# Contributing to TinyWeb

Thanks for helping. TinyWeb is a decentralized search engine built for the
Reticulum mesh. Contributions that respect its architecture and constraints
are welcome.

## Before you start

- Open an issue first for anything beyond a small bug fix to discuss the approach.
- One change per pull request. Keep it focused and reviewable.
- TinyWeb has no authentication by design — PRs adding login or user accounts
  are outside scope unless the architecture changes.

## Setup

```bash
pip install -r requirements.txt
python app.py
```

Open `http://127.0.0.1:8080`. Run with `--bind 0.0.0.0` for LAN access
(see [SECURITY.md](SECURITY.md) about the risks of exposing an unauthenticated app).

## Running checks

Run the test suite before submitting:

```bash
python -m pytest
```

## What fits TinyWeb

- Bug fixes, performance improvements, and mesh reliability work
- New handlers or integrations that respect the no-JS, no-CSS-framework constraint
- Documentation and test coverage
- Edge case handling and error recovery

## What doesn't fit

- Authentication, user accounts, or session systems (by design)
- JavaScript or CSS frameworks (Tailwind, Bootstrap, React, etc.)
- Dependencies that assume internet connectivity or cloud infrastructure
- Database backends other than SQLite
- Features that break local-first or mesh-native operation

## Pull requests

- Target `main`.
- Describe what changed and why.
- Include test output or manual test steps.
- Screenshots for anything visual.
- Use [Conventional Commits](https://www.conventionalcommits.org):
  `fix(search): ...`, `feat(rns): ...`, `docs(readme): ...`

LLM-generated PRs should be preceded by an issue. Unannounced bulk PRs may
be closed without review.

## Code conventions

- No inline `style=""` except for functional margins/padding/alignment
- No JavaScript or CSS frameworks
- No Unicode emoji in UI — use HTML entities or plain text
- No hardcoded paths — use `DATA_DIR` or `TINYWEB_DATA_DIR` env var
- No hardcoded domains, IPs, or destination hashes

## Issue reports

Include: install method, OS, steps to reproduce, expected vs actual.
For mesh issues: interface type, RNS destination hash if relevant.

## Security

See [SECURITY.md](SECURITY.md). Report privately — don't post exploits in issues.