superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/access/rbac.py

@@ -0,0 +1,477 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 — RBAC / teams (C3)
+
+"""Role-based access control for the memory tenancy model.
+
+The tenancy boundary is the *profile* (individual / team / company). This
+engine adds real, persisted user identity and role grants on top of that
+boundary, following the Cognee reference model (Tenant -> User -> Role).
+
+Design principles
+-----------------
+* **Additive / self-hosting-correct.** With zero users the daemon stays
+  single-operator: the machine operator (install token / daemon capability
+  over loopback) is the implicit *owner* with every permission, so individual
+  use has no login friction. Once an org creates users + memberships from the
+  dashboard, logged-in users are enforced against their role.
+* **Enforced, not decorative.** ``has_permission`` is called from the write /
+  delete / share / manage routes. This module is the single source of truth
+  for the role -> permission matrix.
+* **No plaintext secrets.** Passwords are hashed with ``hashlib.scrypt`` and a
+  per-user random salt; session tokens are stored only as SHA-256 hashes and
+  compared in constant time.
+
+All state lives in memory.db (tables from migration M024). Connections are
+short-lived (opened per call) with a bounded busy timeout, matching the mesh
+broker's concurrency-safe pattern.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import logging
+import secrets
+import sqlite3
+import uuid
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+from pathlib import Path
+
+logger = logging.getLogger("superlocalmemory.access.rbac")
+
+_BUSY_TIMEOUT_MS = 4000
+_SESSION_TTL_HOURS = 12
+
+# scrypt cost parameters (OWASP-recommended interactive-login range).
+_SCRYPT_N = 2 ** 14
+_SCRYPT_R = 8
+_SCRYPT_P = 1
+_SCRYPT_DKLEN = 32
+
+
+class Role(str, Enum):
+    ADMIN = "admin"
+    MEMBER = "member"
+    VIEWER = "viewer"
+
+
+class Permission(str, Enum):
+    READ = "read"
+    WRITE = "write"
+    DELETE = "delete"
+    SHARE = "share"
+    MANAGE = "manage"  # manage users, roles, profile settings
+
+
+# Role -> permission set. This is the single source of truth for authorization.
+_ROLE_PERMISSIONS: dict[Role, frozenset[Permission]] = {
+    Role.ADMIN: frozenset(Permission),
+    Role.MEMBER: frozenset({Permission.READ, Permission.WRITE, Permission.SHARE}),
+    Role.VIEWER: frozenset({Permission.READ}),
+}
+
+
+def permissions_for_role(role: Role) -> frozenset[Permission]:
+    return _ROLE_PERMISSIONS.get(role, frozenset())
+
+
+class RbacError(ValueError):
+    """Raised for invalid RBAC operations (bad role, duplicate user, ...)."""
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _uid() -> str:
+    return uuid.uuid4().hex[:16]
+
+
+def _hash_password(password: str) -> str:
+    """scrypt$N$r$p$salt_hex$dk_hex — self-describing so params can evolve."""
+    if not password or len(password) < 8:
+        raise RbacError("Password must be at least 8 characters.")
+    salt = secrets.token_bytes(16)
+    dk = hashlib.scrypt(
+        password.encode("utf-8"), salt=salt,
+        n=_SCRYPT_N, r=_SCRYPT_R, p=_SCRYPT_P, dklen=_SCRYPT_DKLEN,
+    )
+    return f"scrypt${_SCRYPT_N}${_SCRYPT_R}${_SCRYPT_P}${salt.hex()}${dk.hex()}"
+
+
+def _verify_password(password: str, stored: str) -> bool:
+    try:
+        scheme, n, r, p, salt_hex, dk_hex = stored.split("$")
+        if scheme != "scrypt":
+            return False
+        dk = hashlib.scrypt(
+            password.encode("utf-8"), salt=bytes.fromhex(salt_hex),
+            n=int(n), r=int(r), p=int(p), dklen=len(bytes.fromhex(dk_hex)),
+        )
+        return hmac.compare_digest(dk.hex(), dk_hex)
+    except (ValueError, TypeError):
+        return False
+
+
+def _hash_token(raw_token: str) -> str:
+    return hashlib.sha256(raw_token.encode("utf-8")).hexdigest()
+
+
+# Constant dummy hash so verify_credentials spends ~equal time on unknown and
+# known usernames (defeats the username-enumeration timing oracle). Computed
+# once at import.
+_DUMMY_PASSWORD_HASH = _hash_password("__slm_dummy_sentinel__never_a_real_pw__")
+
+
+class RbacEngine:
+    """Persisted user / membership / session store with role enforcement."""
+
+    def __init__(self, db_path: str | Path) -> None:
+        self._db_path = str(db_path)
+
+    # -- connection -------------------------------------------------------
+
+    def _conn(self) -> sqlite3.Connection:
+        conn = sqlite3.connect(self._db_path, timeout=_BUSY_TIMEOUT_MS / 1000)
+        conn.execute(f"PRAGMA busy_timeout={_BUSY_TIMEOUT_MS}")
+        conn.row_factory = sqlite3.Row
+        return conn
+
+    # -- users ------------------------------------------------------------
+
+    def user_count(self) -> int:
+        conn = self._conn()
+        try:
+            return int(conn.execute("SELECT COUNT(*) FROM rbac_users").fetchone()[0])
+        finally:
+            conn.close()
+
+    def create_user(self, username: str, password: str, display_name: str = "",
+                    created_by: str = "owner") -> dict:
+        username = (username or "").strip()
+        if not username:
+            raise RbacError("Username is required.")
+        pw_hash = _hash_password(password)
+        user_id = _uid()
+        conn = self._conn()
+        try:
+            # The UNIQUE(username) constraint is the source of truth; the SELECT
+            # is a fast path. Two concurrent creates can both pass the SELECT, so
+            # the loser's INSERT hits the constraint — convert that to RbacError
+            # (409) instead of leaking a raw IntegrityError as a 500.
+            exists = conn.execute(
+                "SELECT 1 FROM rbac_users WHERE username=?", (username,)
+            ).fetchone()
+            if exists:
+                raise RbacError(f"User '{username}' already exists.")
+            try:
+                conn.execute(
+                    "INSERT INTO rbac_users (user_id, username, display_name, "
+                    "password_hash, status, created_at, created_by) "
+                    "VALUES (?, ?, ?, ?, 'active', ?, ?)",
+                    (user_id, username, display_name or username, pw_hash,
+                     _now(), created_by),
+                )
+                conn.commit()
+            except sqlite3.IntegrityError:
+                raise RbacError(f"User '{username}' already exists.")
+        finally:
+            conn.close()
+        logger.info("RBAC: created user '%s' (%s)", username, user_id)
+        return {"user_id": user_id, "username": username,
+                "display_name": display_name or username, "status": "active"}
+
+    def set_password(self, user_id: str, password: str) -> None:
+        pw_hash = _hash_password(password)
+        conn = self._conn()
+        try:
+            cur = conn.execute(
+                "UPDATE rbac_users SET password_hash=? WHERE user_id=?",
+                (pw_hash, user_id),
+            )
+            if cur.rowcount == 0:
+                raise RbacError("User not found.")
+            # A password change invalidates every existing session.
+            conn.execute("DELETE FROM rbac_sessions WHERE user_id=?", (user_id,))
+            conn.commit()
+        finally:
+            conn.close()
+
+    def set_status(self, user_id: str, status: str) -> None:
+        if status not in ("active", "disabled"):
+            raise RbacError("status must be 'active' or 'disabled'.")
+        conn = self._conn()
+        try:
+            cur = conn.execute(
+                "UPDATE rbac_users SET status=? WHERE user_id=?", (status, user_id)
+            )
+            if cur.rowcount == 0:
+                raise RbacError("User not found.")
+            if status == "disabled":
+                conn.execute("DELETE FROM rbac_sessions WHERE user_id=?", (user_id,))
+            conn.commit()
+        finally:
+            conn.close()
+
+    def delete_user(self, user_id: str) -> None:
+        conn = self._conn()
+        try:
+            conn.execute("DELETE FROM rbac_sessions WHERE user_id=?", (user_id,))
+            conn.execute("DELETE FROM rbac_memberships WHERE user_id=?", (user_id,))
+            cur = conn.execute("DELETE FROM rbac_users WHERE user_id=?", (user_id,))
+            if cur.rowcount == 0:
+                raise RbacError("User not found.")
+            conn.commit()
+        finally:
+            conn.close()
+
+    def get_user(self, user_id: str) -> dict | None:
+        conn = self._conn()
+        try:
+            row = conn.execute(
+                "SELECT user_id, username, display_name, status, created_at, created_by "
+                "FROM rbac_users WHERE user_id=?", (user_id,)
+            ).fetchone()
+            return dict(row) if row else None
+        finally:
+            conn.close()
+
+    def list_users(self) -> list[dict]:
+        conn = self._conn()
+        try:
+            rows = conn.execute(
+                "SELECT user_id, username, display_name, status, created_at, created_by "
+                "FROM rbac_users ORDER BY username"
+            ).fetchall()
+            return [dict(r) for r in rows]
+        finally:
+            conn.close()
+
+    # -- credentials / sessions ------------------------------------------
+
+    def verify_credentials(self, username: str, password: str) -> dict | None:
+        conn = self._conn()
+        try:
+            row = conn.execute(
+                "SELECT user_id, username, display_name, password_hash, status "
+                "FROM rbac_users WHERE username=?", ((username or "").strip(),)
+            ).fetchone()
+        finally:
+            conn.close()
+        if not row or row["status"] != "active":
+            # Run a verify against a constant dummy hash so an unknown/disabled
+            # username costs the same wall-time as a wrong password — no timing
+            # oracle for username enumeration.
+            _verify_password(password, _DUMMY_PASSWORD_HASH)
+            return None
+        if not _verify_password(password, row["password_hash"]):
+            return None
+        return {"user_id": row["user_id"], "username": row["username"],
+                "display_name": row["display_name"]}
+
+    def create_session(self, user_id: str, ttl_hours: int = _SESSION_TTL_HOURS) -> str:
+        """Mint an opaque session token; only its hash is stored. Returns the
+        raw token (shown to the client once)."""
+        raw = secrets.token_urlsafe(32)
+        now = datetime.now(timezone.utc)
+        expires = (now + timedelta(hours=ttl_hours)).isoformat()
+        conn = self._conn()
+        try:
+            conn.execute(
+                "INSERT INTO rbac_sessions (token_hash, user_id, created_at, "
+                "expires_at, last_seen) VALUES (?, ?, ?, ?, ?)",
+                (_hash_token(raw), user_id, now.isoformat(), expires, now.isoformat()),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+        return raw
+
+    def resolve_session(self, raw_token: str) -> dict | None:
+        """Return the active user for a session token, or None if invalid /
+        expired / disabled. Updates last_seen. Constant-time by hash lookup."""
+        if not raw_token:
+            return None
+        token_hash = _hash_token(raw_token)
+        now = datetime.now(timezone.utc)
+        conn = self._conn()
+        try:
+            row = conn.execute(
+                "SELECT s.user_id, s.expires_at, s.last_seen, "
+                "u.username, u.display_name, u.status "
+                "FROM rbac_sessions s JOIN rbac_users u ON u.user_id = s.user_id "
+                "WHERE s.token_hash=?", (token_hash,)
+            ).fetchone()
+            if not row:
+                return None
+            try:
+                expired = datetime.fromisoformat(row["expires_at"]) <= now
+            except ValueError:
+                expired = True
+            if expired or row["status"] != "active":
+                conn.execute("DELETE FROM rbac_sessions WHERE token_hash=?", (token_hash,))
+                conn.commit()
+                return None
+            # Debounce last_seen: only write when it is stale (>60s), so a burst
+            # of authenticated requests does not serialize through the single
+            # SQLite writer on every call.
+            stale = True
+            try:
+                stale = (now - datetime.fromisoformat(row["last_seen"])).total_seconds() > 60
+            except (ValueError, TypeError, KeyError):
+                stale = True
+            if stale:
+                conn.execute(
+                    "UPDATE rbac_sessions SET last_seen=? WHERE token_hash=?",
+                    (now.isoformat(), token_hash),
+                )
+                conn.commit()
+            return {"user_id": row["user_id"], "username": row["username"],
+                    "display_name": row["display_name"]}
+        finally:
+            conn.close()
+
+    def revoke_session(self, raw_token: str) -> None:
+        conn = self._conn()
+        try:
+            conn.execute("DELETE FROM rbac_sessions WHERE token_hash=?",
+                         (_hash_token(raw_token),))
+            conn.commit()
+        finally:
+            conn.close()
+
+    def purge_expired_sessions(self) -> int:
+        conn = self._conn()
+        try:
+            cur = conn.execute(
+                "DELETE FROM rbac_sessions WHERE expires_at <= ?", (_now(),)
+            )
+            conn.commit()
+            return cur.rowcount or 0
+        finally:
+            conn.close()
+
+    # -- memberships ------------------------------------------------------
+
+    def set_membership(self, profile_id: str, user_id: str, role: str,
+                       added_by: str = "owner") -> dict:
+        try:
+            role_enum = Role(role)
+        except ValueError:
+            raise RbacError(f"Invalid role '{role}'. Use admin/member/viewer.")
+        conn = self._conn()
+        try:
+            if not conn.execute(
+                "SELECT 1 FROM rbac_users WHERE user_id=?", (user_id,)
+            ).fetchone():
+                raise RbacError("User not found.")
+            conn.execute(
+                "INSERT INTO rbac_memberships (profile_id, user_id, role, added_at, added_by) "
+                "VALUES (?, ?, ?, ?, ?) "
+                "ON CONFLICT(profile_id, user_id) DO UPDATE SET role=excluded.role, "
+                "added_at=excluded.added_at, added_by=excluded.added_by",
+                (profile_id, user_id, role_enum.value, _now(), added_by),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+        return {"profile_id": profile_id, "user_id": user_id, "role": role_enum.value}
+
+    def remove_membership(self, profile_id: str, user_id: str) -> None:
+        conn = self._conn()
+        try:
+            conn.execute(
+                "DELETE FROM rbac_memberships WHERE profile_id=? AND user_id=?",
+                (profile_id, user_id),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+    def get_role(self, user_id: str, profile_id: str) -> Role | None:
+        conn = self._conn()
+        try:
+            row = conn.execute(
+                "SELECT role FROM rbac_memberships WHERE user_id=? AND profile_id=?",
+                (user_id, profile_id),
+            ).fetchone()
+        finally:
+            conn.close()
+        if not row:
+            return None
+        try:
+            return Role(row["role"])
+        except ValueError:
+            return None
+
+    def list_members(self, profile_id: str) -> list[dict]:
+        conn = self._conn()
+        try:
+            rows = conn.execute(
+                "SELECT m.user_id, u.username, u.display_name, m.role, m.added_at "
+                "FROM rbac_memberships m JOIN rbac_users u ON u.user_id = m.user_id "
+                "WHERE m.profile_id=? ORDER BY u.username", (profile_id,)
+            ).fetchall()
+            return [dict(r) for r in rows]
+        finally:
+            conn.close()
+
+    def list_user_profiles(self, user_id: str) -> list[dict]:
+        conn = self._conn()
+        try:
+            rows = conn.execute(
+                "SELECT profile_id, role FROM rbac_memberships WHERE user_id=?",
+                (user_id,)
+            ).fetchall()
+            return [dict(r) for r in rows]
+        finally:
+            conn.close()
+
+    # -- policy settings --------------------------------------------------
+
+    def get_policy(self, key: str, default: str = "") -> str:
+        conn = self._conn()
+        try:
+            row = conn.execute(
+                "SELECT value FROM rbac_settings WHERE key=?", (key,)
+            ).fetchone()
+            return row["value"] if row else default
+        finally:
+            conn.close()
+
+    def set_policy(self, key: str, value: str) -> None:
+        conn = self._conn()
+        try:
+            conn.execute(
+                "INSERT INTO rbac_settings (key, value) VALUES (?, ?) "
+                "ON CONFLICT(key) DO UPDATE SET value=excluded.value",
+                (key, value),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+    def require_login(self) -> bool:
+        """Company mode: mutations require a valid user session (no owner
+        bypass). Default off (personal / single-operator use)."""
+        return self.get_policy("require_login", "0") == "1"
+
+    def set_require_login(self, enabled: bool) -> None:
+        self.set_policy("require_login", "1" if enabled else "0")
+
+    # -- authorization ----------------------------------------------------
+
+    def has_permission(self, user_id: str, profile_id: str,
+                       permission: Permission | str) -> bool:
+        """True iff the user's role on the profile grants ``permission``.
+
+        A user with no membership on the profile has NO access (deny-by-default).
+        The implicit machine owner is handled by the caller, not here.
+        """
+        perm = permission if isinstance(permission, Permission) else Permission(permission)
+        role = self.get_role(user_id, profile_id)
+        if role is None:
+            return False
+        return perm in permissions_for_role(role)

package/src/superlocalmemory/cli/commands.py

@@ -40,6 +40,14 @@ def _cmd_db_dispatch(args: Namespace) -> None:
     sys.exit(2)
 
 
+def _cmd_mesh_dispatch(args: Namespace) -> None:
+    """Route ``slm mesh ...`` inspection subcommands (M-03)."""
+    from superlocalmemory.cli.mesh_cmd import cmd_mesh
+    rc = cmd_mesh(args)
+    if rc:
+        sys.exit(rc)
+
+
 def _cmd_escape_disable(args: Namespace) -> None:
     from superlocalmemory.cli.escape_hatch import cmd_disable
     cmd_disable(args)
@@ -98,6 +106,11 @@ def _cmd_help_optimize(args: Namespace) -> None:
     cmd_help_optimize(args)
 
 
+def _cmd_loop(args: Namespace) -> None:
+    from superlocalmemory.cli.loop_cmd import cmd_loop
+    cmd_loop(args)
+
+
 # ---- end SLM v3.6 Optimize dispatch functions ----
 
 
@@ -201,6 +214,8 @@ def dispatch(args: Namespace) -> None:
         "context": _cmd_context_dispatch,
         # V3.4.22 LLD-06 additive schema migrations
         "db": _cmd_db_dispatch,
+        # V3.7.9 M-03 — terminal mesh inspection
+        "mesh": _cmd_mesh_dispatch,
         # V3.4.22 Stage 8 SB-5 — MASTER-PLAN §8 escape hatches.
         "disable": _cmd_escape_disable,
         "enable": _cmd_escape_enable,
@@ -218,6 +233,8 @@ def dispatch(args: Namespace) -> None:
         "compress": _cmd_compress,
         "proxy": _cmd_proxy,
         "help-optimize": _cmd_help_optimize,
+        # V3.8.0 bounded loops (gate-verified agent loops, SLM-backed ledger)
+        "loop": _cmd_loop,
     }
     handler = handlers.get(args.command)
     if handler:
@@ -345,6 +362,11 @@ def cmd_serve(args: Namespace) -> None:
     else:
         from superlocalmemory.infra.data_root import state_path
         print(f"Failed to start daemon. Check {state_path('logs', 'daemon.log')}")
+        # INT-H-02: exit non-zero so callers can detect the failure. The plugin
+        # launcher (plugin/scripts/slm-launch) guards on this exit code and
+        # refuses to open a direct MCP writer against a broken daemon; without
+        # the non-zero exit that guard was a dead no-op.
+        sys.exit(1)
 
 
 # -- Ingestion Adapters (V3.4.3) ------------------------------------------
@@ -610,6 +632,8 @@ def cmd_config(args: Namespace) -> None:
     elif action == "set":
         _ALLOWED_CONFIG_KEYS = {
             "evolution.enabled", "evolution.backend", "evolution.max_evolutions_per_cycle",
+            "evolution.mutation_model", "evolution.verify_model",
+            "evolution.confirm_model",
             "mesh_enabled", "daemon_idle_timeout", "entity_compilation_enabled",
             "graph_backend", "vector_backend", "scale_engine_state",
             "scope.default_scope", "scope.recall_include_global",
@@ -677,6 +701,31 @@ def cmd_config(args: Namespace) -> None:
                 print(f"Error: {message}")
             sys.exit(1)
 
+        _MODEL_KEYS = {
+            "evolution.mutation_model", "evolution.verify_model",
+            "evolution.confirm_model",
+        }
+        if key in _MODEL_KEYS:
+            from superlocalmemory.evolution.model_selection import _MODEL_ALIASES
+
+            accepted = set(_MODEL_ALIASES) | {"", "auto"}
+            sval = str(parsed_value)
+            if sval not in accepted:
+                allowed = ", ".join(["auto", *sorted(_MODEL_ALIASES)])
+                message = f"{key} must be one of: {allowed}"
+                if use_json:
+                    from superlocalmemory.cli.json_output import json_print
+                    json_print("config", error={
+                        "code": "INVALID_VALUE", "message": message,
+                    })
+                else:
+                    print(f"Error: {message}")
+                sys.exit(1)
+            # Normalise the "auto" sentinel to the empty string the
+            # resolver treats as "pick the cheapest for the backend".
+            if sval == "auto":
+                parsed_value = ""
+
         if key.startswith("scope."):
             from superlocalmemory.cli.daemon import daemon_request, is_daemon_running
 
@@ -727,6 +776,18 @@ def cmd_config(args: Namespace) -> None:
             })
         else:
             print(f"{key}: {old_value} -> {parsed_value}")
+            if key == "evolution.enabled" and parsed_value is True:
+                print(
+                    "\n⚠  Skill evolution is now ON. It makes background "
+                    "LLM calls during consolidation\n"
+                    "   (capped at 10 calls/cycle, 3 cycles/day). It defaults "
+                    "to the lowest-cost model\n"
+                    "   for your backend (Claude → Haiku, Ollama → "
+                    "local/free).\n"
+                    "   Pick models: slm config set evolution.mutation_model "
+                    "<auto|haiku|sonnet|ollama>\n"
+                    "   Turn off:    slm config set evolution.enabled false"
+                )
 
     else:
         if use_json:
@@ -1271,10 +1332,12 @@ def cmd_recall(args: Namespace) -> None:
                 scope_qs += f"&include_global={str(include_global).lower()}"
             if include_shared is not None:
                 scope_qs += f"&include_shared={str(include_shared).lower()}"
+            _window = getattr(args, "window", "") or ""
+            window_qs = f"&window={quote(_window)}" if _window else ""
             result = daemon_request(
                 "GET",
                 f"/recall?q={quote(args.query)}&limit={args.limit}"
-                f"&session_id={quote(session_id)}{fast_qs}{scope_qs}",
+                f"&session_id={quote(session_id)}{fast_qs}{scope_qs}{window_qs}",
             )
             if result and "results" in result:
                 # Format daemon response same as engine response
@@ -1294,8 +1357,10 @@ def cmd_recall(args: Namespace) -> None:
                 for i, r in enumerate(result["results"], 1):
                     print(f"  {i}. [{r['score']:.2f}] {r['content']}")
                 return
-    except Exception:
-        pass  # Fall through to direct engine
+    except Exception as _exc:  # noqa: BLE001
+        logger.warning(
+            "Daemon recall failed, falling back to direct engine: %s", _exc
+        )
 
     from superlocalmemory.core.config import SLMConfig
     from superlocalmemory.core.engine import MemoryEngine
@@ -1310,6 +1375,7 @@ def cmd_recall(args: Namespace) -> None:
             fast=getattr(args, "fast", False),
             include_global=include_global,
             include_shared=include_shared,
+            window=getattr(args, "window", "") or None,
         )
     except Exception as exc:
         if use_json:
@@ -1394,12 +1460,32 @@ def cmd_forget(args: Namespace) -> None:
     from superlocalmemory.core.config import SLMConfig
 
     use_json = getattr(args, 'json', False)
+    dry_run = getattr(args, 'dry_run', False)
+    raw_query = getattr(args, 'query', None)
+
+    # F3: `query` is optional so `slm forget --dry-run` can preview every memory.
+    # Deletion ALWAYS requires an explicit query — a bare `slm forget` must never
+    # mass-delete. In dry-run mode a missing query means "match all" (preview).
+    if raw_query is None and not dry_run:
+        msg = (
+            "A query is required to delete. Preview everything with "
+            "'slm forget --dry-run', or delete matches with 'slm forget <query>'."
+        )
+        if use_json:
+            from superlocalmemory.cli.json_output import json_print
+            json_print("forget", error={"code": "QUERY_REQUIRED", "message": msg})
+        else:
+            print(msg)
+        sys.exit(2)
+
+    query_lower = "" if raw_query is None else raw_query.lower()
+    query_label = raw_query if raw_query is not None else "*all*"
+
     try:
         config = SLMConfig.load()
         engine = MemoryEngine(config)
         engine.initialize()
         facts = engine._db.get_all_facts(engine.profile_id)
-        query_lower = args.query.lower()
         matches = [f for f in facts if query_lower in f.content.lower()]
     except Exception as exc:
         if use_json:
@@ -1408,8 +1494,6 @@ def cmd_forget(args: Namespace) -> None:
             sys.exit(1)
         raise
 
-    dry_run = getattr(args, 'dry_run', False)
-
     def delete_fact_authorized_for_cli(fact_id: str) -> None:
         from superlocalmemory.core.engine_ingestion import local_trusted_actor_id
         from superlocalmemory.core.mutations import delete_fact_authorized
@@ -1450,12 +1534,12 @@ def cmd_forget(args: Namespace) -> None:
                 "matches": match_items,
                 "hint": "Add --yes to confirm deletion",
             }, next_actions=[
-                {"command": f"slm forget '{args.query}' --json --yes", "description": "Confirm deletion"},
+                {"command": f"slm forget '{query_label}' --json --yes", "description": "Confirm deletion"},
             ])
         return
 
     if not matches:
-        print(f"No memories matching '{args.query}'")
+        print(f"No memories matching '{query_label}'")
         return
     print(f"Found {len(matches)} matching memories:")
     for f in matches[:10]:
@@ -1835,8 +1919,8 @@ def cmd_health(args: Namespace) -> None:
 
     print("Math Layer Health:")
     print(f"  Total facts: {len(facts)}")
-    print(f"  Fisher-Rao indexed: {fisher_count}/{len(facts)}")
-    print(f"  Langevin positioned: {langevin_count}/{len(facts)}")
+    print(f"  Math layer indexed: {fisher_count}/{len(facts)}")
+    print(f"  Lifecycle positioned: {langevin_count}/{len(facts)}")
     print(f"  Mode: {config.mode.value.upper()}")