@cybermem/cli 0.9.12 → 0.13.3

package/dist/templates/charts/cybermem/values.yaml

@@ -1,14 +1,24 @@
 # Default values for cybermem.
 
+# Global settings for SSoT
+global:
+  traefik:
+    port: 8625
+  openmemory:
+    serviceName: "openmemory"
+    port: 8080
+  dashboard:
+    serviceName: "dashboard"
+    port: 3000
+
 openmemory:
   image:
-    repository: cybermem-openmemory
-    pullPolicy: IfNotPresent
+    repository: ghcr.io/mikhailkogan17/cybermem-mcp
+    pullPolicy: Always
     tag: "latest"
   replicaCount: 1
   service:
     type: ClusterIP
-    port: 8080
   persistence:
     enabled: true
     size: 10Gi
@@ -20,23 +30,21 @@ openmemory:
     requests:
       cpu: 100m
       memory: 256Mi
-  env:
-    # Passed to the container
-    OM_PORT: "8080"
+  env: {}
 
 dashboard:
   image:
-    repository: cybermem-dashboard
+    repository: ghcr.io/mikhailkogan17/cybermem-dashboard
     pullPolicy: IfNotPresent
     tag: "latest"
   replicaCount: 1
   service:
     type: ClusterIP
-    port: 3000
     nodePort: 30000 # For k3d/local access if needed
   resources: {}
 
 env:
   # Shared secrets
-  OPENMEMORY_API_KEY: "dev-secret-key"
+  OPENMEMORY_API_KEY: "sk-74d94d0021f1a9a525e1c311cfd16575"
   OPENAI_API_KEY: ""
+  CYBERMEM_ENV: "staging"

package/dist/templates/docker-compose.yml

@@ -6,21 +6,28 @@
 services:
   traefik:
     image: traefik:v3.0
-    container_name: cybermem-traefik
+    # container_name removed for simultaneity
     command:
-      - --api.dashboard=true
-      - --api.insecure=true
-      - --providers.docker=true
-      - --providers.docker.exposedbydefault=false
-      - --entrypoints.web.address=:8626
+      - --entryPoints.web.address=:${TRAEFIK_PORT:-8626}
+      - --ping=true
+      - --ping.entryPoint=web
+      - --log.level=INFO
       - --accesslog=true
       - --accesslog.filepath=/var/log/traefik/access.log
       - --accesslog.format=json
+      - --accesslog.fields.headers.names.X-Client-Name=keep
+      - --accesslog.fields.headers.names.X-Client-Version=keep
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.constraints=Label(`com.docker.compose.project`, `${PROJECT_NAME:-cybermem}`)
+      - --providers.file.directory=/etc/traefik/dynamic
+      - --providers.file.watch=true
+      - --api.dashboard=true
+      - --api.insecure=true
     ports:
-      - "8626:8626"
+      - "${TRAEFIK_PORT:-8626}:${TRAEFIK_PORT:-8626}"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./monitoring/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
       - ./monitoring/traefik/dynamic:/etc/traefik/dynamic:ro
       - traefik-logs:/var/log/traefik
     labels:
@@ -35,62 +42,67 @@ services:
       context: ../../mcp
       dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-mcp:latest
-    # Note: platform omitted - docker auto-detects (amd64 for CI, arm64 for RPi)
+    command:
+      [
+        "node",
+        "dist/index.js",
+        "--http",
+        "--port",
+        "8080",
+        "--env",
+        "${CYBERMEM_ENV:-prod}",
+      ]
     restart: unless-stopped
-    container_name: cybermem-mcp
+    # container_name removed for simultaneity
     environment:
-      OM_TIER: "hybrid"
-      PORT: "8080"
-      OM_PORT: "0"
       OM_DB_PATH: /data/openmemory.sqlite
+      CYBERMEM_ENV: ${CYBERMEM_ENV:-prod}
+      CYBERMEM_INSTANCE: ${CYBERMEM_INSTANCE:-local}
+      CYBERMEM_TAILSCALE: ${CYBERMEM_TAILSCALE:-false}
     volumes:
       - ${CYBERMEM_ENV_PATH:-${HOME}/.cybermem/.env}:/.env
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
+      - ${SECRETS_DIR:-./secrets}/om_api_key:/run/secrets/om_api_key:ro
     depends_on:
       - traefik
       - auth-sidecar
+    # Secrets removed to avoid CI read-only mount issues
+    # secrets:
+    #   - om_api_key
     labels:
       - traefik.enable=true
-      # Middleware definitions (must be on a service that starts BEFORE routes reference them)
-      # Authenticated routes
-      - traefik.http.routers.mcp.rule=PathPrefix(`/mcp`) || PathPrefix(`/sse`)
-      - traefik.http.routers.mcp.entrypoints=web
-      - traefik.http.routers.mcp.priority=100
-      - traefik.http.routers.mcp.service=mcp-service
-      - traefik.http.routers.mcp.middlewares=auth-check
-      # Public routes (Health/Metrics)
-      - traefik.http.routers.mcp-public.rule=PathPrefix(`/health`) || PathPrefix(`/metrics`)
-      - traefik.http.routers.mcp-public.entrypoints=web
-      - traefik.http.routers.mcp-public.priority=100
-      - traefik.http.routers.mcp-public.service=mcp-service
-      - traefik.http.services.mcp-service.loadbalancer.server.port=8080
-      # Legacy API support (for simple REST clients)
-      - traefik.http.routers.legacy-api.rule=PathPrefix(`/add`) || PathPrefix(`/query`) || PathPrefix(`/all`)
-      - traefik.http.routers.legacy-api.entrypoints=web
-      - traefik.http.routers.legacy-api.priority=100
-      - traefik.http.routers.legacy-api.service=mcp-service
-      - traefik.http.routers.legacy-api.middlewares=auth-check
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.rule=PathPrefix(`/mcp`) || PathPrefix(`/sse`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.priority=100
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.service=${PROJECT_NAME:-cybermem}-mcp-service
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.middlewares=auth-check
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp-public.rule=PathPrefix(`/health`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp-public.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp-public.priority=100
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp-public.service=${PROJECT_NAME:-cybermem}-mcp-service
+      - traefik.http.services.${PROJECT_NAME:-cybermem}-mcp-service.loadbalancer.server.port=8080
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.rule=PathPrefix(`/add`) || PathPrefix(`/query`) || PathPrefix(`/all`) || PathPrefix(`/memory`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.priority=130
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.service=${PROJECT_NAME:-cybermem}-mcp-service
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.middlewares=auth-check
 
-      # Support legacy /cybermem redirect to root
-      - traefik.http.middlewares.cybermem-redirect.redirectregex.regex=^https?://[^/]+/cybermem(/.*)?$$
-      - traefik.http.middlewares.cybermem-redirect.redirectregex.replacement=/$${1}
-      - traefik.http.middlewares.cybermem-redirect.redirectregex.permanent=false
-      - traefik.http.routers.cybermem-legacy.rule=PathPrefix(`/cybermem`)
-      - traefik.http.routers.cybermem-legacy.entrypoints=web
-      - traefik.http.routers.cybermem-legacy.middlewares=cybermem-redirect
-      - traefik.http.routers.cybermem-legacy.priority=50
-
-  # Auth sidecar for JWT/API key validation (ForwardAuth)
   auth-sidecar:
+    build:
+      context: ./auth-sidecar
+      dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-auth-sidecar:latest
-    container_name: cybermem-auth-sidecar
+    # container_name removed for simultaneity
     environment:
       PORT: "3001"
       OM_DB_PATH: /data/openmemory.sqlite
-      API_KEY_FILE: /.env
+      CYBERMEM_ENV: ${CYBERMEM_ENV:-prod}
+      CYBERMEM_INSTANCE: ${CYBERMEM_INSTANCE:-local}
+      CYBERMEM_TAILSCALE: ${CYBERMEM_TAILSCALE:-false}
     volumes:
       - ${CYBERMEM_ENV_PATH:-${HOME}/.cybermem/.env}:/.env:ro
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
+      - ${SECRETS_DIR:-./secrets}/om_api_key:/run/secrets/om_api_key:ro
     labels:
       - traefik.enable=true
     healthcheck:
@@ -107,27 +119,29 @@ services:
       timeout: 5s
       retries: 3
     restart: unless-stopped
-
-  # Memory engine (MCP + Persistence)
-  # Uses embedded SQLite stored at ~/.cybermem/data/openmemory.sqlite
+    # secrets:
+    #   - om_api_key
 
   db-exporter:
+    build:
+      context: ./monitoring/db_exporter
+      dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-db_exporter:latest
-    container_name: cybermem-db-exporter
+    # container_name removed for simultaneity
     environment:
       DB_PATH: /data/openmemory.sqlite
       SCRAPE_INTERVAL: "15"
       EXPORTER_PORT: "8000"
-    ports:
-      - "8000:8000"
     volumes:
-      # Mount host openmemory data dir (created by SDK)
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
     restart: unless-stopped
 
   log-exporter:
+    build:
+      context: ./monitoring/log_exporter
+      dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-log_exporter:latest
-    container_name: cybermem-log-exporter
+    # container_name removed for simultaneity
     environment:
       LOG_FILE: /var/log/traefik/access.log
       SCRAPE_INTERVAL: "5"
@@ -135,7 +149,7 @@ services:
       DB_PATH: /data/openmemory.sqlite
     volumes:
       - traefik-logs:/var/log/traefik:ro
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
       - ./monitoring/log_exporter/exporter.py:/app/exporter.py:ro
     restart: unless-stopped
     depends_on:
@@ -143,7 +157,7 @@ services:
 
   postgres:
     image: postgres:15-alpine
-    container_name: cybermem-postgres
+    # container_name removed for simultaneity
     environment:
       POSTGRES_DB: ${PG_DB:-openmemory}
       POSTGRES_USER: ${PG_USER:-openmemory}
@@ -163,7 +177,7 @@ services:
 
   ollama:
     image: ollama/ollama:latest
-    container_name: cybermem-ollama
+    # container_name removed for simultaneity
     ports:
       - "11434:11434"
     volumes:
@@ -173,49 +187,60 @@ services:
       - ollama
 
   dashboard:
+    build:
+      context: ../../dashboard
+      dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-dashboard:latest
-    # Note: platform omitted - docker auto-detects (amd64 for CI, arm64 for RPi)
-    container_name: cybermem-dashboard
+    # container_name removed for simultaneity
+    # ports:
+    #   - "${DASHBOARD_PORT:-3000}:3000"
     environment:
       DB_EXPORTER_URL: http://db-exporter:8000
-      # Required for Health Check to find the MCP API internally
-      CYBERMEM_URL: http://mcp-server:8080
+      INTERNAL_MCP_URL: http://mcp-server:8080
       OM_DB_PATH: /data/openmemory.sqlite
-      OM_API_KEY: ${OM_API_KEY:-dev-secret-key}
-      # Tailscale domain for remote config (optional, auto-detected if not set)
       TAILSCALE_DOMAIN: ${TAILSCALE_DOMAIN:-}
-    ports:
-      - "3000:3000"
+      CYBERMEM_ENV: ${CYBERMEM_ENV:-prod}
+      CYBERMEM_INSTANCE: ${CYBERMEM_INSTANCE:-local}
+      CYBERMEM_TAILSCALE: ${CYBERMEM_TAILSCALE:-false}
     volumes:
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
       - /var/run/docker.sock:/var/run/docker.sock
       - ${CYBERMEM_ENV_PATH:-${HOME}/.cybermem/.env}:/app/shared.env
     labels:
       - traefik.enable=true
-      # Dashboard route: root -> dashboard on port 3000
-      - traefik.http.routers.dashboard.entrypoints=web
-      - traefik.http.routers.dashboard.rule=PathPrefix(`/`)
-      - traefik.http.routers.dashboard.priority=1
-      - traefik.http.routers.dashboard.middlewares=auth-check
-      - traefik.http.services.dashboard.loadbalancer.server.port=3000
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard-public.rule=PathPrefix(`/auth`) || PathPrefix(`/_next`) || PathPrefix(`/static`) || PathPrefix(`/api/auth`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard-public.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard-public.priority=120
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard-public.service=${PROJECT_NAME:-cybermem}-dashboard
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard.rule=PathPrefix(`/`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard.priority=1
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard.middlewares=auth-check
+      - traefik.http.services.${PROJECT_NAME:-cybermem}-dashboard.loadbalancer.server.port=3000
     restart: unless-stopped
+    # secrets:
+    #   - om_api_key
     depends_on:
       - db-exporter
 
 volumes:
   openmemory-data:
-    name: cybermem-data
+    name: ${PROJECT_NAME:-cybermem}-data
     driver: local
   postgres-data:
-    name: cybermem-postgres-data
+    name: ${PROJECT_NAME:-cybermem}-postgres-data
     driver: local
   ollama-models:
-    name: cybermem-ollama-models
+    name: ${PROJECT_NAME:-cybermem}-ollama-models
     driver: local
   traefik-logs:
-    name: cybermem-traefik-logs
+    name: ${PROJECT_NAME:-cybermem}-traefik-logs
     driver: local
 
+# secrets:
+#   om_api_key:
+#     file: ${SECRETS_DIR:-./secrets}/om_api_key
+
 networks:
   default:
-    name: cybermem-network
+    name: ${PROJECT_NAME:-cybermem}-network

package/dist/templates/monitoring/log_exporter/exporter.py

@@ -190,20 +190,13 @@ def parse_and_export():
             status = str(data.get("DownstreamStatus", 0))
 
             # Extract MCP client info from custom headers
-            client_name = data.get("request_X-Client-Name", "unknown")
+            client_name = data.get("request_X-Client-Name", "unknown").lower()
             client_version = data.get("request_X-Client-Version", "unknown")
 
-            # Fallback to User-Agent if client_name is unknown
+            # Fallback invalid
             if client_name == "unknown":
-                ua = data.get("request_User-Agent", "")
-                if ua and ua != "-":
-                    # Simple heuristic: take the first part before '/' or space
-                    # e.g. "curl/7.64.1" -> "curl", "Mozilla/5.0" -> "Mozilla"
-                    parts = ua.split("/")
-                    if len(parts) > 0:
-                        potential_name = parts[0].split(" ")[0].strip()
-                        if potential_name:
-                            client_name = potential_name
+                # STRICT mode: Do NOT fallback to User-Agent
+                pass
 
             # Remove query params first
             endpoint = path.split("?")[0]
@@ -234,29 +227,29 @@ def parse_and_export():
             ):
                 endpoint = "/memory/:id"
 
-            # Only track requests to OpenMemory API (/memory/* and /mcp endpoints)
             # Exclude /health checks - they pollute Top/Last Reader metrics
             if endpoint.startswith("/memory") or endpoint.startswith("/mcp"):
                 # Check if it's an error (4xx or 5xx)
                 is_error = status.startswith("4") or status.startswith("5")
 
-                # Write aggregate stats
-                increment_stat(client_name, operation, is_error)
-
-                # Log individual request to access_log
-                log_access(
-                    client_name,
-                    client_version,
-                    method,
-                    endpoint,
-                    operation,
-                    status,
-                    is_error,
-                )
-
-                print(
-                    f"[{time.strftime('%H:%M:%S')}] {client_name}/{client_version} {method} {endpoint} ({operation}) -> {status}"
-                )
+                # Write aggregate stats AND audit log ONLY for known clients
+                if client_name != "unknown" and "health" not in endpoint:
+                    increment_stat(client_name, operation, is_error)
+
+                    # Log individual request to access_log
+                    log_access(
+                        client_name,
+                        client_version,
+                        method,
+                        endpoint,
+                        operation,
+                        status,
+                        is_error,
+                    )
+
+                    print(
+                        f"[{time.strftime('%H:%M:%S')}] {client_name}/{client_version} {method} {endpoint} ({operation}) -> {status}"
+                    )
 
         except json.JSONDecodeError:
             # Skip invalid JSON lines

package/dist/templates/monitoring/traefik/traefik.yml

@@ -26,7 +26,4 @@ providers:
   file:
     directory: /etc/traefik/dynamic
     watch: true
-
-entryPoints:
-  web:
-    address: ":8626"
+# entryPoints and ping moved to docker-compose.yml command for dynamic port support

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cybermem/cli",
-  "version": "0.9.12",
+  "version": "0.13.3",
   "description": "CyberMem — Universal Long-Term Memory for AI Agents",
   "homepage": "https://cybermem.dev",
   "repository": {
@@ -16,10 +16,15 @@
     "templates"
   ],
   "scripts": {
-    "build": "tsc && cp -r templates dist/",
+    "build": "mkdir -p dist && tsc && cp -r templates dist/",
     "lint": "eslint src/ --ext .ts",
     "start": "ts-node src/index.ts",
-    "test:e2e": "ts-node e2e/test-mcp.ts",
+    "test:e2e": "playwright test",
+    "test:e2e:mcp": "npm run test:e2e -w packages/mcp",
+    "test:e2e:dashboard": "npm run test:e2e -w packages/dashboard",
+    "test:e2e:dashboard:api": "npm run test:e2e -w packages/dashboard -- --project=api",
+    "test:e2e:dashboard:ui": "npm run test:e2e -w packages/dashboard -- --project=ui",
+    "test:e2e:cli": "playwright test --project=integration",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -51,6 +56,7 @@
     "@typescript-eslint/parser": "^8.52.0",
     "eslint": "^9.39.2",
     "ts-node": "^10.9.1",
+    "@playwright/test": "^1.57.0",
     "typescript": "^5.0.0"
   }
 }