empathy-framework 5.3.0__py3-none-any.whl → 5.4.0__py3-none-any.whl

empathy_os/memory/control_panel.py

@@ -1,1290 +0,0 @@
-"""Memory Control Panel for Empathy Framework
-
-Enterprise-grade control panel for managing AI memory systems.
-Provides both programmatic API and CLI interface.
-
-Features:
-- Redis lifecycle management (start/stop/status)
-- Memory statistics and health monitoring
-- Pattern management (list, search, delete)
-- Configuration management
-- Export/import capabilities
-
-Usage (Python API):
-    from empathy_os.memory import MemoryControlPanel
-
-    panel = MemoryControlPanel()
-    print(panel.status())
-    panel.start_redis()
-    panel.show_statistics()
-
-Usage (CLI):
-    python -m empathy_os.memory.control_panel status
-    python -m empathy_os.memory.control_panel start
-    python -m empathy_os.memory.control_panel stats
-    python -m empathy_os.memory.control_panel patterns --list
-
-Copyright 2025 Smart AI Memory, LLC
-Licensed under Fair Source 0.9
-"""
-
-import argparse
-import json
-import logging
-import re
-import signal
-import ssl
-import sys
-import time
-import warnings
-from dataclasses import asdict, dataclass
-from datetime import datetime
-from http.server import BaseHTTPRequestHandler, HTTPServer
-from pathlib import Path
-from typing import Any
-from urllib.parse import parse_qs, urlparse
-
-import structlog
-
-from .control_panel_support import APIKeyAuth, MemoryStats, RateLimiter
-from .long_term import Classification, SecureMemDocsIntegration
-from .redis_bootstrap import (
-    RedisStartMethod,
-    RedisStatus,
-    _check_redis_running,
-    ensure_redis,
-    stop_redis,
-)
-from .short_term import AccessTier, AgentCredentials, RedisShortTermMemory
-
-# Suppress noisy warnings in CLI mode
-warnings.filterwarnings("ignore", category=RuntimeWarning, module="runpy")
-
-# Version
-__version__ = "2.2.0"
-
-logger = structlog.get_logger(__name__)
-
-# =============================================================================
-# Security Configuration
-# =============================================================================
-
-# Pattern ID validation regex - matches format: pat_YYYYMMDDHHMMSS_hexstring
-PATTERN_ID_REGEX = re.compile(r"^pat_\d{14}_[a-f0-9]{8,16}$")
-
-# Alternative pattern formats that are also valid
-PATTERN_ID_ALT_REGEX = re.compile(r"^[a-zA-Z][a-zA-Z0-9_-]{2,63}$")
-
-# Rate limiting configuration
-RATE_LIMIT_WINDOW_SECONDS = 60
-RATE_LIMIT_MAX_REQUESTS = 100  # Per IP per window
-
-
-def _validate_pattern_id(pattern_id: str) -> bool:
-    """Validate pattern ID to prevent path traversal and injection attacks.
-
-    Args:
-        pattern_id: The pattern ID to validate
-
-    Returns:
-        True if valid, False otherwise
-
-    """
-    if not pattern_id or not isinstance(pattern_id, str):
-        return False
-
-    # Check for path traversal attempts
-    if ".." in pattern_id or "/" in pattern_id or "\\" in pattern_id:
-        return False
-
-    # Check for null bytes
-    if "\x00" in pattern_id:
-        return False
-
-    # Check length bounds
-    if len(pattern_id) < 3 or len(pattern_id) > 64:
-        return False
-
-    # Must match one of the valid formats
-    return bool(PATTERN_ID_REGEX.match(pattern_id) or PATTERN_ID_ALT_REGEX.match(pattern_id))
-
-
-def _validate_agent_id(agent_id: str) -> bool:
-    """Validate agent ID format.
-
-    Args:
-        agent_id: The agent ID to validate
-
-    Returns:
-        True if valid, False otherwise
-
-    """
-    if not agent_id or not isinstance(agent_id, str):
-        return False
-
-    # Check for dangerous characters (path separators, null bytes, command injection)
-    # Note: "." and "@" are allowed for email-style user IDs
-    if any(c in agent_id for c in ["/", "\\", "\x00", ";", "|", "&"]):
-        return False
-
-    # Check length bounds
-    if len(agent_id) < 1 or len(agent_id) > 64:
-        return False
-
-    # Simple alphanumeric with some allowed chars
-    return bool(re.match(r"^[a-zA-Z0-9_@.-]+$", agent_id))
-
-
-def _validate_classification(classification: str | None) -> bool:
-    """Validate classification parameter.
-
-    Args:
-        classification: The classification to validate
-
-    Returns:
-        True if valid, False otherwise
-
-    """
-    if classification is None:
-        return True
-    if not isinstance(classification, str):
-        return False
-    return classification.upper() in ("PUBLIC", "INTERNAL", "SENSITIVE")
-
-
-def _validate_file_path(path: str, allowed_dir: str | None = None) -> Path:
-    """Validate file path to prevent path traversal and arbitrary writes.
-
-    Args:
-        path: Path to validate
-        allowed_dir: Optional directory that must contain the path
-
-    Returns:
-        Resolved absolute Path object
-
-    Raises:
-        ValueError: If path is invalid or outside allowed directory
-
-    """
-    if not path or not isinstance(path, str):
-        raise ValueError("path must be a non-empty string")
-
-    # Check for null bytes
-    if "\x00" in path:
-        raise ValueError("path contains null bytes")
-
-    try:
-        # Resolve to absolute path
-        resolved = Path(path).resolve()
-    except (OSError, RuntimeError) as e:
-        raise ValueError(f"Invalid path: {e}")
-
-    # Check if within allowed directory
-    if allowed_dir:
-        try:
-            allowed = Path(allowed_dir).resolve()
-            resolved.relative_to(allowed)
-        except ValueError:
-            raise ValueError(f"path must be within {allowed_dir}")
-
-    # Check for dangerous system paths
-    dangerous_paths = ["/etc", "/sys", "/proc", "/dev"]
-    for dangerous in dangerous_paths:
-        if str(resolved).startswith(dangerous):
-            raise ValueError(f"Cannot write to system directory: {dangerous}")
-
-    return resolved
-
-
-@dataclass
-class ControlPanelConfig:
-    """Configuration for control panel."""
-
-    redis_host: str = "localhost"
-    redis_port: int = 6379
-    storage_dir: str = "./memdocs_storage"
-    audit_dir: str = "./logs"
-    auto_start_redis: bool = True
-
-
-class MemoryControlPanel:
-    """Enterprise control panel for Empathy memory management.
-
-    Provides unified management interface for:
-    - Short-term memory (Redis)
-    - Long-term memory (MemDocs/file storage)
-    - Security and compliance controls
-
-    Example:
-        >>> panel = MemoryControlPanel()
-        >>> status = panel.status()
-        >>> print(f"Redis: {status['redis']['status']}")
-        >>> print(f"Patterns: {status['long_term']['pattern_count']}")
-
-    """
-
-    def __init__(self, config: ControlPanelConfig | None = None):
-        """Initialize control panel.
-
-        Args:
-            config: Configuration options (uses defaults if None)
-
-        """
-        self.config = config or ControlPanelConfig()
-        self._redis_status: RedisStatus | None = None
-        self._short_term: RedisShortTermMemory | None = None
-        self._long_term: SecureMemDocsIntegration | None = None
-
-    def status(self) -> dict[str, Any]:
-        """Get comprehensive status of memory system.
-
-        Returns:
-            Dictionary with status of all memory components
-
-        """
-        redis_running = _check_redis_running(self.config.redis_host, self.config.redis_port)
-
-        result = {
-            "timestamp": datetime.utcnow().isoformat() + "Z",
-            "redis": {
-                "status": "running" if redis_running else "stopped",
-                "host": self.config.redis_host,
-                "port": self.config.redis_port,
-                "method": self._redis_status.method.value if self._redis_status else "unknown",
-            },
-            "long_term": {
-                "status": (
-                    "available" if Path(self.config.storage_dir).exists() else "not_initialized"
-                ),
-                "storage_dir": self.config.storage_dir,
-                "pattern_count": self._count_patterns(),
-            },
-            "config": {
-                "auto_start_redis": self.config.auto_start_redis,
-                "audit_dir": self.config.audit_dir,
-            },
-        }
-
-        return result
-
-    def start_redis(self, verbose: bool = True) -> RedisStatus:
-        """Start Redis if not running.
-
-        Args:
-            verbose: Print status messages
-
-        Returns:
-            RedisStatus with result
-
-        """
-        self._redis_status = ensure_redis(
-            host=self.config.redis_host,
-            port=self.config.redis_port,
-            auto_start=True,
-            verbose=verbose,
-        )
-        return self._redis_status
-
-    def stop_redis(self) -> bool:
-        """Stop Redis if we started it.
-
-        Returns:
-            True if stopped successfully
-
-        """
-        if self._redis_status and self._redis_status.method != RedisStartMethod.ALREADY_RUNNING:
-            return stop_redis(self._redis_status.method)
-        return False
-
-    def get_statistics(self) -> MemoryStats:
-        """Collect comprehensive statistics.
-
-        Returns:
-            MemoryStats with all metrics
-
-        """
-        start_time = time.perf_counter()
-        stats = MemoryStats(collected_at=datetime.utcnow().isoformat() + "Z")
-
-        # Redis stats
-        redis_running = _check_redis_running(self.config.redis_host, self.config.redis_port)
-        stats.redis_available = redis_running
-
-        if redis_running:
-            try:
-                memory = self._get_short_term()
-
-                # Measure Redis ping latency
-                ping_start = time.perf_counter()
-                redis_stats = memory.get_stats()
-                stats.redis_ping_ms = (time.perf_counter() - ping_start) * 1000
-
-                stats.redis_method = redis_stats.get("mode", "redis")
-                stats.redis_keys_total = redis_stats.get("total_keys", 0)
-                stats.redis_keys_working = redis_stats.get("working_keys", 0)
-                stats.redis_keys_staged = redis_stats.get("staged_keys", 0)
-                stats.redis_memory_used = redis_stats.get("used_memory", "0")
-            except Exception as e:
-                logger.warning("redis_stats_failed", error=str(e))
-
-        # Long-term stats
-        storage_path = Path(self.config.storage_dir)
-        if storage_path.exists():
-            stats.long_term_available = True
-
-            # Calculate storage size
-            try:
-                stats.storage_bytes = sum(
-                    f.stat().st_size for f in storage_path.glob("**/*") if f.is_file()
-                )
-            except Exception as e:
-                logger.debug("storage_size_calculation_failed", error=str(e))
-                stats.storage_bytes = 0
-
-            try:
-                long_term = self._get_long_term()
-                lt_stats = long_term.get_statistics()
-                stats.patterns_total = lt_stats.get("total_patterns", 0)
-                stats.patterns_public = lt_stats.get("by_classification", {}).get("PUBLIC", 0)
-                stats.patterns_internal = lt_stats.get("by_classification", {}).get("INTERNAL", 0)
-                stats.patterns_sensitive = lt_stats.get("by_classification", {}).get("SENSITIVE", 0)
-                stats.patterns_encrypted = lt_stats.get("encrypted_count", 0)
-            except Exception as e:
-                logger.warning("long_term_stats_failed", error=str(e))
-
-        # Total collection time
-        stats.collection_time_ms = (time.perf_counter() - start_time) * 1000
-
-        return stats
-
-    def list_patterns(
-        self,
-        classification: str | None = None,
-        limit: int = 100,
-    ) -> list[dict[str, Any]]:
-        """List patterns in long-term storage.
-
-        Args:
-            classification: Filter by classification (PUBLIC/INTERNAL/SENSITIVE)
-            limit: Maximum patterns to return
-
-        Returns:
-            List of pattern summaries
-
-        Raises:
-            ValueError: If classification is invalid or limit is out of range
-
-        """
-        # Validate classification
-        if not _validate_classification(classification):
-            raise ValueError(
-                f"Invalid classification '{classification}'. "
-                f"Must be PUBLIC, INTERNAL, or SENSITIVE."
-            )
-
-        # Validate limit range
-        if limit < 1:
-            raise ValueError(f"limit must be positive, got {limit}")
-
-        if limit > 10000:
-            raise ValueError(f"limit too large (max 10000), got {limit}")
-
-        long_term = self._get_long_term()
-
-        class_filter = None
-        if classification:
-            class_filter = Classification[classification.upper()]
-
-        # Use admin user for listing
-        patterns = long_term.list_patterns(
-            user_id="admin@system",
-            classification=class_filter,
-        )
-
-        return patterns[:limit]
-
-    def delete_pattern(self, pattern_id: str, user_id: str = "admin@system") -> bool:
-        """Delete a pattern from long-term storage.
-
-        Args:
-            pattern_id: Pattern to delete
-            user_id: User performing deletion (for audit)
-
-        Returns:
-            True if deleted
-
-        Raises:
-            ValueError: If pattern_id or user_id format is invalid
-
-        """
-        # Validate pattern_id
-        if not _validate_pattern_id(pattern_id):
-            raise ValueError(f"Invalid pattern_id format: {pattern_id}")
-
-        # Validate user_id (reuse agent_id validation - same format)
-        if not _validate_agent_id(user_id):
-            raise ValueError(f"Invalid user_id format: {user_id}")
-
-        long_term = self._get_long_term()
-        try:
-            return long_term.delete_pattern(pattern_id, user_id)
-        except Exception as e:
-            logger.error("delete_pattern_failed", pattern_id=pattern_id, error=str(e))
-            return (
-                False  # Graceful degradation - validation errors raise, storage errors return False
-            )
-
-    def clear_short_term(self, agent_id: str = "admin") -> int:
-        """Clear all short-term memory for an agent.
-
-        Args:
-            agent_id: Agent whose memory to clear
-
-        Returns:
-            Number of keys deleted
-
-        Raises:
-            ValueError: If agent_id format is invalid
-
-        """
-        # Validate agent_id
-        if not _validate_agent_id(agent_id):
-            raise ValueError(f"Invalid agent_id format: {agent_id}")
-
-        memory = self._get_short_term()
-        creds = AgentCredentials(agent_id=agent_id, tier=AccessTier.STEWARD)
-        return memory.clear_working_memory(creds)
-
-    def export_patterns(self, output_path: str, classification: str | None = None) -> int:
-        """Export patterns to JSON file.
-
-        Args:
-            output_path: Path to output file
-            classification: Filter by classification
-
-        Returns:
-            Number of patterns exported
-
-        Raises:
-            ValueError: If output_path is invalid, classification invalid, or path is unsafe
-
-        """
-        # Validate file path to prevent path traversal attacks
-        validated_path = _validate_file_path(output_path)
-
-        # Validate classification (list_patterns will also validate, but do it early)
-        if not _validate_classification(classification):
-            raise ValueError(
-                f"Invalid classification '{classification}'. "
-                f"Must be PUBLIC, INTERNAL, or SENSITIVE."
-            )
-
-        patterns = self.list_patterns(classification=classification)
-
-        export_data = {
-            "exported_at": datetime.utcnow().isoformat() + "Z",
-            "classification_filter": classification,
-            "pattern_count": len(patterns),
-            "patterns": patterns,
-        }
-
-        with open(validated_path, "w") as f:
-            json.dump(export_data, f, indent=2)
-
-        return len(patterns)
-
-    def health_check(self) -> dict[str, Any]:
-        """Perform comprehensive health check.
-
-        Returns:
-            Health status with recommendations
-
-        """
-        status = self.status()
-        stats = self.get_statistics()
-
-        checks: list[dict[str, str]] = []
-        recommendations: list[str] = []
-        health: dict[str, Any] = {
-            "overall": "healthy",
-            "checks": checks,
-            "recommendations": recommendations,
-        }
-
-        # Check Redis
-        if status["redis"]["status"] == "running":
-            checks.append({"name": "redis", "status": "pass", "message": "Redis is running"})
-        else:
-            checks.append({"name": "redis", "status": "warn", "message": "Redis not running"})
-            recommendations.append("Start Redis for multi-agent coordination")
-            health["overall"] = "degraded"
-
-        # Check long-term storage
-        if status["long_term"]["status"] == "available":
-            checks.append({"name": "long_term", "status": "pass", "message": "Storage available"})
-        else:
-            checks.append(
-                {"name": "long_term", "status": "warn", "message": "Storage not initialized"},
-            )
-            recommendations.append("Initialize long-term storage directory")
-            health["overall"] = "degraded"
-
-        # Check pattern count
-        if stats.patterns_total > 0:
-            checks.append(
-                {
-                    "name": "patterns",
-                    "status": "pass",
-                    "message": f"{stats.patterns_total} patterns stored",
-                },
-            )
-        else:
-            checks.append(
-                {"name": "patterns", "status": "info", "message": "No patterns stored yet"},
-            )
-
-        # Check encryption
-        if stats.patterns_sensitive > 0 and stats.patterns_encrypted < stats.patterns_sensitive:
-            checks.append(
-                {
-                    "name": "encryption",
-                    "status": "fail",
-                    "message": "Some sensitive patterns are not encrypted",
-                },
-            )
-            recommendations.append("Enable encryption for sensitive patterns")
-            health["overall"] = "unhealthy"
-        elif stats.patterns_sensitive > 0:
-            checks.append(
-                {
-                    "name": "encryption",
-                    "status": "pass",
-                    "message": "All sensitive patterns encrypted",
-                },
-            )
-
-        return health
-
-    def _get_short_term(self) -> RedisShortTermMemory:
-        """Get or create short-term memory instance."""
-        if self._short_term is None:
-            redis_running = _check_redis_running(self.config.redis_host, self.config.redis_port)
-            self._short_term = RedisShortTermMemory(
-                host=self.config.redis_host,
-                port=self.config.redis_port,
-                use_mock=not redis_running,
-            )
-        return self._short_term
-
-    def _get_long_term(self) -> SecureMemDocsIntegration:
-        """Get or create long-term memory instance."""
-        if self._long_term is None:
-            self._long_term = SecureMemDocsIntegration(
-                storage_dir=self.config.storage_dir,
-                audit_log_dir=self.config.audit_dir,
-                enable_encryption=True,
-            )
-        return self._long_term
-
-    def _count_patterns(self) -> int:
-        """Count patterns in storage.
-
-        Returns:
-            Number of pattern files, or 0 if counting fails
-
-        """
-        storage_path = Path(self.config.storage_dir)
-        if not storage_path.exists():
-            return 0
-
-        try:
-            return len(list(storage_path.glob("*.json")))
-        except (OSError, PermissionError) as e:
-            logger.debug("pattern_count_failed", error=str(e))
-            return 0
-
-
-def print_status(panel: MemoryControlPanel):
-    """Print status in a formatted way."""
-    status = panel.status()
-
-    print("\n" + "=" * 50)
-    print("EMPATHY MEMORY STATUS")
-    print("=" * 50)
-
-    # Redis
-    redis = status["redis"]
-    redis_icon = "✓" if redis["status"] == "running" else "✗"
-    print(f"\n{redis_icon} Redis: {redis['status'].upper()}")
-    print(f"  Host: {redis['host']}:{redis['port']}")
-    if redis["method"] != "unknown":
-        print(f"  Method: {redis['method']}")
-
-    # Long-term
-    lt = status["long_term"]
-    lt_icon = "✓" if lt["status"] == "available" else "○"
-    print(f"\n{lt_icon} Long-term Storage: {lt['status'].upper()}")
-    print(f"  Path: {lt['storage_dir']}")
-    print(f"  Patterns: {lt['pattern_count']}")
-
-    print()
-
-
-def print_stats(panel: MemoryControlPanel):
-    """Print statistics in a formatted way."""
-    stats = panel.get_statistics()
-
-    print("\n" + "=" * 50)
-    print("EMPATHY MEMORY STATISTICS")
-    print("=" * 50)
-
-    print("\nShort-term Memory (Redis):")
-    print(f"  Available: {stats.redis_available}")
-    if stats.redis_available:
-        print(f"  Total keys: {stats.redis_keys_total}")
-        print(f"  Working keys: {stats.redis_keys_working}")
-        print(f"  Staged patterns: {stats.redis_keys_staged}")
-        print(f"  Memory used: {stats.redis_memory_used}")
-
-    print("\nLong-term Memory (Patterns):")
-    print(f"  Available: {stats.long_term_available}")
-    print(f"  Total patterns: {stats.patterns_total}")
-    print(f"  └─ PUBLIC: {stats.patterns_public}")
-    print(f"  └─ INTERNAL: {stats.patterns_internal}")
-    print(f"  └─ SENSITIVE: {stats.patterns_sensitive}")
-    print(f"  Encrypted: {stats.patterns_encrypted}")
-
-    # Performance stats
-    print("\nPerformance:")
-    if stats.redis_ping_ms > 0:
-        print(f"  Redis latency: {stats.redis_ping_ms:.2f}ms")
-    if stats.storage_bytes > 0:
-        size_kb = stats.storage_bytes / 1024
-        print(f"  Storage size: {size_kb:.1f} KB")
-    print(f"  Stats collected in: {stats.collection_time_ms:.2f}ms")
-
-    print()
-
-
-def print_health(panel: MemoryControlPanel):
-    """Print health check in a formatted way."""
-    health = panel.health_check()
-
-    print("\n" + "=" * 50)
-    print("EMPATHY MEMORY HEALTH CHECK")
-    print("=" * 50)
-
-    status_icons = {"pass": "✓", "warn": "⚠", "fail": "✗", "info": "ℹ"}
-    overall_icon = (
-        "✓" if health["overall"] == "healthy" else "⚠" if health["overall"] == "degraded" else "✗"
-    )
-
-    print(f"\n{overall_icon} Overall: {health['overall'].upper()}")
-
-    print("\nChecks:")
-    for check in health["checks"]:
-        icon = status_icons.get(check["status"], "?")
-        print(f"  {icon} {check['name']}: {check['message']}")
-
-    if health["recommendations"]:
-        print("\nRecommendations:")
-        for rec in health["recommendations"]:
-            print(f"  • {rec}")
-
-    print()
-
-
-class MemoryAPIHandler(BaseHTTPRequestHandler):
-    """HTTP request handler for Memory Control Panel API."""
-
-    panel: MemoryControlPanel | None = None  # Set by server
-    rate_limiter: RateLimiter | None = None  # Set by server
-    api_auth: APIKeyAuth | None = None  # Set by server
-    allowed_origins: list[str] | None = None  # Set by server for CORS
-
-    def log_message(self, format, *args):
-        """Override to use structlog instead of stderr."""
-        logger.debug("api_request", message=format % args)
-
-    def _get_client_ip(self) -> str:
-        """Get client IP address, handling proxies."""
-        # Check for X-Forwarded-For header (behind proxy)
-        forwarded = self.headers.get("X-Forwarded-For")
-        if forwarded:
-            # Take the first IP in the chain
-            return forwarded.split(",")[0].strip()
-        # Fall back to direct connection
-        return self.client_address[0]
-
-    def _check_rate_limit(self) -> bool:
-        """Check if request should be rate limited."""
-        if self.rate_limiter is None:
-            return True
-        return self.rate_limiter.is_allowed(self._get_client_ip())
-
-    def _check_auth(self) -> bool:
-        """Check API key authentication."""
-        if self.api_auth is None or not self.api_auth.enabled:
-            return True
-
-        # Check Authorization header
-        auth_header = self.headers.get("Authorization")
-        if auth_header and auth_header.startswith("Bearer "):
-            token = auth_header[7:]
-            return self.api_auth.is_valid(token)
-
-        # Check X-API-Key header
-        api_key = self.headers.get("X-API-Key")
-        if api_key:
-            return self.api_auth.is_valid(api_key)
-
-        return False
-
-    def _get_cors_origin(self) -> str:
-        """Get appropriate CORS origin header value."""
-        if self.allowed_origins is None:
-            # Default: allow localhost only
-            origin = self.headers.get("Origin", "")
-            if origin.startswith("http://localhost") or origin.startswith("https://localhost"):
-                return origin
-            return "http://localhost:8765"
-
-        if "*" in self.allowed_origins:
-            return "*"
-
-        origin = self.headers.get("Origin", "")
-        if origin in self.allowed_origins:
-            return origin
-
-        return self.allowed_origins[0] if self.allowed_origins else ""
-
-    def _send_json(self, data: Any, status: int = 200):
-        """Send JSON response."""
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Access-Control-Allow-Origin", self._get_cors_origin())
-        self.send_header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS")
-        self.send_header("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key")
-
-        # Add rate limit headers if available
-        if self.rate_limiter:
-            remaining = self.rate_limiter.get_remaining(self._get_client_ip())
-            self.send_header("X-RateLimit-Remaining", str(remaining))
-            self.send_header("X-RateLimit-Limit", str(self.rate_limiter.max_requests))
-
-        self.end_headers()
-        self.wfile.write(json.dumps(data).encode())
-
-    def _send_error(self, message: str, status: int = 400):
-        """Send error response."""
-        self._send_json({"error": message, "status_code": status}, status)
-
-    def do_OPTIONS(self):
-        """Handle CORS preflight."""
-        self.send_response(200)
-        self.send_header("Access-Control-Allow-Origin", self._get_cors_origin())
-        self.send_header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS")
-        self.send_header("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key")
-        self.end_headers()
-
-    def do_GET(self):
-        """Handle GET requests."""
-        # Rate limiting check
-        if not self._check_rate_limit():
-            self._send_error("Rate limit exceeded. Try again later.", 429)
-            return
-
-        # Authentication check (skip for ping endpoint)
-        parsed = urlparse(self.path)
-        path = parsed.path
-
-        if path != "/api/ping" and not self._check_auth():
-            self._send_error("Unauthorized. Provide valid API key.", 401)
-            return
-
-        query = parse_qs(parsed.query)
-
-        if path == "/api/ping":
-            self._send_json({"status": "ok", "service": "empathy-memory"})
-
-        elif path == "/api/status":
-            self._send_json(self.panel.status())
-
-        elif path == "/api/stats":
-            stats = self.panel.get_statistics()
-            self._send_json(asdict(stats))
-
-        elif path == "/api/health":
-            self._send_json(self.panel.health_check())
-
-        elif path == "/api/patterns":
-            classification = query.get("classification", [None])[0]
-
-            # Validate classification
-            if not _validate_classification(classification):
-                self._send_error("Invalid classification. Use PUBLIC, INTERNAL, or SENSITIVE.", 400)
-                return
-
-            # Validate and sanitize limit
-            try:
-                limit = int(query.get("limit", [100])[0])
-                limit = max(1, min(limit, 1000))  # Clamp between 1 and 1000
-            except (ValueError, TypeError):
-                limit = 100
-
-            patterns = self.panel.list_patterns(classification=classification, limit=limit)
-            self._send_json(patterns)
-
-        elif path == "/api/patterns/export":
-            classification = query.get("classification", [None])[0]
-
-            # Validate classification
-            if not _validate_classification(classification):
-                self._send_error("Invalid classification. Use PUBLIC, INTERNAL, or SENSITIVE.", 400)
-                return
-
-            patterns = self.panel.list_patterns(classification=classification)
-            export_data = {
-                "exported_at": datetime.utcnow().isoformat() + "Z",
-                "classification_filter": classification,
-                "patterns": patterns,
-            }
-            self._send_json({"pattern_count": len(patterns), "export_data": export_data})
-
-        elif path.startswith("/api/patterns/"):
-            pattern_id = path.split("/")[-1]
-
-            # Validate pattern ID
-            if not _validate_pattern_id(pattern_id):
-                self._send_error("Invalid pattern ID format", 400)
-                return
-
-            patterns = self.panel.list_patterns()
-            pattern = next((p for p in patterns if p.get("pattern_id") == pattern_id), None)
-            if pattern:
-                self._send_json(pattern)
-            else:
-                self._send_error("Pattern not found", 404)
-
-        else:
-            self._send_error("Not found", 404)
-
-    def do_POST(self):
-        """Handle POST requests."""
-        # Rate limiting check
-        if not self._check_rate_limit():
-            self._send_error("Rate limit exceeded. Try again later.", 429)
-            return
-
-        # Authentication check
-        if not self._check_auth():
-            self._send_error("Unauthorized. Provide valid API key.", 401)
-            return
-
-        parsed = urlparse(self.path)
-        path = parsed.path
-
-        # Read body if present (with size limit to prevent DoS)
-        content_length = int(self.headers.get("Content-Length", 0))
-        max_body_size = 1024 * 1024  # 1MB limit
-        if content_length > max_body_size:
-            self._send_error("Request body too large", 413)
-            return
-
-        body = {}
-        if content_length > 0:
-            try:
-                body = json.loads(self.rfile.read(content_length).decode())
-            except (json.JSONDecodeError, UnicodeDecodeError):
-                self._send_error("Invalid JSON body", 400)
-                return
-
-        if path == "/api/redis/start":
-            status = self.panel.start_redis(verbose=False)
-            self._send_json(
-                {
-                    "success": status.available,
-                    "message": f"Redis {'OK' if status.available else 'failed'} via {status.method.value}",
-                },
-            )
-
-        elif path == "/api/redis/stop":
-            stopped = self.panel.stop_redis()
-            self._send_json(
-                {
-                    "success": stopped,
-                    "message": "Redis stopped" if stopped else "Could not stop Redis",
-                },
-            )
-
-        elif path == "/api/memory/clear":
-            agent_id = body.get("agent_id", "admin")
-
-            # Validate agent ID
-            if not _validate_agent_id(agent_id):
-                self._send_error("Invalid agent ID format", 400)
-                return
-
-            deleted = self.panel.clear_short_term(agent_id)
-            self._send_json({"keys_deleted": deleted})
-
-        else:
-            self._send_error("Not found", 404)
-
-    def do_DELETE(self):
-        """Handle DELETE requests."""
-        # Rate limiting check
-        if not self._check_rate_limit():
-            self._send_error("Rate limit exceeded. Try again later.", 429)
-            return
-
-        # Authentication check
-        if not self._check_auth():
-            self._send_error("Unauthorized. Provide valid API key.", 401)
-            return
-
-        parsed = urlparse(self.path)
-        path = parsed.path
-
-        if path.startswith("/api/patterns/"):
-            pattern_id = path.split("/")[-1]
-
-            # Validate pattern ID to prevent path traversal
-            if not _validate_pattern_id(pattern_id):
-                self._send_error("Invalid pattern ID format", 400)
-                return
-
-            deleted = self.panel.delete_pattern(pattern_id)
-            self._send_json({"success": deleted})
-        else:
-            self._send_error("Not found", 404)
-
-
-def run_api_server(
-    panel: MemoryControlPanel,
-    host: str = "localhost",
-    port: int = 8765,
-    api_key: str | None = None,
-    enable_rate_limit: bool = True,
-    rate_limit_requests: int = 100,
-    rate_limit_window: int = 60,
-    ssl_certfile: str | None = None,
-    ssl_keyfile: str | None = None,
-    allowed_origins: list[str] | None = None,
-):
-    """Run the Memory API server with security features.
-
-    Args:
-        panel: MemoryControlPanel instance
-        host: Host to bind to
-        port: Port to bind to
-        api_key: API key for authentication (or set EMPATHY_MEMORY_API_KEY env var)
-        enable_rate_limit: Enable rate limiting
-        rate_limit_requests: Max requests per window per IP
-        rate_limit_window: Rate limit window in seconds
-        ssl_certfile: Path to SSL certificate file for HTTPS
-        ssl_keyfile: Path to SSL key file for HTTPS
-        allowed_origins: List of allowed CORS origins (None = localhost only)
-
-    """
-    # Set up handler class attributes
-    MemoryAPIHandler.panel = panel
-    MemoryAPIHandler.allowed_origins = allowed_origins
-
-    # Set up rate limiting
-    if enable_rate_limit:
-        MemoryAPIHandler.rate_limiter = RateLimiter(
-            window_seconds=rate_limit_window,
-            max_requests=rate_limit_requests,
-        )
-    else:
-        MemoryAPIHandler.rate_limiter = None
-
-    # Set up API key authentication
-    MemoryAPIHandler.api_auth = APIKeyAuth(api_key)
-
-    server = HTTPServer((host, port), MemoryAPIHandler)
-
-    # Enable HTTPS if certificates provided
-    use_https = False
-    if ssl_certfile and ssl_keyfile:
-        if Path(ssl_certfile).exists() and Path(ssl_keyfile).exists():
-            context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-            context.load_cert_chain(ssl_certfile, ssl_keyfile)
-            server.socket = context.wrap_socket(server.socket, server_side=True)
-            use_https = True
-        else:
-            logger.warning("ssl_cert_not_found", certfile=ssl_certfile, keyfile=ssl_keyfile)
-
-    protocol = "https" if use_https else "http"
-
-    # Graceful shutdown handler
-    def shutdown_handler(signum, frame):
-        print("\n\nReceived shutdown signal...")
-        print("Stopping API server...")
-        server.shutdown()
-        # Stop Redis if we started it
-        if panel.stop_redis():
-            print("Stopped Redis")
-        print("Shutdown complete.")
-        sys.exit(0)
-
-    # Register signal handlers
-    signal.signal(signal.SIGINT, shutdown_handler)
-    signal.signal(signal.SIGTERM, shutdown_handler)
-
-    print(f"\n{'=' * 50}")
-    print("EMPATHY MEMORY API SERVER")
-    print(f"{'=' * 50}")
-    print(f"\nServer running at {protocol}://{host}:{port}")
-
-    # Security status
-    print("\nSecurity:")
-    print(f"  HTTPS:        {'✓ Enabled' if use_https else '✗ Disabled'}")
-    print(f"  API Key Auth: {'✓ Enabled' if MemoryAPIHandler.api_auth.enabled else '✗ Disabled'}")
-    print(
-        f"  Rate Limit:   {'✓ Enabled (' + str(rate_limit_requests) + '/min)' if enable_rate_limit else '✗ Disabled'}",
-    )
-    print(f"  CORS Origins: {allowed_origins or ['localhost']}")
-
-    print("\nEndpoints:")
-    print("  GET  /api/ping           Health check (no auth)")
-    print("  GET  /api/status         Memory system status")
-    print("  GET  /api/stats          Detailed statistics")
-    print("  GET  /api/health         Health check with recommendations")
-    print("  GET  /api/patterns       List patterns")
-    print("  GET  /api/patterns/export Export patterns")
-    print("  POST /api/redis/start    Start Redis")
-    print("  POST /api/redis/stop     Stop Redis")
-    print("  POST /api/memory/clear   Clear short-term memory")
-
-    if MemoryAPIHandler.api_auth.enabled:
-        print("\nAuthentication:")
-        print("  Add header: Authorization: Bearer <your-api-key>")
-        print("  Or header:  X-API-Key: <your-api-key>")
-
-    print("\nPress Ctrl+C to stop\n")
-
-    server.serve_forever()
-
-
-def _configure_logging(verbose: bool = False):
-    """Configure logging for CLI mode."""
-    level = logging.DEBUG if verbose else logging.WARNING
-    logging.basicConfig(level=level, format="%(message)s")
-    structlog.configure(
-        wrapper_class=structlog.make_filtering_bound_logger(level),
-    )
-
-
-def main():
-    """CLI entry point."""
-    parser = argparse.ArgumentParser(
-        description="Empathy Memory Control Panel - Manage Redis and pattern storage",
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog="""
-Examples:
-  %(prog)s status              Show memory system status
-  %(prog)s start               Start Redis if not running
-  %(prog)s stop                Stop Redis (if we started it)
-  %(prog)s stats               Show detailed statistics
-  %(prog)s health              Run health check
-  %(prog)s patterns            List stored patterns
-  %(prog)s export patterns.json  Export patterns to file
-  %(prog)s api --api-port 8765 Start REST API server only
-  %(prog)s serve               Start Redis + API server (recommended)
-
-Quick Start:
-  1. pip install empathy-framework
-  2. empathy-memory serve
-  3. Open http://localhost:8765/api/status in browser
-        """,
-    )
-
-    parser.add_argument(
-        "command",
-        choices=[
-            "status",
-            "start",
-            "stop",
-            "stats",
-            "health",
-            "patterns",
-            "export",
-            "api",
-            "serve",
-        ],
-        help="Command to execute",
-        nargs="?",
-    )
-    parser.add_argument(
-        "-V",
-        "--version",
-        action="version",
-        version=f"empathy-memory {__version__}",
-    )
-    parser.add_argument(
-        "--host",
-        default="localhost",
-        help="Redis host (or API host for 'api' command)",
-    )
-    parser.add_argument("--port", type=int, default=6379, help="Redis port")
-    parser.add_argument(
-        "--api-port",
-        type=int,
-        default=8765,
-        help="API server port (for 'api' command)",
-    )
-    parser.add_argument(
-        "--storage",
-        default="./memdocs_storage",
-        help="Long-term storage directory",
-    )
-    parser.add_argument(
-        "--classification",
-        "-c",
-        help="Filter by classification (PUBLIC/INTERNAL/SENSITIVE)",
-    )
-    parser.add_argument("--output", "-o", help="Output file for export")
-    parser.add_argument("--json", action="store_true", help="Output in JSON format")
-    parser.add_argument("-v", "--verbose", action="store_true", help="Show debug output")
-
-    # Security options (for api/serve commands)
-    parser.add_argument(
-        "--api-key",
-        help="API key for authentication (or set EMPATHY_MEMORY_API_KEY env var)",
-    )
-    parser.add_argument("--no-rate-limit", action="store_true", help="Disable rate limiting")
-    parser.add_argument(
-        "--rate-limit",
-        type=int,
-        default=100,
-        help="Max requests per minute per IP (default: 100)",
-    )
-    parser.add_argument("--ssl-cert", help="Path to SSL certificate file for HTTPS")
-    parser.add_argument("--ssl-key", help="Path to SSL key file for HTTPS")
-    parser.add_argument(
-        "--cors-origins",
-        help="Comma-separated list of allowed CORS origins (default: localhost)",
-    )
-
-    args = parser.parse_args()
-
-    # Configure logging (quiet by default)
-    _configure_logging(verbose=args.verbose)
-
-    # If no command specified, show help
-    if args.command is None:
-        parser.print_help()
-        sys.exit(0)
-
-    config = ControlPanelConfig(
-        redis_host=args.host,
-        redis_port=args.port,
-        storage_dir=args.storage,
-    )
-    panel = MemoryControlPanel(config)
-
-    if args.command == "status":
-        if args.json:
-            print(json.dumps(panel.status(), indent=2))
-        else:
-            print_status(panel)
-
-    elif args.command == "start":
-        status = panel.start_redis(verbose=not args.json)
-        if args.json:
-            print(json.dumps({"available": status.available, "method": status.method.value}))
-        elif status.available:
-            print(f"\n✓ Redis started via {status.method.value}")
-        else:
-            print(f"\n✗ Failed to start Redis: {status.message}")
-            sys.exit(1)
-
-    elif args.command == "stop":
-        if panel.stop_redis():
-            print("✓ Redis stopped")
-        else:
-            print("⚠ Could not stop Redis (may not have been started by us)")
-
-    elif args.command == "stats":
-        if args.json:
-            print(json.dumps(asdict(panel.get_statistics()), indent=2))
-        else:
-            print_stats(panel)
-
-    elif args.command == "health":
-        if args.json:
-            print(json.dumps(panel.health_check(), indent=2))
-        else:
-            print_health(panel)
-
-    elif args.command == "patterns":
-        patterns = panel.list_patterns(classification=args.classification)
-        if args.json:
-            print(json.dumps(patterns, indent=2))
-        else:
-            print(f"\nPatterns ({len(patterns)} found):")
-            for p in patterns:
-                print(
-                    f"  [{p.get('classification', '?')}] {p.get('pattern_id', '?')} ({p.get('pattern_type', '?')})",
-                )
-
-    elif args.command == "export":
-        output = args.output or "patterns_export.json"
-        count = panel.export_patterns(output, classification=args.classification)
-        print(f"✓ Exported {count} patterns to {output}")
-
-    elif args.command == "api":
-        # Parse CORS origins
-        cors_origins = None
-        if args.cors_origins:
-            cors_origins = [o.strip() for o in args.cors_origins.split(",")]
-
-        run_api_server(
-            panel,
-            host=args.host,
-            port=args.api_port,
-            api_key=args.api_key,
-            enable_rate_limit=not args.no_rate_limit,
-            rate_limit_requests=args.rate_limit,
-            ssl_certfile=args.ssl_cert,
-            ssl_keyfile=args.ssl_key,
-            allowed_origins=cors_origins,
-        )
-
-    elif args.command == "serve":
-        # Start Redis first
-        print("\n" + "=" * 50)
-        print("EMPATHY MEMORY - STARTING SERVICES")
-        print("=" * 50)
-
-        print("\n[1/2] Starting Redis...")
-        redis_status = panel.start_redis(verbose=False)
-        if redis_status.available:
-            print(f"  ✓ Redis running via {redis_status.method.value}")
-        else:
-            print(f"  ⚠ Redis not available: {redis_status.message}")
-            print("      (Continuing with mock memory)")
-
-        # Parse CORS origins
-        cors_origins = None
-        if args.cors_origins:
-            cors_origins = [o.strip() for o in args.cors_origins.split(",")]
-
-        print("\n[2/2] Starting API server...")
-        run_api_server(
-            panel,
-            host=args.host,
-            port=args.api_port,
-            api_key=args.api_key,
-            enable_rate_limit=not args.no_rate_limit,
-            rate_limit_requests=args.rate_limit,
-            ssl_certfile=args.ssl_cert,
-            ssl_keyfile=args.ssl_key,
-            allowed_origins=cors_origins,
-        )
-
-
-if __name__ == "__main__":
-    main()