@cybermem/cli 0.9.12 → 0.13.3

package/dist/templates/auth-sidecar/server.js

@@ -2,98 +2,71 @@
  * CyberMem Auth Sidecar
  *
  * ForwardAuth service for Traefik that validates:
- * 1. Bearer tokens (sk-xxx) against SQLite access_keys table
+ * 1. Bearer tokens (sk-xxx) against Docker Secret file (SSoT)
  * 2. Local requests bypass (localhost, *.local domains)
  *
- * NO EXTERNAL DEPENDENCIES - uses built-in crypto and sqlite3.
+ * NO EXTERNAL DEPENDENCIES - uses built-in crypto and fs.
  */
 
 const http = require("http");
 const crypto = require("crypto");
 const path = require("path");
-const sqlite3 = require("sqlite3").verbose();
+const fs = require("fs");
+const SECRET_PATH = process.env.API_KEY_FILE || "/run/secrets/om_api_key";
+let cachedToken = null;
 
 const PORT = process.env.PORT || 3001;
-const DB_PATH = process.env.OM_DB_PATH || "/data/openmemory.sqlite";
-
-// Ensure schema exists
-function initSchema() {
-  const db = new sqlite3.Database(DB_PATH);
-  db.serialize(() => {
-    db.run(
-      `
-      CREATE TABLE IF NOT EXISTS access_keys (
-        key_id TEXT PRIMARY KEY,
-        key_hash TEXT UNIQUE NOT NULL,
-        user_id TEXT NOT NULL,
-        name TEXT,
-        is_active INTEGER DEFAULT 1,
-        created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-      )
-    `,
-      (err) => {
-        if (err) console.error("SCHEMA ERROR:", err.message);
-        else console.log("Schema verified for access_keys");
-        db.close();
-      },
-    );
-  });
-}
-
-initSchema();
-
-// Hash token using same PBKDF2 as CLI (for verification)
-function hashToken(token) {
-  return new Promise((resolve, reject) => {
-    const salt = crypto
-      .createHash("sha256")
-      .update("cybermem-salt-v1")
-      .digest("hex")
-      .slice(0, 16);
-    crypto.pbkdf2(token, salt, 100000, 64, "sha512", (err, key) => {
-      if (err) reject(err);
-      else resolve(key.toString("hex"));
-    });
-  });
-}
 
-// Verify token against SQLite access_keys table
-async function verifyToken(token) {
+// Load token from secret file once at startup (SSoT)
+function loadSecret() {
   try {
-    const db = new sqlite3.Database(DB_PATH);
-
-    const tokenHash = await hashToken(token);
-
-    return new Promise((resolve, reject) => {
-      db.get(
-        "SELECT user_id, name FROM access_keys WHERE key_hash = ? AND is_active = 1",
-        [tokenHash],
-        (err, row) => {
-          db.close();
-          if (err) {
-            console.log("DB error:", err.message);
-            resolve(null);
-          } else if (row) {
-            // Update last_used_at
-            const updateDb = new sqlite3.Database(DB_PATH);
-            updateDb.run(
-              "UPDATE access_keys SET last_used_at = datetime('now') WHERE key_hash = ?",
-              [tokenHash],
-            );
-            updateDb.close();
-            resolve({ userId: row.user_id, name: row.name });
-          } else {
-            resolve(null);
-          }
-        },
+    // 1. Check environment variable first (Direct)
+    if (process.env.OM_API_KEY) {
+      cachedToken = process.env.OM_API_KEY.trim();
+      console.log("SSoT Token loaded from OM_API_KEY env");
+      return;
+    }
+
+    // 2. Check secret/env file (Mapped)
+    if (fs.existsSync(SECRET_PATH)) {
+      const content = fs.readFileSync(SECRET_PATH, "utf8").trim();
+
+      // Check if it's a shell-formatted env file (OM_API_KEY=sk-...)
+      const envMatch = content.match(/OM_API_KEY=["']?(sk-[a-zA-Z0-9]+)["']?/);
+      if (envMatch) {
+        cachedToken = envMatch[1];
+        console.log(`SSoT Token extracted from env file: ${SECRET_PATH}`);
+      } else {
+        // Assume raw token file
+        cachedToken = content;
+        console.log(`SSoT Token loaded from raw file: ${SECRET_PATH}`);
+      }
+    } else {
+      console.warn(
+        `SECRET WARNING: ${SECRET_PATH} not found. Remote auth will fail.`,
       );
-    });
+    }
   } catch (err) {
-    console.log("Token verification error:", err.message);
-    return null;
+    console.error("SECRET LOAD ERROR:", err.message);
   }
 }
 
+loadSecret();
+
+// Verify token against SSoT (file-based)
+async function verifyToken(token) {
+  if (!cachedToken) {
+    // Try one more time if not loaded (e.g. race condition/debug)
+    loadSecret();
+  }
+
+  if (cachedToken && token === cachedToken) {
+    return { userId: "admin", name: "SSoT-Admin" };
+  }
+
+  return null;
+}
+
 // Check if request is from localhost or local network
 function isLocalRequest(req) {
   const forwarded = req.headers["x-forwarded-for"];
@@ -102,21 +75,41 @@ function isLocalRequest(req) {
   const ip =
     forwarded?.split(",")[0]?.trim() || realIp || req.socket.remoteAddress;
 
-  // IP-based local check
+  // 1. First reject Tailscale/Remote requests (.ts.net, 100.x.x.x)
+  // CRITICAL: Tailscale requests (via Funnel) must NEVER be treated as local.
+  // If host contains .ts.net, it's external.
+  // NOTE: Legacy CYBERMEM_TAILSCALE env-flag logic was removed on purpose.
+  //       We now auto-detect Tailscale by host/IP (".ts.net" / "100.x.x.x"),
+  //       so .local bypass works regardless of CYBERMEM_TAILSCALE being set.
+  if (
+    host.includes(".ts.net") ||
+    (typeof ip === "string" && ip.startsWith("100."))
+  ) {
+    return false;
+  }
+
+  // 2. Allow .local (mDNS) bypass for RPi LAN access
+  const hostname = host.split(":")[0];
+  if (hostname.endsWith(".local")) {
+    return true;
+  }
+
+  // Host-based check REMOVED for security (CVE-2026-001)
+  // We only trust loopback IP if not on Tailscale.
+
+  // Allow localhost bypass ONLY for local Dev environment (Docker Desktop)
+  const isDev = process.env.CYBERMEM_INSTANCE === "local";
+  if (isDev && (host.startsWith("localhost") || host.startsWith("127.0.0.1"))) {
+    return true;
+  }
+
   const isLocalIp =
     ip === "127.0.0.1" ||
     ip === "::1" ||
     ip === "::ffff:127.0.0.1" ||
     ip === "localhost";
 
-  // Host-based local check (raspberrypi.local, localhost, *.local)
-  const isLocalHost =
-    host.includes("localhost") ||
-    host.includes("127.0.0.1") ||
-    host.includes("raspberrypi.local") ||
-    host.match(/\.local(:\d+)?$/);
-
-  return isLocalIp || isLocalHost;
+  return isLocalIp;
 }
 
 // ForwardAuth handler
@@ -131,9 +124,47 @@ const server = http.createServer(async (req, res) => {
   const authHeader = req.headers["authorization"];
   const apiKeyHeader = req.headers["x-api-key"];
 
-  // 1. Local bypass - no auth required for localhost
-  if (isLocalRequest(req)) {
-    console.log("Auth OK: Local bypass");
+  // 1. Resolve URI
+  const requestUri = req.headers["x-forwarded-uri"] || req.url || "/";
+  console.log(`[Auth-Sidecar] Processing ${req.method} ${requestUri}`);
+
+  // 2. Public Paths Bypass
+  // We allow Dashboard roots, login paths and essential assets to bypass SSoT token check
+  // The Dashboard itself handles its own session auth.
+  const prefixPublicPaths = [
+    "/auth",
+    "/api/auth",
+    "/api/health",
+    // "/api/metrics", // LEAK FIXED
+    // "/api/stats",   // LEAK FIXED
+    "/api/settings",
+    "/_next",
+    "/favicon",
+    "/static",
+    "/public",
+    "/health",
+    "/login",
+    // "/metrics",     // LEAK FIXED
+    "/clients.json",
+  ];
+
+  const exactPublicPaths = ["/"];
+
+  const isPublic =
+    exactPublicPaths.includes(requestUri) ||
+    prefixPublicPaths.some((p) => requestUri.startsWith(p));
+
+  if (isPublic) {
+    console.log(`[Auth-Sidecar] ✅ Public bypass: ${requestUri}`);
+    res.writeHead(200, { "X-Auth-Method": "public" });
+    res.end();
+    return;
+  }
+
+  // 3. Local bypass
+  const isK3d = process.env.CYBERMEM_INSTANCE === "k3d";
+  if (!isK3d && isLocalRequest(req)) {
+    console.log(`[Auth-Sidecar] ✅ Local bypass: ${requestUri}`);
     res.writeHead(200, {
       "X-Auth-Method": "local",
       "X-User-Id": "local",
@@ -142,32 +173,41 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
-  // 2. Check Bearer token (sk-xxx format)
+  // 4. Token Auth Verification Helper
+  const verifyRequestToken = async (received) => {
+    if (!received) return null;
+    const result = await verifyToken(received);
+    if (!result) {
+      console.log(
+        `[Auth-Sidecar] DEBUG Mismatch: received [${received.substring(0, 5)}...] (len:${received.length}) vs cached [${cachedToken?.substring(0, 5)}...] (len:${cachedToken?.length})`,
+      );
+    }
+    return result;
+  };
+
   if (authHeader?.startsWith("Bearer ")) {
     const token = authHeader.substring(7);
-
-    if (token.startsWith("sk-")) {
-      const result = await verifyToken(token);
-
-      if (result) {
-        console.log(`Auth OK: Token (${result.name || result.userId})`);
-        res.writeHead(200, {
-          "X-User-Id": result.userId,
-          "X-Auth-Method": "token",
-          "X-Token-Name": result.name || "",
-        });
-        res.end();
-        return;
-      }
+    const result = await verifyRequestToken(token);
+    if (result) {
+      console.log(
+        `[Auth-Sidecar] ✅ Auth OK (Bearer): ${result.name || result.userId}`,
+      );
+      res.writeHead(200, {
+        "X-User-Id": result.userId,
+        "X-Auth-Method": "token",
+        "X-Token-Name": result.name || "",
+      });
+      res.end();
+      return;
     }
   }
 
-  // 3. Check X-API-Key header (sk-xxx format)
   if (apiKeyHeader?.startsWith("sk-")) {
-    const result = await verifyToken(apiKeyHeader);
-
+    const result = await verifyRequestToken(apiKeyHeader);
     if (result) {
-      console.log(`Auth OK: API-Key Header (${result.name || result.userId})`);
+      console.log(
+        `[Auth-Sidecar] ✅ Auth OK (X-API-Key): ${result.name || result.userId}`,
+      );
       res.writeHead(200, {
         "X-User-Id": result.userId,
         "X-Auth-Method": "api-key",
@@ -178,8 +218,8 @@ const server = http.createServer(async (req, res) => {
     }
   }
 
-  // 4. Unauthorized
-  console.log("Auth FAILED: No valid token");
+  // 5. Unauthorized
+  console.log(`[Auth-Sidecar] ❌ Auth FAILED: ${requestUri}`);
   res.writeHead(401, { "Content-Type": "application/json" });
   res.end(
     JSON.stringify({
@@ -192,5 +232,4 @@ const server = http.createServer(async (req, res) => {
 
 server.listen(PORT, () => {
   console.log(`Auth sidecar (token-auth) listening on port ${PORT}`);
-  console.log(`DB path: ${DB_PATH}`);
 });

package/dist/templates/charts/cybermem/.helmignore

@@ -0,0 +1,13 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, same as .gitignore.
+#  ...
+.DS_Store
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+.git
+.gitignore
+.idea
+.vscode

package/dist/templates/charts/cybermem/templates/dashboard-deployment.yaml

@@ -1,29 +1,53 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ .Chart.Name }}-dashboard
+  name: "{{ .Chart.Name }}-{{ .Values.global.dashboard.serviceName }}"
   labels:
-    app.kubernetes.io/name: dashboard
+    app.kubernetes.io/name: "{{ .Values.global.dashboard.serviceName }}"
 spec:
   replicas: {{ .Values.dashboard.replicaCount }}
   selector:
     matchLabels:
-      app.kubernetes.io/name: dashboard
+      app.kubernetes.io/name: "{{ .Values.global.dashboard.serviceName }}"
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: dashboard
+        app.kubernetes.io/name: "{{ .Values.global.dashboard.serviceName }}"
     spec:
       containers:
-        - name: dashboard
+        - name: "{{ .Values.global.dashboard.serviceName }}"
           image: "{{ .Values.dashboard.image.repository }}:{{ .Values.dashboard.image.tag }}"
           imagePullPolicy: {{ .Values.dashboard.image.pullPolicy }}
           ports:
             - name: http
-              containerPort: 3000
+              containerPort: {{ .Values.global.dashboard.port }}
               protocol: TCP
           env:
             - name: NEXT_PUBLIC_API_URL
-              value: "http://{{ .Chart.Name }}-openmemory:8080"
+              value: "http://{{ .Chart.Name }}-{{ .Values.global.openmemory.serviceName }}:{{ .Values.global.openmemory.port }}"
+            - name: CYBERMEM_INSTANCE
+              value: "vps"
+            - name: CYBERMEM_ENV
+              value: {{ .Values.env.CYBERMEM_ENV | default "prod" | quote }}
+            - name: POM_API_KEY
+              value: {{ .Values.env.OPENMEMORY_API_KEY | quote }}
+            - name: OM_API_KEY
+              value: {{ .Values.env.OPENMEMORY_API_KEY | quote }}
+            - name: PORT
+              value: {{ .Values.global.dashboard.port | quote }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: api-key
+              mountPath: /run/secrets/om_api_key
+              subPath: om_api_key
+              readOnly: true
           resources:
             {{- toYaml .Values.dashboard.resources | nindent 12 }}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Chart.Name }}-{{ .Values.global.openmemory.serviceName }}-pvc"
+        - name: api-key
+          secret:
+            secretName: "{{ .Chart.Name }}-api-key"

package/dist/templates/charts/cybermem/templates/dashboard-service.yaml

@@ -1,20 +1,20 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ .Chart.Name }}-dashboard
+  name: {{ .Chart.Name }}-{{ .Values.global.dashboard.serviceName }}
 spec:
   type: {{ .Values.dashboard.service.type }}
   ports:
-    - port: {{ .Values.dashboard.service.port }}
+    - port: {{ .Values.global.dashboard.port }}
       targetPort: http
       protocol: TCP
       name: http
     {{- if eq .Values.dashboard.service.type "NodePort" }}
-    - port: {{ .Values.dashboard.service.port }}
+    - port: {{ .Values.global.dashboard.port }}
       targetPort: http
       nodePort: {{ .Values.dashboard.service.nodePort }}
       protocol: TCP
       name: http-node
     {{- end }}
   selector:
-    app.kubernetes.io/name: dashboard
+    app.kubernetes.io/name: {{ .Values.global.dashboard.serviceName }}

package/dist/templates/charts/cybermem/templates/openmemory-deployment.yaml

@@ -1,34 +1,40 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ .Chart.Name }}-openmemory
+  name: {{ .Chart.Name }}-{{ .Values.global.openmemory.serviceName }}
   labels:
-    app.kubernetes.io/name: openmemory
+    app.kubernetes.io/name: {{ .Values.global.openmemory.serviceName }}
 spec:
   replicas: {{ .Values.openmemory.replicaCount }}
   selector:
     matchLabels:
-      app.kubernetes.io/name: openmemory
+      app.kubernetes.io/name: {{ .Values.global.openmemory.serviceName }}
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: openmemory
+        app.kubernetes.io/name: {{ .Values.global.openmemory.serviceName }}
     spec:
       containers:
-        - name: openmemory
+        - name: {{ .Values.global.openmemory.serviceName }}
           image: "{{ .Values.openmemory.image.repository }}:{{ .Values.openmemory.image.tag }}"
           imagePullPolicy: {{ .Values.openmemory.image.pullPolicy }}
           ports:
             - name: http
-              containerPort: 8080
+              containerPort: {{ .Values.global.openmemory.port }}
               protocol: TCP
           env:
             - name: OPENMEMORY_API_KEY
               value: {{ .Values.env.OPENMEMORY_API_KEY | quote }}
             - name: OPENAI_API_KEY
               value: {{ .Values.env.OPENAI_API_KEY | quote }}
-            - name: DB_PATH
+            - name: OM_DB_PATH
               value: "/data/openmemory.sqlite"
+            - name: OM_PORT
+              value: {{ .Values.global.openmemory.port | quote }}
+            - name: CYBERMEM_INSTANCE
+              value: "vps"
+            - name: CYBERMEM_ENV
+              value: "staging"
           volumeMounts:
             - name: data
               mountPath: /data
@@ -37,4 +43,4 @@ spec:
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: {{ .Chart.Name }}-openmemory-pvc
+            claimName: {{ .Chart.Name }}-{{ .Values.global.openmemory.serviceName }}-pvc

package/dist/templates/charts/cybermem/templates/openmemory-service.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ .Chart.Name }}-openmemory
+  name: {{ .Chart.Name }}-{{ .Values.global.openmemory.serviceName }}
 spec:
   type: {{ .Values.openmemory.service.type }}
   ports:
-    - port: {{ .Values.openmemory.service.port }}
+    - port: {{ .Values.global.openmemory.port }}
       targetPort: http
       protocol: TCP
       name: http
   selector:
-    app.kubernetes.io/name: openmemory
+    app.kubernetes.io/name: {{ .Values.global.openmemory.serviceName }}

package/dist/templates/charts/cybermem/templates/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ .Chart.Name }}-api-key"
+  labels:
+    app.kubernetes.io/name: "{{ .Chart.Name }}"
+type: Opaque
+stringData:
+  om_api_key: "{{ .Values.env.OPENMEMORY_API_KEY }}"

package/dist/templates/charts/cybermem/templates/traefik-config.yaml

@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Chart.Name }}-traefik-config
+data:
+  traefik.yml: |
+    accessLog: {}
+    entryPoints:
+      web:
+        address: ":{{ .Values.global.traefik.port }}"
+    providers:
+      file:
+        filename: /etc/traefik/dynamic.yml
+  dynamic.yml: |
+    http:
+      routers:
+        mcp-delete:
+          rule: "Method(`DELETE`)"
+          service: mcp-service
+          entryPoints:
+            - web
+          priority: 300
+        mcp-add:
+          rule: "PathPrefix(`/add`)"
+          service: mcp-service
+          entryPoints:
+            - web
+          priority: 250
+        mcp-query:
+          rule: "PathPrefix(`/query`)"
+          service: mcp-service
+          entryPoints:
+            - web
+          priority: 250
+        mcp-all:
+          rule: "PathPrefix(`/all`)"
+          service: mcp-service
+          entryPoints:
+            - web
+          priority: 250
+        mcp-api:
+          rule: "PathPrefix(`/mcp`) || PathPrefix(`/sse`)"
+          service: mcp-service
+          entryPoints:
+            - web
+          priority: 200
+        mcp-public:
+          rule: "PathPrefix(`/health`) || PathPrefix(`/metrics`)"
+          service: mcp-service
+          entryPoints:
+            - web
+          priority: 200
+        dashboard:
+          rule: "PathPrefix(`/`)"
+          service: dashboard-service
+          entryPoints:
+            - web
+          priority: 1
+      services:
+        mcp-service:
+          loadBalancer:
+            servers:
+              - url: "http://{{ .Chart.Name }}-{{ .Values.global.openmemory.serviceName }}:{{ .Values.global.openmemory.port }}"
+        dashboard-service:
+          loadBalancer:
+            servers:
+              - url: "http://{{ .Chart.Name }}-{{ .Values.global.dashboard.serviceName }}:{{ .Values.global.dashboard.port }}"

package/dist/templates/charts/cybermem/templates/traefik-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Chart.Name }}-traefik"
+  labels:
+    app.kubernetes.io/name: traefik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: traefik
+      annotations:
+        # Standard k8s pattern to trigger restart when ConfigMap changes
+        checksum/config: {{ include (print $.Template.BasePath "/traefik-config.yaml") . | sha256sum }}
+    spec:
+      containers:
+        - name: traefik
+          image: traefik:v3.0
+          args:
+            - --api.dashboard=true
+            - --api.insecure=true
+            - --providers.kubernetes-ingress=false
+            - --providers.kubernetes-crd=false
+            - --entrypoints.web.address=:{{ .Values.global.traefik.port }}
+          ports:
+            - name: web
+              containerPort: {{ .Values.global.traefik.port }}
+            - name: admin
+              containerPort: 8080
+          volumeMounts:
+            - name: config
+              mountPath: /etc/traefik/traefik.yml
+              subPath: traefik.yml
+            - name: dynamic
+              mountPath: /etc/traefik/dynamic.yml
+              subPath: dynamic.yml
+      volumes:
+        - name: config
+          configMap:
+            name: {{ .Chart.Name }}-traefik-config
+            items:
+              - key: traefik.yml
+                path: traefik.yml
+        - name: dynamic
+          configMap:
+            name: {{ .Chart.Name }}-traefik-config
+            items:
+              - key: dynamic.yml
+                path: dynamic.yml

package/dist/templates/charts/cybermem/templates/traefik-service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Chart.Name }}-lb
+spec:
+  type: LoadBalancer
+  ports:
+    - port: 80
+      targetPort: web
+      protocol: TCP
+      name: http
+    - port: {{ .Values.global.traefik.port }}
+      targetPort: web
+      protocol: TCP
+      name: web
+  selector:
+    app.kubernetes.io/name: traefik

package/dist/templates/charts/cybermem/values-vps.yaml

@@ -1,16 +1,20 @@
-# VPS Overrides
+global:
+  traefik:
+    port: 8625
 
 openmemory:
   image:
-    repository: ghcr.io/mikhailkogan17/cybermem-openmemory
-    pullPolicy: Always
+    repository: ghcr.io/mikhailkogan17/cybermem-mcp
+    pullPolicy: IfNotPresent
+    tag: "v0.12.5-local"
   service:
     type: ClusterIP
 
 dashboard:
   image:
     repository: ghcr.io/mikhailkogan17/cybermem-dashboard
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
+    tag: "v0.12.5-local"
 
 env:
   OPENMEMORY_API_KEY: "prod-secret-key-CHANGE-ME"