Clarify Obfuscator docs and route docstrings

README.md

@@ -40,13 +40,13 @@ The browser sends files one at a time: it waits for the WebDAV `PUT`, then asks
 - `upload/frontend/upload/put_to_vm.js` sends a raw file body with `PUT` and reports progress.
 - `upload/frontend/upload/upload_via_vm.js` coordinates the per-file `PUT` and `/api/upload_refs` requests.
 
-The UI accepts `.pdf`, `.doc`, `.docx`, `.txt`, `.md`, and `.zip` inputs. ZIP inputs are expanded by the processing layer. The picker limits a selected set to 1,000 entries, 50 MiB per entry, and 500 MiB total.
+The UI accepts `.pdf`, `.doc`, `.docx`, `.txt`, `.md`, and `.zip` inputs. ZIP archives are expanded by the browser picker, and their allowed inner files are uploaded individually. The backend `drhider/extractor.py` also expands ZIPs received directly (for example, through `POST /api/upload`). Per-file (50 MiB) and per-session (500 MiB) limits are enforced by the backend; the picker's entry/size/depth limits apply only while unpacking ZIP archives.
 
 ### Flask composition and routes
 
 `site/app.py` creates the Flask application and configures request limits and logging. The platform starts the Flask app from `site/`; it does not deploy this VM buffer config.
 
-`site/routes/__init__.py` registers the page, health, processing API, and `upload_refs` blueprints. `site/routes/main_bp.py` serves the page and picker assets. `site/routes/health_bp.py` exposes `/health` with the application version.
+`site/routes/__init__.py` registers the page, health, processing API, and `upload_refs` blueprints. `site/routes/main_bp.py` serves the page, the picker bundle (`/file-picker/...`), and raw ES modules (`/upload/...`, `/dist/...`). `site/routes/health_bp.py` exposes `/health` with the application version.
 
 Main endpoints:
 
@@ -55,6 +55,7 @@ Main endpoints:
 | `GET /` | Render the browser UI |
 | `GET /health` | Liveness and version response |
 | `GET /file-picker/<path>` | Serve the built picker bundle |
+| `GET /upload/<path>`, `GET /dist/<path>` | Serve raw picker ES modules and dist assets |
 | `POST /api/upload_refs` | Pull browser-uploaded buffer objects into a Flask session |
 | `POST /api/upload` | Direct multipart upload endpoint |
 | `GET /api/session_files/<sid>` | Inspect files in a session (diagnostic endpoint) |
@@ -84,7 +85,7 @@ The core package is split by responsibility:
 
 Processing runs in a worker thread for the SSE endpoint. Progress, per-file events, LLM activity, completion, cancellation, and errors are sent to the browser as SSE events. Cancellation is cooperative; the current operation/file may finish before the worker stops.
 
-The LLM client reads `LLM_KEY` or `LLM_API_KEY`, with optional `LLM_URL` and `LLM_MODEL`, from the Managed Flask environment. The `.doc` converter URL is configured with `CONVERT_SERVICE_URL`. Secrets belong in service environment settings, never in this repository.
+The LLM client reads `LLM_KEY` or `LLM_API_KEY`, with optional `LLM_URL` (default `https://api.aillm.ru/v1/chat/completions`) and `LLM_MODEL` (default `gpt-oss-120b`), from the Managed Flask environment. The `.doc` converter URL is configured with `CONVERT_SERVICE_URL` (default `https://liberta.containerk8s.dev.nubes.ru/convert`); `.doc` files are converted sequentially to avoid overloading the conversion service. Secrets belong in service environment settings, never in this repository.
 
 ## VM213 WebDAV Buffer
 
@@ -97,7 +98,7 @@ The source of the Obfuscator Nginx config is [`deploy/vm213/nginx/obfuscator-upl
 - Maximum Nginx request body: 1 GiB; the Flask upload bridge is stricter at 50 MiB per file.
 - HTTP redirects to HTTPS; the ACME challenge is served from `/var/www/acme`.
 
-The CORS allowlist is for the Obfuscator browser origin. CORS is a browser policy, **not authentication**; direct HTTP clients are not blocked by CORS. The VM disk is temporary staging, not durable storage. A VM or disk failure can lose files that have not yet been pulled by Flask.
+The CORS allowlist is for the Obfuscator browser origin `https://obfuscator.pythonk8s.services.ngcloud.ru`. CORS is a browser policy, **not authentication**; direct HTTP clients are not blocked by CORS. The VM disk is temporary staging, not durable storage. A VM or disk failure can lose files that have not yet been pulled by Flask.
 
 To update the VM config, update this repository source, install the same file on VM213, run `nginx -t`, and reload Nginx only if validation succeeds. The Managed Flask deployment and Nginx deployment are independent; deploying one does not deploy the other.
 

site/app.py

@@ -5,9 +5,10 @@ Obfuscator — Managed Flask приложение на платформе Шту
 Штурвал запускает Flask самостоятельно (без Dockerfile/gunicorn).
 
 Роуты разнесены по blueprint'ам:
-- main_bp: GET /          — веб-интерфейс
+- main_bp: GET / и статика picker — веб-интерфейс
 - health_bp: GET /health          — проверка живости
-- api_bp: POST /api/drhider — обфускация документов
+- api_bp: upload/process_stream/process/download/csv — обфускация документов
+- upload_refs: POST /api/upload_refs — pull файлов с ВМ-буфера в сессию
 """
 
 import os

site/routes/api_bp.py

@@ -1,8 +1,10 @@
 """
 Blueprint: API Obfuscator.
 
-Five endpoints:
-- POST /api/upload         — upload one file -> {session_id}
+Seven endpoints:
+- POST /api/upload                — upload one or more files -> {session_id}
+- GET  /api/session_files/<sid>   — diagnostic list of session files
+- POST /api/cancel/<sid>          — request cooperative stop
 - GET  /api/process_stream/<sid>  — SSE: process files, per-file progress
 - POST /api/process/<sid>         — process all session files -> {status:"done"} (legacy)
 - GET  /api/download/<sid>        — download ZIP (with timestamp name)