Files
poimen-memory/crates/mem-cli/src/main.rs
T
rock 780af66b3e feat(rbac): wire AccessGuard into HTTP server and retrieval pipeline
HTTP Layer Integration:
- Add access_guard to AppState with builtin_role_provider
- Add to_rbac_claims() to convert JwtClaims → RBAC Claims
- Add query_result_to_resource_meta() for result filtering

Query Handler (/memory/query):
- RBAC filter applied after M3.8 optimization
- Batch check_access for all results
- Log filtered count per request

Context Handler (/memory/context):
- Project-level access check before lookup
- Return 403 if user lacks project access

Code Cleanup:
- Move http_server from bin to lib module
- Use mem_cli::http_server in main.rs

All 660+ tests passing.
2026-09-01 08:41:21 -07:00

597 lines
18 KiB
Rust

mod lessons_cmd;
// http_server is in lib.rs, use mem_cli::http_server
mod endpoints;
mod ingest_worker;
mod query_worker;
mod rate_limiter;
mod idempotency;
mod jwt_validator;
mod verify;
mod opensearch_client;
mod dual_write_indexer;
mod queue_adapter;
mod gateway_queue_adapter;
mod queue_worker;
mod context_endpoint;
mod query_optimizer;
mod simple_hybrid_search;
mod accuracy_metrics;
use clap::{Parser, Subcommand};
use mem_chunk::token_counter::CharsOverFourCounter;
use mem_chunk::TokenCounter;
use mem_core::{Record, Provenance, Role};
use std::fs;
use std::path::PathBuf;
use time::OffsetDateTime;
#[derive(Parser)]
#[command(name = "mem")]
#[command(about = "Poimen memory system CLI")]
struct Cli {
#[command(subcommand)]
command: Commands,
}
#[derive(Subcommand)]
enum Commands {
/// Count tokens in a file
Tokens {
/// Path to the file to count tokens in
#[arg(value_name = "FILE")]
file: PathBuf,
/// Use actual Qwen2 tokenizer (requires assets/qwen2-tokenizer.json)
#[arg(long)]
qwen: bool,
},
/// Ingest records from a project
Ingest {
/// Project path or key
#[arg(long, value_name = "PROJECT")]
project: PathBuf,
/// Dry run - analyze without writing to log
#[arg(long)]
dry_run: bool,
/// Limit to N chunks (for testing)
#[arg(long)]
limit: Option<usize>,
/// Output format (text, json)
#[arg(long, default_value = "text")]
format: String,
},
/// Record one command execution (hook entrypoint). Output on stdin.
Capture {
#[arg(long)]
cmd: String,
#[arg(long)]
exit: i32,
/// Read output from a file instead of stdin
#[arg(long)]
output_file: Option<PathBuf>,
#[arg(long)]
cwd: Option<String>,
},
/// Derive lessons by pairing failures with the next success
Resolve {
#[arg(long)]
json: bool,
},
/// Look a failure up. Prints nothing when it does not know.
Lookup {
#[arg(long)]
tool: Option<String>,
/// Infer the tool from this command line
#[arg(long)]
cmd: Option<String>,
/// Read the failure log from a file instead of stdin
#[arg(long)]
file: Option<PathBuf>,
#[arg(long, default_value_t = lessons_cmd::DEFAULT_FLOOR)]
floor: f32,
},
/// Write lessons out as SKILL.md files and a CLAUDE.md digest
Materialize,
/// Draft a skill from a memory note
SkillDraft {
/// Project name
#[arg(long, value_name = "PROJECT")]
project: String,
/// Query ID or memory note identifier
#[arg(long, value_name = "QUERY_ID")]
from: String,
/// Dry run - print without writing
#[arg(long)]
dry_run: bool,
},
/// Start HTTP server
Serve {
#[arg(long, default_value = "8080")]
port: u16,
#[arg(long)]
api_key: Option<String>,
#[arg(long)]
database_url: Option<String>,
},
/// Verify edge closure and graph integrity
Verify {
/// Project name
#[arg(long, value_name = "PROJECT")]
project: String,
/// Check database (default: true)
#[arg(long, default_value_t = true)]
db: bool,
/// Check log (default: true)
#[arg(long, default_value_t = true)]
log: bool,
/// Log directory
#[arg(long)]
log_dir: Option<PathBuf>,
/// Output format (text, json)
#[arg(long, default_value = "text")]
format: String,
/// Database URL
#[arg(long)]
database_url: Option<String>,
},
/// Extract and explain failure signature
Sig {
/// Tool name (e.g. npm, cargo, kubectl)
#[arg(long, value_name = "TOOL")]
tool: String,
/// Read failure log from file (stdin if not specified)
#[arg(long, value_name = "FILE")]
file: Option<PathBuf>,
},
/// Ingest markdown knowledge via gated loop (LLM evaluates + compacts)
Learn {
/// Markdown files or directories to ingest
#[arg(value_name = "PATH")]
paths: Vec<PathBuf>,
/// Project to file under
#[arg(long, default_value = "knowledge")]
project: String,
/// Dry run — show chunks without ingesting
#[arg(long)]
dry_run: bool,
/// Maximum chunk size in characters (splits on headings)
#[arg(long, default_value_t = 2000)]
chunk_size: usize,
/// Memory budget in tokens (LLM compacts to fit)
#[arg(long, default_value_t = 4096)]
memory_budget: u32,
/// LLM model for gated evaluation
#[arg(long, default_value = "qwen2.5:3b-instruct")]
model: String,
},
}
#[tokio::main]
async fn main() -> anyhow::Result<()> {
// Initialize logging
tracing_subscriber::fmt()
.with_max_level(tracing::Level::INFO)
.init();
let cli = Cli::parse();
match cli.command {
Commands::Tokens { file, qwen } => {
cmd_tokens(&file, qwen)?;
}
Commands::Ingest {
project,
dry_run,
limit,
format,
} => {
cmd_ingest(&project, dry_run, limit, &format).await?;
}
Commands::Capture {
cmd,
exit,
output_file,
cwd,
} => {
lessons_cmd::cmd_capture(&cmd, exit, output_file.as_deref(), cwd.as_deref())?;
}
Commands::Resolve { json } => lessons_cmd::cmd_resolve(json)?,
Commands::Lookup {
tool,
cmd,
file,
floor,
} => lessons_cmd::cmd_lookup(tool.as_deref(), cmd.as_deref(), file.as_deref(), floor)?,
Commands::Materialize => lessons_cmd::cmd_materialize()?,
Commands::SkillDraft { project, from, dry_run } => {
lessons_cmd::cmd_skill_draft(&project, &from, dry_run).await?
}
Commands::Serve { port, api_key, database_url } => {
let api_key = api_key.unwrap_or_else(|| std::env::var("MEM_API_KEY").unwrap_or_else(|_| "test-key".to_string()));
let database_url = database_url.unwrap_or_else(|| std::env::var("DATABASE_URL").unwrap_or_else(|_| "postgresql://app:poimen@localhost:5432/memory".to_string()));
mem_cli::http_server::start_server(port, api_key, &database_url).await?
}
Commands::Verify { project, db, log, log_dir, format: fmt, database_url } => {
let database_url = database_url.unwrap_or_else(|| std::env::var("DATABASE_URL").unwrap_or_else(|_| "postgresql://app:poimen@localhost:5432/memory".to_string()));
let output_format = match fmt.as_str() {
"json" => verify::OutputFormat::Json,
_ => verify::OutputFormat::Text,
};
cmd_verify(&project, db, log, log_dir, output_format, &database_url).await?
}
Commands::Sig { tool, file } => {
cmd_sig(&tool, file.as_ref())?
}
Commands::Learn { paths, project, dry_run, chunk_size, memory_budget, model } => {
cmd_learn(&paths, &project, dry_run, chunk_size, memory_budget, &model).await?;
}
}
Ok(())
}
fn cmd_tokens(file: &PathBuf, use_qwen: bool) -> anyhow::Result<()> {
let counter = if use_qwen {
println!("Using Qwen2 tokenizer...");
// Would load QwenTokenCounter here
CharsOverFourCounter
} else {
println!("Using character-based token counter (chars/4)...");
CharsOverFourCounter
};
let content = fs::read_to_string(file)?;
// For now, just count the file content as a single record
let record = Record {
role: Role::User,
text: content,
timestamp: OffsetDateTime::now_utc(),
provenance: Provenance {
source_id: file.to_string_lossy().to_string(),
offset: 0,
},
};
let token_count = counter.count(&record);
println!(
"File: {}",
file.display()
);
println!("Token count: {}", token_count);
println!("Approximate size: {:.2} KB", token_count as f64 * 0.004);
Ok(())
}
async fn cmd_ingest(
project: &std::path::Path,
dry_run: bool,
_limit: Option<usize>,
format: &str,
) -> anyhow::Result<()> {
use mem_core::{QuerySet, gated_loop::{run_loop, LoopConfig}, Level};
use mem_llm::ChatClient;
use mem_store::LogWriter;
let project_key = project.to_string_lossy().to_string();
println!("Analyzing project: {}", project_key);
if dry_run {
println!(" (dry-run mode - no log writes)");
}
// Try to load queries, but gracefully handle missing projects
let query_set = match QuerySet::load(&format!("queries/{}.yaml", project_key)) {
Ok(qs) => qs,
Err(_) => {
// Project not recognized - show empty output
if format == "json" {
println!("{{\"project\": \"{}\", \"sources\": \"pi:0 claude:0\", \"records\": 0, \"chunks\": 0}}", project_key);
} else {
println!("project {}", project_key);
println!("sources pi:0 files claude:0 files");
println!("records 0");
println!("chunks 0");
println!("tokens min 0 p50 0 p95 0 max 0");
}
return Ok(());
}
};
println!("Loaded {} standing queries", query_set.queries.len());
// If not dry-run, run the actual gated loop
if !dry_run {
let llm = ChatClient::new("https://api.riotpiao.com/v1", std::env::var("MEM_API_KEY").unwrap_or_default(), "qwen2.5:3b-instruct")?;
for query in &query_set.queries {
println!(" {}...", query.id);
let config = LoopConfig {
level: Level::L1,
query: query.clone(),
memory_budget: query_set.defaults.memory_budget,
use_exit_gate: false,
};
// Empty chunks for now (would load from pi/claude sources)
let chunks = vec![];
let outcome = run_loop(config, chunks, &llm)?;
// Log events
let mut log = LogWriter::new(&project_key, &query.id, "run1")?;
for event in outcome.events {
log.log(mem_store::EventRecord {
project: project_key.clone(),
query: query.id.clone(),
run: "run1".to_string(),
turn: 0,
event_type: format!("{:?}", event),
data: serde_json::json!({}),
})?;
}
println!(" chunks_seen: {}, chunks_used: {}", outcome.chunks_seen, outcome.chunks_used);
}
}
println!("Done.");
Ok(())
}
async fn cmd_verify(
project: &str,
check_db: bool,
check_log: bool,
log_dir: Option<PathBuf>,
format: verify::OutputFormat,
database_url: &str,
) -> anyhow::Result<()> {
let opts = verify::VerifyOpts {
project: project.to_string(),
check_db,
check_log,
log_dir,
format,
};
let verifier = verify::Verifier::new(database_url).await?;
let result = verifier.verify(opts).await?;
match format {
verify::OutputFormat::Json => {
println!("{}", serde_json::to_string_pretty(&result)?);
}
verify::OutputFormat::Text => {
println!("Project: {}", result.project);
println!("Status: {}", if result.clean { "✓ CLEAN" } else { "✗ VIOLATIONS" });
println!("Total violations: {}", result.total_violations);
if !result.violations.is_empty() {
println!("\nViolations:");
for v in &result.violations {
println!(
" Invariant {}: {} (sha: {}, level: {})",
v.invariant,
v.description,
v.sha.as_deref().unwrap_or("N/A"),
v.level.as_deref().unwrap_or("N/A")
);
}
}
}
}
// Exit with non-zero if there are violations
if !result.clean {
std::process::exit(1);
}
Ok(())
}
async fn cmd_learn(
paths: &[PathBuf],
project: &str,
dry_run: bool,
max_chunk: usize,
memory_budget: u32,
model: &str,
) -> anyhow::Result<()> {
let mut all_files: Vec<PathBuf> = Vec::new();
for p in paths {
if p.is_dir() {
for entry in walkdir::WalkDir::new(p)
.into_iter()
.filter_map(|e| e.ok())
.filter(|e| {
e.path()
.extension()
.map(|ext| ext == "md")
.unwrap_or(false)
})
{
all_files.push(entry.into_path());
}
} else if p.extension().map(|e| e == "md").unwrap_or(false) {
all_files.push(p.clone());
} else {
eprintln!("Skipping non-markdown file: {}", p.display());
}
}
if all_files.is_empty() {
eprintln!("No markdown files found.");
return Ok(());
}
all_files.sort();
println!("Found {} markdown files", all_files.len());
let api_url = std::env::var("MEM_API_URL")
.unwrap_or_else(|_| "http://localhost:8080".to_string());
let api_token = std::env::var("MEM_API_TOKEN").ok();
let http = reqwest::Client::builder()
.timeout(std::time::Duration::from_secs(120))
.build()?;
let mut total_seen = 0u64;
let mut total_used = 0u64;
for file in &all_files {
let content = fs::read_to_string(file)?;
let filename = file.file_stem().unwrap().to_string_lossy();
let chunks = chunk_markdown(&content, max_chunk);
println!("\n\u{1f4c4} {} \u{2014} {} chunks", file.display(), chunks.len());
if dry_run {
for (i, chunk) in chunks.iter().enumerate() {
let preview: String = chunk.chars().take(80).collect();
println!(" [{}/{}] ({} bytes) {}",
i + 1, chunks.len(), chunk.len(),
preview.replace('\n', " "));
}
continue;
}
let payload = serde_json::json!({
"project": project,
"text": content,
"query": format!("What are the key facts and patterns in {}?", filename),
"memory_budget": memory_budget,
"chunk_size": max_chunk,
"model": model,
});
let mut req = http.post(format!("{}/memory/learn", api_url))
.header("Content-Type", "application/json")
.json(&payload);
if let Some(ref token) = api_token {
req = req.header("Authorization", format!("Bearer {}", token));
}
println!(" \u{2192} Sending to {}/memory/learn (model={})...", api_url, model);
match req.send().await {
Ok(resp) => {
let status = resp.status();
let body: serde_json::Value = resp.json().await.unwrap_or_default();
if status.is_success() {
let seen = body["chunks_seen"].as_u64().unwrap_or(0);
let used = body["chunks_used"].as_u64().unwrap_or(0);
let stored = body["stored"].as_bool().unwrap_or(false);
let mem_preview: String = body["memory"].as_str()
.unwrap_or("").chars().take(100).collect();
total_seen += seen;
total_used += used;
println!(" \u{2713} {} seen, {} accepted, stored={}", seen, used, stored);
println!(" \u{2713} Memory: {}...", mem_preview.replace('\n', " "));
} else {
eprintln!(" \u{2717} {} \u{2014} {}", status, body);
}
}
Err(e) => {
eprintln!(" \u{2717} API call failed: {}", e);
eprintln!(" Is the memory service running at {}?", api_url);
}
}
}
println!("\n{}", "\u{2500}".repeat(50));
if dry_run {
println!("(dry run \u{2014} nothing sent)");
} else {
println!("{} files \u{2192} {} chunks seen, {} accepted",
all_files.len(), total_seen, total_used);
println!("Ingested via gated loop at {}", api_url);
}
Ok(())
}
/// Split markdown on ## headings, respecting max_chunk size.
fn chunk_markdown(content: &str, max_chunk: usize) -> Vec<String> {
let mut chunks = Vec::new();
let mut current = String::new();
for line in content.lines() {
// Split on ## headings (keep # title in first chunk)
if line.starts_with("## ") && !current.is_empty() {
let trimmed = current.trim().to_string();
if !trimmed.is_empty() {
chunks.push(trimmed);
}
current = String::new();
}
current.push_str(line);
current.push('\n');
// Hard split if chunk too large
if current.len() > max_chunk {
let trimmed = current.trim().to_string();
if !trimmed.is_empty() {
chunks.push(trimmed);
}
current = String::new();
}
}
let trimmed = current.trim().to_string();
if !trimmed.is_empty() {
chunks.push(trimmed);
}
chunks
}
fn cmd_sig(tool: &str, file: Option<&PathBuf>) -> anyhow::Result<()> {
use mem_core::lesson;
use std::io::Read;
// Read failure log from file or stdin
let mut output = String::new();
if let Some(file_path) = file {
output = fs::read_to_string(file_path)?;
} else {
std::io::stdin().read_to_string(&mut output)?;
}
// Extract signature
match lesson::extract(tool, &output) {
Some(sig) => {
println!("=== Failure Signature ===");
println!("Tool: {}", sig.tool);
println!("Rule: {}", sig.rule);
println!("Hash (SHA256): {}", sig.sig_sha);
println!("\n=== Raw Error ===");
println!("{}", sig.raw);
println!("\n=== Normalised Form ===");
println!("{}", sig.normalised);
}
None => {
eprintln!("Failed to extract signature for tool: {}", tool);
std::process::exit(1);
}
}
Ok(())
}