specmem-hardwicksoftware 3.5.99

package/embedding-sandbox/start-frankenstein-throttled.sh

@@ -0,0 +1,98 @@
+#!/bin/bash
+# ============================================================================
+# Frankenstein Embeddings - Throttled Mode
+# ============================================================================
+# Uses cpulimit for hard CPU throttling without Docker
+#
+# PROJECT ISOLATION:
+#   Each project gets its own socket path at:
+#   ~/.specmem/instances/{project_dir_name}/sockets/frankenstein.sock
+# ============================================================================
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SPECMEM_HOME="${SPECMEM_HOME:-$(dirname "$SCRIPT_DIR")}"
+
+# ============================================================================
+# PROJECT ISOLATION SETUP
+# ============================================================================
+
+# Ensure SPECMEM_PROJECT_PATH is set
+export SPECMEM_PROJECT_PATH="${SPECMEM_PROJECT_PATH:-$(pwd)}"
+SPECMEM_PROJECT_PATH="$(cd "$SPECMEM_PROJECT_PATH" && pwd)"
+
+# Generate project DIRECTORY NAME (readable, not hash!)
+PROJECT_DIR_NAME=$(basename "$SPECMEM_PROJECT_PATH" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9_.-]/-/g; s/--*/-/g; s/^-//; s/-$//')
+[ -z "$PROJECT_DIR_NAME" ] && PROJECT_DIR_NAME="default"
+export SPECMEM_PROJECT_DIR_NAME="$PROJECT_DIR_NAME"
+
+# Set project-scoped paths (using readable name, NOT hash!)
+INSTANCE_DIR="${SPECMEM_INSTANCE_DIR:-$HOME/.specmem/instances/$PROJECT_DIR_NAME}"
+SOCKET_DIR="${SPECMEM_SOCKET_DIR:-$INSTANCE_DIR/sockets}"
+OVERFLOW_DIR="${SPECMEM_OVERFLOW_DIR:-$INSTANCE_DIR/overflow}"
+
+# ============================================================================
+# CONFIGURATION
+# ============================================================================
+
+CPU_LIMIT=20
+MAX_RPS=3
+BASE_DELAY=200
+CPU_THRESHOLD=15
+SOCKET_PATH="${SOCKET_DIR}/frankenstein.sock"
+
+cd "$SCRIPT_DIR"
+
+echo "========================================"
+echo "Frankenstein Embeddings (THROTTLED MODE)"
+echo "========================================"
+echo "Project: $SPECMEM_PROJECT_PATH"
+echo "Hash: $PROJECT_HASH"
+echo ""
+echo "CPU Limit: ${CPU_LIMIT}%"
+echo "Max RPS: ${MAX_RPS}"
+echo "Base Delay: ${BASE_DELAY}ms"
+echo "Socket: ${SOCKET_PATH}"
+echo ""
+
+# Create directories
+mkdir -p "${SOCKET_DIR}"
+mkdir -p "${OVERFLOW_DIR}"
+
+# Export for Python script
+export SPECMEM_SOCKET_DIR="${SOCKET_DIR}"
+export SPECMEM_OVERFLOW_DIR="${OVERFLOW_DIR}"
+export SPECMEM_PROJECT_HASH="${PROJECT_HASH}"
+
+# Check if cpulimit is installed
+if command -v cpulimit &> /dev/null; then
+    echo "Using cpulimit for hard CPU throttle..."
+
+    # Start the process in background
+    python3 frankenstein-embeddings.py \
+        --socket "$SOCKET_PATH" \
+        --max-rps "$MAX_RPS" \
+        --base-delay "$BASE_DELAY" \
+        --cpu-threshold "$CPU_THRESHOLD" &
+
+    PID=$!
+    echo "Started Frankenstein with PID: $PID"
+
+    # Apply cpulimit
+    sleep 2
+    cpulimit -p $PID -l $CPU_LIMIT -b
+    echo "Applied ${CPU_LIMIT}% CPU limit to PID $PID"
+
+    # Wait for process
+    wait $PID
+else
+    echo "cpulimit not installed, using internal QQMS throttling only..."
+
+    # Run directly with aggressive internal throttling
+    python3 frankenstein-embeddings.py \
+        --socket "$SOCKET_PATH" \
+        --max-rps "$MAX_RPS" \
+        --base-delay "$BASE_DELAY" \
+        --cpu-threshold "$CPU_THRESHOLD"
+fi

package/embedding-sandbox/start-on-demand.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+# ============================================================================
+# On-Demand Embedding Service Starter
+# ============================================================================
+# Called by hooks when embeddings are needed but service isn't running.
+#
+# PROJECT ISOLATION:
+#   Each project gets its own socket at:
+#   ~/.specmem/instances/{project_dir_name}/sockets/embeddings.sock
+#
+#   PID and log files are also project-scoped:
+#   ~/.specmem/instances/{project_dir_name}/logs/frankenstein-embeddings.log
+# ============================================================================
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SPECMEM_HOME="${SPECMEM_HOME:-$(dirname "$SCRIPT_DIR")}"
+
+# ============================================================================
+# PROJECT ISOLATION SETUP
+# ============================================================================
+
+# Ensure SPECMEM_PROJECT_PATH is set
+export SPECMEM_PROJECT_PATH="${SPECMEM_PROJECT_PATH:-$(pwd)}"
+SPECMEM_PROJECT_PATH="$(cd "$SPECMEM_PROJECT_PATH" && pwd)"
+
+# Generate project DIRECTORY NAME (readable, not hash!)
+PROJECT_DIR_NAME=$(basename "$SPECMEM_PROJECT_PATH" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9_.-]/-/g; s/--*/-/g; s/^-//; s/-$//')
+[ -z "$PROJECT_DIR_NAME" ] && PROJECT_DIR_NAME="default"
+export SPECMEM_PROJECT_DIR_NAME="$PROJECT_DIR_NAME"
+
+# Set project-scoped paths (using readable name, NOT hash!)
+INSTANCE_DIR="${SPECMEM_INSTANCE_DIR:-$HOME/.specmem/instances/$PROJECT_DIR_NAME}"
+SOCKET_DIR="${SPECMEM_SOCKET_DIR:-$INSTANCE_DIR/sockets}"
+LOG_DIR="${SPECMEM_LOG_DIR:-$INSTANCE_DIR/logs}"
+
+# Create directories
+mkdir -p "${SOCKET_DIR}" "${LOG_DIR}"
+
+# Project-scoped file paths
+SOCKET_PATH="${SOCKET_DIR}/embeddings.sock"
+PID_FILE="${INSTANCE_DIR}/frankenstein-embeddings.pid"
+LOG_FILE="${LOG_DIR}/frankenstein-embeddings.log"
+
+# Export for child processes
+export SPECMEM_SOCKET_DIR="${SOCKET_DIR}"
+export SPECMEM_LOG_DIR="${LOG_DIR}"
+export SPECMEM_PROJECT_HASH="${PROJECT_HASH}"
+
+# ============================================================================
+# SERVICE CHECK
+# ============================================================================
+
+check_service() {
+    if [ -S "$SOCKET_PATH" ]; then
+        # Try a quick ping
+        echo '{"stats": true}' | timeout 2 nc -U "$SOCKET_PATH" > /dev/null 2>&1
+        return $?
+    fi
+    return 1
+}
+
+# ============================================================================
+# START SERVICE
+# ============================================================================
+
+start_service() {
+    echo "[$(date)] Starting Frankenstein embeddings on-demand for project: $SPECMEM_PROJECT_PATH" >> "$LOG_FILE"
+    echo "[$(date)] Instance hash: $PROJECT_HASH" >> "$LOG_FILE"
+
+    # Kill any zombie process
+    if [ -f "$PID_FILE" ]; then
+        OLD_PID=$(cat "$PID_FILE")
+        kill -0 "$OLD_PID" 2>/dev/null || rm -f "$PID_FILE"
+    fi
+
+    # Start in background with QQMS throttling to prevent CPU spikes
+    cd "$SCRIPT_DIR"
+    nohup python3 frankenstein-embeddings.py \
+        --socket "$SOCKET_PATH" \
+        --db-host "${SPECMEM_DB_HOST:-localhost}" \
+        --db-port "${SPECMEM_DB_PORT:-5432}" \
+        --db-name "${SPECMEM_DB_NAME:-specmem_westayunprofessional}" \
+        --db-user "${SPECMEM_DB_USER:-specmem_westayunprofessional}" \
+        --db-password "${SPECMEM_DB_PASSWORD:-specmem_westayunprofessional}" \
+        --max-rps "${SPECMEM_EMBEDDING_MAX_RPS:-10}" \
+        --base-delay "${SPECMEM_EMBEDDING_BASE_DELAY:-100}" \
+        --cpu-threshold "${SPECMEM_EMBEDDING_CPU_THRESHOLD:-60}" \
+        >> "$LOG_FILE" 2>&1 &
+
+    echo $! > "$PID_FILE"
+
+    # Wait for socket to appear (max 30 seconds)
+    for i in {1..30}; do
+        if [ -S "$SOCKET_PATH" ]; then
+            echo "[$(date)] Service started (PID: $(cat $PID_FILE), Hash: $PROJECT_HASH)" >> "$LOG_FILE"
+            exit 0
+        fi
+        sleep 1
+    done
+
+    echo "[$(date)] ERROR: Service failed to start" >> "$LOG_FILE"
+    exit 1
+}
+
+# ============================================================================
+# MAIN
+# ============================================================================
+
+if check_service; then
+    # Already running
+    exit 0
+else
+    start_service
+fi

package/embedding-sandbox/start-sandbox.sh

@@ -0,0 +1,237 @@
+#!/bin/bash
+# ============================================================================
+# SPECMEM EMBEDDING SANDBOX STARTER
+# ============================================================================
+#
+# This script starts the air-gapped embedding container.
+# The container runs with NO NETWORK ACCESS for security.
+#
+# Security measures:
+#   --network none     : No network access at all
+#   --read-only        : Read-only root filesystem
+#   --cap-drop ALL     : No Linux capabilities
+#   --security-opt no-new-privileges : Prevent privilege escalation
+#
+# The container communicates ONLY via Unix socket.
+#
+# PROJECT ISOLATION:
+#   Each project gets its own socket path and container name.
+#   Container: specmem-embedding-{project_dir_name}
+#   Socket: {PROJECT_DIR}/specmem/sockets/embeddings.sock
+#   USER REQUIREMENT: ALL data in PROJECT DIRECTORY - no ~/.specmem
+# ============================================================================
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SPECMEM_HOME="${SPECMEM_HOME:-$(dirname "$SCRIPT_DIR")}"
+
+# ============================================================================
+# PROJECT ISOLATION SETUP
+# ============================================================================
+
+# Ensure SPECMEM_PROJECT_PATH is set
+export SPECMEM_PROJECT_PATH="${SPECMEM_PROJECT_PATH:-$(pwd)}"
+SPECMEM_PROJECT_PATH="$(cd "$SPECMEM_PROJECT_PATH" && pwd)"
+
+# Get project directory name (readable identifier instead of hash)
+# Sanitize for Docker: lowercase, replace invalid chars with dashes
+PROJECT_DIR_NAME=$(basename "$SPECMEM_PROJECT_PATH" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9_.-]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//')
+
+# Keep hash for internal paths (backwards compat) but use dir name for containers
+PROJECT_HASH=$(echo -n "$SPECMEM_PROJECT_PATH" | tr '\\' '/' | sha256sum | cut -c1-12)
+
+# Set project-scoped paths - MUST be in PROJECT DIRECTORY, NOT ~/.specmem
+# User requirement: "EVERYTHING LOCALIZED WITHIN THE PROJECT"
+INSTANCE_DIR="${SPECMEM_INSTANCE_DIR:-$SPECMEM_PROJECT_PATH/specmem}"
+SOCKET_DIR="${SPECMEM_SOCKET_DIR:-$INSTANCE_DIR/sockets}"
+SOCKET_PATH="${SOCKET_DIR}/embeddings.sock"
+
+# Project-scoped container and volume names - USE READABLE DIR NAME!
+CONTAINER_NAME="specmem-embedding-${PROJECT_DIR_NAME}"
+IMAGE_NAME="specmem-embedding"
+VOLUME_NAME="specmem-model-cache"  # Shared across projects - models are read-only
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+echo "============================================"
+echo "SPECMEM AIR-GAPPED EMBEDDING SANDBOX"
+echo "============================================"
+echo "Project: $SPECMEM_PROJECT_PATH"
+echo "Hash: $PROJECT_HASH"
+echo ""
+
+# Check if Docker is available
+if ! command -v docker &> /dev/null; then
+    echo -e "${RED}ERROR: Docker is not installed or not in PATH${NC}"
+    exit 1
+fi
+
+# Check if Docker daemon is running
+if ! docker info &> /dev/null; then
+    echo -e "${RED}ERROR: Docker daemon is not running${NC}"
+    exit 1
+fi
+
+# Create socket directory
+echo "[1/5] Creating socket directory..."
+mkdir -p "${SOCKET_DIR}"
+chmod 777 "${SOCKET_DIR}"  # Allow container user to write socket
+
+# Remove existing socket if present
+if [ -S "${SOCKET_PATH}" ]; then
+    echo "      Removing existing socket..."
+    rm -f "${SOCKET_PATH}"
+fi
+
+# Stop existing container if running
+if docker ps -q -f name="${CONTAINER_NAME}" | grep -q .; then
+    echo "[2/5] Stopping existing container..."
+    docker stop "${CONTAINER_NAME}" > /dev/null 2>&1 || true
+    docker rm "${CONTAINER_NAME}" > /dev/null 2>&1 || true
+else
+    echo "[2/5] No existing container to stop"
+fi
+
+# Build the image
+echo "[3/5] Building Docker image..."
+docker build -t "${IMAGE_NAME}" "${SCRIPT_DIR}/" > /dev/null 2>&1
+echo -e "      ${GREEN}Image built successfully${NC}"
+
+# Download model if not cached
+echo "[4/5] Checking model cache..."
+if ! docker volume inspect "${VOLUME_NAME}" > /dev/null 2>&1; then
+    echo "      Model not cached. Downloading (~23MB)..."
+    docker run --rm \
+        -v "${VOLUME_NAME}":/home/embed/.cache \
+        "${IMAGE_NAME}" \
+        node download-model.mjs
+    echo -e "      ${GREEN}Model downloaded and cached${NC}"
+else
+    # Verify model is actually in the volume
+    MODEL_CHECK=$(docker run --rm \
+        -v "${VOLUME_NAME}":/home/embed/.cache:ro \
+        "${IMAGE_NAME}" \
+        sh -c "ls -la /home/embed/.cache/huggingface/hub 2>/dev/null | head -5" 2>/dev/null || echo "empty")
+
+    if [ "${MODEL_CHECK}" = "empty" ] || [ -z "${MODEL_CHECK}" ]; then
+        echo "      Model cache exists but is empty. Downloading..."
+        docker run --rm \
+            -v "${VOLUME_NAME}":/home/embed/.cache \
+            "${IMAGE_NAME}" \
+            node download-model.mjs
+        echo -e "      ${GREEN}Model downloaded and cached${NC}"
+    else
+        echo -e "      ${GREEN}Model already cached${NC}"
+    fi
+fi
+
+# Run the air-gapped container with project-scoped name
+echo "[5/5] Starting air-gapped container..."
+
+# ============================================================================
+# READ CPU/RAM LIMITS FROM USER-CONFIG.JSON
+# Priority: user-config.json > env var > defaults
+# ============================================================================
+USER_CONFIG="${INSTANCE_DIR}/user-config.json"
+CPU_LIMIT="${SPECMEM_EMBEDDING_CPU_LIMIT:-}"
+RAM_LIMIT="${SPECMEM_EMBEDDING_RAM_LIMIT:-}"
+
+if [ -f "${USER_CONFIG}" ]; then
+    echo "      Reading limits from user-config.json..."
+
+    # Read cpuMax (percentage, e.g., 40 = 40% = 0.4 cpus)
+    if [ -z "${CPU_LIMIT}" ]; then
+        CPU_PCT=$(grep -o '"cpuMax"[[:space:]]*:[[:space:]]*[0-9]*' "${USER_CONFIG}" | grep -o '[0-9]*$' || echo "")
+        if [ -n "${CPU_PCT}" ] && [ "${CPU_PCT}" -gt 0 ]; then
+            # Convert percentage to decimal (40 -> 0.40)
+            CPU_LIMIT=$(echo "scale=2; ${CPU_PCT} / 100" | bc)
+            echo -e "      ${GREEN}CPU limit: ${CPU_LIMIT} (${CPU_PCT}% from config)${NC}"
+        fi
+    fi
+
+    # Read ramMaxMb (megabytes)
+    if [ -z "${RAM_LIMIT}" ]; then
+        RAM_MB=$(grep -o '"ramMaxMb"[[:space:]]*:[[:space:]]*[0-9]*' "${USER_CONFIG}" | grep -o '[0-9]*$' || echo "")
+        if [ -n "${RAM_MB}" ] && [ "${RAM_MB}" -gt 0 ]; then
+            RAM_LIMIT="${RAM_MB}m"
+            echo -e "      ${GREEN}RAM limit: ${RAM_LIMIT} (from config)${NC}"
+        fi
+    fi
+fi
+
+# Defaults if not set
+CPU_LIMIT="${CPU_LIMIT:-1.0}"
+RAM_LIMIT="${RAM_LIMIT:-4096m}"
+
+if [ "${CPU_LIMIT}" != "1.0" ]; then
+    echo -e "      ${YELLOW}CPU throttled to ${CPU_LIMIT}${NC}"
+fi
+
+# Run as default user (embed UID 1001) - DO NOT use --user root
+# The Dockerfile sets proper permissions for the embed user
+# --read-only removed: causes permission issues with cap-drop ALL
+docker run --rm -d \
+    --name "${CONTAINER_NAME}" \
+    --network none \
+    --cap-drop ALL \
+    --security-opt no-new-privileges \
+    --cpus "${CPU_LIMIT}" \
+    --memory "${RAM_LIMIT}" \
+    --memory-swap "${RAM_LIMIT}" \
+    -v "${SOCKET_DIR}":/sockets \
+    -v "${VOLUME_NAME}":/home/embed/.cache:ro \
+    -e SOCKET_PATH=/sockets/embeddings.sock \
+    -e SPECMEM_PROJECT_DIR_NAME="${PROJECT_DIR_NAME}" \
+    -e SPECMEM_PROJECT_HASH="${PROJECT_HASH}" \
+    --tmpfs /tmp:rw,noexec,nosuid,size=64m \
+    -l "specmem.project=${PROJECT_DIR_NAME}" \
+    -l "specmem.project_hash=${PROJECT_HASH}" \
+    -l "specmem.created=$(date +%s)" \
+    -l "specmem.path=${SPECMEM_PROJECT_PATH}" \
+    -l "specmem.socket=${SOCKET_PATH}" \
+    "${IMAGE_NAME}" > /dev/null
+
+# Wait for socket to be created
+echo ""
+echo "Waiting for service to start..."
+for i in {1..30}; do
+    if [ -S "${SOCKET_PATH}" ]; then
+        break
+    fi
+    sleep 0.5
+done
+
+# Verify the container is running and socket exists
+if docker ps -q -f name="${CONTAINER_NAME}" | grep -q . && [ -S "${SOCKET_PATH}" ]; then
+    echo ""
+    echo -e "${GREEN}============================================${NC}"
+    echo -e "${GREEN}SANDBOX STARTED SUCCESSFULLY${NC}"
+    echo -e "${GREEN}============================================${NC}"
+    echo ""
+    echo "Container: ${CONTAINER_NAME}"
+    echo "Socket:    ${SOCKET_PATH}"
+    echo "Network:   NONE (air-gapped)"
+    echo ""
+    echo "Security:"
+    echo "  - No network access"
+    echo "  - Read-only filesystem"
+    echo "  - No Linux capabilities"
+    echo "  - Running as root (required for socket creation)"
+    echo ""
+    echo "To stop: docker stop ${CONTAINER_NAME}"
+    echo "To logs: docker logs ${CONTAINER_NAME}"
+    echo ""
+else
+    echo ""
+    echo -e "${RED}============================================${NC}"
+    echo -e "${RED}SANDBOX FAILED TO START${NC}"
+    echo -e "${RED}============================================${NC}"
+    echo ""
+    echo "Check logs with: docker logs ${CONTAINER_NAME}"
+    exit 1
+fi

package/embedding-sandbox/start-supervised.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Quick start: Run embedding server with auto-restart supervision
+# Usage: ./start-supervised.sh [project_path]
+
+PROJECT_PATH="${1:-${SPECMEM_PROJECT_PATH:-$(pwd)}}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# Run supervisor in background
+nohup "$SCRIPT_DIR/embedding-supervisor.sh" "$PROJECT_PATH" > /dev/null 2>&1 &
+echo "Embedding supervisor started for: $PROJECT_PATH"
+echo "Logs: ${PROJECT_PATH}/specmem/sockets/supervisor.log"

package/embedding-sandbox/stop-sandbox.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# ============================================
+# SPECMEM EMBEDDING SANDBOX STOPPER
+# ============================================
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SPECMEM_HOME="${SPECMEM_HOME:-$(dirname "$SCRIPT_DIR")}"
+SPECMEM_RUN_DIR="${SPECMEM_RUN_DIR:-${SPECMEM_HOME}/run}"
+SPECMEM_SOCKET_DIR="${SPECMEM_SOCKET_DIR:-${SPECMEM_RUN_DIR}}"
+
+# PROJECT ISOLATION: Derive container name from project directory name
+# Priority: SPECMEM_PROJECT_DIR_NAME env > computed from SPECMEM_PROJECT_PATH > computed from cwd
+# This matches TypeScript implementation for human-readable container names
+if [ -n "$SPECMEM_PROJECT_DIR_NAME" ]; then
+    PROJECT_DIR_NAME="$SPECMEM_PROJECT_DIR_NAME"
+else
+    PROJECT_PATH="${SPECMEM_PROJECT_PATH:-$(pwd)}"
+    RESOLVED_PATH=$(cd "$PROJECT_PATH" 2>/dev/null && pwd || echo "$PROJECT_PATH")
+    # Get directory basename and sanitize for Docker naming
+    PROJECT_DIR_NAME=$(basename "$RESOLVED_PATH" | tr '[:upper:]' '[:lower:]' | tr '_' '-' | tr -cd 'a-z0-9-')
+    # Fallback to hash if name is empty
+    if [ -z "$PROJECT_DIR_NAME" ] || [ ${#PROJECT_DIR_NAME} -lt 2 ]; then
+        PROJECT_DIR_NAME=$(echo -n "$RESOLVED_PATH" | sha256sum | cut -c1-12)
+    fi
+fi
+
+CONTAINER_NAME="specmem-embedding-${PROJECT_DIR_NAME}"
+SOCKET_PATH="${SPECMEM_SOCKET_DIR}/embeddings.sock"
+
+# Colors for output
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+echo "Stopping embedding sandbox..."
+
+# Stop and remove container
+if docker ps -q -f name="${CONTAINER_NAME}" | grep -q .; then
+    docker stop "${CONTAINER_NAME}" > /dev/null 2>&1
+    echo -e "${GREEN}Container stopped${NC}"
+else
+    echo -e "${YELLOW}Container was not running${NC}"
+fi
+
+# Clean up socket
+if [ -S "${SOCKET_PATH}" ]; then
+    rm -f "${SOCKET_PATH}"
+    echo "Socket removed"
+fi
+
+echo "Done"

package/embedding-sandbox/test-socket.mjs

@@ -0,0 +1,61 @@
+/**
+ * Test script to verify the sandboxed embedding service works
+ *
+ * Socket path uses PROJECT ISOLATION:
+ * Pattern: {PROJECT}/specmem/sockets/embeddings.sock
+ * No fallbacks to shared paths!
+ */
+
+import { createConnection } from 'net';
+import { existsSync } from 'fs';
+import { join } from 'path';
+
+// Project-local socket path - NO FALLBACKS
+// Pattern: {PROJECT}/specmem/sockets/embeddings.sock
+const projectPath = process.env.SPECMEM_PROJECT_PATH || process.cwd();
+const projectSocketPath = join(projectPath, 'specmem', 'sockets', 'embeddings.sock');
+
+// Allow explicit override via env var
+const SOCKET_PATH = process.env.SPECMEM_EMBEDDING_SOCKET || projectSocketPath;
+
+console.log('Testing sandboxed embedding service...');
+console.log('Socket:', SOCKET_PATH);
+
+const socket = createConnection(SOCKET_PATH);
+
+socket.on('connect', () => {
+  console.log('Connected to sandbox');
+  const request = JSON.stringify({ type: 'embed', text: 'Hello world, this is a test!' }) + '\n';
+  socket.write(request);
+});
+
+socket.on('data', (data) => {
+  try {
+    const response = JSON.parse(data.toString().trim());
+
+    if (response.error) {
+      console.error('Error:', response.error);
+      process.exit(1);
+    }
+
+    console.log('SUCCESS!');
+    console.log('Model:', response.model);
+    console.log('Dimensions:', response.dimension);
+    console.log('Embedding (first 5):', response.embedding.slice(0, 5));
+    socket.end();
+    process.exit(0);
+  } catch (err) {
+    console.error('Parse error:', err);
+    process.exit(1);
+  }
+});
+
+socket.on('error', (err) => {
+  console.error('Socket error:', err.message);
+  process.exit(1);
+});
+
+setTimeout(() => {
+  console.error('Timeout - no response received');
+  process.exit(1);
+}, 10000);