user-uuid>",
+  "type": "access|refresh",
+  "exp": 1234567890,
+  "iat": 1234567890
+}
+```
+
+## Protected Endpoints
+
+All API endpoints use the `@jwt_refresh_token_required` decorator for basic authentication:
+
+```python
+@blueprint.route("/example")
+@jwt_refresh_token_required
+async def protected_endpoint():
+    user_id = get_jwt_identity()
+    # ...
+```
+
+---
+
+## Role-Based Access Control (RBAC)
+
+RBAC is implemented using LDAP groups passed through Authelia as OIDC claims. Users in the `lldap_admin` group have admin privileges.
+
+### Architecture
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                        LLDAP                                │
+│  Groups: lldap_admin, lldap_user                           │
+└─────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌─────────────────────────────────────────────────────────────┐
+│                       Authelia                              │
+│  Scope: groups → Claim: groups = ["lldap_admin"]           │
+└─────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌─────────────────────────────────────────────────────────────┐
+│                       SimbaRAG                              │
+│  1. Extract groups from ID token                            │
+│  2. Store in User.ldap_groups                               │
+│  3. Check membership with @admin_required decorator         │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Authelia Configuration
+
+Ensure Authelia is configured to pass the `groups` claim:
+
+```yaml
+identity_providers:
+  oidc:
+    clients:
+      - client_id: simbarag
+        scopes:
+          - openid
+          - profile
+          - email
+          - groups  # Required for RBAC
+```
+
+### Admin-Only Endpoints
+
+The `@admin_required` decorator protects privileged endpoints:
+
+```python
+from blueprints.users.decorators import admin_required
+
+@blueprint.post("/admin-action")
+@admin_required
+async def admin_only_endpoint():
+    # Only users in lldap_admin group can access
+    ...
+```
+
+**Protected endpoints:**
+
+| Endpoint | Access | Description |
+|----------|--------|-------------|
+| `POST /api/rag/index` | Admin | Trigger document indexing |
+| `POST /api/rag/reindex` | Admin | Clear and reindex all documents |
+| `GET /api/rag/stats` | All users | View vector store statistics |
+
+### User Response
+
+The OIDC callback returns group information:
+
+```json
+{
+  "access_token": "...",
+  "refresh_token": "...",
+  "user": {
+    "id": "uuid",
+    "username": "john",
+    "email": "john@example.com",
+    "groups": ["lldap_admin", "lldap_user"],
+    "is_admin": true
+  }
+}
+```
+
+---
+
+## Security Considerations
+
+### Current Gaps
+
+| Issue | Risk | Mitigation |
+|-------|------|------------|
+| In-memory session storage | State lost on restart, not scalable | Use Redis for production |
+| No token revocation | Tokens valid until expiry | Implement blacklist or short expiry |
+| No audit logging | Cannot track auth events | Add event logging |
+| Single JWT secret | Compromise affects all tokens | Rotate secrets, use asymmetric keys |
+
+### Recommendations
+
+1. **Use Redis** for OIDC state storage in production
+2. **Implement logout** with token blacklisting
+3. **Add audit logging** for authentication events
+4. **Rotate JWT secrets** regularly
+5. **Use short-lived access tokens** (15 min) with refresh
+
+---
+
+## File Reference
+
+| File | Purpose |
+|------|---------|
+| `services/raggr/oidc_config.py` | OIDC client configuration and discovery |
+| `services/raggr/blueprints/users/models.py` | User model definition with group helpers |
+| `services/raggr/blueprints/users/oidc_service.py` | User provisioning from OIDC claims |
+| `services/raggr/blueprints/users/__init__.py` | Auth endpoints and flow |
+| `services/raggr/blueprints/users/decorators.py` | Auth decorators (`@admin_required`) |

docs/deployment.md

@@ -0,0 +1,188 @@
+# Deployment & Migrations Guide
+
+This document covers database migrations and deployment workflows for SimbaRAG.
+
+## Migration Workflow
+
+Migrations are managed by [Aerich](https://github.com/tortoise/aerich), the migration tool for Tortoise ORM.
+
+### Key Principles
+
+1. **Generate migrations in Docker** - Aerich needs database access to detect schema changes
+2. **Migrations auto-apply on startup** - Both `startup.sh` and `startup-dev.sh` run `aerich upgrade`
+3. **Commit migrations to git** - Migration files must be in the repo for production deploys
+
+### Generating a New Migration
+
+#### Development (Recommended)
+
+With `docker-compose.dev.yml`, your local `services/raggr` directory is synced to the container. Migrations generated inside the container appear on your host automatically.
+
+```bash
+# 1. Start the dev environment
+docker compose -f docker-compose.dev.yml up -d
+
+# 2. Generate migration (runs inside container, syncs to host)
+docker compose -f docker-compose.dev.yml exec raggr aerich migrate --name describe_your_change
+
+# 3. Verify migration was created
+ls services/raggr/migrations/models/
+
+# 4. Commit the migration
+git add services/raggr/migrations/
+git commit -m "Add migration: describe_your_change"
+```
+
+#### Production Container
+
+For production, migration files are baked into the image. You must generate migrations in dev first.
+
+```bash
+# If you need to generate a migration from production (not recommended):
+docker compose exec raggr aerich migrate --name describe_your_change
+
+# Copy the file out of the container
+docker cp $(docker compose ps -q raggr):/app/migrations/models/ ./services/raggr/migrations/
+```
+
+### Applying Migrations
+
+Migrations apply automatically on container start via the startup scripts.
+
+**Manual application (if needed):**
+
+```bash
+# Dev
+docker compose -f docker-compose.dev.yml exec raggr aerich upgrade
+
+# Production
+docker compose exec raggr aerich upgrade
+```
+
+### Checking Migration Status
+
+```bash
+# View applied migrations
+docker compose exec raggr aerich history
+
+# View pending migrations
+docker compose exec raggr aerich heads
+```
+
+### Rolling Back
+
+```bash
+# Downgrade one migration
+docker compose exec raggr aerich downgrade
+
+# Downgrade to specific version
+docker compose exec raggr aerich downgrade -v 1
+```
+
+## Deployment Workflows
+
+### Development
+
+```bash
+# Start with watch mode (auto-restarts on file changes)
+docker compose -f docker-compose.dev.yml up
+
+# Or with docker compose watch (requires Docker Compose v2.22+)
+docker compose -f docker-compose.dev.yml watch
+```
+
+The dev environment:
+- Syncs `services/raggr/` to `/app` in the container
+- Rebuilds frontend on changes
+- Auto-applies migrations on startup
+
+### Production
+
+```bash
+# Build and deploy
+docker compose build raggr
+docker compose up -d
+
+# View logs
+docker compose logs -f raggr
+
+# Verify migrations applied
+docker compose exec raggr aerich history
+```
+
+### Fresh Deploy (New Database)
+
+On first deploy with an empty database, `startup-dev.sh` runs `aerich init-db` instead of `aerich upgrade`. This creates all tables from the current models.
+
+For production (`startup.sh`), ensure the database exists and run:
+
+```bash
+# If aerich table doesn't exist yet
+docker compose exec raggr aerich init-db
+
+# Or if migrating from existing schema
+docker compose exec raggr aerich upgrade
+```
+
+## Troubleshooting
+
+### "No migrations found" on startup
+
+The `migrations/models/` directory is empty or not copied into the image.
+
+**Fix:** Ensure migrations are committed and the Dockerfile copies them:
+```dockerfile
+COPY migrations ./migrations
+```
+
+### Migration fails with "relation already exists"
+
+The database has tables but aerich doesn't know about them (fresh aerich setup on existing DB).
+
+**Fix:** Fake the initial migration:
+```bash
+# Mark initial migration as applied without running it
+docker compose exec raggr aerich upgrade --fake
+```
+
+### Model changes not detected
+
+Aerich compares models against the last migration's state. If state is out of sync:
+
+```bash
+# Regenerate migration state (dangerous - review carefully)
+docker compose exec raggr aerich migrate --name fix_state
+```
+
+### Database connection errors
+
+Ensure PostgreSQL is healthy before running migrations:
+
+```bash
+# Check postgres status
+docker compose ps postgres
+
+# Wait for postgres then run migrations
+docker compose exec raggr bash -c "sleep 5 && aerich upgrade"
+```
+
+## File Reference
+
+| File | Purpose |
+|------|---------|
+| `pyproject.toml` | Aerich config (`[tool.aerich]` section) |
+| `migrations/models/` | Migration files |
+| `startup.sh` | Production startup (runs `aerich upgrade`) |
+| `startup-dev.sh` | Dev startup (runs `aerich upgrade` or `init-db`) |
+| `app.py` | Contains `TORTOISE_CONFIG` |
+| `aerich_config.py` | Aerich initialization configuration |
+
+## Quick Reference
+
+| Task | Command |
+|------|---------|
+| Generate migration | `docker compose -f docker-compose.dev.yml exec raggr aerich migrate --name name` |
+| Apply migrations | `docker compose exec raggr aerich upgrade` |
+| View history | `docker compose exec raggr aerich history` |
+| Rollback | `docker compose exec raggr aerich downgrade` |
+| Fresh init | `docker compose exec raggr aerich init-db` |

docs/development.md

@@ -0,0 +1,258 @@
+# Development Guide
+
+This guide explains how to run SimbaRAG in development mode.
+
+## Quick Start
+
+### Option 1: Local Development (Recommended)
+
+Run PostgreSQL in Docker and the application locally for faster iteration:
+
+```bash
+# 1. Start PostgreSQL
+docker compose -f docker-compose.dev.yml up -d
+
+# 2. Set environment variables
+export DATABASE_URL="postgres://raggr:raggr_dev_password@localhost:5432/raggr"
+export CHROMADB_PATH="./chromadb"
+export $(grep -v '^#' .env | xargs)  # Load other vars from .env
+
+# 3. Install dependencies (first time)
+pip install -r requirements.txt
+cd raggr-frontend && yarn install && yarn build && cd ..
+
+# 4. Run migrations
+aerich upgrade
+
+# 5. Start the server
+python app.py
+```
+
+The application will be available at `http://localhost:8080`.
+
+### Option 2: Full Docker Development
+
+Run everything in Docker with hot reload (slower, but matches production):
+
+```bash
+# Uncomment the raggr service in docker-compose.dev.yml first!
+
+# Start all services
+docker compose -f docker-compose.dev.yml up --build
+
+# View logs
+docker compose -f docker-compose.dev.yml logs -f raggr
+```
+
+## Project Structure
+
+```
+raggr/
+├── app.py                    # Quart application entry point
+├── main.py                   # RAG logic and LangChain agent
+├── llm.py                    # LLM client (Ollama + OpenAI fallback)
+├── aerich_config.py          # Database migration configuration
+│
+├── blueprints/               # API route blueprints
+│   ├── users/               # Authentication (OIDC, JWT, RBAC)
+│   ├── conversation/        # Chat conversations and messages
+│   └── rag/                 # Document indexing (admin only)
+│
+├── config/                   # Configuration modules
+│   └── oidc_config.py       # OIDC authentication settings
+│
+├── utils/                    # Reusable utilities
+│   ├── chunker.py           # Document chunking for embeddings
+│   ├── cleaner.py           # PDF cleaning and summarization
+│   ├── image_process.py     # Image description with LLM
+│   └── request.py           # Paperless-NGX API client
+│
+├── scripts/                  # Administrative scripts
+│   ├── add_user.py          # Create users manually
+│   ├── user_message_stats.py # User message statistics
+│   ├── manage_vectorstore.py # Vector store management
+│   ├── inspect_vector_store.py # Inspect ChromaDB contents
+│   └── query.py             # Query generation utilities
+│
+├── raggr-frontend/          # React frontend
+│   └── src/                # Frontend source code
+│
+├── migrations/              # Database migrations
+└── docs/                    # Documentation
+```
+
+## Making Changes
+
+### Backend Changes
+
+**Local development:**
+1. Edit Python files
+2. Save
+3. Restart `python app.py` (or use a tool like `watchdog` for auto-reload)
+
+**Docker development:**
+1. Edit Python files
+2. Files are synced via Docker watch mode
+3. Container automatically restarts
+
+### Frontend Changes
+
+```bash
+cd raggr-frontend
+
+# Development mode with hot reload
+yarn dev
+
+# Production build (for testing)
+yarn build
+```
+
+The backend serves built files from `raggr-frontend/dist/`.
+
+### Database Model Changes
+
+When you modify Tortoise ORM models:
+
+```bash
+# Generate migration
+aerich migrate --name "describe_your_change"
+
+# Apply migration
+aerich upgrade
+
+# View history
+aerich history
+```
+
+See [deployment.md](deployment.md) for detailed migration workflows.
+
+### Adding Dependencies
+
+**Backend:**
+```bash
+# Add to requirements.txt or use uv
+pip install package-name
+pip freeze > requirements.txt
+```
+
+**Frontend:**
+```bash
+cd raggr-frontend
+yarn add package-name
+```
+
+## Useful Commands
+
+### Database
+
+```bash
+# Connect to PostgreSQL
+docker compose -f docker-compose.dev.yml exec postgres psql -U raggr -d raggr
+
+# Reset database
+docker compose -f docker-compose.dev.yml down -v
+docker compose -f docker-compose.dev.yml up -d
+aerich init-db
+```
+
+### Vector Store
+
+```bash
+# Show statistics
+python scripts/manage_vectorstore.py stats
+
+# Index new documents from Paperless
+python scripts/manage_vectorstore.py index
+
+# Clear and reindex everything
+python scripts/manage_vectorstore.py reindex
+```
+
+See [vectorstore.md](vectorstore.md) for details.
+
+### Scripts
+
+```bash
+# Add a new user
+python scripts/add_user.py
+
+# View message statistics
+python scripts/user_message_stats.py
+
+# Inspect vector store contents
+python scripts/inspect_vector_store.py
+```
+
+## Environment Variables
+
+Copy `.env.example` to `.env` and configure:
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `DATABASE_URL` | PostgreSQL connection | `postgres://user:pass@localhost:5432/db` |
+| `CHROMADB_PATH` | ChromaDB storage path | `./chromadb` |
+| `OLLAMA_URL` | Ollama server URL | `http://localhost:11434` |
+| `OPENAI_API_KEY` | OpenAI API key (fallback LLM) | `sk-...` |
+| `PAPERLESS_TOKEN` | Paperless-NGX API token | `...` |
+| `BASE_URL` | Paperless-NGX URL | `https://paperless.example.com` |
+| `OIDC_ISSUER` | OIDC provider URL | `https://auth.example.com` |
+| `OIDC_CLIENT_ID` | OIDC client ID | `simbarag` |
+| `OIDC_CLIENT_SECRET` | OIDC client secret | `...` |
+| `JWT_SECRET_KEY` | JWT signing key | `random-secret` |
+| `TAVILY_KEY` | Tavily web search API key | `tvly-...` |
+
+## Troubleshooting
+
+### Port Already in Use
+
+```bash
+# Find and kill process on port 8080
+lsof -ti:8080 | xargs kill -9
+
+# Or change the port in app.py
+```
+
+### Database Connection Errors
+
+```bash
+# Check if PostgreSQL is running
+docker compose -f docker-compose.dev.yml ps postgres
+
+# View PostgreSQL logs
+docker compose -f docker-compose.dev.yml logs postgres
+```
+
+### Frontend Not Building
+
+```bash
+cd raggr-frontend
+rm -rf node_modules dist
+yarn install
+yarn build
+```
+
+### ChromaDB Errors
+
+```bash
+# Clear and recreate ChromaDB
+rm -rf chromadb/
+python scripts/manage_vectorstore.py reindex
+```
+
+### Import Errors After Reorganization
+
+Ensure you're in the project root directory when running scripts, or use:
+
+```bash
+# Add project root to Python path
+export PYTHONPATH="${PYTHONPATH}:$(pwd)"
+python scripts/your_script.py
+```
+
+## Hot Tips
+
+- Use `python -m pdb app.py` for debugging
+- Enable Quart debug mode in `app.py`: `app.run(debug=True)`
+- Check API logs: They appear in the terminal running `python app.py`
+- Frontend logs: Open browser DevTools console
+- Use `docker compose -f docker-compose.dev.yml down -v` for a clean slate

docs/index.md

@@ -0,0 +1,203 @@
+# SimbaRAG Documentation
+
+Welcome to the SimbaRAG documentation! This guide will help you understand, develop, and deploy the SimbaRAG conversational AI system.
+
+## Getting Started
+
+New to SimbaRAG? Start here:
+
+1. Read the main [README](../README.md) for project overview and architecture
+2. Follow the [Development Guide](development.md) to set up your environment
+3. Learn about [Authentication](authentication.md) setup with OIDC and LDAP
+
+## Documentation Structure
+
+### Core Guides
+
+- **[Development Guide](development.md)** - Local development setup, project structure, and workflows
+- **[Deployment Guide](deployment.md)** - Database migrations, deployment workflows, and troubleshooting
+- **[Vector Store Guide](VECTORSTORE.md)** - Managing ChromaDB, indexing documents, and RAG operations
+- **[Migrations Guide](MIGRATIONS.md)** - Database migration reference
+- **[Authentication Guide](authentication.md)** - OIDC, Authelia, LLDAP configuration and user management
+
+### Quick Reference
+
+| Task | Documentation |
+|------|---------------|
+| Set up local dev environment | [Development Guide → Quick Start](development.md#quick-start) |
+| Run database migrations | [Deployment Guide → Migration Workflow](deployment.md#migration-workflow) |
+| Index documents | [Vector Store Guide → Management Commands](VECTORSTORE.md#management-commands) |
+| Configure authentication | [Authentication Guide](authentication.md) |
+| Run administrative scripts | [Development Guide → Scripts](development.md#scripts) |
+
+## Common Tasks
+
+### Development
+
+```bash
+# Start local development
+docker compose -f docker-compose.dev.yml up -d
+export DATABASE_URL="postgres://raggr:raggr_dev_password@localhost:5432/raggr"
+export CHROMADB_PATH="./chromadb"
+python app.py
+```
+
+### Database Migrations
+
+```bash
+# Generate migration
+aerich migrate --name "your_change"
+
+# Apply migrations
+aerich upgrade
+
+# View history
+aerich history
+```
+
+### Vector Store Management
+
+```bash
+# Show statistics
+python scripts/manage_vectorstore.py stats
+
+# Index new documents
+python scripts/manage_vectorstore.py index
+
+# Reindex everything
+python scripts/manage_vectorstore.py reindex
+```
+
+## Architecture Overview
+
+SimbaRAG is built with:
+
+- **Backend**: Quart (async Python), LangChain, Tortoise ORM
+- **Frontend**: React 19, Rsbuild, Tailwind CSS
+- **Database**: PostgreSQL (users, conversations)
+- **Vector Store**: ChromaDB (document embeddings)
+- **LLM**: Ollama (primary), OpenAI (fallback)
+- **Auth**: Authelia (OIDC), LLDAP (user directory)
+
+See the [README](../README.md#system-architecture) for detailed architecture diagram.
+
+## Project Structure
+
+```
+simbarag/
+├── app.py                  # Quart app entry point
+├── main.py                 # RAG & LangChain agent
+├── llm.py                  # LLM client
+├── blueprints/             # API routes
+├── config/                 # Configuration
+├── utils/                  # Utilities
+├── scripts/                # Admin scripts
+├── raggr-frontend/         # React UI
+├── migrations/             # Database migrations
+├── docs/                   # This documentation
+├── docker-compose.yml      # Production Docker setup
+└── docker-compose.dev.yml  # Development Docker setup
+```
+
+## Key Concepts
+
+### RAG (Retrieval-Augmented Generation)
+
+SimbaRAG uses RAG to answer questions about Simba:
+
+1. Documents are fetched from Paperless-NGX
+2. Documents are chunked and embedded using OpenAI
+3. Embeddings are stored in ChromaDB
+4. User queries are embedded and matched against the store
+5. Relevant chunks are passed to the LLM for context
+6. LLM generates an answer using retrieved context
+
+### LangChain Agent
+
+The conversational agent has two tools:
+
+- **simba_search**: Queries the vector store for Simba's documents
+- **web_search**: Searches the web via Tavily API
+
+The agent automatically selects tools based on the query.
+
+### Authentication Flow
+
+1. User initiates OIDC login via Authelia
+2. Authelia authenticates against LLDAP
+3. Backend receives OIDC tokens and issues JWT
+4. Frontend stores JWT in localStorage
+5. Subsequent requests use JWT for authorization
+
+## Environment Variables
+
+Key environment variables (see `.env.example` for complete list):
+
+| Variable | Purpose |
+|----------|---------|
+| `DATABASE_URL` | PostgreSQL connection |
+| `CHROMADB_PATH` | Vector store location |
+| `OLLAMA_URL` | Local LLM server |
+| `OPENAI_API_KEY` | OpenAI for embeddings/fallback |
+| `PAPERLESS_TOKEN` | Document source API |
+| `OIDC_*` | Authentication configuration |
+| `TAVILY_KEY` | Web search API |
+
+## API Endpoints
+
+### Authentication
+- `GET /api/user/oidc/login` - Start OIDC flow
+- `GET /api/user/oidc/callback` - OIDC callback
+- `POST /api/user/refresh` - Refresh JWT
+
+### Conversations
+- `POST /api/conversation/` - Create conversation
+- `GET /api/conversation/` - List conversations
+- `POST /api/conversation/query` - Chat message
+
+### RAG (Admin Only)
+- `GET /api/rag/stats` - Vector store stats
+- `POST /api/rag/index` - Index documents
+- `POST /api/rag/reindex` - Reindex all
+
+## Troubleshooting
+
+### Common Issues
+
+| Issue | Solution |
+|-------|----------|
+| Port already in use | Check if services are running: `lsof -ti:8080` |
+| Database connection error | Ensure PostgreSQL is running: `docker compose ps` |
+| ChromaDB errors | Clear and reindex: `python scripts/manage_vectorstore.py reindex` |
+| Import errors | Check you're in `services/raggr/` directory |
+| Frontend not building | `cd raggr-frontend && yarn install && yarn build` |
+
+See individual guides for detailed troubleshooting.
+
+## Contributing
+
+1. Read the [Development Guide](development.md)
+2. Set up your local environment
+3. Make changes and test locally
+4. Generate migrations if needed
+5. Submit a pull request
+
+## Additional Resources
+
+- [LangChain Documentation](https://python.langchain.com/)
+- [ChromaDB Documentation](https://docs.trychroma.com/)
+- [Quart Documentation](https://quart.palletsprojects.com/)
+- [Tortoise ORM Documentation](https://tortoise.github.io/)
+- [Authelia Documentation](https://www.authelia.com/)
+
+## Need Help?
+
+- Check the relevant guide in this documentation
+- Review troubleshooting sections
+- Check application logs: `docker compose logs -f`
+- Inspect database: `docker compose exec postgres psql -U raggr`
+
+---
+
+**Documentation Version**: 1.0
+**Last Updated**: January 2026

index.html

@@ -0,0 +1,81 @@
+<!doctype html>
+
+
+<html lang="en">
+    <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+        <meta name="author" content="Paperless-ngx project and contributors">
+        <meta name="robots" content="noindex,nofollow">
+
+        <title>
+            
+    Paperless-ngx sign in
+
+        </title>
+        <link href="/static/bootstrap.min.css" rel="stylesheet">
+        <link href="/static/base.css" rel="stylesheet">
+    </head>
+
+    <body class="text-center">
+        <div class="position-absolute top-50 start-50 translate-middle">
+            <form class="form-accounts" id="form-account" method="post">
+                <input type="hidden" name="csrfmiddlewaretoken" value="KLQ3mMraTFHfK9sMmc6DJcNIS6YixeHnSJiT3A12LYB49HeEXOpx5RnY9V6uPSrD">
+                
+                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 2897.4 896.6" width='300' class='logo mb-4'>
+    <path class="leaf" d="M140,713.7c-3.4-16.4-10.3-49.1-11.2-49.1c-145.7-87.1-128.4-238-80.2-324.2C59,449,251.2,524,139.1,656.8 c-0.9,1.7,5.2,22.4,10.3,41.4c22.4-37.9,56-83.6,54.3-87.9C65.9,273.9,496.9,248.1,586.6,39.4c40.5,201.8-20.7,513.9-367.2,593.2 c-1.7,0.9-62.9,108.6-65.5,109.5c0-1.7-25.9-0.9-22.4-9.5C133.1,727.4,136.6,720.6,140,713.7L140,713.7z M135.7,632.6 c44-50.9-7.8-137.9-38.8-166.4C149.5,556.7,146,609.3,135.7,632.6L135.7,632.6z" transform="translate(0)" style="fill:#17541f"/>
+    <g class="text" style="fill:#000">
+        <path d="M1022.3,428.7c-17.8-19.9-42.7-29.8-74.7-29.8c-22.3,0-42.4,5.7-60.5,17.3c-18.1,11.6-32.3,27.5-42.5,47.8 s-15.3,42.9-15.3,67.8c0,24.9,5.1,47.5,15.3,67.8c10.3,20.3,24.4,36.2,42.5,47.8c18.1,11.5,38.3,17.3,60.5,17.3 c32,0,56.9-9.9,74.7-29.8v20.4v0.2h84.5V408.3h-84.5V428.7z M1010.5,575c-10.2,11.7-23.6,17.6-40.2,17.6s-29.9-5.9-40-17.6 s-15.1-26.1-15.1-43.3c0-17.1,5-31.6,15.1-43.3s23.4-17.6,40-17.6c16.6,0,30,5.9,40.2,17.6s15.3,26.1,15.3,43.3 S1020.7,563.3,1010.5,575z" transform="translate(0)"/>
+        <path d="M1381,416.1c-18.1-11.5-38.3-17.3-60.5-17.4c-32,0-56.9,9.9-74.7,29.8v-20.4h-84.5v390.7h84.5v-164 c17.8,19.9,42.7,29.8,74.7,29.8c22.3,0,42.4-5.7,60.5-17.3s32.3-27.5,42.5-47.8c10.2-20.3,15.3-42.9,15.3-67.8s-5.1-47.5-15.3-67.8 C1413.2,443.6,1399.1,427.7,1381,416.1z M1337.9,575c-10.1,11.7-23.4,17.6-40,17.6s-29.9-5.9-40-17.6s-15.1-26.1-15.1-43.3 c0-17.1,5-31.6,15.1-43.3s23.4-17.6,40-17.6s29.9,5.9,40,17.6s15.1,26.1,15.1,43.3S1347.9,563.3,1337.9,575z" transform="translate(0)"/>
+        <path d="M1672.2,416.8c-20.5-12-43-18-67.6-18c-24.9,0-47.6,5.9-68,17.6c-20.4,11.7-36.5,27.7-48.2,48s-17.6,42.7-17.6,67.3 c0.3,25.2,6.2,47.8,17.8,68c11.5,20.2,28,36,49.3,47.6c21.3,11.5,45.9,17.3,73.8,17.3c48.6,0,86.8-14.7,114.7-44l-52.5-48.9 c-8.6,8.3-17.6,14.6-26.7,19c-9.3,4.3-21.1,6.4-35.3,6.4c-11.6,0-22.5-3.6-32.7-10.9c-10.3-7.3-17.1-16.5-20.7-27.8h180l0.4-11.6 c0-29.6-6-55.7-18-78.2S1692.6,428.8,1672.2,416.8z M1558.3,503.2c2.1-12.1,7.5-21.8,16.2-29.1s18.7-10.9,30-10.9 s21.2,3.6,29.8,10.9c8.6,7.2,13.9,16.9,16,29.1H1558.3z" transform="translate(0)"/>
+        <path d="M1895.3,411.7c-11,5.6-20.3,13.7-28,24.4h-0.1v-28h-84.5v247.3h84.5V536.3c0-22.6,4.7-38.1,14.2-46.5 c9.5-8.5,22.7-12.7,39.6-12.7c6.2,0,13.5,1,21.8,3.1l10.7-72c-5.9-3.3-14.5-4.9-25.8-4.9C1917.1,403.3,1906.3,406.1,1895.3,411.7z"  transform="translate(0)"/>
+        <rect x="1985" y="277.4" width="84.5" height="377.8" transform="translate(0)"/>
+        <path d="M2313.2,416.8c-20.5-12-43-18-67.6-18c-24.9,0-47.6,5.9-68,17.6s-36.5,27.7-48.2,48c-11.7,20.3-17.6,42.7-17.6,67.3 c0.3,25.2,6.2,47.8,17.8,68c11.5,20.2,28,36,49.3,47.6c21.3,11.5,45.9,17.3,73.8,17.3c48.6,0,86.8-14.7,114.7-44l-52.5-48.9 c-8.6,8.3-17.6,14.6-26.7,19c-9.3,4.3-21.1,6.4-35.3,6.4c-11.6,0-22.5-3.6-32.7-10.9c-10.3-7.3-17.1-16.5-20.7-27.8h180l0.4-11.6 c0-29.6-6-55.7-18-78.2S2333.6,428.8,2313.2,416.8z M2199.3,503.2c2.1-12.1,7.5-21.8,16.2-29.1s18.7-10.9,30-10.9 s21.2,3.6,29.8,10.9c8.6,7.2,13.9,16.9,16,29.1H2199.3z" transform="translate(0)"/>
+        <path d="M2583.6,507.7c-13.8-4.4-30.6-8.1-50.5-11.1c-15.1-2.7-26.1-5.2-32.9-7.6c-6.8-2.4-10.2-6.1-10.2-11.1s2.3-8.7,6.7-10.9 c4.4-2.2,11.5-3.3,21.3-3.3c11.6,0,24.3,2.4,38.1,7.2c13.9,4.8,26.2,11,36.9,18.4l32.4-58.2c-11.3-7.4-26.2-14.7-44.9-21.8 c-18.7-7.1-39.6-10.7-62.7-10.7c-33.7,0-60.2,7.6-79.3,22.7c-19.1,15.1-28.7,36.1-28.7,63.1c0,19,4.8,33.9,14.4,44.7 c9.6,10.8,21,18.5,34,22.9c13.1,4.5,28.9,8.3,47.6,11.6c14.6,2.7,25.1,5.3,31.6,7.8s9.8,6.5,9.8,11.8c0,10.4-9.7,15.6-29.3,15.6 c-13.7,0-28.5-2.3-44.7-6.9c-16.1-4.6-29.2-11.3-39.3-20.2l-33.3,60c9.2,7.4,24.6,14.7,46.2,22c21.7,7.3,45.2,10.9,70.7,10.9 c34.7,0,62.9-7.4,84.5-22.4c21.7-15,32.5-37.3,32.5-66.9c0-19.3-5-34.2-15.1-44.9S2597.4,512.1,2583.6,507.7z" transform="translate(0)"/>
+        <path d="M2883.4,575.3c0-19.3-5-34.2-15.1-44.9s-22-18.3-35.8-22.7c-13.8-4.4-30.6-8.1-50.5-11.1c-15.1-2.7-26.1-5.2-32.9-7.6 c-6.8-2.4-10.2-6.1-10.2-11.1s2.3-8.7,6.7-10.9c4.4-2.2,11.5-3.3,21.3-3.3c11.6,0,24.3,2.4,38.1,7.2c13.9,4.8,26.2,11,36.9,18.4 l32.4-58.2c-11.3-7.4-26.2-14.7-44.9-21.8c-18.7-7.1-39.6-10.7-62.7-10.7c-33.7,0-60.2,7.6-79.3,22.7 c-19.1,15.1-28.7,36.1-28.7,63.1c0,19,4.8,33.9,14.4,44.7c9.6,10.8,21,18.5,34,22.9c13.1,4.5,28.9,8.3,47.6,11.6 c14.6,2.7,25.1,5.3,31.6,7.8s9.8,6.5,9.8,11.8c0,10.4-9.7,15.6-29.3,15.6c-13.7,0-28.5-2.3-44.7-6.9c-16.1-4.6-29.2-11.3-39.3-20.2 l-33.3,60c9.2,7.4,24.6,14.7,46.2,22c21.7,7.3,45.2,10.9,70.7,10.9c34.7,0,62.9-7.4,84.5-22.4 C2872.6,627.2,2883.4,604.9,2883.4,575.3z" transform="translate(0)"/>
+        <rect x="2460.7" y="738.7" width="59.6" height="17.2" transform="translate(0)"/>
+        <path d="M2596.5,706.4c-5.7,0-11,1-15.8,3s-9,5-12.5,8.9v-9.4h-19.4v93.6h19.4v-52c0-8.6,2.1-15.3,6.3-20c4.2-4.7,9.5-7.1,15.9-7.1 c7.8,0,13.4,2.3,16.8,6.7c3.4,4.5,5.1,11.3,5.1,20.5v52h19.4v-56.8c0-12.8-3.2-22.6-9.5-29.3 C2615.8,709.8,2607.3,706.4,2596.5,706.4z" transform="translate(0)"/>
+        <path d="M2733.8,717.7c-3.6-3.4-7.9-6.1-13.1-8.2s-10.6-3.1-16.2-3.1c-8.7,0-16.5,2.1-23.5,6.3s-12.5,10-16.5,17.3 c-4,7.3-6,15.4-6,24.4c0,8.9,2,17.1,6,24.3c4,7.3,9.5,13,16.5,17.2s14.9,6.3,23.5,6.3c5.6,0,11-1,16.2-3.1 c5.1-2.1,9.5-4.8,13.1-8.2v24.4c0,8.5-2.5,14.8-7.6,18.7c-5,3.9-11,5.9-18,5.9c-6.7,0-12.4-1.6-17.3-4.7c-4.8-3.1-7.6-7.7-8.3-13.8 h-19.4c0.6,7.7,2.9,14.2,7.1,19.5s9.6,9.3,16.2,12c6.6,2.7,13.8,4,21.7,4c12.8,0,23.5-3.4,32-10.1c8.6-6.7,12.8-17.1,12.8-31.1 V708.9h-19.2V717.7z M2732.2,770.1c-2.5,4.7-6,8.3-10.4,11.2c-4.4,2.7-9.4,4-14.9,4c-5.7,0-10.8-1.4-15.2-4.3s-7.8-6.7-10.2-11.4 c-2.3-4.8-3.5-9.8-3.5-15.2c0-5.5,1.1-10.6,3.5-15.3s5.8-8.5,10.2-11.3s9.5-4.2,15.2-4.2c5.5,0,10.5,1.4,14.9,4s7.9,6.3,10.4,11 s3.8,10,3.8,15.8S2734.7,765.4,2732.2,770.1z" transform="translate(0)"/>
+        <polygon points="2867.9,708.9 2846.5,708.9 2820.9,741.9 2795.5,708.9 2773.1,708.9 2809.1,755 2771.5,802.5 2792.9,802.5  2820.1,767.9 2847.2,802.6 2869.6,802.6 2832,754.4 	" transform="translate(0)"/>
+        <path d="M757.6,293.7c-20-10.8-42.6-16.2-67.8-16.2H600c-8.5,39.2-21.1,76.4-37.6,111.3c-9.9,20.8-21.1,40.6-33.6,59.4v207.2h88.9 V521.5h72c25.2,0,47.8-5.4,67.8-16.2s35.7-25.6,47.1-44.2c11.4-18.7,17.1-39.1,17.1-61.3c0.1-22.7-5.6-43.3-17-61.9 C793.3,319.2,777.6,304.5,757.6,293.7z M716.6,434.3c-9.3,8.9-21.6,13.3-36.7,13.3l-62.2,0.4v-92.5l62.2-0.4 c15.1,0,27.3,4.4,36.7,13.3c9.4,8.9,14,19.9,14,32.9C730.6,414.5,726,425.4,716.6,434.3z" transform="translate(0)"/>
+    </g>
+</svg>
+
+                
+                
+                
+    <p>
+      Please sign in.
+      
+    </p>
+
+                
+
+                
+		
+    
+        
+        
+        <div class="form-floating form-stacked-top">
+            <input type="text" name="login" id="inputUsername" placeholder="Username" class="form-control" autocorrect="off" autocapitalize="none" required autofocus>
+            <label for="inputUsername">Username</label>
+        </div>
+        <div class="form-floating form-stacked-bottom">
+            <input type="password" name="password" id="inputPassword" placeholder="Password" class="form-control" required>
+            <label for="inputPassword">Password</label>
+        </div>
+        <div class="d-grid mt-3">
+            <button class="btn btn-lg btn-primary" type="submit">Sign in</button>
+        </div>
+        
+    
+
+            </form>
+            
+    
+    
+    
+
+        </div>
+    </body>
+</html>

llm.py

@@ -0,0 +1,46 @@
+import os
+import logging
+
+from openai import OpenAI
+from dotenv import load_dotenv
+
+load_dotenv()
+
+logging.basicConfig(level=logging.INFO)
+
+
+class LLMClient:
+    def __init__(self):
+        llama_url = os.getenv("LLAMA_SERVER_URL")
+        if llama_url:
+            self.client = OpenAI(base_url=llama_url, api_key="not-needed")
+            self.model = os.getenv("LLAMA_MODEL_NAME", "llama-3.1-8b-instruct")
+            self.PROVIDER = "llama_server"
+            logging.info("Using llama_server as LLM backend")
+        else:
+            self.client = OpenAI()
+            self.model = "gpt-4o-mini"
+            self.PROVIDER = "openai"
+            logging.info("Using OpenAI as LLM backend")
+
+    def chat(
+        self,
+        prompt: str,
+        system_prompt: str,
+    ):
+        response = self.client.chat.completions.create(
+            model=self.model,
+            messages=[
+                {
+                    "role": "system",
+                    "content": system_prompt,
+                },
+                {"role": "user", "content": prompt},
+            ],
+        )
+        return response.choices[0].message.content
+
+
+if __name__ == "__main__":
+    client = LLMClient()
+    print(client.chat(prompt="Hello!", system_prompt="You are a helpful assistant."))

main.py

@@ -1,30 +1,20 @@
+import argparse
 import datetime
 import logging
 import os
 import sqlite3
-
-import argparse
-import chromadb
-import ollama
-
 import time
 
-
-from request import PaperlessNGXService
-from chunker import Chunker
-from cleaner import pdf_to_image, summarize_pdf_image
-from llm import LLMClient
-from query import QueryGenerator
-
-
 from dotenv import load_dotenv
 
-_dotenv_loaded = load_dotenv()
+import chromadb
+from utils.chunker import Chunker
+from utils.cleaner import pdf_to_image, summarize_pdf_image
+from llm import LLMClient
+from scripts.query import QueryGenerator
+from utils.request import PaperlessNGXService
 
-# Configure ollama client with URL from environment or default to localhost
+_dotenv_loaded = load_dotenv()
-ollama_client = ollama.Client(
-    host=os.getenv("OLLAMA_URL", "http://localhost:11434"), timeout=10.0
-)
 
 client = chromadb.PersistentClient(path=os.getenv("CHROMADB_PATH", ""))
 simba_docs = client.get_or_create_collection(name="simba_docs2")
@@ -235,6 +225,10 @@ def filter_indexed_files(docs):
 def reindex():
     with sqlite3.connect("database/visited.db") as conn:
         c = conn.cursor()
+        # Ensure the table exists before trying to delete from it
+        c.execute(
+            "CREATE TABLE IF NOT EXISTS indexed_documents (id INTEGER PRIMARY KEY AUTOINCREMENT, paperless_id INTEGER)"
+        )
         c.execute("DELETE FROM indexed_documents")
         conn.commit()
 

migrations/models/1_20260131214411_None.py

@@ -0,0 +1,72 @@
+from tortoise import BaseDBAsyncClient
+
+RUN_IN_TRANSACTION = True
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        CREATE TABLE IF NOT EXISTS "users" (
+    "id" UUID NOT NULL PRIMARY KEY,
+    "username" VARCHAR(255) NOT NULL,
+    "password" BYTEA,
+    "email" VARCHAR(100) NOT NULL UNIQUE,
+    "oidc_subject" VARCHAR(255) UNIQUE,
+    "auth_provider" VARCHAR(50) NOT NULL DEFAULT 'local',
+    "ldap_groups" JSONB NOT NULL,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS "idx_users_oidc_su_5aec5a" ON "users" ("oidc_subject");
+CREATE TABLE IF NOT EXISTS "conversations" (
+    "id" UUID NOT NULL PRIMARY KEY,
+    "name" VARCHAR(255) NOT NULL,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "user_id" UUID REFERENCES "users" ("id") ON DELETE CASCADE
+);
+CREATE TABLE IF NOT EXISTS "conversation_messages" (
+    "id" UUID NOT NULL PRIMARY KEY,
+    "text" TEXT NOT NULL,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "speaker" VARCHAR(10) NOT NULL,
+    "conversation_id" UUID NOT NULL REFERENCES "conversations" ("id") ON DELETE CASCADE
+);
+COMMENT ON COLUMN "conversation_messages"."speaker" IS 'USER: user\nSIMBA: simba';
+CREATE TABLE IF NOT EXISTS "aerich" (
+    "id" SERIAL NOT NULL PRIMARY KEY,
+    "version" VARCHAR(255) NOT NULL,
+    "app" VARCHAR(100) NOT NULL,
+    "content" JSONB NOT NULL
+);"""
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        """
+
+
+MODELS_STATE = (
+    "eJztmm1v4jgQx78Kyquu1KtatnRX1emkQOkttwuceNinXhWZ2ICviZ1NnG1R1e9+tkmIkz"
+    "gUKFDY401bxh5s/zzO/Mfpo+FSiJzgpEbJT+QHgGFKjMvSo0GAi/gf2vbjkgE8L2kVBgYG"
+    "jnSwlZ6yBQwC5gOb8cYhcALETRAFto+9aDASOo4wUpt3xGSUmEKCf4TIYnSE2Bj5vOHmlp"
+    "sxgegBBfFH784aYuTA1LwxFGNLu8UmnrT1+42ra9lTDDewbOqELkl6exM2pmTWPQwxPBE+"
+    "om2ECPIBQ1BZhphltOzYNJ0xNzA/RLOpwsQA0RCEjoBh/D4MiS0YlORI4sf5H8YSeDhqgR"
+    "YTJlg8Pk1XlaxZWg0xVO2D2Tl6e/FGrpIGbOTLRknEeJKOgIGpq+SagJS/cyhrY+DrUcb9"
+    "MzD5RFfBGBsSjkkMxSBjQKtRM1zwYDmIjNiYfyxXKnMwfjY7kiTvJVFSHtfTqG9FTeVpm0"
+    "CaILR9JJZsAZYHecVbGHaRHmbaM4MURq4n8R87CpivAbaJM4kOwRy+vUaz3u2Zzb/FStwg"
+    "+OFIRGavLlrK0jrJWI8uMlsx+5LSl0bvQ0l8LH1vt+rZ2J/16303xJxAyKhF6L0FoHJeY2"
+    "sMJrWxoQdX3Ni052FjX3Vjo8kr+xog31ougyguL0gj0dy2uImrJw2Reod32pwhYOThXVMf"
+    "4RH5iCYSYYPPAxBblywi0dGPvmZXoSXWZBY+uJ+pETUo+Or4mhCbZk+zWzOv6oZkOAD23T"
+    "3woVUA00VBAEYoyAOtRp7XHzvImUkzPUtVwDWn37ibT5UitpIVLVOFUYpevsktu1kLIHzd"
+    "MBpbjDSHzjMqWIG4mBi21I08iOK9FsUMPWhSfo9b9Sjj/vsiiuel8vrXXiqLx9L3qGl+fZ"
+    "PK5J/arT/j7opUrn1qVw8K+VcUUnmFHHgI3OnEgCgg6yR0c1IgtbuK+ysfHaPfrXcuSyKj"
+    "/0O6jWbVvCwF2B0AY7EtTlWZZ6cLFJlnp4U1pmjKHCA10Sz3mNe4rvOZv6cS1s5ceL1Qym"
+    "bvz3aW4rOaVhMuy2rbTSo5WTNopFtcSxRrNXG0D9ps/7WZ2MdlLy1Vn33RaFu4uPRAENxT"
+    "XxOZVUyAP9HDVL0yMAcTNq1/drWk18GrCr2qyi2OrNpomZ1veskb91fjtvqtVzczdJELsL"
+    "NMlM4c1hOiz5/4dQbo2eliomee6snJHoqhbQXh4F9kayqHYpJZv5WAZoN0uzw3cuC5lh9b"
+    "nk9/Ylgk2vVAc47be4oaDrWB84I0lOZaWSRMK8VRWskFqQOBZ418GnqaO7y/uu2WHmnGLQ"
+    "O0T/gqbyC22XHJwQG73Rjem9vNpHix8vkXCdk7g8wzVXzB4SLhf3KRcHjV9kts7OwmP1cQ"
+    "PvcaJPd/Jet5F7LLYnS770BM5GN7bGhq56jleF71DJI+O1M+N0jBdby2ehaYM8EQ7fyrim"
+    "j5Juq38tn5u/P3by/O3/MuciYzy7s5D4NGq/dMtSwOgvaKq1jrKS6HWjmRzvxoLCOYp933"
+    "E+BGajk+IkNEk96LJbLi8lryeGO3DmuTx0tk2/Wnl6f/AHvgrXs="
+)

migrations/models/2_20260228125713_add_whatsapp_number.py

@@ -0,0 +1,42 @@
+from tortoise import BaseDBAsyncClient
+
+RUN_IN_TRANSACTION = True
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        ALTER TABLE "users" ADD "whatsapp_number" VARCHAR(20) UNIQUE;"""
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        DROP INDEX IF EXISTS "uid_users_whatsap_e6b586";
+        ALTER TABLE "users" DROP COLUMN "whatsapp_number";"""
+
+
+MODELS_STATE = (
+    "eJztmm1v4jgQx78Kyquu1KtatnRX1emkQOkttwuceNinXhWZxECuiZ2NnaWo6nc/2yTESR"
+    "wgFCjs8aYtYw+2fx5n/p70SXOxBR1yVsPoJ/QJoDZG2nXpSUPAhewPZftpSQOeF7dyAwUD"
+    "RziYUk/RAgaE+sCkrHEIHAKZyYLE9G0vHAwFjsON2GQdbTSKTQGyfwTQoHgE6Rj6rOHunp"
+    "ltZMFHSKKP3oMxtKFjJeZtW3xsYTfo1BO2fr9xcyt68uEGhomdwEVxb29KxxjNuweBbZ1x"
+    "H942ggj6gEJLWgafZbjsyDSbMTNQP4DzqVqxwYJDEDgchvb7MEAmZ1ASI/Efl39oBfAw1B"
+    "ytjShn8fQ8W1W8ZmHV+FC1D3rn5O3VG7FKTOjIF42CiPYsHAEFM1fBNQYpfmdQ1sbAV6OM"
+    "+qdgsomugzEyxBzjGIpARoDWo6a54NFwIBrRMftYrlQWYPysdwRJ1kugxCyuZ1HfCpvKsz"
+    "aONEZo+pAv2QA0C/KGtVDbhWqYSc8UUit0PYv+2FPAbA1WGznT8BAs4NtrNOvdnt78m6/E"
+    "JeSHIxDpvTpvKQvrNGU9uUptxfxLSl8avQ8l/rH0vd2qp2N/3q/3XeNzAgHFBsITA1jSeY"
+    "2sEZjExgaetebGJj2PG/uqGxtOXtpXAn2jWAaRXF6QRsK57XAT108aPPUOH5Q5g8PIwrvF"
+    "PrRH6COcCoQNNg+ATFWyCEVHP/yafYUWW+NZ+GAyVyNyULDVsTVBOsueerem39Q1wXAAzI"
+    "cJ8C0jB6YLCQEjSLJAq6Hn7ccOdObSTM1SFnDN2Tfu51Mlj61ghctYYpSgl21yy27aAhBb"
+    "txWOzUdaQGeJCpYgriaGDXkjj6L4oEUxhY+KlN9jVjXKqP+hiOJFqbz+tZfI4pH0PWnqX9"
+    "8kMvmnduvPqLsklWuf2tWjQv4VhVRWIRMPggeVGOAXyDoK3IwUSOyu5P7KR0frd+ud6xLP"
+    "6P+gbqNZ1a9LxHYHQFttixO3zIvzFS6ZF+e5d0zelDpAcqIp9phXuG7ymX+gEtZMFbxeKG"
+    "XT9bO9pbhU0yrCpai23aaSE3cGhXSL7hL5Wo0f7aM2O3xtxvexaNFS9jkUjbaDwqUHCJlg"
+    "XxGZVRsBf6qGKXulYA6mdHb/2dcrvQpeletVWW4xZNVGS+98U0veqL8ct9VvvbqeogtdYD"
+    "tFonTusJkQXX7iNxmgF+eriZ5FqicjeyZjQAl7pBtMSQ7yZKYapsJ1LazpUN0t1fIqUMv5"
+    "TMsZpNi2TIMEg3+hqbiM5fNM+x0izG08Q9n1aGx4Pv5pW8UCNOO4u8SkOdgEzgsye5JrZZ"
+    "UgreQHaSUTpI4FPGPk48BTlEX/6rZbaqQptxTQPmKrvLNsk56WHJvQ+63hvbvfjmriK19c"
+    "m0mXYVJpin/BsTbzP6nNHN9e/hIbO385krljL3uzlPlXnc28Xtpnfb/b10o69G1zrCnKEW"
+    "HL6aKCBIj77E1FooFy3nAoCxIccyoYwp1/1XuJeLn3W/ni8t3l+7dXl+9ZFzGTueXdgodB"
+    "o9VbUoDgB0FZNczXepLLsfwQS2d2NIoI5ln3wwS4lesxG5FCpEjv+RJZcnkteby1Qs7G5H"
+    "GBbLv59PL8Hy/ZG1k="
+)

migrations/models/3_20260313000000_add_email_fields.py

@@ -0,0 +1,46 @@
+from tortoise import BaseDBAsyncClient
+
+RUN_IN_TRANSACTION = True
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        ALTER TABLE "users" ADD "email_enabled" BOOL NOT NULL DEFAULT FALSE;
+        ALTER TABLE "users" ADD "email_hmac_token" VARCHAR(16) UNIQUE;
+        CREATE INDEX "idx_users_email_h_a1b2c3" ON "users" ("email_hmac_token");"""
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        DROP INDEX IF EXISTS "idx_users_email_h_a1b2c3";
+        ALTER TABLE "users" DROP COLUMN "email_hmac_token";
+        ALTER TABLE "users" DROP COLUMN "email_enabled";"""
+
+
+MODELS_STATE = (
+    "eJztmm1v4jgQx78Kyquu1KtaKN1VdTopUHrLbYEThX3qVZFJXMg1sbOJsxRV/e5nm4Q4jg"
+    "OEAoU93rRl7CH2z2PP35M+ay62oBOc1DH6Cf0AEBsj7bL0rCHgQvqHsv24pAHPS1qZgYCB"
+    "wx1MoSdvAYOA+MAktPEBOAGkJgsGpm970cNQ6DjMiE3a0UbDxBQi+0cIDYKHkIygTxvu7q"
+    "nZRhZ8gkH80Xs0HmzoWKlx2xZ7NrcbZOJxW7/fvLrmPdnjBoaJndBFSW9vQkYYzbqHoW2d"
+    "MB/WNoQI+oBAS5gGG2U07dg0HTE1ED+Es6FaicGCDyB0GAzt94cQmYxBiT+J/Tj/QyuAh6"
+    "JmaG1EGIvnl+mskjlzq8YeVf+od48qF+/4LHFAhj5v5ES0F+4ICJi6cq4JSP47g7I+Ar4a"
+    "ZdxfgkkHugrG2JBwTGIoBhkDWo2a5oInw4FoSEb0Y7lanYPxs97lJGkvjhLTuJ5GfTtqKk"
+    "/bGNIEoelDNmUDkCzIK9pCbBeqYaY9JaRW5HoS/7GjgOkcrA5yJtEmmMO312w1bnt66282"
+    "EzcIfjgckd5rsJYyt04k69GFtBSzLyl9afY+ltjH0vdOuyHH/qxf77vGxgRCgg2ExwawhP"
+    "0aW2MwqYUNPWvFhU17Hhb2TRc2GrywrgH0jWIZRHB5RRqJxrbFRVw9abDU+/CozBkMRhbe"
+    "NfahPUSf4IQjbNJxAGSqkkUkOvrR1+wqtMSajMIH45kaEYOCzo7OCZJp9tRv6/pVQ+MMB8"
+    "B8HAPfMnJgujAIwBAGWaC1yPP6Uxc6M2mmZikKuNb0G3fzVMljy1nhMhYYpehlm9yyK1sA"
+    "ovO2omezJ82hs0AFCxCXE8OGuJAHUbzXopjAJ0XK71GrGmXcf19E8bxU3vjaS2XxWPoetf"
+    "Sv71KZ/KbT/jPuLkjl+k2ndlDIv6KQyirkwIPgUSUG2AWygUI3IwVSqyu4v/HW0fq3je5l"
+    "iWX0f9Bts1XTL0uB7Q6AttwSp26ZZ6dLXDLPTnPvmKxJ2kBioil2zCtc13nm76mENaWC1y"
+    "ulrFw/21mKCzWtIlyKattNKjl+Z1BIt/guka/V2NY+aLP912ZsHYsWLUWffdFoWyhceiAI"
+    "xthXRGbNRsCfqGGKXhLMwYRM7z+7eqVXwasxvSrKLYqs1mzr3W9qyRv3F+O29q3X0CW60A"
+    "W2UyRKZw7rCdHFO36dAXp2upzomad6MrJnPAIkoEe6QZXkIE9mqmEqXFfCKofqdqlWloFa"
+    "yWdaySDlQWZAxKan2vgYOxCgOQEq+srbnzpv6jAtmqoL7P9O5ya1/2tN+Urbb9UaNHg5Zt"
+    "rJnkqhZrunhDtygUk1wiNUKMsFu1/y3cOIPbtY5hiQr6zCKXAhRyy2LdMIwsG/0FSUD/KB"
+    "yn57CHMjWZ9e6EeG5+OftlXsSM04bk9KaQ42gfMKLZrmWl3mWK3mH6vVzLHqWMAzhj4OPU"
+    "Uh/6/bTluNVHKTgPYRneWdZZvkuOTYAbnfGN67+83ofDbz+dVEuXAoCSv2BYdq4v+kmnh4"
+    "3/5LLOzsdV6mKrToXWjmn8vW80J0l2+k230RqkPfNkeaooAWtRzPK6GBpM/O1NCaKOednL"
+    "KExjBLwRCt/JvepPnr6N/KZ+fvzz9ULs4/0C58JDPL+zmHQXwNyS+ZsY2grHPnaz3B5VAw"
+    "S6Qz3RpFBPO0+34C3EhBhz6RQKRI7/kSWXB5K3m8sdLj2uRxgWy7/vTy8h9Mf/k3"
+)

migrations/models/4_20260404080201_add_image_key.py

@@ -0,0 +1,43 @@
+from tortoise import BaseDBAsyncClient
+
+RUN_IN_TRANSACTION = True
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        ALTER TABLE "conversation_messages" ADD "image_key" VARCHAR(512);"""
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        ALTER TABLE "conversation_messages" DROP COLUMN "image_key";"""
+
+
+MODELS_STATE = (
+    "eJztmmtv4jgUhv8KyqeO1K0KvcyoWq0UWrrDToFVC3PrVpFJXPCS2JnEGYqq/ve1TUIcx6"
+    "GkBQqzfGnLsQ+xH1/Oe076aHjEgW54cE7wTxiEgCKCjbPKo4GBB9kf2vb9igF8P23lBgr6"
+    "rnCwpZ6iBfRDGgCbssZ74IaQmRwY2gHy44fhyHW5kdisI8KD1BRh9COCFiUDSIcwYA23d8"
+    "yMsAMfYJh89EfWPYKukxk3cvizhd2iE1/Yer3mxaXoyR/Xt2ziRh5Oe/sTOiR41j2KkHPA"
+    "fXjbAGIYAAodaRp8lPG0E9N0xMxAgwjOhuqkBgfeg8jlMIzf7yNscwYV8ST+4/gPowQehp"
+    "qjRZhyFo9P01mlcxZWgz/q/KN5vXd0+k7MkoR0EIhGQcR4Eo6Agqmr4JqCFL9zKM+HINCj"
+    "TPorMNlAX4IxMaQc0z2UgEwAvYya4YEHy4V4QIfsY+3kZA7Gz+a1IMl6CZSE7evprm/HTb"
+    "VpG0eaIrQDyKdsAZoHecFaKPKgHmbWU0HqxK4HyR8bCpjNwelgdxIfgjl8u81W46Zrtv7m"
+    "M/HC8IcrEJndBm+pCetEse6dKksx+5LKl2b3Y4V/rHzvtBvq3p/16343+JhARImFydgCjn"
+    "ReE2sCJrOwke+8cGGznruFfdOFjQcvrWsIA6tcBJFcXhFG4rGtcRFfHjR46L0faWMGh5GH"
+    "d0kCiAb4E5wIhE02DoBtXbCIRUcv/ppNhZZa01EEYDxTI/KmYLNjc4J0Gj3Nm3PzomEIhn"
+    "1gj8YgcKwCmB4MQzCAYR5oPfa8/HQN3Zk007OUBVxr+o2beasUsRWsSI1IjDL08k1ezVMt"
+    "ALN5O/Gz+ZPm0HlGBUsQFxPDlryQO1G81aKYwgdNyO8yqx5l0n9bRPG8UN742s1E8UT67r"
+    "XMr+8ykfyq0/4z6S5J5fOrTn2nkH9FIZVXyKEPwUgnBngC2cCRl5MCmdWV3N/46Bi9m8b1"
+    "WYVH9H/wTbNVN88qIfL6wFhsiTNZZvVwgSSzeliYY/Km7AFCHoss1ghOyqTqGacX8V2/9M"
+    "qCPKnWFiDJehWiFG3KZSQH7XIhU+O6zPi5pemArRQPX5kWqLXIjaX4bH6g2S5l84RVqmKR"
+    "f2lkcJKXFetefk3udO7261y+jmULwLLPtujdNRSBfRCGYxJodmYdYRBM9DBlLwVmf0Knue"
+    "TGxeg58Opc+8vSlSGrN9vm9Td9+pD0l/dt/Vu3YSp0oQeQW2aXzhyWs0WfP/HL3KDVw8UE"
+    "5DwFmZOQ4yGgIbvSLabK+0WSXQ9T47oUObleqkeLQD0qZnqUQyo2mQUxn57u4BPiQoDnbF"
+    "DZVz3+zHlVl2nZUF3i/Hc6V5nzX2+q5YFeq95gm1dgZp3QVAo1210t3KEHbKYRRlCjLJ85"
+    "/YrvFu7Y6uki14Ca/ku3wKm6YwlybCuM+v9CW1OKKQaq+m0hzJVEfRDRoeUH5Cdyyl2pOc"
+    "f1SSnDJTZwX6FFlRx9kWv1pPhaPcldq64DfGsQkMjXvBT566bT1iNV3BSgPcxmeesgm+5X"
+    "XBTSu5Xhvb1bjc7nM59fmVWLsIqw4l+wq8z+Tyqzu/9d+CUWdvZqNFcVeu69cu4f9Zbzcn"
+    "mTM9L1vlQ2YYDsoaEpoMUt+/NKaCDtszE1tCYueL+pLaFxzMpmiFf+TTNp8Wr/t1r1+P3x"
+    "h6PT4w+sixjJzPJ+zmWQpCHFJTN+ELR17mKtJ7nsCmapdGZHo4xgnnbfToArKeiwJ1KINe"
+    "G9WCJLLm8lj1dWelyaPC4RbZcfXp7+AzcBYwM="
+)

mkdocs.yml

@@ -0,0 +1,25 @@
+site_name: SimbaRAG Documentation
+site_description: Documentation for SimbaRAG - RAG-powered conversational AI
+
+theme:
+  name: material
+  features:
+    - content.code.copy
+    - navigation.sections
+    - navigation.expand
+
+markdown_extensions:
+  - admonition
+  - pymdownx.highlight:
+      anchor_linenums: true
+  - pymdownx.superfences
+  - pymdownx.tabbed:
+      alternate_style: true
+  - tables
+  - toc:
+      permalink: true
+
+nav:
+  - Home: index.md
+  - Architecture:
+      - Authentication: authentication.md

pyproject.toml

@@ -9,7 +9,6 @@ dependencies = [
     "python-dotenv>=1.0.0",
     "flask>=3.1.2",
     "httpx>=0.28.1",
-    "ollama>=0.6.0",
     "openai>=2.0.1",
     "pydantic>=2.11.9",
     "pillow>=10.0.0",
@@ -21,7 +20,7 @@ dependencies = [
     "pony>=0.7.19",
     "flask-login>=0.6.3",
     "quart>=0.20.0",
-    "tortoise-orm>=0.25.1",
+    "tortoise-orm>=0.25.1,<1.0.0",
     "quart-jwt-extended>=0.1.0",
     "pre-commit>=4.3.0",
     "tortoise-orm-stubs>=1.0.2",
@@ -31,9 +30,17 @@ dependencies = [
     "asyncpg>=0.30.0",
     "langchain-openai>=1.1.6",
     "langchain>=1.2.0",
+    "langchain-chroma>=1.0.0",
+    "langchain-community>=0.4.1",
+    "jq>=1.10.0",
+    "tavily-python>=0.7.17",
+    "ynab>=1.3.0",
+    "ollama>=0.6.1",
+    "twilio>=9.10.2",
+    "aioboto3>=13.0.0",
 ]
 
 [tool.aerich]
-tortoise_orm = "app.TORTOISE_CONFIG"
+tortoise_orm = "config.db.TORTOISE_CONFIG"
 location = "./migrations"
 src_folder = "./."

raggr-frontend/package.json

@@ -12,11 +12,15 @@
   },
   "dependencies": {
     "axios": "^1.12.2",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "lucide-react": "^0.577.0",
     "marked": "^16.3.0",
     "npm-watch": "^0.13.0",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",
     "react-markdown": "^10.1.0",
+    "tailwind-merge": "^3.5.0",
     "watch": "^1.0.2"
   },
   "devDependencies": {

raggr-frontend/public/manifest.json

@@ -0,0 +1,14 @@
+{
+  "name": "Ask Simba",
+  "short_name": "Simba",
+  "description": "Chat with Simba - your AI cat companion",
+  "start_url": "/",
+  "display": "standalone",
+  "background_color": "#FAF8F2",
+  "theme_color": "#2A4D38",
+  "icons": [
+    { "src": "/pwa-icon-192.png", "sizes": "192x192", "type": "image/png" },
+    { "src": "/pwa-icon-512.png", "sizes": "512x512", "type": "image/png" },
+    { "src": "/pwa-icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" }
+  ]
+}

raggr-frontend/public/sw.js

@@ -0,0 +1,46 @@
+const CACHE = 'simba-v1';
+
+self.addEventListener('install', (e) => {
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', (e) => {
+  e.waitUntil(
+    caches.keys().then((keys) =>
+      Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k)))
+    )
+  );
+  self.clients.claim();
+});
+
+self.addEventListener('fetch', (e) => {
+  const { request } = e;
+  const url = new URL(request.url);
+
+  // Network-only for API calls
+  if (url.pathname.startsWith('/api/')) return;
+
+  // Cache-first for fingerprinted static assets
+  if (url.pathname.startsWith('/static/')) {
+    e.respondWith(
+      caches.match(request).then(
+        (cached) =>
+          cached ||
+          fetch(request).then((res) => {
+            const clone = res.clone();
+            caches.open(CACHE).then((c) => c.put(request, clone));
+            return res;
+          })
+      )
+    );
+    return;
+  }
+
+  // Network-first for navigation (offline fallback to cache)
+  if (request.mode === 'navigate') {
+    e.respondWith(
+      fetch(request).catch(() => caches.match(request))
+    );
+    return;
+  }
+});

raggr-frontend/rsbuild.config.ts

@@ -0,0 +1,19 @@
+import { defineConfig } from '@rsbuild/core';
+import { pluginReact } from '@rsbuild/plugin-react';
+
+export default defineConfig({
+  plugins: [pluginReact()],
+  html: {
+    title: 'Ask Simba',
+    favicon: './src/assets/favicon.svg',
+    tags: [
+      { tag: 'link', attrs: { rel: 'manifest', href: '/manifest.json' } },
+      { tag: 'meta', attrs: { name: 'theme-color', content: '#2A4D38' } },
+      { tag: 'link', attrs: { rel: 'apple-touch-icon', href: '/apple-touch-icon.png' } },
+      { tag: 'meta', attrs: { name: 'apple-mobile-web-app-capable', content: 'yes' } },
+    ],
+  },
+  output: {
+    copy: [{ from: './public', to: '.' }],
+  },
+});

raggr-frontend/src/App.css

@@ -0,0 +1,173 @@
+@import url('https://fonts.googleapis.com/css2?family=Nunito:wght@400;500;600;700;800&family=Playfair+Display:ital,wght@0,600;0,700;1,600&display=swap');
+@import "tailwindcss";
+
+@theme {
+  /* === Animal Crossing × Claude Palette === */
+
+  /* Backgrounds */
+  --color-cream: #FAF8F2;
+  --color-cream-dark: #F0EBDF;
+  --color-warm-white: #FFFDF9;
+
+  /* Forest / Nook Green system */
+  --color-forest: #2A4D38;
+  --color-forest-mid: #345E46;
+  --color-forest-light: #4D7A5E;
+  --color-leaf: #5E9E70;
+  --color-leaf-dark: #3D7A52;
+  --color-leaf-light: #B8DEC4;
+  --color-leaf-pale: #EBF7EE;
+
+  /* Amber / warm accents */
+  --color-amber-glow: #E8943A;
+  --color-amber-dark: #C97828;
+  --color-amber-soft: #F5C882;
+  --color-amber-pale: #FFF4E0;
+
+  /* Neutrals */
+  --color-charcoal: #2C2420;
+  --color-warm-gray: #7A7268;
+  --color-sand: #DECFB8;
+  --color-sand-light: #EDE3D4;
+  --color-blush: #F2D1B3;
+
+  /* Sidebar */
+  --color-sidebar-bg: #2A4D38;
+  --color-sidebar-hover: #345E46;
+  --color-sidebar-active: #3D6E52;
+
+  /* Fonts */
+  --font-display: 'Playfair Display', Georgia, serif;
+  --font-body: 'Nunito', 'Nunito Sans', system-ui, sans-serif;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  font-family: var(--font-body);
+  background-color: var(--color-cream);
+  color: var(--color-charcoal);
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+/* ── Scrollbar ─────────────────────────────────────── */
+::-webkit-scrollbar { width: 5px; }
+::-webkit-scrollbar-track { background: transparent; }
+::-webkit-scrollbar-thumb { background: var(--color-sand); border-radius: 99px; }
+::-webkit-scrollbar-thumb:hover { background: var(--color-warm-gray); }
+
+/* ── Markdown in answer bubbles ─────────────────────── */
+.markdown-content p { margin: 0.5em 0; line-height: 1.7; }
+.markdown-content p:first-child { margin-top: 0; }
+.markdown-content p:last-child { margin-bottom: 0; }
+
+.markdown-content h1,
+.markdown-content h2,
+.markdown-content h3 {
+  font-family: var(--font-display);
+  font-weight: 600;
+  margin: 1em 0 0.4em;
+  line-height: 1.3;
+  color: var(--color-charcoal);
+}
+.markdown-content h1 { font-size: 1.2rem; }
+.markdown-content h2 { font-size: 1.05rem; }
+.markdown-content h3 { font-size: 0.95rem; }
+
+.markdown-content ul,
+.markdown-content ol { padding-left: 1.4em; margin: 0.5em 0; }
+.markdown-content li { margin: 0.3em 0; line-height: 1.6; }
+
+.markdown-content code {
+  background: rgba(0,0,0,0.06);
+  padding: 0.15em 0.4em;
+  border-radius: 5px;
+  font-size: 0.85em;
+  font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
+}
+
+.markdown-content pre {
+  background: var(--color-charcoal);
+  color: #F0EBDF;
+  padding: 1em 1.1em;
+  border-radius: 12px;
+  overflow-x: auto;
+  margin: 0.8em 0;
+}
+.markdown-content pre code { background: none; padding: 0; color: inherit; }
+
+.markdown-content a {
+  color: var(--color-leaf-dark);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+
+.markdown-content blockquote {
+  border-left: 3px solid var(--color-amber-soft);
+  padding-left: 1em;
+  margin: 0.75em 0;
+  color: var(--color-warm-gray);
+  font-style: italic;
+}
+
+.markdown-content strong { font-weight: 700; }
+.markdown-content em { font-style: italic; }
+
+/* ── Animations ─────────────────────────────────────── */
+@keyframes fadeSlideUp {
+  from { opacity: 0; transform: translateY(10px); }
+  to   { opacity: 1; transform: translateY(0); }
+}
+.message-enter {
+  animation: fadeSlideUp 0.3s ease-out forwards;
+}
+
+@keyframes catPulse {
+  0%, 80%, 100% { opacity: 0.25; transform: scale(0.75); }
+  40%           { opacity: 1;    transform: scale(1); }
+}
+.loading-dot { animation: catPulse 1.4s ease-in-out infinite; }
+.loading-dot:nth-child(2) { animation-delay: 0.2s; }
+.loading-dot:nth-child(3) { animation-delay: 0.4s; }
+
+@keyframes shimmer {
+  0%   { background-position: -200% 0; }
+  100% { background-position:  200% 0; }
+}
+.skeleton-shimmer {
+  background: linear-gradient(90deg,
+    var(--color-sand-light) 25%,
+    var(--color-cream) 50%,
+    var(--color-sand-light) 75%
+  );
+  background-size: 200% 100%;
+  animation: shimmer 1.8s ease-in-out infinite;
+}
+
+/* ── Toggle switch ──────────────────────────────────── */
+.toggle-track {
+  width: 36px;
+  height: 20px;
+  border-radius: 99px;
+  background: var(--color-sand);
+  position: relative;
+  transition: background 0.2s;
+  cursor: pointer;
+}
+.toggle-track.checked { background: var(--color-leaf); }
+.toggle-thumb {
+  width: 14px;
+  height: 14px;
+  background: white;
+  border-radius: 99px;
+  position: absolute;
+  top: 3px;
+  left: 3px;
+  transition: transform 0.2s;
+  box-shadow: 0 1px 3px rgba(0,0,0,0.15);
+}
+.toggle-track.checked .toggle-thumb { transform: translateX(16px); }

raggr-frontend/src/App.tsx

@@ -5,6 +5,7 @@ import { AuthProvider } from "./contexts/AuthContext";
 import { ChatScreen } from "./components/ChatScreen";
 import { LoginScreen } from "./components/LoginScreen";
 import { conversationService } from "./api/conversationService";
+import catIcon from "./assets/cat.png";
 
 const AppContainer = () => {
   const [isAuthenticated, setAuthenticated] = useState<boolean>(false);
@@ -44,8 +45,15 @@ const AppContainer = () => {
   // Show loading state while checking authentication
   if (isChecking) {
     return (
-      <div className="h-screen flex items-center justify-center bg-white/85">
+      <div className="h-screen flex flex-col items-center justify-center bg-cream gap-4">
-        <div className="text-xl">Loading...</div>
+        <img
+          src={catIcon}
+          alt="Simba"
+          className="w-16 h-16 animate-bounce"
+        />
+        <p className="text-warm-gray font-medium text-lg tracking-wide">
+          waking up simba...
+        </p>
       </div>
     );
   }

raggr-frontend/src/api/conversationService.ts

@@ -0,0 +1,214 @@
+import { userService } from "./userService";
+
+export type SSEEvent =
+  | { type: "tool_start"; tool: string }
+  | { type: "tool_end"; tool: string }
+  | { type: "response"; message: string }
+  | { type: "error"; message: string };
+
+export type SSEEventCallback = (event: SSEEvent) => void;
+
+interface Message {
+  id: string;
+  text: string;
+  speaker: "user" | "simba";
+  created_at: string;
+  image_key?: string | null;
+}
+
+interface Conversation {
+  id: string;
+  name: string;
+  messages?: Message[];
+  created_at: string;
+  updated_at: string;
+  user_id?: string;
+}
+
+interface QueryRequest {
+  query: string;
+}
+
+interface QueryResponse {
+  response: string;
+}
+
+interface CreateConversationRequest {
+  user_id: string;
+}
+
+class ConversationService {
+  private baseUrl = "/api";
+  private conversationBaseUrl = "/api/conversation";
+
+  async sendQuery(
+    query: string,
+    conversation_id: string,
+    signal?: AbortSignal,
+  ): Promise<QueryResponse> {
+    const response = await userService.fetchWithRefreshToken(
+      `${this.conversationBaseUrl}/query`,
+      {
+        method: "POST",
+        body: JSON.stringify({ query, conversation_id }),
+        signal,
+      },
+    );
+
+    if (!response.ok) {
+      throw new Error("Failed to send query");
+    }
+
+    return await response.json();
+  }
+
+  async getMessages(): Promise<Conversation> {
+    const response = await userService.fetchWithRefreshToken(
+      `${this.baseUrl}/messages`,
+      {
+        method: "GET",
+      },
+    );
+
+    if (!response.ok) {
+      throw new Error("Failed to fetch messages");
+    }
+
+    return await response.json();
+  }
+
+  async getConversation(conversationId: string): Promise<Conversation> {
+    const response = await userService.fetchWithRefreshToken(
+      `${this.conversationBaseUrl}/${conversationId}`,
+      {
+        method: "GET",
+      },
+    );
+
+    if (!response.ok) {
+      throw new Error("Failed to fetch conversation");
+    }
+
+    return await response.json();
+  }
+
+  async createConversation(): Promise<Conversation> {
+    const response = await userService.fetchWithRefreshToken(
+      `${this.conversationBaseUrl}/`,
+      {
+        method: "POST",
+      },
+    );
+
+    if (!response.ok) {
+      throw new Error("Failed to create conversation");
+    }
+
+    return await response.json();
+  }
+
+  async getAllConversations(): Promise<Conversation[]> {
+    const response = await userService.fetchWithRefreshToken(
+      `${this.conversationBaseUrl}/`,
+      {
+        method: "GET",
+      },
+    );
+
+    if (!response.ok) {
+      throw new Error("Failed to fetch conversations");
+    }
+
+    return await response.json();
+  }
+
+  async uploadImage(
+    file: File,
+    conversationId: string,
+  ): Promise<{ image_key: string; image_url: string }> {
+    const formData = new FormData();
+    formData.append("file", file);
+    formData.append("conversation_id", conversationId);
+
+    const response = await userService.fetchWithRefreshToken(
+      `${this.conversationBaseUrl}/upload-image`,
+      {
+        method: "POST",
+        body: formData,
+      },
+      { skipContentType: true },
+    );
+
+    if (!response.ok) {
+      const data = await response.json();
+      throw new Error(data.error || "Failed to upload image");
+    }
+
+    return await response.json();
+  }
+
+  getImageUrl(imageKey: string): string {
+    return `/api/conversation/image/${imageKey}`;
+  }
+
+  async streamQuery(
+    query: string,
+    conversation_id: string,
+    onEvent: SSEEventCallback,
+    signal?: AbortSignal,
+    imageKey?: string,
+  ): Promise<void> {
+    const body: Record<string, string> = { query, conversation_id };
+    if (imageKey) {
+      body.image_key = imageKey;
+    }
+
+    const response = await userService.fetchWithRefreshToken(
+      `${this.conversationBaseUrl}/stream-query`,
+      {
+        method: "POST",
+        body: JSON.stringify(body),
+        signal,
+      },
+    );
+
+    if (!response.ok) {
+      throw new Error("Failed to stream query");
+    }
+
+    await this._readSSEStream(response, onEvent);
+  }
+
+  private async _readSSEStream(
+    response: Response,
+    onEvent: SSEEventCallback,
+  ): Promise<void> {
+    const reader = response.body!.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+
+      buffer += decoder.decode(value, { stream: true });
+      const parts = buffer.split("\n\n");
+      buffer = parts.pop() ?? "";
+
+      for (const part of parts) {
+        const line = part.trim();
+        if (!line.startsWith("data: ")) continue;
+        const data = line.slice(6);
+        if (data === "[DONE]") return;
+        try {
+          const event = JSON.parse(data) as SSEEvent;
+          onEvent(event);
+        } catch {
+          // ignore malformed events
+        }
+      }
+    }
+  }
+}
+
+export const conversationService = new ConversationService();

raggr-frontend/src/api/userService.ts

@@ -106,14 +106,15 @@ class UserService {
   async fetchWithRefreshToken(
     url: string,
     options: RequestInit = {},
+    { skipContentType = false }: { skipContentType?: boolean } = {},
   ): Promise<Response> {
     const refreshToken = localStorage.getItem("refresh_token");
 
     // Add authorization header
-    const headers = {
+    const headers: Record<string, string> = {
-      "Content-Type": "application/json",
+      ...(skipContentType ? {} : { "Content-Type": "application/json" }),
-      ...(options.headers || {}),
+      ...((options.headers as Record<string, string>) || {}),
-      ...(refreshToken && { Authorization: `Bearer ${refreshToken}` }),
+      ...(refreshToken ? { Authorization: `Bearer ${refreshToken}` } : {}),
     };
 
     let response = await fetch(url, { ...options, headers });
@@ -134,6 +135,67 @@ class UserService {
 
     return response;
   }
+
+  async getMe(): Promise<{ id: string; username: string; email: string; is_admin: boolean }> {
+    const response = await this.fetchWithRefreshToken(`${this.baseUrl}/me`);
+    if (!response.ok) throw new Error("Failed to fetch user profile");
+    return response.json();
   }
 
+  async adminListUsers(): Promise<AdminUserRecord[]> {
+    const response = await this.fetchWithRefreshToken(`${this.baseUrl}/admin/users`);
+    if (!response.ok) throw new Error("Failed to list users");
+    return response.json();
+  }
+
+  async adminSetWhatsapp(userId: string, number: string): Promise<AdminUserRecord> {
+    const response = await this.fetchWithRefreshToken(
+      `${this.baseUrl}/admin/users/${userId}/whatsapp`,
+      { method: "PUT", body: JSON.stringify({ whatsapp_number: number }) },
+    );
+    if (response.status === 409) {
+      const data = await response.json();
+      throw new Error(data.error ?? "WhatsApp number already in use");
+    }
+    if (!response.ok) throw new Error("Failed to set WhatsApp number");
+    return response.json();
+  }
+
+  async adminUnlinkWhatsapp(userId: string): Promise<void> {
+    const response = await this.fetchWithRefreshToken(
+      `${this.baseUrl}/admin/users/${userId}/whatsapp`,
+      { method: "DELETE" },
+    );
+    if (!response.ok) throw new Error("Failed to unlink WhatsApp number");
+  }
+
+  async adminToggleEmail(userId: string): Promise<AdminUserRecord> {
+    const response = await this.fetchWithRefreshToken(
+      `${this.baseUrl}/admin/users/${userId}/email`,
+      { method: "PUT" },
+    );
+    if (!response.ok) throw new Error("Failed to enable email");
+    return response.json();
+  }
+
+  async adminDisableEmail(userId: string): Promise<void> {
+    const response = await this.fetchWithRefreshToken(
+      `${this.baseUrl}/admin/users/${userId}/email`,
+      { method: "DELETE" },
+    );
+    if (!response.ok) throw new Error("Failed to disable email");
+  }
+}
+
+export interface AdminUserRecord {
+  id: string;
+  username: string;
+  email: string;
+  whatsapp_number: string | null;
+  auth_provider: string;
+  email_enabled: boolean;
+  email_address: string | null;
+}
+
+export { UserService };
 export const userService = new UserService();

raggr-frontend/src/components/AdminPanel.tsx

@@ -0,0 +1,312 @@
+import { useEffect, useState } from "react";
+import { X, Phone, PhoneOff, Pencil, Check, Mail, Copy } from "lucide-react";
+import { userService, type AdminUserRecord } from "../api/userService";
+import { cn } from "../lib/utils";
+import { Button } from "./ui/button";
+import { Input } from "./ui/input";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "./ui/table";
+
+type Props = {
+  onClose: () => void;
+};
+
+export const AdminPanel = ({ onClose }: Props) => {
+  const [users, setUsers] = useState<AdminUserRecord[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [editingId, setEditingId] = useState<string | null>(null);
+  const [editValue, setEditValue] = useState("");
+  const [rowError, setRowError] = useState<Record<string, string>>({});
+  const [rowSuccess, setRowSuccess] = useState<Record<string, string>>({});
+
+  useEffect(() => {
+    userService
+      .adminListUsers()
+      .then(setUsers)
+      .catch(() => {})
+      .finally(() => setLoading(false));
+  }, []);
+
+  const startEdit = (user: AdminUserRecord) => {
+    setEditingId(user.id);
+    setEditValue(user.whatsapp_number ?? "");
+    setRowError((p) => ({ ...p, [user.id]: "" }));
+    setRowSuccess((p) => ({ ...p, [user.id]: "" }));
+  };
+
+  const cancelEdit = () => {
+    setEditingId(null);
+    setEditValue("");
+  };
+
+  const saveWhatsapp = async (userId: string) => {
+    setRowError((p) => ({ ...p, [userId]: "" }));
+    try {
+      const updated = await userService.adminSetWhatsapp(userId, editValue);
+      setUsers((p) => p.map((u) => (u.id === userId ? updated : u)));
+      setRowSuccess((p) => ({ ...p, [userId]: "Saved ✓" }));
+      setEditingId(null);
+      setTimeout(() => setRowSuccess((p) => ({ ...p, [userId]: "" })), 2000);
+    } catch (err) {
+      setRowError((p) => ({
+        ...p,
+        [userId]: err instanceof Error ? err.message : "Failed to save",
+      }));
+    }
+  };
+
+  const unlinkWhatsapp = async (userId: string) => {
+    setRowError((p) => ({ ...p, [userId]: "" }));
+    try {
+      await userService.adminUnlinkWhatsapp(userId);
+      setUsers((p) =>
+        p.map((u) => (u.id === userId ? { ...u, whatsapp_number: null } : u)),
+      );
+      setRowSuccess((p) => ({ ...p, [userId]: "Unlinked ✓" }));
+      setTimeout(() => setRowSuccess((p) => ({ ...p, [userId]: "" })), 2000);
+    } catch (err) {
+      setRowError((p) => ({
+        ...p,
+        [userId]: err instanceof Error ? err.message : "Failed to unlink",
+      }));
+    }
+  };
+
+  const toggleEmail = async (userId: string) => {
+    setRowError((p) => ({ ...p, [userId]: "" }));
+    try {
+      const updated = await userService.adminToggleEmail(userId);
+      setUsers((p) => p.map((u) => (u.id === userId ? updated : u)));
+      setRowSuccess((p) => ({ ...p, [userId]: "Email enabled ✓" }));
+      setTimeout(() => setRowSuccess((p) => ({ ...p, [userId]: "" })), 2000);
+    } catch (err) {
+      setRowError((p) => ({
+        ...p,
+        [userId]: err instanceof Error ? err.message : "Failed to enable email",
+      }));
+    }
+  };
+
+  const disableEmail = async (userId: string) => {
+    setRowError((p) => ({ ...p, [userId]: "" }));
+    try {
+      await userService.adminDisableEmail(userId);
+      setUsers((p) =>
+        p.map((u) => (u.id === userId ? { ...u, email_enabled: false, email_address: null } : u)),
+      );
+      setRowSuccess((p) => ({ ...p, [userId]: "Email disabled ✓" }));
+      setTimeout(() => setRowSuccess((p) => ({ ...p, [userId]: "" })), 2000);
+    } catch (err) {
+      setRowError((p) => ({
+        ...p,
+        [userId]: err instanceof Error ? err.message : "Failed to disable email",
+      }));
+    }
+  };
+
+  const copyToClipboard = (text: string, userId: string) => {
+    navigator.clipboard.writeText(text);
+    setRowSuccess((p) => ({ ...p, [userId]: "Copied ✓" }));
+    setTimeout(() => setRowSuccess((p) => ({ ...p, [userId]: "" })), 2000);
+  };
+
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-center justify-center bg-charcoal/40 backdrop-blur-sm"
+      onClick={(e) => e.target === e.currentTarget && onClose()}
+    >
+      <div
+        className={cn(
+          "bg-warm-white rounded-3xl shadow-2xl shadow-charcoal/20",
+          "w-full max-w-3xl mx-4 max-h-[82vh] flex flex-col",
+          "border border-sand-light/60",
+        )}
+      >
+        {/* Header */}
+        <div className="flex items-center justify-between px-6 py-4 border-b border-sand-light/60">
+          <div className="flex items-center gap-2.5">
+            <div className="w-8 h-8 rounded-xl bg-leaf-pale flex items-center justify-center">
+              <Phone size={14} className="text-leaf-dark" />
+            </div>
+            <h2 className="text-sm font-semibold text-charcoal">
+              Admin · User Integrations
+            </h2>
+          </div>
+          <button
+            onClick={onClose}
+            className="w-7 h-7 rounded-lg flex items-center justify-center text-warm-gray hover:text-charcoal hover:bg-cream-dark transition-colors cursor-pointer"
+          >
+            <X size={15} />
+          </button>
+        </div>
+
+        {/* Body */}
+        <div className="overflow-y-auto flex-1 rounded-b-3xl">
+          {loading ? (
+            <div className="px-6 py-12 text-center text-warm-gray text-sm">
+              <div className="flex justify-center gap-1.5 mb-3">
+                <span className="loading-dot w-2 h-2 rounded-full bg-amber-soft inline-block" />
+                <span className="loading-dot w-2 h-2 rounded-full bg-amber-soft inline-block" />
+                <span className="loading-dot w-2 h-2 rounded-full bg-amber-soft inline-block" />
+              </div>
+              Loading users…
+            </div>
+          ) : (
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>Username</TableHead>
+                  <TableHead>Email</TableHead>
+                  <TableHead>WhatsApp</TableHead>
+                  <TableHead>Email</TableHead>
+                  <TableHead className="w-28">Actions</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {users.map((user) => (
+                  <TableRow key={user.id}>
+                    <TableCell className="font-medium text-charcoal">
+                      {user.username}
+                    </TableCell>
+                    <TableCell className="text-warm-gray">{user.email}</TableCell>
+                    <TableCell>
+                      {editingId === user.id ? (
+                        <div className="flex flex-col gap-1">
+                          <Input
+                            value={editValue}
+                            onChange={(e) => setEditValue(e.target.value)}
+                            placeholder="whatsapp:+15551234567"
+                            className="w-52"
+                            autoFocus
+                            onKeyDown={(e) =>
+                              e.key === "Enter" && saveWhatsapp(user.id)
+                            }
+                          />
+                          {rowError[user.id] && (
+                            <span className="text-xs text-red-500">
+                              {rowError[user.id]}
+                            </span>
+                          )}
+                        </div>
+                      ) : (
+                        <div className="flex flex-col gap-0.5">
+                          <span
+                            className={cn(
+                              "text-sm",
+                              user.whatsapp_number
+                                ? "text-charcoal"
+                                : "text-warm-gray/40 italic",
+                            )}
+                          >
+                            {user.whatsapp_number ?? "—"}
+                          </span>
+                          {rowSuccess[user.id] && (
+                            <span className="text-xs text-leaf-dark">
+                              {rowSuccess[user.id]}
+                            </span>
+                          )}
+                          {rowError[user.id] && (
+                            <span className="text-xs text-red-500">
+                              {rowError[user.id]}
+                            </span>
+                          )}
+                        </div>
+                      )}
+                    </TableCell>
+                    <TableCell>
+                      <div className="flex flex-col gap-0.5">
+                        {user.email_enabled && user.email_address ? (
+                          <div className="flex items-center gap-1.5">
+                            <span className="text-sm text-charcoal truncate max-w-[180px]" title={user.email_address}>
+                              {user.email_address}
+                            </span>
+                            <button
+                              onClick={() => copyToClipboard(user.email_address!, user.id)}
+                              className="text-warm-gray hover:text-charcoal transition-colors cursor-pointer"
+                              title="Copy address"
+                            >
+                              <Copy size={11} />
+                            </button>
+                          </div>
+                        ) : (
+                          <span className="text-sm text-warm-gray/40 italic">—</span>
+                        )}
+                      </div>
+                    </TableCell>
+                    <TableCell>
+                      {editingId === user.id ? (
+                        <div className="flex gap-1.5">
+                          <Button
+                            size="sm"
+                            variant="default"
+                            onClick={() => saveWhatsapp(user.id)}
+                          >
+                            <Check size={12} />
+                            Save
+                          </Button>
+                          <Button
+                            size="sm"
+                            variant="ghost-dark"
+                            onClick={cancelEdit}
+                          >
+                            Cancel
+                          </Button>
+                        </div>
+                      ) : (
+                        <div className="flex gap-1.5">
+                          <Button
+                            size="sm"
+                            variant="ghost-dark"
+                            onClick={() => startEdit(user)}
+                          >
+                            <Pencil size={11} />
+                            Edit
+                          </Button>
+                          {user.whatsapp_number && (
+                            <Button
+                              size="sm"
+                              variant="destructive"
+                              onClick={() => unlinkWhatsapp(user.id)}
+                            >
+                              <PhoneOff size={11} />
+                              Unlink
+                            </Button>
+                          )}
+                          {user.email_enabled ? (
+                            <Button
+                              size="sm"
+                              variant="destructive"
+                              onClick={() => disableEmail(user.id)}
+                            >
+                              <Mail size={11} />
+                              Email
+                            </Button>
+                          ) : (
+                            <Button
+                              size="sm"
+                              variant="ghost-dark"
+                              onClick={() => toggleEmail(user.id)}
+                            >
+                              <Mail size={11} />
+                              Email
+                            </Button>
+                          )}
+                        </div>
+                      )}
+                    </TableCell>
+                  </TableRow>
+                ))}
+              </TableBody>
+            </Table>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+};

raggr-frontend/src/components/AnswerBubble.tsx

@@ -0,0 +1,39 @@
+import ReactMarkdown from "react-markdown";
+import { cn } from "../lib/utils";
+
+type AnswerBubbleProps = {
+  text: string;
+  loading?: boolean;
+};
+
+export const AnswerBubble = ({ text, loading }: AnswerBubbleProps) => {
+  return (
+    <div className="flex justify-start message-enter">
+      <div
+        className={cn(
+          "max-w-[78%] rounded-3xl rounded-bl-md",
+          "bg-warm-white border border-sand-light/70",
+          "shadow-sm shadow-sand/30",
+          "overflow-hidden",
+        )}
+      >
+        {/* amber accent bar */}
+        <div className="h-0.5 w-full bg-gradient-to-r from-amber-soft via-amber-glow/50 to-transparent" />
+
+        <div className="px-4 py-3">
+          {loading ? (
+            <div className="flex items-center gap-1.5 py-1 px-1">
+              <span className="loading-dot w-2 h-2 rounded-full bg-amber-soft inline-block" />
+              <span className="loading-dot w-2 h-2 rounded-full bg-amber-soft inline-block" />
+              <span className="loading-dot w-2 h-2 rounded-full bg-amber-soft inline-block" />
+            </div>
+          ) : (
+            <div className="markdown-content text-sm leading-relaxed text-charcoal">
+              <ReactMarkdown>{text}</ReactMarkdown>
+            </div>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+};

raggr-frontend/src/components/ChatScreen.tsx

@@ -0,0 +1,436 @@
+import { useEffect, useState, useRef } from "react";
+import { LogOut, Shield, PanelLeftClose, PanelLeftOpen, Menu, X } from "lucide-react";
+import { conversationService } from "../api/conversationService";
+import { userService } from "../api/userService";
+import { QuestionBubble } from "./QuestionBubble";
+import { AnswerBubble } from "./AnswerBubble";
+import { ToolBubble } from "./ToolBubble";
+import { MessageInput } from "./MessageInput";
+import { ConversationList } from "./ConversationList";
+import { AdminPanel } from "./AdminPanel";
+import { cn } from "../lib/utils";
+import catIcon from "../assets/cat.png";
+
+type Message = {
+  text: string;
+  speaker: "simba" | "user" | "tool";
+  image_key?: string | null;
+};
+
+type Conversation = {
+  title: string;
+  id: string;
+};
+
+type ChatScreenProps = {
+  setAuthenticated: (isAuth: boolean) => void;
+};
+
+const TOOL_MESSAGES: Record<string, string> = {
+  simba_search: "🔍 Searching Simba's records...",
+  web_search: "🌐 Searching the web...",
+  get_current_date: "📅 Checking today's date...",
+  ynab_budget_summary: "💰 Checking budget summary...",
+  ynab_search_transactions: "💳 Looking up transactions...",
+  ynab_category_spending: "📊 Analyzing category spending...",
+  ynab_insights: "📈 Generating budget insights...",
+  obsidian_search_notes: "📝 Searching notes...",
+  obsidian_read_note: "📖 Reading note...",
+  obsidian_create_note: "✏️ Saving note...",
+  obsidian_create_task: "✅ Creating task...",
+  journal_get_today: "📔 Reading today's journal...",
+  journal_get_tasks: "📋 Getting tasks...",
+  journal_add_task: "➕ Adding task...",
+  journal_complete_task: "✔️ Completing task...",
+};
+
+export const ChatScreen = ({ setAuthenticated }: ChatScreenProps) => {
+  const [query, setQuery] = useState<string>("");
+  const [simbaMode, setSimbaMode] = useState<boolean>(false);
+  const [messages, setMessages] = useState<Message[]>([]);
+  const [conversations, setConversations] = useState<Conversation[]>([]);
+  const [showConversations, setShowConversations] = useState<boolean>(false);
+  const [selectedConversation, setSelectedConversation] =
+    useState<Conversation | null>(null);
+  const [sidebarCollapsed, setSidebarCollapsed] = useState<boolean>(false);
+  const [isLoading, setIsLoading] = useState<boolean>(false);
+  const [isAdmin, setIsAdmin] = useState<boolean>(false);
+  const [showAdminPanel, setShowAdminPanel] = useState<boolean>(false);
+  const [pendingImage, setPendingImage] = useState<File | null>(null);
+
+  const messagesEndRef = useRef<HTMLDivElement>(null);
+  const isMountedRef = useRef<boolean>(true);
+  const abortControllerRef = useRef<AbortController | null>(null);
+  const simbaAnswers = ["meow.", "hiss...", "purrrrrr", "yowOWROWWowowr"];
+
+  const scrollToBottom = () => {
+    messagesEndRef.current?.scrollIntoView({ behavior: "smooth" });
+  };
+
+  useEffect(() => {
+    isMountedRef.current = true;
+    return () => {
+      isMountedRef.current = false;
+      abortControllerRef.current?.abort();
+    };
+  }, []);
+
+  const handleSelectConversation = (conversation: Conversation) => {
+    setShowConversations(false);
+    setSelectedConversation(conversation);
+    const load = async () => {
+      try {
+        const fetched = await conversationService.getConversation(conversation.id);
+        setMessages(
+          fetched.messages.map((m) => ({ text: m.text, speaker: m.speaker, image_key: m.image_key })),
+        );
+      } catch (err) {
+        console.error("Failed to load messages:", err);
+      }
+    };
+    load();
+  };
+
+  const loadConversations = async () => {
+    try {
+      const fetched = await conversationService.getAllConversations();
+      const parsed = fetched.map((c) => ({ id: c.id, title: c.name }));
+      setConversations(parsed);
+    } catch (err) {
+      console.error("Failed to load conversations:", err);
+    }
+  };
+
+  const handleCreateNewConversation = async () => {
+    const newConv = await conversationService.createConversation();
+    await loadConversations();
+    setSelectedConversation({ title: newConv.name, id: newConv.id });
+  };
+
+  useEffect(() => {
+    loadConversations();
+    userService.getMe().then((me) => setIsAdmin(me.is_admin)).catch(() => {});
+  }, []);
+
+  useEffect(() => {
+    scrollToBottom();
+  }, [messages]);
+
+  useEffect(() => {
+    const load = async () => {
+      if (!selectedConversation) return;
+      try {
+        const conv = await conversationService.getConversation(selectedConversation.id);
+        setSelectedConversation({ id: conv.id, title: conv.name });
+        setMessages(conv.messages.map((m) => ({ text: m.text, speaker: m.speaker, image_key: m.image_key })));
+      } catch (err) {
+        console.error("Failed to load messages:", err);
+      }
+    };
+    load();
+  }, [selectedConversation?.id]);
+
+  const handleQuestionSubmit = async () => {
+    if ((!query.trim() && !pendingImage) || isLoading) return;
+
+    let activeConversation = selectedConversation;
+    if (!activeConversation) {
+      const newConv = await conversationService.createConversation();
+      activeConversation = { title: newConv.name, id: newConv.id };
+      setSelectedConversation(activeConversation);
+      setConversations((prev) => [activeConversation!, ...prev]);
+    }
+
+    // Capture pending image before clearing state
+    const imageFile = pendingImage;
+
+    const currMessages = messages.concat([{ text: query, speaker: "user" }]);
+    setMessages(currMessages);
+    setQuery("");
+    setPendingImage(null);
+    setIsLoading(true);
+
+    if (simbaMode) {
+      const randomElement = simbaAnswers[Math.floor(Math.random() * simbaAnswers.length)];
+      setMessages((prev) => prev.concat([{ text: randomElement, speaker: "simba" }]));
+      setIsLoading(false);
+      return;
+    }
+
+    const abortController = new AbortController();
+    abortControllerRef.current = abortController;
+
+    try {
+      // Upload image first if present
+      let imageKey: string | undefined;
+      if (imageFile) {
+        const uploadResult = await conversationService.uploadImage(
+          imageFile,
+          activeConversation.id,
+        );
+        imageKey = uploadResult.image_key;
+
+        // Update the user message with the image key
+        setMessages((prev) => {
+          const updated = [...prev];
+          // Find the last user message we just added
+          for (let i = updated.length - 1; i >= 0; i--) {
+            if (updated[i].speaker === "user") {
+              updated[i] = { ...updated[i], image_key: imageKey };
+              break;
+            }
+          }
+          return updated;
+        });
+      }
+
+      await conversationService.streamQuery(
+        query,
+        activeConversation.id,
+        (event) => {
+          if (!isMountedRef.current) return;
+          if (event.type === "tool_start") {
+            const friendly = TOOL_MESSAGES[event.tool] ?? `🔧 Using ${event.tool}...`;
+            setMessages((prev) => prev.concat([{ text: friendly, speaker: "tool" }]));
+          } else if (event.type === "response") {
+            setMessages((prev) => prev.concat([{ text: event.message, speaker: "simba" }]));
+          } else if (event.type === "error") {
+            console.error("Stream error:", event.message);
+          }
+        },
+        abortController.signal,
+        imageKey,
+      );
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") {
+        console.log("Request was aborted");
+      } else {
+        console.error("Failed to send query:", error);
+        if (error instanceof Error && error.message.includes("Session expired")) {
+          setAuthenticated(false);
+        }
+      }
+    } finally {
+      if (isMountedRef.current) setIsLoading(false);
+      abortControllerRef.current = null;
+    }
+  };
+
+  const handleQueryChange = (event: React.ChangeEvent<HTMLTextAreaElement>) => {
+    setQuery(event.target.value);
+  };
+
+  const handleKeyDown = (event: React.ChangeEvent<HTMLTextAreaElement>) => {
+    const kev = event as unknown as React.KeyboardEvent<HTMLTextAreaElement>;
+    if (kev.key === "Enter" && !kev.shiftKey) {
+      kev.preventDefault();
+      handleQuestionSubmit();
+    }
+  };
+
+  const handleLogout = () => {
+    localStorage.removeItem("access_token");
+    localStorage.removeItem("refresh_token");
+    setAuthenticated(false);
+  };
+
+  return (
+    <div className="h-screen h-[100dvh] flex flex-row bg-cream overflow-hidden">
+      {/* ── Desktop Sidebar ─────────────────────────────── */}
+      <aside
+        className={cn(
+          "hidden md:flex md:flex-col",
+          "bg-sidebar-bg transition-all duration-300 ease-in-out",
+          sidebarCollapsed ? "w-[56px]" : "w-64",
+        )}
+      >
+        {sidebarCollapsed ? (
+          /* Collapsed state */
+          <div className="flex flex-col items-center py-4 gap-4 h-full">
+            <button
+              onClick={() => setSidebarCollapsed(false)}
+              className="w-9 h-9 rounded-xl flex items-center justify-center text-cream/50 hover:text-cream hover:bg-white/10 transition-all cursor-pointer"
+            >
+              <PanelLeftOpen size={18} />
+            </button>
+            <img
+              src={catIcon}
+              alt="Simba"
+              className="w-12 h-12 opacity-70 mt-1"
+            />
+          </div>
+        ) : (
+          /* Expanded state */
+          <div className="flex flex-col h-full">
+            {/* Header */}
+            <div className="flex items-center justify-between px-4 py-4 border-b border-white/8">
+              <div className="flex items-center gap-2.5">
+                <img src={catIcon} alt="Simba" className="w-12 h-12" />
+                <h2
+                  className="text-lg font-bold text-cream tracking-tight"
+                  style={{ fontFamily: "var(--font-display)" }}
+                >
+                  asksimba
+                </h2>
+              </div>
+              <button
+                onClick={() => setSidebarCollapsed(true)}
+                className="w-7 h-7 rounded-lg flex items-center justify-center text-cream/40 hover:text-cream hover:bg-white/10 transition-all cursor-pointer"
+              >
+                <PanelLeftClose size={15} />
+              </button>
+            </div>
+
+            {/* Conversations */}
+            <div className="flex-1 overflow-y-auto px-2 py-3">
+              <ConversationList
+                conversations={conversations}
+                onCreateNewConversation={handleCreateNewConversation}
+                onSelectConversation={handleSelectConversation}
+                selectedId={selectedConversation?.id}
+              />
+            </div>
+
+            {/* Footer */}
+            <div className="px-2 pb-3 pt-2 border-t border-white/8 flex flex-col gap-0.5">
+              {isAdmin && (
+                <button
+                  onClick={() => setShowAdminPanel(true)}
+                  className="flex items-center gap-2 w-full px-3 py-2 rounded-xl text-sm text-cream/50 hover:text-cream hover:bg-white/8 transition-all cursor-pointer"
+                >
+                  <Shield size={14} />
+                  <span>Admin</span>
+                </button>
+              )}
+              <button
+                onClick={handleLogout}
+                className="flex items-center gap-2 w-full px-3 py-2 rounded-xl text-sm text-cream/50 hover:text-cream hover:bg-white/8 transition-all cursor-pointer"
+              >
+                <LogOut size={14} />
+                <span>Sign out</span>
+              </button>
+            </div>
+          </div>
+        )}
+      </aside>
+
+      {/* Admin Panel modal */}
+      {showAdminPanel && <AdminPanel onClose={() => setShowAdminPanel(false)} />}
+
+      {/* ── Main chat area ──────────────────────────────── */}
+      <div className="flex-1 flex flex-col h-full overflow-hidden min-w-0">
+        {/* Mobile header */}
+        <header className="md:hidden flex items-center justify-between px-4 py-3 bg-warm-white border-b border-sand-light/60">
+          <div className="flex items-center gap-2">
+            <img src={catIcon} alt="Simba" className="w-12 h-12" />
+            <h1
+              className="text-base font-bold text-charcoal"
+              style={{ fontFamily: "var(--font-display)" }}
+            >
+              asksimba
+            </h1>
+          </div>
+          <div className="flex items-center gap-2">
+            <button
+              className="w-8 h-8 rounded-xl flex items-center justify-center text-warm-gray hover:text-charcoal hover:bg-cream-dark transition-all cursor-pointer"
+              onClick={() => setShowConversations((v) => !v)}
+            >
+              {showConversations ? <X size={16} /> : <Menu size={16} />}
+            </button>
+            <button
+              className="w-8 h-8 rounded-xl flex items-center justify-center text-warm-gray hover:text-charcoal hover:bg-cream-dark transition-all cursor-pointer"
+              onClick={handleLogout}
+            >
+              <LogOut size={15} />
+            </button>
+          </div>
+        </header>
+
+        {messages.length === 0 ? (
+          /* ── Empty / homepage state ── */
+          <div className="flex-1 flex flex-col items-center justify-center px-4 gap-6">
+            {/* Mobile conversation drawer */}
+            {showConversations && (
+              <div className="md:hidden w-full max-w-2xl bg-warm-white rounded-2xl border border-sand-light p-3 shadow-sm">
+                <ConversationList
+                  conversations={conversations}
+                  onCreateNewConversation={handleCreateNewConversation}
+                  onSelectConversation={handleSelectConversation}
+                  selectedId={selectedConversation?.id}
+                  variant="light"
+                />
+              </div>
+            )}
+            <div className="relative">
+              <div className="absolute -inset-6 bg-amber-soft/20 rounded-full blur-3xl" />
+              <img src={catIcon} alt="Simba" className="relative w-36 h-36" />
+            </div>
+            <h1
+              className="text-2xl font-bold text-charcoal"
+              style={{ fontFamily: "var(--font-display)" }}
+            >
+              Ask me anything
+            </h1>
+            <div className="w-full max-w-2xl">
+              <MessageInput
+                query={query}
+                handleQueryChange={handleQueryChange}
+                handleKeyDown={handleKeyDown}
+                handleQuestionSubmit={handleQuestionSubmit}
+                setSimbaMode={setSimbaMode}
+                isLoading={isLoading}
+                pendingImage={pendingImage}
+                onImageSelect={(file) => setPendingImage(file)}
+                onClearImage={() => setPendingImage(null)}
+              />
+            </div>
+          </div>
+        ) : (
+          /* ── Active chat state ── */
+          <>
+            <div className="flex-1 overflow-y-auto px-4 py-6">
+              <div className="max-w-2xl mx-auto flex flex-col gap-3">
+                {/* Mobile conversation drawer */}
+                {showConversations && (
+                  <div className="md:hidden mb-3 bg-warm-white rounded-2xl border border-sand-light p-3 shadow-sm">
+                    <ConversationList
+                      conversations={conversations}
+                      onCreateNewConversation={handleCreateNewConversation}
+                      onSelectConversation={handleSelectConversation}
+                      selectedId={selectedConversation?.id}
+                      variant="light"
+                    />
+                  </div>
+                )}
+
+                {messages.map((msg, index) => {
+                  if (msg.speaker === "tool")
+                    return <ToolBubble key={index} text={msg.text} />;
+                  if (msg.speaker === "simba")
+                    return <AnswerBubble key={index} text={msg.text} />;
+                  return <QuestionBubble key={index} text={msg.text} image_key={msg.image_key} />;
+                })}
+
+                {isLoading && <AnswerBubble text="" loading={true} />}
+                <div ref={messagesEndRef} />
+              </div>
+            </div>
+
+            <footer className="border-t border-sand-light/40 bg-cream/80 backdrop-blur-sm">
+              <div className="max-w-2xl mx-auto px-4 py-3">
+                <MessageInput
+                  query={query}
+                  handleQueryChange={handleQueryChange}
+                  handleKeyDown={handleKeyDown}
+                  handleQuestionSubmit={handleQuestionSubmit}
+                  setSimbaMode={setSimbaMode}
+                  isLoading={isLoading}
+                />
+              </div>
+            </footer>
+          </>
+        )}
+      </div>
+    </div>
+  );
+};

raggr-frontend/src/components/ConversationList.tsx

@@ -0,0 +1,91 @@
+import { useState, useEffect } from "react";
+import { Plus } from "lucide-react";
+import { cn } from "../lib/utils";
+import { conversationService } from "../api/conversationService";
+
+type Conversation = {
+  title: string;
+  id: string;
+};
+
+type ConversationProps = {
+  conversations: Conversation[];
+  onSelectConversation: (conversation: Conversation) => void;
+  onCreateNewConversation: () => void;
+  selectedId?: string;
+  variant?: "dark" | "light";
+};
+
+export const ConversationList = ({
+  conversations,
+  onSelectConversation,
+  onCreateNewConversation,
+  selectedId,
+  variant = "dark",
+}: ConversationProps) => {
+  const [items, setItems] = useState(conversations);
+
+  useEffect(() => {
+    const load = async () => {
+      try {
+        let fetched = await conversationService.getAllConversations();
+        if (fetched.length === 0) {
+          await conversationService.createConversation();
+          fetched = await conversationService.getAllConversations();
+        }
+        setItems(fetched.map((c) => ({ id: c.id, title: c.name })));
+      } catch (err) {
+        console.error("Failed to load conversations:", err);
+      }
+    };
+    load();
+  }, []);
+
+  // Keep in sync when parent updates conversations
+  useEffect(() => {
+    setItems(conversations);
+  }, [conversations]);
+
+  return (
+    <div className="flex flex-col gap-1">
+      {/* New thread button */}
+      <button
+        onClick={onCreateNewConversation}
+        className={cn(
+          "flex items-center gap-2 w-full px-3 py-2 rounded-xl",
+          "text-sm transition-all duration-150 cursor-pointer mb-1",
+          variant === "dark"
+            ? "text-cream/60 hover:text-cream hover:bg-white/8"
+            : "text-warm-gray hover:text-charcoal hover:bg-cream-dark",
+        )}
+      >
+        <Plus size={14} strokeWidth={2.5} />
+        <span>New thread</span>
+      </button>
+
+      {/* Conversation items */}
+      {items.map((conv) => {
+        const isActive = conv.id === selectedId;
+        return (
+          <button
+            key={conv.id}
+            onClick={() => onSelectConversation(conv)}
+            className={cn(
+              "w-full px-3 py-2 rounded-xl text-left",
+              "text-sm truncate transition-all duration-150 cursor-pointer",
+              variant === "dark"
+                ? isActive
+                  ? "bg-white/12 text-cream font-medium"
+                  : "text-cream/60 hover:text-cream hover:bg-white/8"
+                : isActive
+                  ? "bg-cream-dark text-charcoal font-medium"
+                  : "text-warm-gray hover:text-charcoal hover:bg-cream-dark",
+            )}
+          >
+            {conv.title}
+          </button>
+        );
+      })}
+    </div>
+  );
+};

raggr-frontend/src/components/LoginScreen.tsx

@@ -0,0 +1,162 @@
+import { useState, useEffect } from "react";
+import { userService } from "../api/userService";
+import { oidcService } from "../api/oidcService";
+import catIcon from "../assets/cat.png";
+import { cn } from "../lib/utils";
+
+type LoginScreenProps = {
+  setAuthenticated: (isAuth: boolean) => void;
+};
+
+export const LoginScreen = ({ setAuthenticated }: LoginScreenProps) => {
+  const [error, setError] = useState<string>("");
+  const [isChecking, setIsChecking] = useState<boolean>(true);
+  const [isLoggingIn, setIsLoggingIn] = useState<boolean>(false);
+
+  useEffect(() => {
+    const initAuth = async () => {
+      const callbackParams = oidcService.getCallbackParamsFromURL();
+      if (callbackParams) {
+        try {
+          setIsLoggingIn(true);
+          const result = await oidcService.handleCallback(
+            callbackParams.code,
+            callbackParams.state,
+          );
+          localStorage.setItem("access_token", result.access_token);
+          localStorage.setItem("refresh_token", result.refresh_token);
+          oidcService.clearCallbackParams();
+          setAuthenticated(true);
+          setIsChecking(false);
+          return;
+        } catch (err) {
+          console.error("OIDC callback error:", err);
+          setError("Login failed. Please try again.");
+          oidcService.clearCallbackParams();
+          setIsLoggingIn(false);
+          setIsChecking(false);
+          return;
+        }
+      }
+      const isValid = await userService.validateToken();
+      if (isValid) setAuthenticated(true);
+      setIsChecking(false);
+    };
+    initAuth();
+  }, [setAuthenticated]);
+
+  const handleOIDCLogin = async () => {
+    try {
+      setIsLoggingIn(true);
+      setError("");
+      const authUrl = await oidcService.initiateLogin();
+      window.location.href = authUrl;
+    } catch {
+      setError("Failed to initiate login. Please try again.");
+      setIsLoggingIn(false);
+    }
+  };
+
+  if (isChecking || isLoggingIn) {
+    return (
+      <div className="h-screen flex flex-col items-center justify-center bg-cream gap-4">
+        {/* Subtle dot grid */}
+        <div
+          className="fixed inset-0 pointer-events-none opacity-[0.035]"
+          style={{
+            backgroundImage: `radial-gradient(circle, var(--color-charcoal) 1px, transparent 0)`,
+            backgroundSize: "22px 22px",
+          }}
+        />
+        <div className="relative">
+          <div className="absolute -inset-4 bg-amber-soft/30 rounded-full blur-2xl" />
+          <img
+            src={catIcon}
+            alt="Simba"
+            className="relative w-14 h-14 animate-bounce drop-shadow"
+          />
+        </div>
+        <p className="text-warm-gray text-sm tracking-wide font-medium">
+          {isLoggingIn ? "letting you in..." : "checking credentials..."}
+        </p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="h-screen bg-cream flex items-center justify-center p-4 relative overflow-hidden">
+      {/* Background dot texture */}
+      <div
+        className="fixed inset-0 pointer-events-none opacity-[0.04]"
+        style={{
+          backgroundImage: `radial-gradient(circle, var(--color-charcoal) 1px, transparent 0)`,
+          backgroundSize: "22px 22px",
+        }}
+      />
+
+      {/* Decorative background blobs */}
+      <div className="absolute top-1/4 -left-20 w-72 h-72 rounded-full bg-leaf-pale/60 blur-3xl pointer-events-none" />
+      <div className="absolute bottom-1/4 -right-20 w-64 h-64 rounded-full bg-amber-pale/70 blur-3xl pointer-events-none" />
+
+      <div className="relative w-full max-w-sm">
+        {/* Branding */}
+        <div className="flex flex-col items-center mb-8">
+          <div className="relative mb-5">
+            <div className="absolute -inset-5 bg-amber-soft/30 rounded-full blur-2xl" />
+            <img
+              src={catIcon}
+              alt="Simba"
+              className="relative w-20 h-20 drop-shadow-lg"
+            />
+          </div>
+          <h1
+            className="text-4xl font-bold text-charcoal tracking-tight"
+            style={{ fontFamily: "var(--font-display)" }}
+          >
+            asksimba
+          </h1>
+          <p className="text-warm-gray text-sm mt-1.5 tracking-wide">
+            your feline knowledge companion
+          </p>
+        </div>
+
+        {/* Card */}
+        <div
+          className={cn(
+            "bg-warm-white rounded-3xl border border-sand-light",
+            "shadow-xl shadow-sand/30 p-8",
+          )}
+        >
+          {error && (
+            <div className="mb-5 text-sm bg-red-50 text-red-600 px-4 py-3 rounded-2xl border border-red-200">
+              {error}
+            </div>
+          )}
+
+          <p className="text-center text-warm-gray text-sm mb-6">
+            Sign in to start chatting with Simba
+          </p>
+
+          <button
+            onClick={handleOIDCLogin}
+            disabled={isLoggingIn}
+            className={cn(
+              "w-full py-3.5 px-4 rounded-2xl text-sm font-semibold tracking-wide",
+              "bg-forest text-cream",
+              "shadow-md shadow-forest/20",
+              "hover:bg-forest-mid hover:shadow-lg hover:shadow-forest/30",
+              "active:scale-[0.98] disabled:opacity-50 disabled:cursor-not-allowed",
+              "transition-all duration-200 cursor-pointer",
+            )}
+          >
+            {isLoggingIn ? "Redirecting..." : "Sign in with Authelia"}
+          </button>
+        </div>
+
+        <p className="text-center text-sand mt-5 text-xs tracking-widest select-none">
+          ✦ meow ✦
+        </p>
+      </div>
+    </div>
+  );
+};

raggr-frontend/src/components/MessageInput.tsx

@@ -0,0 +1,148 @@
+import { useRef, useState } from "react";
+import { ArrowUp, ImagePlus, X } from "lucide-react";
+import { cn } from "../lib/utils";
+import { Textarea } from "./ui/textarea";
+
+type MessageInputProps = {
+  handleQueryChange: (event: React.ChangeEvent<HTMLTextAreaElement>) => void;
+  handleKeyDown: (event: React.ChangeEvent<HTMLTextAreaElement>) => void;
+  handleQuestionSubmit: () => void;
+  setSimbaMode: (val: boolean) => void;
+  query: string;
+  isLoading: boolean;
+  pendingImage: File | null;
+  onImageSelect: (file: File) => void;
+  onClearImage: () => void;
+};
+
+export const MessageInput = ({
+  query,
+  handleKeyDown,
+  handleQueryChange,
+  handleQuestionSubmit,
+  setSimbaMode,
+  isLoading,
+  pendingImage,
+  onImageSelect,
+  onClearImage,
+}: MessageInputProps) => {
+  const [simbaMode, setLocalSimbaMode] = useState(false);
+  const fileInputRef = useRef<HTMLInputElement>(null);
+
+  const toggleSimbaMode = () => {
+    const next = !simbaMode;
+    setLocalSimbaMode(next);
+    setSimbaMode(next);
+  };
+
+  const handleFileChange = (e: React.ChangeEvent<HTMLInputElement>) => {
+    const file = e.target.files?.[0];
+    if (file) {
+      onImageSelect(file);
+    }
+    // Reset so the same file can be re-selected
+    e.target.value = "";
+  };
+
+  const canSend = !isLoading && (query.trim() || pendingImage);
+
+  return (
+    <div
+      className={cn(
+        "rounded-2xl bg-warm-white border border-sand shadow-md shadow-sand/30",
+        "transition-shadow duration-200 focus-within:shadow-lg focus-within:shadow-amber-soft/20",
+        "focus-within:border-amber-soft/60",
+      )}
+    >
+      {/* Image preview */}
+      {pendingImage && (
+        <div className="px-3 pt-3">
+          <div className="relative inline-block">
+            <img
+              src={URL.createObjectURL(pendingImage)}
+              alt="Pending upload"
+              className="h-20 rounded-lg object-cover border border-sand"
+            />
+            <button
+              type="button"
+              onClick={onClearImage}
+              className="absolute -top-1.5 -right-1.5 w-5 h-5 rounded-full bg-charcoal text-white flex items-center justify-center hover:bg-charcoal/80 transition-colors cursor-pointer"
+            >
+              <X size={12} />
+            </button>
+          </div>
+        </div>
+      )}
+
+      {/* Textarea */}
+      <Textarea
+        onChange={handleQueryChange}
+        onKeyDown={handleKeyDown}
+        value={query}
+        rows={2}
+        placeholder="Ask Simba anything..."
+        className="min-h-[60px] max-h-40"
+      />
+
+      {/* Hidden file input */}
+      <input
+        ref={fileInputRef}
+        type="file"
+        accept="image/*"
+        onChange={handleFileChange}
+        className="hidden"
+      />
+
+      {/* Bottom toolbar */}
+      <div className="flex items-center justify-between px-3 pb-2.5 pt-1">
+        <div className="flex items-center gap-3">
+          {/* Simba mode toggle */}
+          <button
+            type="button"
+            onClick={toggleSimbaMode}
+            className="flex items-center gap-2 group cursor-pointer select-none"
+          >
+            <div className={cn("toggle-track", simbaMode && "checked")}>
+              <div className="toggle-thumb" />
+            </div>
+            <span className="text-xs text-warm-gray group-hover:text-charcoal transition-colors">
+              simba mode
+            </span>
+          </button>
+
+          {/* Image attach button */}
+          <button
+            type="button"
+            onClick={() => fileInputRef.current?.click()}
+            disabled={isLoading}
+            className={cn(
+              "w-7 h-7 rounded-lg flex items-center justify-center transition-all cursor-pointer",
+              isLoading
+                ? "text-warm-gray/40 cursor-not-allowed"
+                : "text-warm-gray hover:text-charcoal hover:bg-cream-dark",
+            )}
+          >
+            <ImagePlus size={16} />
+          </button>
+        </div>
+
+        {/* Send button */}
+        <button
+          type="submit"
+          onClick={handleQuestionSubmit}
+          disabled={!canSend}
+          className={cn(
+            "w-8 h-8 rounded-full flex items-center justify-center",
+            "transition-all duration-200 cursor-pointer",
+            "shadow-sm",
+            !canSend
+              ? "bg-sand text-warm-gray/50 cursor-not-allowed shadow-none"
+              : "bg-amber-glow text-white hover:bg-amber-dark hover:shadow-md hover:shadow-amber-glow/30 active:scale-95",
+          )}
+        >
+          <ArrowUp size={15} strokeWidth={2.5} />
+        </button>
+      </div>
+    </div>
+  );
+};

raggr-frontend/src/components/QuestionBubble.tsx

@@ -0,0 +1,31 @@
+import { cn } from "../lib/utils";
+import { conversationService } from "../api/conversationService";
+
+type QuestionBubbleProps = {
+  text: string;
+  image_key?: string | null;
+};
+
+export const QuestionBubble = ({ text, image_key }: QuestionBubbleProps) => {
+  return (
+    <div className="flex justify-end message-enter">
+      <div
+        className={cn(
+          "max-w-[72%] rounded-3xl rounded-br-md",
+          "bg-leaf-pale border border-leaf-light/60",
+          "px-4 py-3 text-sm leading-relaxed text-charcoal",
+          "shadow-sm shadow-leaf/10",
+        )}
+      >
+        {image_key && (
+          <img
+            src={conversationService.getImageUrl(image_key)}
+            alt="Uploaded image"
+            className="max-w-full rounded-xl mb-2"
+          />
+        )}
+        {text}
+      </div>
+    </div>
+  );
+};

raggr-frontend/src/components/ToolBubble.tsx

@@ -0,0 +1,15 @@
+import { cn } from "../lib/utils";
+
+export const ToolBubble = ({ text }: { text: string }) => (
+  <div className="flex justify-center message-enter">
+    <div
+      className={cn(
+        "inline-flex items-center gap-1.5 px-3 py-1 rounded-full",
+        "bg-leaf-pale border border-leaf-light/50",
+        "text-xs text-leaf-dark italic",
+      )}
+    >
+      {text}
+    </div>
+  </div>
+);

raggr-frontend/src/components/ui/badge.tsx

@@ -0,0 +1,26 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { cn } from "../../lib/utils";
+
+const badgeVariants = cva(
+  "inline-flex items-center gap-1.5 rounded-full px-3 py-1 text-xs font-medium transition-colors",
+  {
+    variants: {
+      variant: {
+        default: "bg-leaf-pale text-leaf-dark border border-leaf-light/50",
+        amber: "bg-amber-pale text-amber-glow border border-amber-soft/40",
+        muted: "bg-sand-light/60 text-warm-gray border border-sand/40",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  },
+);
+
+export interface BadgeProps
+  extends React.HTMLAttributes<HTMLDivElement>,
+    VariantProps<typeof badgeVariants> {}
+
+export const Badge = ({ className, variant, ...props }: BadgeProps) => {
+  return <div className={cn(badgeVariants({ variant }), className)} {...props} />;
+};

raggr-frontend/src/components/ui/button.tsx

@@ -0,0 +1,48 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { cn } from "../../lib/utils";
+
+const buttonVariants = cva(
+  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-xl text-sm font-semibold transition-all duration-200 disabled:pointer-events-none disabled:opacity-50 cursor-pointer select-none",
+  {
+    variants: {
+      variant: {
+        default:
+          "bg-leaf text-white shadow-sm shadow-leaf/20 hover:bg-leaf-dark hover:shadow-md hover:shadow-leaf/30 active:scale-[0.97]",
+        amber:
+          "bg-amber-glow text-white shadow-sm shadow-amber/20 hover:bg-amber-dark hover:shadow-md active:scale-[0.97]",
+        ghost:
+          "text-cream/70 hover:text-cream hover:bg-white/8 active:scale-[0.97]",
+        "ghost-dark":
+          "text-warm-gray hover:text-charcoal hover:bg-sand-light/60 active:scale-[0.97]",
+        outline:
+          "border border-sand bg-transparent text-warm-gray hover:bg-cream-dark hover:text-charcoal active:scale-[0.97]",
+        destructive:
+          "text-red-400 hover:text-red-600 hover:bg-red-50 active:scale-[0.97]",
+      },
+      size: {
+        default: "h-9 px-4 py-2",
+        sm: "h-7 px-3 text-xs",
+        lg: "h-11 px-6 text-base",
+        icon: "h-9 w-9",
+        "icon-sm": "h-7 w-7",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  },
+);
+
+export interface ButtonProps
+  extends React.ButtonHTMLAttributes<HTMLButtonElement>,
+    VariantProps<typeof buttonVariants> {}
+
+export const Button = ({ className, variant, size, ...props }: ButtonProps) => {
+  return (
+    <button
+      className={cn(buttonVariants({ variant, size }), className)}
+      {...props}
+    />
+  );
+};

raggr-frontend/src/components/ui/input.tsx

@@ -0,0 +1,19 @@
+import { cn } from "../../lib/utils";
+
+export interface InputProps
+  extends React.InputHTMLAttributes<HTMLInputElement> {}
+
+export const Input = ({ className, ...props }: InputProps) => {
+  return (
+    <input
+      className={cn(
+        "flex h-8 w-full rounded-lg border border-sand bg-cream px-3 py-1",
+        "text-sm text-charcoal placeholder:text-warm-gray/50",
+        "focus:outline-none focus:ring-2 focus:ring-amber-soft/60",
+        "disabled:cursor-not-allowed disabled:opacity-50",
+        className,
+      )}
+      {...props}
+    />
+  );
+};

raggr-frontend/src/components/ui/table.tsx

@@ -0,0 +1,37 @@
+import { cn } from "../../lib/utils";
+
+export const Table = ({ className, ...props }: React.HTMLAttributes<HTMLTableElement>) => (
+  <table className={cn("w-full caption-bottom text-sm", className)} {...props} />
+);
+
+export const TableHeader = ({ className, ...props }: React.HTMLAttributes<HTMLTableSectionElement>) => (
+  <thead className={cn("[&_tr]:border-b [&_tr]:border-sand-light", className)} {...props} />
+);
+
+export const TableBody = ({ className, ...props }: React.HTMLAttributes<HTMLTableSectionElement>) => (
+  <tbody className={cn("[&_tr:last-child]:border-0", className)} {...props} />
+);
+
+export const TableRow = ({ className, ...props }: React.HTMLAttributes<HTMLTableRowElement>) => (
+  <tr
+    className={cn(
+      "border-b border-sand-light/50 transition-colors hover:bg-cream-dark/40",
+      className,
+    )}
+    {...props}
+  />
+);
+
+export const TableHead = ({ className, ...props }: React.ThHTMLAttributes<HTMLTableCellElement>) => (
+  <th
+    className={cn(
+      "h-10 px-4 text-left align-middle text-xs font-semibold text-warm-gray uppercase tracking-wider",
+      className,
+    )}
+    {...props}
+  />
+);
+
+export const TableCell = ({ className, ...props }: React.TdHTMLAttributes<HTMLTableCellElement>) => (
+  <td className={cn("px-4 py-3 align-middle", className)} {...props} />
+);

raggr-frontend/src/components/ui/textarea.tsx

@@ -0,0 +1,19 @@
+import { cn } from "../../lib/utils";
+
+export interface TextareaProps
+  extends React.TextareaHTMLAttributes<HTMLTextAreaElement> {}
+
+export const Textarea = ({ className, ...props }: TextareaProps) => {
+  return (
+    <textarea
+      className={cn(
+        "flex w-full resize-none rounded-xl border-0 bg-transparent px-3 py-2.5",
+        "text-sm text-charcoal placeholder:text-warm-gray/50",
+        "focus:outline-none",
+        "disabled:cursor-not-allowed disabled:opacity-50",
+        className,
+      )}
+      {...props}
+    />
+  );
+};

raggr-frontend/src/index.tsx

@@ -11,3 +11,9 @@ if (rootEl) {
     </React.StrictMode>,
   );
 }
+
+if ('serviceWorker' in navigator) {
+  window.addEventListener('load', () => {
+    navigator.serviceWorker.register('/sw.js').catch(console.warn);
+  });
+}

raggr-frontend/src/lib/utils.ts

@@ -0,0 +1,6 @@
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}

scripts/index_immich.py

@@ -1,18 +1,21 @@
-import httpx
-import os
-from pathlib import Path
 import logging
-import tempfile
+import os
-
-from image_process import describe_simba_image
-from request import PaperlessNGXService
 import sqlite3
 
+import httpx
+from dotenv import load_dotenv
+import sys
+from pathlib import Path
+
+# Add parent directory to path for imports
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from utils.image_process import describe_simba_image
+from utils.request import PaperlessNGXService
+
 logging.basicConfig(level=logging.INFO)
 
 
-from dotenv import load_dotenv
-
 load_dotenv()
 
 # Configuration from environment variables
@@ -89,7 +92,7 @@ if __name__ == "__main__":
             image_date = description.image_date
 
             description_filepath = os.path.join(
-                "/Users/ryanchen/Programs/raggr", f"SIMBA_DESCRIBE_001.txt"
+                "/Users/ryanchen/Programs/raggr", "SIMBA_DESCRIBE_001.txt"
             )
             file = open(description_filepath, "w+")
             file.write(image_description)

scripts/inspect_vector_store.py

@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+"""CLI tool to inspect the vector store contents."""
+
+import argparse
+import os
+
+from dotenv import load_dotenv
+
+from blueprints.rag.logic import (
+    get_vector_store_stats,
+    index_documents,
+    list_all_documents,
+)
+
+# Load .env from the root directory
+root_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), "../.."))
+env_path = os.path.join(root_dir, ".env")
+load_dotenv(env_path)
+
+
+def print_stats():
+    """Print vector store statistics."""
+    stats = get_vector_store_stats()
+    print("=== Vector Store Statistics ===")
+    print(f"Collection Name: {stats['collection_name']}")
+    print(f"Total Documents: {stats['total_documents']}")
+    print()
+
+
+def print_documents(limit: int = 10, show_content: bool = False):
+    """Print documents in the vector store."""
+    docs = list_all_documents(limit=limit)
+    print(f"=== Documents (showing {len(docs)} of {limit} requested) ===\n")
+
+    for i, doc in enumerate(docs, 1):
+        print(f"Document {i}:")
+        print(f"  ID: {doc['id']}")
+        print(f"  Metadata: {doc['metadata']}")
+        if show_content:
+            print(f"  Content Preview: {doc['content_preview']}")
+        print()
+
+
+async def run_index():
+    """Run the indexing process."""
+    print("Starting indexing process...")
+    await index_documents()
+    print("Indexing complete!")
+    print_stats()
+
+
+def main():
+    import asyncio
+
+    parser = argparse.ArgumentParser(description="Inspect the vector store contents")
+    parser.add_argument(
+        "--stats", action="store_true", help="Show vector store statistics"
+    )
+    parser.add_argument(
+        "--list", type=int, metavar="N", help="List N documents from the vector store"
+    )
+    parser.add_argument(
+        "--show-content",
+        action="store_true",
+        help="Show content preview when listing documents",
+    )
+    parser.add_argument(
+        "--index",
+        action="store_true",
+        help="Index documents from Paperless-NGX into the vector store",
+    )
+
+    args = parser.parse_args()
+
+    # Handle indexing first if requested
+    if args.index:
+        asyncio.run(run_index())
+        return
+
+    # If no arguments provided, show stats by default
+    if not any([args.stats, args.list]):
+        args.stats = True
+
+    if args.stats:
+        print_stats()
+
+    if args.list:
+        print_documents(limit=args.list, show_content=args.show_content)
+
+
+if __name__ == "__main__":
+    main()

scripts/manage_vectorstore.py

@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""Management script for vector store operations."""
+
+import argparse
+import asyncio
+import sys
+
+from blueprints.rag.logic import (
+    get_vector_store_stats,
+    index_documents,
+    list_all_documents,
+    vector_store,
+)
+
+
+def stats():
+    """Show vector store statistics."""
+    stats = get_vector_store_stats()
+    print("=== Vector Store Statistics ===")
+    print(f"Collection: {stats['collection_name']}")
+    print(f"Total Documents: {stats['total_documents']}")
+
+
+async def index():
+    """Index documents from Paperless-NGX."""
+    print("Starting indexing process...")
+    print("Fetching documents from Paperless-NGX...")
+    await index_documents()
+    print("✓ Indexing complete!")
+    stats()
+
+
+async def reindex():
+    """Clear and reindex all documents."""
+    print("Clearing existing documents...")
+    collection = vector_store._collection
+    all_docs = collection.get()
+
+    if all_docs["ids"]:
+        print(f"Deleting {len(all_docs['ids'])} existing documents...")
+        collection.delete(ids=all_docs["ids"])
+        print("✓ Cleared")
+    else:
+        print("Collection is already empty")
+
+    await index()
+
+
+def list_docs(limit: int = 10, show_content: bool = False):
+    """List documents in the vector store."""
+    docs = list_all_documents(limit=limit)
+    print(f"\n=== Documents (showing {len(docs)}) ===\n")
+
+    for i, doc in enumerate(docs, 1):
+        print(f"Document {i}:")
+        print(f"  ID: {doc['id']}")
+        print(f"  Metadata: {doc['metadata']}")
+        if show_content:
+            print(f"  Content: {doc['content_preview']}")
+        print()
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Manage vector store for RAG system",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  %(prog)s stats                    # Show vector store statistics
+  %(prog)s index                    # Index new documents from Paperless-NGX
+  %(prog)s reindex                  # Clear and reindex all documents
+  %(prog)s list 10                  # List first 10 documents
+  %(prog)s list 20 --show-content   # List 20 documents with content preview
+        """,
+    )
+
+    subparsers = parser.add_subparsers(dest="command", help="Command to execute")
+
+    # Stats command
+    subparsers.add_parser("stats", help="Show vector store statistics")
+
+    # Index command
+    subparsers.add_parser("index", help="Index documents from Paperless-NGX")
+
+    # Reindex command
+    subparsers.add_parser("reindex", help="Clear and reindex all documents")
+
+    # List command
+    list_parser = subparsers.add_parser("list", help="List documents in vector store")
+    list_parser.add_argument(
+        "limit", type=int, default=10, nargs="?", help="Number of documents to list"
+    )
+    list_parser.add_argument(
+        "--show-content", action="store_true", help="Show content preview"
+    )
+
+    args = parser.parse_args()
+
+    if not args.command:
+        parser.print_help()
+        sys.exit(1)
+
+    try:
+        if args.command == "stats":
+            stats()
+        elif args.command == "index":
+            asyncio.run(index())
+        elif args.command == "reindex":
+            asyncio.run(reindex())
+        elif args.command == "list":
+            list_docs(limit=args.limit, show_content=args.show_content)
+    except KeyboardInterrupt:
+        print("\n\nOperation cancelled by user")
+        sys.exit(1)
+    except Exception as e:
+        print(f"\n❌ Error: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()