refactor: use official iii binary, pinned versions, HMAC secret, tini init

Dockerfile

@@ -1,34 +1,114 @@
-FROM node:20-bookworm
+ARG III_VERSION=0.11.2
 
-# Install Caddy + Python (for huggingface_hub CLI)
-RUN apt-get update && apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl unzip python3 python3-pip \
-    && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg \
-    && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list \
+# Pull the official iii engine binary
+FROM iiidev/iii:${III_VERSION} AS iii-image
+
+FROM node:22-slim
+
+ARG AGENTMEMORY_VERSION=0.9.21
+ARG III_VERSION=0.11.2
+ARG III_SDK_VERSION=0.11.2
+
+# Install Caddy + runtime deps
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+       debian-keyring debian-archive-keyring apt-transport-https \
+       curl openssl ca-certificates tini gosu python3 python3-pip \
+    && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
+       | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg \
+    && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
+       | tee /etc/apt/sources.list.d/caddy-stable.list \
     && apt-get update && apt-get install -y caddy \
     && pip3 install --break-system-packages huggingface_hub \
-    && apt-get clean && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/*
 
-# Set up user and environment
-RUN userdel -r node && useradd -m -u 1000 user
-WORKDIR /app
+# Copy iii binary from official image (avoids re-downloading on every boot)
+COPY --from=iii-image /app/iii /usr/local/bin/iii
+
+# Set up HF Spaces user (uid 1000 required)
+RUN userdel -r node 2>/dev/null || true \
+    && useradd -m -u 1000 user
 
-# Install agentmemory dependencies
-COPY package.json /app/
-RUN npm install
+# Install agentmemory with pinned iii-sdk to match engine version
+WORKDIR /opt/agentmemory
+RUN printf '{"name":"agentmemory-deploy","version":"1.0.0","private":true,"overrides":{"iii-sdk":"%s"}}\n' \
+      "${III_SDK_VERSION}" > package.json \
+    && npm install "@agentmemory/agentmemory@${AGENTMEMORY_VERSION}" \
+       --omit=optional --no-fund --no-audit \
+    && ln -s /opt/agentmemory/node_modules/.bin/agentmemory /usr/local/bin/agentmemory
 
-# Set permissions
-RUN chown -R user:user /app
+# Override iii-config.yaml at build time:
+# - bind 0.0.0.0 (not 127.0.0.1) so Caddy can reach it
+# - use absolute /home/user/.agentmemory paths so data lands in our sync dir
+RUN cat > /opt/agentmemory/node_modules/@agentmemory/agentmemory/dist/iii-config.yaml <<'EOF'
+workers:
+  - name: iii-http
+    config:
+      port: 3111
+      host: 0.0.0.0
+      default_timeout: 180000
+      cors:
+        allowed_origins:
+          - "http://localhost:3111"
+          - "http://localhost:3113"
+          - "http://127.0.0.1:3111"
+          - "http://127.0.0.1:3113"
+        allowed_methods: [GET, POST, PUT, DELETE, OPTIONS]
+  - name: iii-state
+    config:
+      adapter:
+        name: kv
+        config:
+          store_method: file_based
+          file_path: /home/user/.agentmemory/state_store.db
+  - name: iii-queue
+    config:
+      adapter:
+        name: builtin
+  - name: iii-pubsub
+    config:
+      adapter:
+        name: local
+  - name: iii-cron
+    config:
+      adapter:
+        name: kv
+  - name: iii-stream
+    config:
+      port: 3112
+      host: 0.0.0.0
+      adapter:
+        name: kv
+        config:
+          store_method: file_based
+          file_path: /home/user/.agentmemory/stream_store
+  - name: iii-observability
+    config:
+      enabled: true
+      service_name: agentmemory
+      exporter: memory
+      sampling_ratio: 1.0
+      metrics_enabled: true
+      logs_enabled: true
+      logs_console_output: true
+EOF
+
+# Give user 1000 ownership of everything it needs to write at runtime
+RUN chown -R user:user /opt/agentmemory /home/user
+
+ENV TINI_SUBREAPER=1 \
+    HOME=/home/user
+
+WORKDIR /app
+RUN chown user:user /app
 
-# Switch to non-root user
 USER user
-ENV HOME=/app
 
-# Copy Caddyfile and startup script
 COPY --chown=user:user Caddyfile /app/Caddyfile
 COPY --chown=user:user start.sh /app/start.sh
+COPY --chown=user:user sync.py /app/sync.py
 RUN chmod +x /app/start.sh
 
-# Expose HF default port
 EXPOSE 7860
 
-CMD ["/app/start.sh"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/app/start.sh"]

start.sh

@@ -1,16 +1,18 @@
 #!/bin/bash
+set -e
 
-# Create config folder
-mkdir -p ~/.agentmemory
+# Create agentmemory data dir
+mkdir -p /home/user/.agentmemory
 
 # =============================================================================
 # Persistent storage via HF Dataset repo (free)
-# Set AGENTMEMORY_DATASET_REPO in Space secrets (default: Yashwant00CR7/agentmemory-data)
-# Set HF_TOKEN in Space secrets with write access to that dataset repo
+# Secrets to set in HF Space settings:
+#   HF_TOKEN              — write access to the dataset repo
+#   GEMINI_API_KEY        — powers graph, embeddings, compression, crystals
+#   AGENTMEMORY_DATASET_REPO — optional override (default: Yash030/agentmemory-data)
 # =============================================================================
 export AGENTMEMORY_DATASET_REPO="${AGENTMEMORY_DATASET_REPO:-Yash030/agentmemory-data}"
 
-# Restore DB from HF Dataset on startup
 echo "[start] Restoring data from HF Dataset..."
 python3 /app/sync.py restore
 
@@ -22,23 +24,33 @@ python3 /app/sync.py restore
   done
 ) &
 
-# The daemon runs inside the Space and must talk to its own services on local
-# container ports. Use the public hf.space URL only from your local machine.
+# Internal service URLs (daemon talks to itself on localhost)
 export AGENTMEMORY_URL=http://localhost:3111
 export III_ENGINE_URL=ws://localhost:49134
 
-# Hugging Face proxies requests with the public *.hf.space host. agentmemory's
-# viewer rejects unknown Host headers unless they are explicitly allowed.
+# Allow HF Space's public host through the viewer's host check
 if [ -n "${SPACE_HOST}" ]; then
   export VIEWER_ALLOWED_HOSTS="${VIEWER_ALLOWED_HOSTS:-${SPACE_HOST},${SPACE_HOST}:443,${SPACE_HOST}:7860}"
   export VIEWER_ALLOWED_ORIGINS="${VIEWER_ALLOWED_ORIGINS:-https://${SPACE_HOST},http://${SPACE_HOST},http://localhost:3111,http://localhost:3113,http://127.0.0.1:3111,http://127.0.0.1:3113}"
 fi
 
-# Dynamically write env config from environment variables
-cat <<EOF > ~/.agentmemory/.env
-# =============================================================================
-# agentmemory configuration (Hugging Face Spaces)
-# =============================================================================
+# Generate HMAC secret on first boot, persist it so it survives dataset restore
+HMAC_FILE="/home/user/.agentmemory/.hmac"
+if [ ! -s "$HMAC_FILE" ]; then
+  SECRET="$(openssl rand -hex 32)"
+  printf '%s\n' "$SECRET" > "$HMAC_FILE"
+  chmod 600 "$HMAC_FILE"
+  echo "================================================================"
+  echo "agentmemory: generated HMAC secret on first boot"
+  echo "AGENTMEMORY_SECRET=$SECRET"
+  echo "Copy this to your Space secrets as AGENTMEMORY_SECRET."
+  echo "It will not be printed again."
+  echo "================================================================"
+fi
+export AGENTMEMORY_SECRET="${AGENTMEMORY_SECRET:-$(cat "$HMAC_FILE")}"
+
+# Write .env config for the daemon
+cat > /home/user/.agentmemory/.env <<EOF
 GEMINI_API_KEY=${GEMINI_API_KEY}
 AGENTMEMORY_SECRET=${AGENTMEMORY_SECRET}
 AGENTMEMORY_URL=${AGENTMEMORY_URL}
@@ -53,11 +65,11 @@ VIEWER_ALLOWED_HOSTS=${VIEWER_ALLOWED_HOSTS}
 VIEWER_ALLOWED_ORIGINS=${VIEWER_ALLOWED_ORIGINS}
 EOF
 
-# Start agentmemory daemon in the background
-npx @agentmemory/agentmemory &
+# Start agentmemory daemon (installed binary, not npx)
+agentmemory &
 
-# Wait for boot
+# Wait for daemon to be ready
 sleep 5
 
-# Start Caddy reverse proxy
+# Start Caddy reverse proxy (serves everything on port 7860)
 caddy run --config /app/Caddyfile --adapter caddyfile