@cybermem/cli 0.9.12 → 0.13.3

package/templates/docker-compose.yml

@@ -6,21 +6,28 @@
 services:
   traefik:
     image: traefik:v3.0
-    container_name: cybermem-traefik
+    # container_name removed for simultaneity
     command:
-      - --api.dashboard=true
-      - --api.insecure=true
-      - --providers.docker=true
-      - --providers.docker.exposedbydefault=false
-      - --entrypoints.web.address=:8626
+      - --entryPoints.web.address=:${TRAEFIK_PORT:-8626}
+      - --ping=true
+      - --ping.entryPoint=web
+      - --log.level=INFO
       - --accesslog=true
       - --accesslog.filepath=/var/log/traefik/access.log
       - --accesslog.format=json
+      - --accesslog.fields.headers.names.X-Client-Name=keep
+      - --accesslog.fields.headers.names.X-Client-Version=keep
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --providers.docker.constraints=Label(`com.docker.compose.project`, `${PROJECT_NAME:-cybermem}`)
+      - --providers.file.directory=/etc/traefik/dynamic
+      - --providers.file.watch=true
+      - --api.dashboard=true
+      - --api.insecure=true
     ports:
-      - "8626:8626"
+      - "${TRAEFIK_PORT:-8626}:${TRAEFIK_PORT:-8626}"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./monitoring/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
       - ./monitoring/traefik/dynamic:/etc/traefik/dynamic:ro
       - traefik-logs:/var/log/traefik
     labels:
@@ -35,62 +42,67 @@ services:
       context: ../../mcp
       dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-mcp:latest
-    # Note: platform omitted - docker auto-detects (amd64 for CI, arm64 for RPi)
+    command:
+      [
+        "node",
+        "dist/index.js",
+        "--http",
+        "--port",
+        "8080",
+        "--env",
+        "${CYBERMEM_ENV:-prod}",
+      ]
     restart: unless-stopped
-    container_name: cybermem-mcp
+    # container_name removed for simultaneity
     environment:
-      OM_TIER: "hybrid"
-      PORT: "8080"
-      OM_PORT: "0"
       OM_DB_PATH: /data/openmemory.sqlite
+      CYBERMEM_ENV: ${CYBERMEM_ENV:-prod}
+      CYBERMEM_INSTANCE: ${CYBERMEM_INSTANCE:-local}
+      CYBERMEM_TAILSCALE: ${CYBERMEM_TAILSCALE:-false}
     volumes:
       - ${CYBERMEM_ENV_PATH:-${HOME}/.cybermem/.env}:/.env
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
+      - ${SECRETS_DIR:-./secrets}/om_api_key:/run/secrets/om_api_key:ro
     depends_on:
       - traefik
       - auth-sidecar
+    # Secrets removed to avoid CI read-only mount issues
+    # secrets:
+    #   - om_api_key
     labels:
       - traefik.enable=true
-      # Middleware definitions (must be on a service that starts BEFORE routes reference them)
-      # Authenticated routes
-      - traefik.http.routers.mcp.rule=PathPrefix(`/mcp`) || PathPrefix(`/sse`)
-      - traefik.http.routers.mcp.entrypoints=web
-      - traefik.http.routers.mcp.priority=100
-      - traefik.http.routers.mcp.service=mcp-service
-      - traefik.http.routers.mcp.middlewares=auth-check
-      # Public routes (Health/Metrics)
-      - traefik.http.routers.mcp-public.rule=PathPrefix(`/health`) || PathPrefix(`/metrics`)
-      - traefik.http.routers.mcp-public.entrypoints=web
-      - traefik.http.routers.mcp-public.priority=100
-      - traefik.http.routers.mcp-public.service=mcp-service
-      - traefik.http.services.mcp-service.loadbalancer.server.port=8080
-      # Legacy API support (for simple REST clients)
-      - traefik.http.routers.legacy-api.rule=PathPrefix(`/add`) || PathPrefix(`/query`) || PathPrefix(`/all`)
-      - traefik.http.routers.legacy-api.entrypoints=web
-      - traefik.http.routers.legacy-api.priority=100
-      - traefik.http.routers.legacy-api.service=mcp-service
-      - traefik.http.routers.legacy-api.middlewares=auth-check
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.rule=PathPrefix(`/mcp`) || PathPrefix(`/sse`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.priority=100
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.service=${PROJECT_NAME:-cybermem}-mcp-service
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp.middlewares=auth-check
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp-public.rule=PathPrefix(`/health`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp-public.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp-public.priority=100
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-mcp-public.service=${PROJECT_NAME:-cybermem}-mcp-service
+      - traefik.http.services.${PROJECT_NAME:-cybermem}-mcp-service.loadbalancer.server.port=8080
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.rule=PathPrefix(`/add`) || PathPrefix(`/query`) || PathPrefix(`/all`) || PathPrefix(`/memory`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.priority=130
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.service=${PROJECT_NAME:-cybermem}-mcp-service
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-legacy-api.middlewares=auth-check
 
-      # Support legacy /cybermem redirect to root
-      - traefik.http.middlewares.cybermem-redirect.redirectregex.regex=^https?://[^/]+/cybermem(/.*)?$$
-      - traefik.http.middlewares.cybermem-redirect.redirectregex.replacement=/$${1}
-      - traefik.http.middlewares.cybermem-redirect.redirectregex.permanent=false
-      - traefik.http.routers.cybermem-legacy.rule=PathPrefix(`/cybermem`)
-      - traefik.http.routers.cybermem-legacy.entrypoints=web
-      - traefik.http.routers.cybermem-legacy.middlewares=cybermem-redirect
-      - traefik.http.routers.cybermem-legacy.priority=50
-
-  # Auth sidecar for JWT/API key validation (ForwardAuth)
   auth-sidecar:
+    build:
+      context: ./auth-sidecar
+      dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-auth-sidecar:latest
-    container_name: cybermem-auth-sidecar
+    # container_name removed for simultaneity
     environment:
       PORT: "3001"
       OM_DB_PATH: /data/openmemory.sqlite
-      API_KEY_FILE: /.env
+      CYBERMEM_ENV: ${CYBERMEM_ENV:-prod}
+      CYBERMEM_INSTANCE: ${CYBERMEM_INSTANCE:-local}
+      CYBERMEM_TAILSCALE: ${CYBERMEM_TAILSCALE:-false}
     volumes:
       - ${CYBERMEM_ENV_PATH:-${HOME}/.cybermem/.env}:/.env:ro
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
+      - ${SECRETS_DIR:-./secrets}/om_api_key:/run/secrets/om_api_key:ro
     labels:
       - traefik.enable=true
     healthcheck:
@@ -107,27 +119,29 @@ services:
       timeout: 5s
       retries: 3
     restart: unless-stopped
-
-  # Memory engine (MCP + Persistence)
-  # Uses embedded SQLite stored at ~/.cybermem/data/openmemory.sqlite
+    # secrets:
+    #   - om_api_key
 
   db-exporter:
+    build:
+      context: ./monitoring/db_exporter
+      dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-db_exporter:latest
-    container_name: cybermem-db-exporter
+    # container_name removed for simultaneity
     environment:
       DB_PATH: /data/openmemory.sqlite
       SCRAPE_INTERVAL: "15"
       EXPORTER_PORT: "8000"
-    ports:
-      - "8000:8000"
     volumes:
-      # Mount host openmemory data dir (created by SDK)
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
     restart: unless-stopped
 
   log-exporter:
+    build:
+      context: ./monitoring/log_exporter
+      dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-log_exporter:latest
-    container_name: cybermem-log-exporter
+    # container_name removed for simultaneity
     environment:
       LOG_FILE: /var/log/traefik/access.log
       SCRAPE_INTERVAL: "5"
@@ -135,7 +149,7 @@ services:
       DB_PATH: /data/openmemory.sqlite
     volumes:
       - traefik-logs:/var/log/traefik:ro
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
       - ./monitoring/log_exporter/exporter.py:/app/exporter.py:ro
     restart: unless-stopped
     depends_on:
@@ -143,7 +157,7 @@ services:
 
   postgres:
     image: postgres:15-alpine
-    container_name: cybermem-postgres
+    # container_name removed for simultaneity
     environment:
       POSTGRES_DB: ${PG_DB:-openmemory}
       POSTGRES_USER: ${PG_USER:-openmemory}
@@ -163,7 +177,7 @@ services:
 
   ollama:
     image: ollama/ollama:latest
-    container_name: cybermem-ollama
+    # container_name removed for simultaneity
     ports:
       - "11434:11434"
     volumes:
@@ -173,49 +187,60 @@ services:
       - ollama
 
   dashboard:
+    build:
+      context: ../../dashboard
+      dockerfile: Dockerfile
     image: ghcr.io/mikhailkogan17/cybermem-dashboard:latest
-    # Note: platform omitted - docker auto-detects (amd64 for CI, arm64 for RPi)
-    container_name: cybermem-dashboard
+    # container_name removed for simultaneity
+    # ports:
+    #   - "${DASHBOARD_PORT:-3000}:3000"
     environment:
       DB_EXPORTER_URL: http://db-exporter:8000
-      # Required for Health Check to find the MCP API internally
-      CYBERMEM_URL: http://mcp-server:8080
+      INTERNAL_MCP_URL: http://mcp-server:8080
       OM_DB_PATH: /data/openmemory.sqlite
-      OM_API_KEY: ${OM_API_KEY:-dev-secret-key}
-      # Tailscale domain for remote config (optional, auto-detected if not set)
       TAILSCALE_DOMAIN: ${TAILSCALE_DOMAIN:-}
-    ports:
-      - "3000:3000"
+      CYBERMEM_ENV: ${CYBERMEM_ENV:-prod}
+      CYBERMEM_INSTANCE: ${CYBERMEM_INSTANCE:-local}
+      CYBERMEM_TAILSCALE: ${CYBERMEM_TAILSCALE:-false}
     volumes:
-      - ${HOME}/.cybermem/data:/data
+      - ${DATA_DIR:-${HOME}/.cybermem/data}:/data
       - /var/run/docker.sock:/var/run/docker.sock
       - ${CYBERMEM_ENV_PATH:-${HOME}/.cybermem/.env}:/app/shared.env
     labels:
       - traefik.enable=true
-      # Dashboard route: root -> dashboard on port 3000
-      - traefik.http.routers.dashboard.entrypoints=web
-      - traefik.http.routers.dashboard.rule=PathPrefix(`/`)
-      - traefik.http.routers.dashboard.priority=1
-      - traefik.http.routers.dashboard.middlewares=auth-check
-      - traefik.http.services.dashboard.loadbalancer.server.port=3000
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard-public.rule=PathPrefix(`/auth`) || PathPrefix(`/_next`) || PathPrefix(`/static`) || PathPrefix(`/api/auth`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard-public.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard-public.priority=120
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard-public.service=${PROJECT_NAME:-cybermem}-dashboard
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard.rule=PathPrefix(`/`)
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard.entrypoints=web
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard.priority=1
+      - traefik.http.routers.${PROJECT_NAME:-cybermem}-dashboard.middlewares=auth-check
+      - traefik.http.services.${PROJECT_NAME:-cybermem}-dashboard.loadbalancer.server.port=3000
     restart: unless-stopped
+    # secrets:
+    #   - om_api_key
     depends_on:
       - db-exporter
 
 volumes:
   openmemory-data:
-    name: cybermem-data
+    name: ${PROJECT_NAME:-cybermem}-data
     driver: local
   postgres-data:
-    name: cybermem-postgres-data
+    name: ${PROJECT_NAME:-cybermem}-postgres-data
     driver: local
   ollama-models:
-    name: cybermem-ollama-models
+    name: ${PROJECT_NAME:-cybermem}-ollama-models
     driver: local
   traefik-logs:
-    name: cybermem-traefik-logs
+    name: ${PROJECT_NAME:-cybermem}-traefik-logs
     driver: local
 
+# secrets:
+#   om_api_key:
+#     file: ${SECRETS_DIR:-./secrets}/om_api_key
+
 networks:
   default:
-    name: cybermem-network
+    name: ${PROJECT_NAME:-cybermem}-network

package/templates/monitoring/log_exporter/exporter.py

@@ -190,20 +190,13 @@ def parse_and_export():
             status = str(data.get("DownstreamStatus", 0))
 
             # Extract MCP client info from custom headers
-            client_name = data.get("request_X-Client-Name", "unknown")
+            client_name = data.get("request_X-Client-Name", "unknown").lower()
             client_version = data.get("request_X-Client-Version", "unknown")
 
-            # Fallback to User-Agent if client_name is unknown
+            # Fallback invalid
             if client_name == "unknown":
-                ua = data.get("request_User-Agent", "")
-                if ua and ua != "-":
-                    # Simple heuristic: take the first part before '/' or space
-                    # e.g. "curl/7.64.1" -> "curl", "Mozilla/5.0" -> "Mozilla"
-                    parts = ua.split("/")
-                    if len(parts) > 0:
-                        potential_name = parts[0].split(" ")[0].strip()
-                        if potential_name:
-                            client_name = potential_name
+                # STRICT mode: Do NOT fallback to User-Agent
+                pass
 
             # Remove query params first
             endpoint = path.split("?")[0]
@@ -234,29 +227,29 @@ def parse_and_export():
             ):
                 endpoint = "/memory/:id"
 
-            # Only track requests to OpenMemory API (/memory/* and /mcp endpoints)
             # Exclude /health checks - they pollute Top/Last Reader metrics
             if endpoint.startswith("/memory") or endpoint.startswith("/mcp"):
                 # Check if it's an error (4xx or 5xx)
                 is_error = status.startswith("4") or status.startswith("5")
 
-                # Write aggregate stats
-                increment_stat(client_name, operation, is_error)
-
-                # Log individual request to access_log
-                log_access(
-                    client_name,
-                    client_version,
-                    method,
-                    endpoint,
-                    operation,
-                    status,
-                    is_error,
-                )
-
-                print(
-                    f"[{time.strftime('%H:%M:%S')}] {client_name}/{client_version} {method} {endpoint} ({operation}) -> {status}"
-                )
+                # Write aggregate stats AND audit log ONLY for known clients
+                if client_name != "unknown" and "health" not in endpoint:
+                    increment_stat(client_name, operation, is_error)
+
+                    # Log individual request to access_log
+                    log_access(
+                        client_name,
+                        client_version,
+                        method,
+                        endpoint,
+                        operation,
+                        status,
+                        is_error,
+                    )
+
+                    print(
+                        f"[{time.strftime('%H:%M:%S')}] {client_name}/{client_version} {method} {endpoint} ({operation}) -> {status}"
+                    )
 
         except json.JSONDecodeError:
             # Skip invalid JSON lines

package/templates/monitoring/traefik/traefik.yml

@@ -26,7 +26,4 @@ providers:
   file:
     directory: /etc/traefik/dynamic
     watch: true
-
-entryPoints:
-  web:
-    address: ":8626"
+# entryPoints and ping moved to docker-compose.yml command for dynamic port support

package/dist/commands/__tests__/backup.test.js

@@ -1,75 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const execa_1 = __importDefault(require("execa"));
-const fs_1 = __importDefault(require("fs"));
-const backup_1 = require("../backup");
-// Mock dependencies
-jest.mock('execa');
-jest.mock('fs');
-jest.mock('path', () => ({
-    ...jest.requireActual('path'),
-    resolve: jest.fn((...args) => args.join('/')),
-    basename: jest.fn((p) => p.split('/').pop() || ''),
-    dirname: jest.fn((p) => p.split('/').slice(0, -1).join('/') || '/'),
-}));
-// Mock console to keep output clean
-const originalConsoleLog = console.log;
-const originalConsoleError = console.error;
-describe('backup command', () => {
-    beforeAll(() => {
-        console.log = jest.fn();
-        console.error = jest.fn();
-    });
-    afterAll(() => {
-        console.log = originalConsoleLog;
-        console.error = originalConsoleError;
-    });
-    beforeEach(() => {
-        jest.clearAllMocks();
-        // Default process.cwd
-        jest.spyOn(process, 'cwd').mockReturnValue('/mock/cwd');
-    });
-    it('should create a backup successfully when openmemory container exists', async () => {
-        // Mock docker inspect success
-        execa_1.default.mockResolvedValueOnce({ exitCode: 0 });
-        // Mock docker run success
-        execa_1.default.mockResolvedValueOnce({ exitCode: 0 });
-        // Mock fs.existsSync to true (file created)
-        fs_1.default.existsSync.mockReturnValue(true);
-        // Mock fs.statSync
-        fs_1.default.statSync.mockReturnValue({ size: 5 * 1024 * 1024 }); // 5MB
-        await (0, backup_1.backup)({});
-        // Expect docker inspect check
-        expect(execa_1.default).toHaveBeenCalledWith('docker', ['inspect', 'cybermem-openmemory']);
-        // Expect docker run tar
-        const tarCall = execa_1.default.mock.calls[1];
-        expect(tarCall[0]).toBe('docker');
-        expect(tarCall[1]).toContain('run');
-        expect(tarCall[1]).toContain('tar');
-        expect(tarCall[1]).toContain('czf');
-        // Check volumes from
-        expect(tarCall[1]).toContain('--volumes-from');
-        expect(tarCall[1]).toContain('cybermem-openmemory');
-    });
-    it('should fail if openmemory container does not exist', async () => {
-        // Mock inspect failure
-        execa_1.default.mockRejectedValueOnce(new Error('No such container'));
-        const exitSpy = jest.spyOn(process, 'exit').mockImplementation((() => { }));
-        await (0, backup_1.backup)({});
-        expect(console.error).toHaveBeenCalledWith(expect.stringContaining('not found'));
-        expect(exitSpy).toHaveBeenCalledWith(1);
-    });
-    it('should error if backup file is not created', async () => {
-        execa_1.default.mockResolvedValue({ exitCode: 0 }); // inspect OK
-        execa_1.default.mockResolvedValue({ exitCode: 0 }); // run OK
-        // Mock file check false
-        fs_1.default.existsSync.mockReturnValue(false);
-        const exitSpy = jest.spyOn(process, 'exit').mockImplementation((() => { }));
-        await (0, backup_1.backup)({});
-        expect(console.error).toHaveBeenCalledWith(expect.stringContaining('Backup failed'));
-        expect(exitSpy).toHaveBeenCalledWith(1);
-    });
-});

package/dist/commands/__tests__/restore.test.js

@@ -1,70 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const execa_1 = __importDefault(require("execa"));
-const fs_1 = __importDefault(require("fs"));
-const restore_1 = require("../restore");
-jest.mock('execa');
-jest.mock('fs');
-jest.mock('path', () => ({
-    ...jest.requireActual('path'),
-    resolve: jest.fn((...args) => args.join('/')),
-    basename: jest.fn((p) => p.split('/').pop() || ''),
-    dirname: jest.fn((p) => p.split('/').slice(0, -1).join('/') || '/'),
-}));
-const originalConsoleLog = console.log;
-const originalConsoleError = console.error;
-describe('restore command', () => {
-    beforeAll(() => {
-        console.log = jest.fn();
-        console.error = jest.fn();
-    });
-    afterAll(() => {
-        console.log = originalConsoleLog;
-        console.error = originalConsoleError;
-    });
-    beforeEach(() => {
-        jest.clearAllMocks();
-        jest.spyOn(process, 'cwd').mockReturnValue('/mock/cwd');
-    });
-    it('should restore successfully', async () => {
-        // Mock file exists
-        fs_1.default.existsSync.mockReturnValue(true);
-        // Mock docker stop (success)
-        execa_1.default.mockResolvedValueOnce({ exitCode: 0 });
-        // Mock docker run tar (success)
-        execa_1.default.mockResolvedValueOnce({ exitCode: 0 });
-        // Mock docker start (success)
-        execa_1.default.mockResolvedValueOnce({ exitCode: 0 });
-        await (0, restore_1.restore)('backup.tar.gz', {});
-        // Check docker stop
-        expect(execa_1.default).toHaveBeenCalledWith('docker', ['stop', 'cybermem-openmemory']);
-        // Check docker run tar
-        const tarCall = execa_1.default.mock.calls[1];
-        expect(tarCall[0]).toBe('docker');
-        expect(tarCall[1]).toContain('run');
-        expect(tarCall[1]).toContain('tar xzf /backup/backup.tar.gz -C / && chown -R 1001:1001 /data');
-        // Check docker start
-        expect(execa_1.default).toHaveBeenCalledWith('docker', ['start', 'cybermem-openmemory']);
-    });
-    it('should ignore docker stop error (if container not running)', async () => {
-        fs_1.default.existsSync.mockReturnValue(true);
-        // Mock docker stop FAIL
-        execa_1.default.mockRejectedValueOnce(new Error('No such container'));
-        // Mock succeeding calls
-        execa_1.default.mockResolvedValue({ exitCode: 0 });
-        await (0, restore_1.restore)('backup.tar.gz', {});
-        // Should still proceed to restore
-        expect(execa_1.default).toHaveBeenCalledWith('docker', expect.arrayContaining(['run']));
-        expect(execa_1.default).toHaveBeenCalledWith('docker', ['start', 'cybermem-openmemory']);
-    });
-    it('should fail if backup file missing', async () => {
-        fs_1.default.existsSync.mockReturnValue(false);
-        const exitSpy = jest.spyOn(process, 'exit').mockImplementation((() => { }));
-        await (0, restore_1.restore)('mia.tar.gz', {});
-        expect(console.error).toHaveBeenCalledWith(expect.stringContaining('not found'));
-        expect(exitSpy).toHaveBeenCalledWith(1);
-    });
-});