v0.2.0

Changed

• Remote generation and embeddings now speak the OpenAI REST API (/v1/chat/completions, /v1/embeddings) instead of the Hugging Face payload format, so any OpenAI-compatible server — Ollama, vLLM, llama.cpp, TGI, or a hosted gateway — works through one client. Endpoints are the server's /v1 base URL; the model field is the served model name.
• docai_toolkit.hf_client is replaced by docai_toolkit.http_client, which exposes a scheme-guarded HttpClient and an OpenAIClient (chat/embed). RemoteEmbeddings takes a model and calls /v1/embeddings; chat_over_corpus sends chat messages and exposes k for retrieval depth.
• Local generation uses HuggingFacePipeline.invoke instead of the deprecated call form.
• RemoteOcrClient posts the raw PDF to a custom OCR endpoint (unchanged wire format; OCR has no OpenAI-standard route).
• README documents Ollama (laptop/Apple Silicon) and vLLM (NVIDIA/batch) as the blessed local runners.

Added

• EmbeddingConfig.device is now honoured for local embeddings: SentenceTransformerEmbeddings resolves "auto" to CUDA, then Apple Metal (MPS), then CPU (or an explicit cpu/cuda/mps), and build_index_from_markdown forwards it. The knob previously existed but was ignored.
• docai_toolkit.ingest and the docai-ingest CLI: OCR PDFs concurrently, then build a FAISS index in batches with periodic checkpoints and a ledger, so a re-run resumes without re-embedding already-indexed files. Failures on individual PDFs are recorded, not fatal. Consumes the --doc-list from docai-classify.
• docai_toolkit.classify and the docai-classify CLI: recursively triage a file tree into documents / non-documents / quarantine, verifying each file by both extension and detected content type so mislabelled or renamed binaries do not slip through. Emits a JSON manifest and a kept-document list. Content detection prefers python-magic (new classify extra), then the file command, then a built-in signature sniff.

Fixed

• Chat with Docs is wired up again: the question is asked before the worker starts, and the worker now retrieves, generates, and shows the answer instead of discarding the index.
• RAG imports work with langchain >= 0.2 (langchain_text_splitters / langchain_core.embeddings); indexing previously failed with "langchain is required" even when langchain was installed.
• Local embeddings go through a SentenceTransformerEmbeddings adapter, so the default (endpoint-less) index path no longer hands a raw SentenceTransformer to FAISS.
• load_index takes the embeddings it needs and an explicit allow_dangerous_deserialization opt-in; it previously raised unconditionally.
• Worker threads report status through root.after instead of touching Tk directly.
• Default OCR provider is tesseract; the unimplemented deepseek default made OCR fail out of the box.
• Malformed or outdated ~/.docai/config.json falls back to defaults instead of crashing at startup.
• Remote embedding batches are length-checked, and the per-text fallback no longer swallows transport errors.
• pyproject.toml version matches the changelog.

Security

• Endpoints are restricted to https (and http on localhost); arbitrary schemes such as file:// previously turned an endpoint call into a local file read, and http:// sent the bearer token in cleartext.
• ~/.docai/config.json is written 0600 inside a 0700 directory, and a token sourced from the environment is no longer persisted to it. The Settings token field is masked.

Removed

• DeepSeekOcrClient placeholder and the unused OcrConfig.model / OCR Model setting.

Dependencies

• Split dependencies into ocr, rag, llm, all and dev extras so the viewer no longer pulls in torch, bitsandbytes and faiss; pytest moved out of the runtime dependency set.
• requirements.txt is now an exact-pinned set used by the Docker image, and version ranges in pyproject.toml are bounded.
• Replaced the retired PyPDF2 with its maintained successor pypdf.
• Raised the floor to Python 3.11 and added a pytest matrix over 3.11, 3.12, 3.13 and 3.14; the Docker base image moves to python:3.14-slim, pinned by digest.
• Added a [build-system] table and PEP 639 license metadata.
• The docai-viewer console script works from an installed wheel: pdf_viewer_app was never packaged, so the entry point could only fail with ModuleNotFoundError.

CI

• Added Dependabot for pip, GitHub Actions and Docker, with auto-merge for non-major updates and a comment on major ones.
• Pinned every third-party action to a commit SHA.
• Release notes now contain only the section for the tag being released instead of the entire changelog.