@hasna/mementos 0.14.85 → 0.14.87

package/dist/server/index.js

@@ -243,6 +243,7 @@ function translateSql(sql) {
   let translated = sql.replace(/\?/g, () => `$${++parameterIndex}`);
   const ISO_FMT = `'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'`;
   translated = translated.replace(/datetime\s*\(\s*'now'\s*\)/gi, `to_char(now() AT TIME ZONE 'UTC', ${ISO_FMT})`);
+  translated = translated.replace(/strftime\s*\(\s*'%Y-%m-%dT%H:%M:%fZ'\s*,\s*'now'\s*\)/gi, `to_char(now() AT TIME ZONE 'UTC', ${ISO_FMT})`);
   translated = translated.replace(/datetime\s*\(\s*'now'\s*,\s*'(-?\d+)\s+(minutes?|hours?|days?|seconds?)'\s*\)/gi, (_match, amount, unit) => {
     const parsed = parseInt(String(amount), 10);
     const absolute = Math.abs(parsed);
@@ -524,8 +525,13 @@ var init_storage = __esm(() => {
     data;
     closed = false;
     lastError = null;
+    generation = 0;
     static DATA_BYTES = 128 * 1024 * 1024;
-    static QUERY_TIMEOUT_MS = 60000;
+    static queryTimeoutMs() {
+      const raw = process.env["MEMENTOS_PGSYNC_QUERY_TIMEOUT_MS"]?.trim();
+      const parsed = raw ? Number(raw) : Number.NaN;
+      return Number.isFinite(parsed) && parsed > 0 ? parsed : 60000;
+    }
     static resolveWorkerPath() {
       const ext = import.meta.url.endsWith(".ts") ? ".ts" : ".js";
       const here = fileURLToPath(new URL(".", import.meta.url));
@@ -540,12 +546,12 @@ var init_storage = __esm(() => {
       }
       return candidates[0];
     }
-    constructor(connectionString) {
-      const control = new SharedArrayBuffer(8);
+    constructor(connectionString, workerPath) {
+      const control = new SharedArrayBuffer(12);
       const dataSab = new SharedArrayBuffer(PgSyncPool.DATA_BYTES);
       this.status = new Int32Array(control);
       this.data = new Uint8Array(dataSab);
-      this.worker = new Worker(PgSyncPool.resolveWorkerPath(), {
+      this.worker = new Worker(workerPath ?? PgSyncPool.resolveWorkerPath(), {
         workerData: {
           dsn: stripSslParams(connectionString),
           ssl: sslConfigFor(connectionString),
@@ -563,21 +569,35 @@ var init_storage = __esm(() => {
         throw new Error("PgSyncPool is closed");
       if (this.lastError)
         throw this.lastError;
+      const timeoutMs = PgSyncPool.queryTimeoutMs();
+      const gen = ++this.generation;
       Atomics.store(this.status, 0, 0);
-      this.worker.postMessage({ sql, params });
-      const waitResult = Atomics.wait(this.status, 0, 0, PgSyncPool.QUERY_TIMEOUT_MS);
-      const code = Atomics.load(this.status, 0);
-      if (code === 0 || waitResult === "timed-out") {
-        if (this.lastError)
-          throw this.lastError;
-        throw new Error("PostgreSQL query timed out after 60s");
-      }
-      const len = Atomics.load(this.status, 1);
-      const payload = JSON.parse(new TextDecoder().decode(this.data.subarray(0, len)));
-      if (code === 2) {
-        throw new Error(payload.message ?? "PostgreSQL error");
+      Atomics.store(this.status, 2, 0);
+      this.worker.postMessage({ sql, params, gen });
+      const deadline = Date.now() + timeoutMs;
+      for (;; ) {
+        const remaining = deadline - Date.now();
+        const responding = Atomics.load(this.status, 0);
+        if (responding === gen) {
+          const code = Atomics.load(this.status, 2);
+          const len = Atomics.load(this.status, 1);
+          const payload = JSON.parse(new TextDecoder().decode(this.data.subarray(0, len)));
+          if (code === 2) {
+            throw new Error(payload.message ?? "PostgreSQL error");
+          }
+          return payload;
+        }
+        if (responding !== 0) {
+          Atomics.compareExchange(this.status, 0, responding, 0);
+          continue;
+        }
+        if (remaining <= 0) {
+          if (this.lastError)
+            throw this.lastError;
+          throw new Error(`PostgreSQL query timed out after ${timeoutMs}ms`);
+        }
+        Atomics.wait(this.status, 0, 0, remaining);
       }
-      return payload;
     }
     end() {
       if (this.closed)
@@ -2704,6 +2724,7 @@ __export(exports_memories, {
   updateMemory: () => updateMemory,
   touchMemory: () => touchMemory,
   semanticSearch: () => semanticSearch,
+  reservedAgentIdViolation: () => reservedAgentIdViolation,
   parseMemoryRow: () => parseMemoryRow,
   listMemoryHistoryPage: () => listMemoryHistoryPage,
   listMemoryHistory: () => listMemoryHistory,
@@ -2775,7 +2796,20 @@ function parseMemoryRow(row) {
     accessed_at: row["accessed_at"] || null
   };
 }
+function reservedAgentIdViolation(agentId) {
+  if (!agentId)
+    return null;
+  const normalized = agentId.trim().toLowerCase();
+  if (RESERVED_AGENT_IDS.has(normalized)) {
+    return `Reserved placeholder agent id "${agentId}" cannot own a memory. ` + `Refusing to write: test harnesses must not write memories under placeholder agent ` + `identities. Register a real agent (mementos register-agent <name>) and pass its id.`;
+  }
+  return null;
+}
 function createMemory(input, dedupeMode = "merge", db) {
+  const reservedViolation = reservedAgentIdViolation(input.agent_id);
+  if (reservedViolation) {
+    throw new Error(reservedViolation);
+  }
   if (!db && isApiMode()) {
     const { status, data } = apiJson("POST", "/memories", { ...input, dedupe: dedupeMode });
     if (!data || !data.id) {
@@ -2825,7 +2859,8 @@ function createMemory(input, dedupeMode = "merge", db) {
            importance = ?, metadata = ?, expires_at = ?,
            when_to_use = ?,
            pinned = COALESCE(pinned, 0),
-           version = version + 1, updated_at = ?
+           version = version + 1, updated_at = ?,
+           updated_by_agent = ?
          WHERE id = ?`, [
         safeValue,
         input.category || "knowledge",
@@ -2836,6 +2871,7 @@ function createMemory(input, dedupeMode = "merge", db) {
         expiresAt,
         input.when_to_use || null,
         timestamp,
+        input.agent_id || null,
         existing.id
       ]);
       d.run("DELETE FROM memory_tags WHERE memory_id = ?", [existing.id]);
@@ -2940,6 +2976,12 @@ function bulkUpsertMemories(memories, db) {
         errors.push(`Rejected "${key}": ${formatEnumViolation(violation)}`);
         continue;
       }
+      const agentViolation = reservedAgentIdViolation(typeof mem["agent_id"] === "string" ? mem["agent_id"] : undefined);
+      if (agentViolation) {
+        rejected++;
+        errors.push(`Rejected "${key}": ${agentViolation}`);
+        continue;
+      }
       const timestamp = now();
       let tags = [];
       const rawTags = mem["tags"];
@@ -3218,6 +3260,11 @@ function listMemoriesPage(filter, db) {
       agent_id: f.agent_id,
       project_id: f.project_id,
       session_id: f.session_id,
+      machine_id: f.machine_id,
+      visible_to_machine_id: f.visible_to_machine_id,
+      search: f.search,
+      source: f.source,
+      flag: f.flag,
       namespace: f.namespace,
       as_of: f.as_of,
       limit: f.limit,
@@ -3497,20 +3544,29 @@ function updateMemory(id, input, db) {
     sets.push("when_to_use = ?");
     params.push(input.when_to_use ?? null);
   }
+  if (input.updated_by_agent !== undefined) {
+    sets.push("updated_by_agent = ?");
+    params.push(input.updated_by_agent ?? null);
+  }
   if (input.tags !== undefined) {
     sets.push("tags = ?");
     params.push(JSON.stringify(input.tags));
-    d.run("DELETE FROM memory_tags WHERE memory_id = ?", [memoryId]);
-    const insertTag = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
-    for (const tag of input.tags) {
-      insertTag.run(memoryId, tag);
-    }
   }
   params.push(memoryId);
-  const result = d.run(`UPDATE memories SET ${sets.join(", ")} WHERE id = ?`, params);
-  if (result.changes === 0) {
-    throw new Error(`Update affected no rows for memory ${memoryId}: the record was read but not written. ` + `This is a bug in @hasna/mementos, not a bad argument \u2014 please report it.`);
-  }
+  d.transaction(() => {
+    const res = d.run(`UPDATE memories SET ${sets.join(", ")} WHERE id = ?`, params);
+    if (res.changes === 0) {
+      throw new Error(`Update affected no rows for memory ${memoryId}: the record was read but not written. ` + `This is a bug in @hasna/mementos, not a bad argument \u2014 please report it.`);
+    }
+    if (input.tags !== undefined) {
+      d.run("DELETE FROM memory_tags WHERE memory_id = ?", [memoryId]);
+      const insertTag = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
+      for (const tag of input.tags) {
+        insertTag.run(memoryId, tag);
+      }
+    }
+    return res;
+  });
   const updated = getMemory(memoryId, d);
   if (input.value !== undefined) {
     try {
@@ -3681,7 +3737,7 @@ async function semanticSearch(queryText, options = {}, db) {
   scored.sort((a, b) => b.score - a.score);
   return scored.slice(0, limit);
 }
-var RECALL_PROMOTE_THRESHOLD = 3;
+var RESERVED_AGENT_IDS, RECALL_PROMOTE_THRESHOLD = 3;
 var init_memories = __esm(() => {
   init_types();
   init_database();
@@ -3691,6 +3747,12 @@ var init_memories = __esm(() => {
   init_poisoning();
   init_entity_memories();
   init_api_mode();
+  RESERVED_AGENT_IDS = new Set([
+    "agent-a",
+    "agent-x",
+    "agent-z",
+    "nonexistent-agent"
+  ]);
 });
 
 // src/db/entities.ts
@@ -4273,7 +4335,7 @@ function buildFilterConditions(filter) {
   const conditions = [];
   const params = [];
   conditions.push("m.status = 'active'");
-  conditions.push("(m.expires_at IS NULL OR m.expires_at >= datetime('now'))");
+  conditions.push("(m.expires_at IS NULL OR m.expires_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))");
   if (!filter)
     return { conditions, params };
   if (filter.scope) {
@@ -6309,7 +6371,7 @@ async function detectContradiction(newKey, newValue, options = {}, db) {
     conditions.push("project_id = ?");
     params.push(project_id);
   }
-  conditions.push("(valid_until IS NULL OR valid_until > datetime('now'))");
+  conditions.push("(valid_until IS NULL OR valid_until > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))");
   const sql = `SELECT * FROM memories WHERE ${conditions.join(" AND ")} ORDER BY importance DESC LIMIT 10`;
   const rows = d.query(sql).all(...params);
   if (rows.length === 0) {
@@ -19986,7 +20048,7 @@ class JSONSchemaGenerator {
               if (val === undefined) {
                 if (this.unrepresentable === "throw") {
                   throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                }
+                } else {}
               } else if (typeof val === "bigint") {
                 if (this.unrepresentable === "throw") {
                   throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -41636,7 +41698,7 @@ var require_tracestate_impl = __commonJS((exports) => {
           const value = listMember.slice(i + 1, part.length);
           if ((0, tracestate_validators_1.validateKey)(key) && (0, tracestate_validators_1.validateValue)(value)) {
             agg.set(key, value);
-          }
+          } else {}
         }
         return agg;
       }, new Map);
@@ -55465,6 +55527,8 @@ init_hooks();
 // src/db/webhook_hooks.ts
 init_database();
 init_api_mode();
+import { isIP } from "net";
+import { lookup as dnsLookup } from "dns/promises";
 function parseRow(row) {
   return {
     id: row["id"],
@@ -55481,7 +55545,154 @@ function parseRow(row) {
     failureCount: row["failure_count"]
   };
 }
-function createWebhookHook(input, db) {
+function isBlockedIpv4(parts) {
+  const a = parts[0];
+  const b = parts[1];
+  if (a === 0)
+    return true;
+  if (a === 127)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 10)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  return false;
+}
+function isBlockedIpv6(bytes) {
+  const mapped = bytes.slice(0, 10).every((b) => b === 0) && bytes[10] === 255 && bytes[11] === 255;
+  if (mapped)
+    return isBlockedIpv4(bytes.slice(12, 16));
+  if (bytes.every((b) => b === 0))
+    return true;
+  if (bytes.slice(0, 15).every((b) => b === 0) && bytes[15] === 1)
+    return true;
+  if ((bytes[0] & 254) === 252)
+    return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128)
+    return true;
+  return false;
+}
+function quadToGroups(quad) {
+  const nums = quad.split(".").map((p) => Number(p));
+  const [a, b, c, d] = nums;
+  const valid = [a, b, c, d].every((n) => n !== undefined && Number.isInteger(n) && n >= 0 && n <= 255);
+  if (!valid)
+    return null;
+  return [a << 8 | b, c << 8 | d];
+}
+function parseIpv6Bytes(host) {
+  const groups = host.split("::");
+  if (groups.length > 2)
+    return null;
+  const headRaw = groups[0] ?? "";
+  const tailRaw = groups[1] ?? "";
+  const head = headRaw === "" ? [] : headRaw.split(":");
+  const tail = tailRaw === "" ? [] : tailRaw.split(":");
+  const headNums = [];
+  for (const g of head) {
+    if (!/^[0-9a-f]{1,4}$/i.test(g))
+      return null;
+    headNums.push(parseInt(g, 16));
+  }
+  const tailNums = [];
+  for (const g of tail) {
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(g)) {
+      const quads = quadToGroups(g);
+      if (!quads)
+        return null;
+      tailNums.push(...quads);
+    } else if (/^[0-9a-f]{1,4}$/i.test(g)) {
+      tailNums.push(parseInt(g, 16));
+    } else {
+      return null;
+    }
+  }
+  const hasCompression = groups.length === 2;
+  if (!hasCompression && headNums.length !== 8)
+    return null;
+  if (hasCompression && headNums.length + tailNums.length >= 8)
+    return null;
+  const zeros = 8 - headNums.length - tailNums.length;
+  const all = [...headNums, ...new Array(zeros).fill(0), ...tailNums];
+  const bytes = [];
+  for (const n of all) {
+    bytes.push(n >> 8 & 255, n & 255);
+  }
+  return bytes;
+}
+var BLOCKED_TARGET_MESSAGE = "Invalid webhook handler URL \u2014 loopback, link-local, and private network targets are not allowed";
+function defaultResolveHost(hostname2) {
+  return dnsLookup(hostname2, { all: true, verbatim: true });
+}
+function assertResolvedAddressPublic(address, url) {
+  const version = isIP(address);
+  if (version === 4) {
+    if (isBlockedIpv4(address.split(".").map((p) => Number(p)))) {
+      throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+    }
+  } else if (version === 6) {
+    const bytes = parseIpv6Bytes(address);
+    if (!bytes || isBlockedIpv6(bytes)) {
+      throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+    }
+  } else {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+}
+async function validateWebhookHandlerUrl(url, opts) {
+  const resolveHost = opts?.lookup ?? defaultResolveHost;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 must be a valid http(s) URL`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 only http and https are allowed`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 embedded credentials are not allowed`);
+  }
+  const host = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  const version = isIP(host);
+  if (version === 4 || version === 6) {
+    if (version === 4) {
+      if (isBlockedIpv4(host.split(".").map((p) => Number(p)))) {
+        throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+      }
+    } else {
+      const bytes = parseIpv6Bytes(host);
+      if (!bytes || isBlockedIpv6(bytes)) {
+        throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+      }
+    }
+    return;
+  }
+  if (/^[0-9]+(\.[0-9]+)*$/.test(host) || /^0x[0-9a-f]+$/i.test(host) || host.includes("%")) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  let addrs;
+  try {
+    addrs = await resolveHost(host);
+  } catch {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  if (addrs.length === 0) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  for (const { address } of addrs) {
+    assertResolvedAddressPublic(address, url);
+  }
+}
+async function createWebhookHook(input, db, opts) {
+  await validateWebhookHandlerUrl(input.handlerUrl, opts);
   if (!db && isApiMode()) {
     const { data } = apiJson("POST", "/webhooks", {
       type: input.type,
@@ -55765,13 +55976,19 @@ hookRegistry.register({
   }
 });
 var _webhooksLoaded = false;
-function loadWebhooksFromDb() {
+async function loadWebhooksFromDb() {
   if (_webhooksLoaded)
     return;
   _webhooksLoaded = true;
   try {
     const webhooks = listWebhookHooks({ enabled: true });
     for (const wh of webhooks) {
+      try {
+        await validateWebhookHandlerUrl(wh.handlerUrl);
+      } catch (err) {
+        console.error(`[hooks] Skipping webhook ${wh.id} (${wh.type}): ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
       hookRegistry.register({
         type: wh.type,
         blocking: wh.blocking,
@@ -55789,9 +56006,10 @@ function loadWebhooksFromDb() {
     console.error("[hooks] Failed to load webhooks from DB:", err);
   }
 }
-function makeWebhookHandler(webhookId, url) {
+function makeWebhookHandler(webhookId, url, opts) {
   return async (context) => {
     try {
+      await validateWebhookHandlerUrl(url, opts);
       const res = await fetch(url, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -55804,9 +56022,9 @@ function makeWebhookHandler(webhookId, url) {
     }
   };
 }
-function reloadWebhooks() {
+async function reloadWebhooks() {
   _webhooksLoaded = false;
-  loadWebhooksFromDb();
+  await loadWebhooksFromDb();
 }
 
 // src/lib/session-queue.ts
@@ -55943,6 +56161,18 @@ function getNextPendingJob(db) {
     return null;
   return parseJobRow(row);
 }
+function claimSessionJob(id, db) {
+  const d = db || getDatabase();
+  const startedAt = now();
+  const result = d.run("UPDATE session_memory_jobs SET status = 'processing', started_at = ? WHERE id = ? AND status = 'pending'", [startedAt, id]);
+  return result.changes;
+}
+function recoverStaleProcessingJobs(maxAgeMs, db) {
+  const d = db || getDatabase();
+  const cutoff = new Date(Date.now() - maxAgeMs).toISOString();
+  const result = d.run("UPDATE session_memory_jobs SET status = 'pending', started_at = NULL WHERE status = 'processing' AND started_at < ?", [cutoff]);
+  return result.changes;
+}
 
 // src/lib/session-processor.ts
 init_memories();
@@ -56445,7 +56675,11 @@ async function processSessionJob(jobId, db) {
     return result;
   }
   try {
-    updateSessionJob(jobId, { status: "processing", started_at: new Date().toISOString() }, db);
+    const changes = claimSessionJob(jobId, db);
+    if (changes === 0) {
+      result.errors.push(`Job already claimed or not pending: ${jobId}`);
+      return result;
+    }
   } catch (e) {
     result.errors.push(`Failed to mark job as processing: ${String(e)}`);
     return result;
@@ -56553,6 +56787,9 @@ function startSessionQueueWorker() {
     return;
   _workerStarted = true;
   setInterval(() => {
+    try {
+      recoverStaleProcessingJobs(30 * 60 * 1000);
+    } catch {}
     _processNext();
   }, 5000);
 }
@@ -56824,7 +57061,7 @@ function getTaskStats(db, filter) {
   const priorityRows = db.query(`SELECT priority, COUNT(*) as c FROM tasks ${where} GROUP BY priority`).all(...params);
   for (const row of priorityRows)
     byPriority[row.priority] = row.c;
-  const overdue = db.query(`SELECT COUNT(*) as c FROM tasks ${where} AND status != 'completed' AND status != 'cancelled' AND due_at IS NOT NULL AND due_at < datetime('now')`).get(...params).c;
+  const overdue = db.query(`SELECT COUNT(*) as c FROM tasks ${where} AND status != 'completed' AND status != 'cancelled' AND due_at IS NOT NULL AND due_at < strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`).get(...params).c;
   return {
     total,
     by_status: {
@@ -56955,6 +57192,255 @@ async function _tick() {
 
 // src/server/index.ts
 init_storage();
+
+// src/db/analytics.ts
+init_database();
+init_api_mode();
+function getMemoryStats(db) {
+  if (!db && isApiMode()) {
+    const { data } = apiJson("GET", "/memories/stats");
+    return normalizeStats(data);
+  }
+  const d = db || getDatabase();
+  const total = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
+  const byScope = d.query("SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY scope").all();
+  const byCategory = d.query("SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY category").all();
+  const byStatus = d.query("SELECT status, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY status").all();
+  const pinnedCount = d.query("SELECT COUNT(*) as c FROM memories WHERE pinned = 1 AND status = 'active'").get().c;
+  const expiredCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired'").get().c;
+  const expiresAtCount = d.query("SELECT COUNT(*) as c FROM memories WHERE expires_at IS NOT NULL").get().c;
+  const nowIso = new Date().toISOString();
+  const expiredDueCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < ?)").get(nowIso).c;
+  const stats = {
+    total,
+    by_scope: { global: 0, shared: 0, private: 0, working: 0 },
+    by_category: { preference: 0, fact: 0, knowledge: 0, history: 0, procedural: 0, resource: 0 },
+    by_status: { active: 0, archived: 0, expired: 0 },
+    by_agent: {},
+    pinned_count: pinnedCount,
+    expired_count: expiredCount,
+    expires_at_count: expiresAtCount,
+    expired_due_count: expiredDueCount
+  };
+  for (const row of byScope)
+    if (row.scope in stats.by_scope)
+      stats.by_scope[row.scope] = row.c;
+  for (const row of byCategory)
+    if (row.category in stats.by_category)
+      stats.by_category[row.category] = row.c;
+  for (const row of byStatus) {
+    if (row.status in stats.by_status) {
+      stats.by_status[row.status] = row.c;
+    }
+  }
+  const byAgent = d.query("SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL GROUP BY agent_id").all();
+  for (const row of byAgent)
+    stats.by_agent[row.agent_id] = row.c;
+  return stats;
+}
+function normalizeStats(data) {
+  return {
+    total: data?.total ?? 0,
+    by_scope: { global: 0, shared: 0, private: 0, working: 0, ...data?.by_scope ?? {} },
+    by_category: {
+      preference: 0,
+      fact: 0,
+      knowledge: 0,
+      history: 0,
+      procedural: 0,
+      resource: 0,
+      ...data?.by_category ?? {}
+    },
+    by_status: { active: 0, archived: 0, expired: 0, ...data?.by_status ?? {} },
+    by_agent: data?.by_agent ?? {},
+    pinned_count: data?.pinned_count ?? 0,
+    expired_count: data?.expired_count ?? 0,
+    expires_at_count: data?.expires_at_count ?? 0,
+    expired_due_count: data?.expired_due_count ?? 0
+  };
+}
+function getMemoryActivity(filter = {}, db) {
+  const days = Math.min(filter.days || 30, 365);
+  if (!db && isApiMode()) {
+    const q = toQuery({ days, scope: filter.scope, agent_id: filter.agent_id, project_id: filter.project_id });
+    const { data } = apiJson("GET", `/activity${q}`);
+    return { activity: data?.activity ?? [], days: data?.days ?? days, total: data?.total ?? 0 };
+  }
+  const d = db || getDatabase();
+  const conditions = ["status = 'active'"];
+  const params = [];
+  if (filter.scope) {
+    conditions.push("scope = ?");
+    params.push(filter.scope);
+  }
+  if (filter.agent_id) {
+    conditions.push("agent_id = ?");
+    params.push(filter.agent_id);
+  }
+  if (filter.project_id) {
+    conditions.push("project_id = ?");
+    params.push(filter.project_id);
+  }
+  const where = conditions.map((c) => `AND ${c}`).join(" ");
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
+  params.push(cutoffDate);
+  const rows = d.query(`
+    SELECT
+      date(created_at) AS date,
+      COUNT(*) AS memories_created,
+      SUM(CASE WHEN scope = 'global' THEN 1 ELSE 0 END) AS global_count,
+      SUM(CASE WHEN scope = 'shared' THEN 1 ELSE 0 END) AS shared_count,
+      SUM(CASE WHEN scope = 'private' THEN 1 ELSE 0 END) AS private_count,
+      AVG(importance) AS avg_importance
+    FROM memories
+    WHERE date(created_at) >= ? ${where}
+    GROUP BY date(created_at)
+    ORDER BY date ASC
+  `).all(...params);
+  return { activity: rows, days, total: rows.reduce((s, r) => s + r.memories_created, 0) };
+}
+function getMemoryReport(filter = {}, db) {
+  const days = Math.min(filter.days || 7, 365);
+  if (!db && isApiMode()) {
+    const q = toQuery({ days, project_id: filter.project_id, agent_id: filter.agent_id });
+    const { data } = apiJson("GET", `/report${q}`);
+    return {
+      total: data?.total ?? 0,
+      pinned: data?.pinned ?? 0,
+      days: data?.days ?? days,
+      recent: data?.recent ?? { total: 0, activity: [] },
+      by_scope: data?.by_scope ?? {},
+      by_category: data?.by_category ?? {},
+      top_memories: data?.top_memories ?? [],
+      top_agents: data?.top_agents ?? []
+    };
+  }
+  const d = db || getDatabase();
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
+  const scopedCond = [
+    filter.project_id ? "AND project_id = ?" : "",
+    filter.agent_id ? "AND agent_id = ?" : ""
+  ].filter(Boolean).join(" ");
+  const scopedParams = [
+    ...filter.project_id ? [filter.project_id] : [],
+    ...filter.agent_id ? [filter.agent_id] : []
+  ];
+  const recentParams = [cutoffDate, ...scopedParams];
+  const total = d.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond}`).get(...scopedParams).c;
+  const pinned = d.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1 ${scopedCond}`).get(...scopedParams).c;
+  const actRows = d.query(`
+    SELECT date(created_at) AS date, COUNT(*) AS memories_created
+    FROM memories WHERE status = 'active' AND date(created_at) >= ? ${scopedCond}
+    GROUP BY date(created_at) ORDER BY date(created_at) ASC
+  `).all(...recentParams);
+  const recentTotal = actRows.reduce((s, r) => s + r.memories_created, 0);
+  const byScopeRows = d.query(`SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond} GROUP BY scope`).all(...scopedParams);
+  const byCatRows = d.query(`SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond} GROUP BY category`).all(...scopedParams);
+  const topMems = d.query(`SELECT id, key, value, importance, scope, category FROM memories WHERE status = 'active' ${scopedCond} ORDER BY importance DESC, access_count DESC LIMIT 5`).all(...scopedParams);
+  const topAgents = d.query(`SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL ${scopedCond} GROUP BY agent_id ORDER BY c DESC LIMIT 5`).all(...scopedParams);
+  return {
+    total,
+    pinned,
+    days,
+    recent: { total: recentTotal, activity: actRows },
+    by_scope: Object.fromEntries(byScopeRows.map((r) => [r.scope, r.c])),
+    by_category: Object.fromEntries(byCatRows.map((r) => [r.category, r.c])),
+    top_memories: topMems,
+    top_agents: topAgents
+  };
+}
+function getStaleMemoriesPage(filter = {}, db) {
+  const days = Math.min(filter.days || 30, 365);
+  const limit = filter.limit ?? 20;
+  const offset = filter.offset ?? 0;
+  if (!db && isApiMode()) {
+    const q = toQuery({ days, project_id: filter.project_id, agent_id: filter.agent_id, pinned: filter.pinned, limit, offset });
+    const { data } = apiJson("GET", `/memories/stale${q}`);
+    const rows2 = data?.memories ?? [];
+    return {
+      rows: rows2,
+      total: data?.total ?? rows2.length,
+      has_more: data?.has_more,
+      next_cursor: data?.next_cursor ?? null
+    };
+  }
+  const d = db || getDatabase();
+  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString();
+  const conds = ["status = 'active'", "(accessed_at IS NULL OR accessed_at < ?)"];
+  const params = [cutoffDate];
+  if (filter.pinned !== undefined) {
+    conds.push("pinned = ?");
+    params.push(filter.pinned ? 1 : 0);
+  } else {
+    conds.push("pinned = 0");
+  }
+  if (filter.project_id) {
+    conds.push("project_id = ?");
+    params.push(filter.project_id);
+  }
+  if (filter.agent_id) {
+    conds.push("agent_id = ?");
+    params.push(filter.agent_id);
+  }
+  const where = conds.join(" AND ");
+  const countRow = d.query(`SELECT COUNT(*) AS c FROM memories WHERE ${where}`).get(...params);
+  let sql = `SELECT id, key, value, importance, scope, category, accessed_at, access_count, created_at FROM memories WHERE ${where} ORDER BY COALESCE(accessed_at, created_at) ASC LIMIT ?`;
+  params.push(limit);
+  if (offset) {
+    sql += " OFFSET ?";
+    params.push(offset);
+  }
+  const rows = d.query(sql).all(...params);
+  const hasMore = rows.length === limit;
+  return {
+    rows,
+    total: countRow?.c ?? 0,
+    has_more: hasMore,
+    next_cursor: hasMore ? offset + rows.length : null
+  };
+}
+function getMemoryHealth(filter = {}, db) {
+  const staleDays = filter.stale_days ?? 30;
+  const forgottenDays = filter.forgotten_days ?? 60;
+  const limit = filter.limit ?? 10;
+  if (!db && isApiMode()) {
+    const q = toQuery({
+      stale_days: staleDays,
+      forgotten_days: forgottenDays,
+      project_id: filter.project_id,
+      agent_id: filter.agent_id,
+      limit
+    });
+    const { data } = apiJson("GET", `/memories/health${q}`);
+    return { stale: data?.stale ?? [], forgotten: data?.forgotten ?? [], dupes: data?.dupes ?? [] };
+  }
+  const d = db || getDatabase();
+  const extraWhere = [
+    ...filter.project_id ? ["project_id = ?"] : [],
+    ...filter.agent_id ? ["agent_id = ?"] : []
+  ].join(" AND ");
+  const scopeParams = [
+    ...filter.project_id ? [filter.project_id] : [],
+    ...filter.agent_id ? [filter.agent_id] : []
+  ];
+  const staleCutoff = new Date(Date.now() - staleDays * 86400000).toISOString();
+  const forgottenCutoff = new Date(Date.now() - forgottenDays * 86400000).toISOString();
+  const base = `status = 'active' AND pinned = 0${extraWhere ? " AND " + extraWhere : ""}`;
+  const stale = d.prepare(`SELECT id, key, value, importance, scope, created_at FROM memories
+     WHERE ${base} AND access_count = 0 AND created_at < ?
+     ORDER BY created_at ASC LIMIT ?`).all(...scopeParams, staleCutoff, limit);
+  const forgotten = d.prepare(`SELECT id, key, value, importance, scope, accessed_at FROM memories
+     WHERE ${base} AND importance >= 7
+       AND (accessed_at IS NULL OR accessed_at < ?)
+     ORDER BY importance DESC, COALESCE(accessed_at, created_at) ASC LIMIT ?`).all(...scopeParams, forgottenCutoff, limit);
+  const dupes = d.prepare(`SELECT key, COUNT(*) as cnt, MAX(updated_at) as latest, MIN(created_at) as oldest
+     FROM memories WHERE ${base}
+     GROUP BY key HAVING COUNT(*) > 1
+     ORDER BY cnt DESC LIMIT ?`).all(...scopeParams, limit);
+  return { stale, forgotten, dupes };
+}
+
+// src/server/index.ts
 init_router();
 
 // src/server/helpers.ts
@@ -57226,6 +57712,16 @@ addRoute("GET", "/api/memories", (_req, url) => {
     filter.project_id = q["project_id"];
   if (q["session_id"])
     filter.session_id = q["session_id"];
+  if (q["machine_id"])
+    filter.machine_id = q["machine_id"];
+  if (q["visible_to_machine_id"])
+    filter.visible_to_machine_id = q["visible_to_machine_id"];
+  if (q["search"])
+    filter.search = q["search"];
+  if (q["source"])
+    filter.source = q["source"].includes(",") ? q["source"].split(",") : q["source"];
+  if (q["flag"])
+    filter.flag = q["flag"];
   if (q["namespace"])
     filter.namespace = q["namespace"];
   if (q["status"])
@@ -57356,242 +57852,6 @@ addRoute("DELETE", "/api/memories/:id", (_req, _url, params) => {
 
 // src/server/routes/memories-stats.ts
 init_database();
-
-// src/db/analytics.ts
-init_database();
-init_api_mode();
-function getMemoryStats(db) {
-  if (!db && isApiMode()) {
-    const { data } = apiJson("GET", "/memories/stats");
-    return normalizeStats(data);
-  }
-  const d = db || getDatabase();
-  const total = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
-  const byScope = d.query("SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY scope").all();
-  const byCategory = d.query("SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY category").all();
-  const byStatus = d.query("SELECT status, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY status").all();
-  const pinnedCount = d.query("SELECT COUNT(*) as c FROM memories WHERE pinned = 1 AND status = 'active'").get().c;
-  const expiredCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
-  const stats = {
-    total,
-    by_scope: { global: 0, shared: 0, private: 0, working: 0 },
-    by_category: { preference: 0, fact: 0, knowledge: 0, history: 0, procedural: 0, resource: 0 },
-    by_status: { active: 0, archived: 0, expired: 0 },
-    by_agent: {},
-    pinned_count: pinnedCount,
-    expired_count: expiredCount
-  };
-  for (const row of byScope)
-    if (row.scope in stats.by_scope)
-      stats.by_scope[row.scope] = row.c;
-  for (const row of byCategory)
-    if (row.category in stats.by_category)
-      stats.by_category[row.category] = row.c;
-  for (const row of byStatus) {
-    if (row.status in stats.by_status) {
-      stats.by_status[row.status] = row.c;
-    }
-  }
-  const byAgent = d.query("SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL GROUP BY agent_id").all();
-  for (const row of byAgent)
-    stats.by_agent[row.agent_id] = row.c;
-  return stats;
-}
-function normalizeStats(data) {
-  return {
-    total: data?.total ?? 0,
-    by_scope: { global: 0, shared: 0, private: 0, working: 0, ...data?.by_scope ?? {} },
-    by_category: {
-      preference: 0,
-      fact: 0,
-      knowledge: 0,
-      history: 0,
-      procedural: 0,
-      resource: 0,
-      ...data?.by_category ?? {}
-    },
-    by_status: { active: 0, archived: 0, expired: 0, ...data?.by_status ?? {} },
-    by_agent: data?.by_agent ?? {},
-    pinned_count: data?.pinned_count ?? 0,
-    expired_count: data?.expired_count ?? 0
-  };
-}
-function getMemoryActivity(filter = {}, db) {
-  const days = Math.min(filter.days || 30, 365);
-  if (!db && isApiMode()) {
-    const q = toQuery({ days, scope: filter.scope, agent_id: filter.agent_id, project_id: filter.project_id });
-    const { data } = apiJson("GET", `/activity${q}`);
-    return { activity: data?.activity ?? [], days: data?.days ?? days, total: data?.total ?? 0 };
-  }
-  const d = db || getDatabase();
-  const conditions = ["status = 'active'"];
-  const params = [];
-  if (filter.scope) {
-    conditions.push("scope = ?");
-    params.push(filter.scope);
-  }
-  if (filter.agent_id) {
-    conditions.push("agent_id = ?");
-    params.push(filter.agent_id);
-  }
-  if (filter.project_id) {
-    conditions.push("project_id = ?");
-    params.push(filter.project_id);
-  }
-  const where = conditions.map((c) => `AND ${c}`).join(" ");
-  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
-  params.push(cutoffDate);
-  const rows = d.query(`
-    SELECT
-      date(created_at) AS date,
-      COUNT(*) AS memories_created,
-      SUM(CASE WHEN scope = 'global' THEN 1 ELSE 0 END) AS global_count,
-      SUM(CASE WHEN scope = 'shared' THEN 1 ELSE 0 END) AS shared_count,
-      SUM(CASE WHEN scope = 'private' THEN 1 ELSE 0 END) AS private_count,
-      AVG(importance) AS avg_importance
-    FROM memories
-    WHERE date(created_at) >= ? ${where}
-    GROUP BY date(created_at)
-    ORDER BY date ASC
-  `).all(...params);
-  return { activity: rows, days, total: rows.reduce((s, r) => s + r.memories_created, 0) };
-}
-function getMemoryReport(filter = {}, db) {
-  const days = Math.min(filter.days || 7, 365);
-  if (!db && isApiMode()) {
-    const q = toQuery({ days, project_id: filter.project_id, agent_id: filter.agent_id });
-    const { data } = apiJson("GET", `/report${q}`);
-    return {
-      total: data?.total ?? 0,
-      pinned: data?.pinned ?? 0,
-      days: data?.days ?? days,
-      recent: data?.recent ?? { total: 0, activity: [] },
-      by_scope: data?.by_scope ?? {},
-      by_category: data?.by_category ?? {},
-      top_memories: data?.top_memories ?? [],
-      top_agents: data?.top_agents ?? []
-    };
-  }
-  const d = db || getDatabase();
-  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
-  const scopedCond = [
-    filter.project_id ? "AND project_id = ?" : "",
-    filter.agent_id ? "AND agent_id = ?" : ""
-  ].filter(Boolean).join(" ");
-  const scopedParams = [
-    ...filter.project_id ? [filter.project_id] : [],
-    ...filter.agent_id ? [filter.agent_id] : []
-  ];
-  const recentParams = [cutoffDate, ...scopedParams];
-  const total = d.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond}`).get(...scopedParams).c;
-  const pinned = d.query(`SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1 ${scopedCond}`).get(...scopedParams).c;
-  const actRows = d.query(`
-    SELECT date(created_at) AS date, COUNT(*) AS memories_created
-    FROM memories WHERE status = 'active' AND date(created_at) >= ? ${scopedCond}
-    GROUP BY date(created_at) ORDER BY date(created_at) ASC
-  `).all(...recentParams);
-  const recentTotal = actRows.reduce((s, r) => s + r.memories_created, 0);
-  const byScopeRows = d.query(`SELECT scope, COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond} GROUP BY scope`).all(...scopedParams);
-  const byCatRows = d.query(`SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' ${scopedCond} GROUP BY category`).all(...scopedParams);
-  const topMems = d.query(`SELECT id, key, value, importance, scope, category FROM memories WHERE status = 'active' ${scopedCond} ORDER BY importance DESC, access_count DESC LIMIT 5`).all(...scopedParams);
-  const topAgents = d.query(`SELECT agent_id, COUNT(*) as c FROM memories WHERE status = 'active' AND agent_id IS NOT NULL ${scopedCond} GROUP BY agent_id ORDER BY c DESC LIMIT 5`).all(...scopedParams);
-  return {
-    total,
-    pinned,
-    days,
-    recent: { total: recentTotal, activity: actRows },
-    by_scope: Object.fromEntries(byScopeRows.map((r) => [r.scope, r.c])),
-    by_category: Object.fromEntries(byCatRows.map((r) => [r.category, r.c])),
-    top_memories: topMems,
-    top_agents: topAgents
-  };
-}
-function getStaleMemoriesPage(filter = {}, db) {
-  const days = Math.min(filter.days || 30, 365);
-  const limit = filter.limit ?? 20;
-  const offset = filter.offset ?? 0;
-  if (!db && isApiMode()) {
-    const q = toQuery({ days, project_id: filter.project_id, agent_id: filter.agent_id, limit, offset });
-    const { data } = apiJson("GET", `/memories/stale${q}`);
-    const rows2 = data?.memories ?? [];
-    return {
-      rows: rows2,
-      total: data?.total ?? rows2.length,
-      has_more: data?.has_more,
-      next_cursor: data?.next_cursor ?? null
-    };
-  }
-  const d = db || getDatabase();
-  const cutoffDate = new Date(Date.now() - days * 86400000).toISOString();
-  const conds = ["status = 'active'", "(accessed_at IS NULL OR accessed_at < ?)", "pinned = 0"];
-  const params = [cutoffDate];
-  if (filter.project_id) {
-    conds.push("project_id = ?");
-    params.push(filter.project_id);
-  }
-  if (filter.agent_id) {
-    conds.push("agent_id = ?");
-    params.push(filter.agent_id);
-  }
-  const where = conds.join(" AND ");
-  const countRow = d.query(`SELECT COUNT(*) AS c FROM memories WHERE ${where}`).get(...params);
-  let sql = `SELECT id, key, value, importance, scope, category, accessed_at, access_count, created_at FROM memories WHERE ${where} ORDER BY COALESCE(accessed_at, created_at) ASC LIMIT ?`;
-  params.push(limit);
-  if (offset) {
-    sql += " OFFSET ?";
-    params.push(offset);
-  }
-  const rows = d.query(sql).all(...params);
-  const hasMore = rows.length === limit;
-  return {
-    rows,
-    total: countRow?.c ?? 0,
-    has_more: hasMore,
-    next_cursor: hasMore ? offset + rows.length : null
-  };
-}
-function getMemoryHealth(filter = {}, db) {
-  const staleDays = filter.stale_days ?? 30;
-  const forgottenDays = filter.forgotten_days ?? 60;
-  const limit = filter.limit ?? 10;
-  if (!db && isApiMode()) {
-    const q = toQuery({
-      stale_days: staleDays,
-      forgotten_days: forgottenDays,
-      project_id: filter.project_id,
-      agent_id: filter.agent_id,
-      limit
-    });
-    const { data } = apiJson("GET", `/memories/health${q}`);
-    return { stale: data?.stale ?? [], forgotten: data?.forgotten ?? [], dupes: data?.dupes ?? [] };
-  }
-  const d = db || getDatabase();
-  const extraWhere = [
-    ...filter.project_id ? ["project_id = ?"] : [],
-    ...filter.agent_id ? ["agent_id = ?"] : []
-  ].join(" AND ");
-  const scopeParams = [
-    ...filter.project_id ? [filter.project_id] : [],
-    ...filter.agent_id ? [filter.agent_id] : []
-  ];
-  const staleCutoff = new Date(Date.now() - staleDays * 86400000).toISOString();
-  const forgottenCutoff = new Date(Date.now() - forgottenDays * 86400000).toISOString();
-  const base = `status = 'active' AND pinned = 0${extraWhere ? " AND " + extraWhere : ""}`;
-  const stale = d.prepare(`SELECT id, key, value, importance, scope, created_at FROM memories
-     WHERE ${base} AND access_count = 0 AND created_at < ?
-     ORDER BY created_at ASC LIMIT ?`).all(...scopeParams, staleCutoff, limit);
-  const forgotten = d.prepare(`SELECT id, key, value, importance, scope, accessed_at FROM memories
-     WHERE ${base} AND importance >= 7
-       AND (accessed_at IS NULL OR accessed_at < ?)
-     ORDER BY importance DESC, COALESCE(accessed_at, created_at) ASC LIMIT ?`).all(...scopeParams, forgottenCutoff, limit);
-  const dupes = d.prepare(`SELECT key, COUNT(*) as cnt, MAX(updated_at) as latest, MIN(created_at) as oldest
-     FROM memories WHERE ${base}
-     GROUP BY key HAVING COUNT(*) > 1
-     ORDER BY cnt DESC LIMIT ?`).all(...scopeParams, limit);
-  return { stale, forgotten, dupes };
-}
-
-// src/server/routes/memories-stats.ts
 init_memories();
 init_router();
 addRoute("GET", "/api/memories/stats", () => {
@@ -57635,8 +57895,10 @@ addRoute("GET", "/api/memories/stale", (_req, url) => {
   const limit = Number.isInteger(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, 1000) : 20;
   const parsedOffset = Number(q["offset"]);
   const offset = Number.isInteger(parsedOffset) && parsedOffset >= 0 ? parsedOffset : 0;
+  const pinned = q["pinned"] === "1" || q["pinned"] === "true" ? true : q["pinned"] === "0" || q["pinned"] === "false" ? false : undefined;
   const page = getStaleMemoriesPage({
     days,
+    pinned,
     project_id: q["project_id"],
     agent_id: q["agent_id"],
     limit,
@@ -57708,7 +57970,7 @@ function hasFts5Table2(db) {
 function buildScopeFilter(opts) {
   const conditions = [
     "m.status = 'active'",
-    "(m.expires_at IS NULL OR m.expires_at >= datetime('now'))",
+    "(m.expires_at IS NULL OR m.expires_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))",
     "m.category IN ('preference', 'fact', 'knowledge')"
   ];
   const params = [];
@@ -57976,7 +58238,7 @@ async function runTemporalAgent(db, query, opts) {
   const maxResults = opts.max_results ?? 20;
   const limit = maxResults * 3;
   const conditions = [
-    "(m.expires_at IS NULL OR m.expires_at >= datetime('now'))"
+    "(m.expires_at IS NULL OR m.expires_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))"
   ];
   const params = [];
   if (opts.project_id) {
@@ -59810,7 +60072,7 @@ function acquireLock(agentId, resourceType, resourceId, lockType = "exclusive",
   }
   const d = db || getDatabase();
   cleanExpiredLocks(d);
-  const ownLock = d.query("SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND agent_id = ? AND lock_type = ? AND expires_at > datetime('now')").get(resourceType, resourceId, agentId, lockType);
+  const ownLock = d.query("SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND agent_id = ? AND lock_type = ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')").get(resourceType, resourceId, agentId, lockType);
   if (ownLock) {
     const newExpiry = new Date(Date.now() + ttlSeconds * 1000).toISOString();
     d.run("UPDATE resource_locks SET expires_at = ? WHERE id = ?", [
@@ -59820,7 +60082,7 @@ function acquireLock(agentId, resourceType, resourceId, lockType = "exclusive",
     return parseLockRow({ ...ownLock, expires_at: newExpiry });
   }
   if (lockType === "exclusive") {
-    const existing = d.query("SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND lock_type = 'exclusive' AND agent_id != ? AND expires_at > datetime('now')").get(resourceType, resourceId, agentId);
+    const existing = d.query("SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND lock_type = 'exclusive' AND agent_id != ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')").get(resourceType, resourceId, agentId);
     if (existing) {
       return null;
     }
@@ -59865,7 +60127,7 @@ function checkLock(resourceType, resourceId, lockType, db) {
   }
   const d = db || getDatabase();
   cleanExpiredLocks(d);
-  const query = lockType ? "SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND lock_type = ? AND expires_at > datetime('now')" : "SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND expires_at > datetime('now')";
+  const query = lockType ? "SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND lock_type = ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')" : "SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
   const rows = lockType ? d.query(query).all(resourceType, resourceId, lockType) : d.query(query).all(resourceType, resourceId);
   return rows.map(parseLockRow);
 }
@@ -59876,7 +60138,7 @@ function listAgentLocks(agentId, db) {
   }
   const d = db || getDatabase();
   cleanExpiredLocks(d);
-  const rows = d.query("SELECT * FROM resource_locks WHERE agent_id = ? AND expires_at > datetime('now') ORDER BY locked_at DESC").all(agentId);
+  const rows = d.query("SELECT * FROM resource_locks WHERE agent_id = ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now') ORDER BY locked_at DESC").all(agentId);
   return rows.map(parseLockRow);
 }
 function cleanExpiredLocks(db) {
@@ -59885,7 +60147,7 @@ function cleanExpiredLocks(db) {
     return data?.cleaned ?? 0;
   }
   const d = db || getDatabase();
-  const result = d.run("DELETE FROM resource_locks WHERE expires_at <= datetime('now')");
+  const result = d.run("DELETE FROM resource_locks WHERE expires_at <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')");
   return result.changes;
 }
 
@@ -62511,17 +62773,21 @@ function registerSystemHookRoutes() {
     if (!body.type || !body.handler_url) {
       return errorResponse("type and handler_url are required", 400);
     }
-    const wh = createWebhookHook({
-      type: body.type,
-      handlerUrl: body.handler_url,
-      priority: body.priority,
-      blocking: body.blocking,
-      agentId: body.agent_id,
-      projectId: body.project_id,
-      description: body.description
-    });
-    reloadWebhooks();
-    return json(wh, 201);
+    try {
+      const wh = await createWebhookHook({
+        type: body.type,
+        handlerUrl: body.handler_url,
+        priority: body.priority,
+        blocking: body.blocking,
+        agentId: body.agent_id,
+        projectId: body.project_id,
+        description: body.description
+      });
+      await reloadWebhooks();
+      return json(wh, 201);
+    } catch (err) {
+      return errorResponse(err instanceof Error ? err.message : String(err), 400);
+    }
   });
   addRoute("GET", "/api/webhooks/:id", (_req, _url, params) => {
     const wh = getWebhookHook(params["id"]);
@@ -62538,7 +62804,7 @@ function registerSystemHookRoutes() {
     });
     if (!updated)
       return errorResponse("Webhook not found", 404);
-    reloadWebhooks();
+    await reloadWebhooks();
     return json(updated);
   });
   addRoute("DELETE", "/api/webhooks/:id", (_req, _url, params) => {
@@ -64976,13 +65242,11 @@ function startServer(port) {
         const profile = getActiveProfile();
         try {
           const db = getDatabase();
-          const total = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active'").get().c;
-          const expired = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
-          const pinned = db.query("SELECT COUNT(*) as c FROM memories WHERE status = 'active' AND pinned = 1").get().c;
+          const stats = getMemoryStats(db);
           const agents = db.query("SELECT COUNT(*) as c FROM agents").get().c;
           const projects = db.query("SELECT COUNT(*) as c FROM projects").get().c;
-          const status = expired > 50 ? "warn" : "ok";
-          return json({ status, version: pkgVersion(), backend, profile: profile ?? "default", db_path: getDbPath(), hostname: hostname3, memories: { total, expired, pinned }, agents, projects });
+          const status = stats.expired_due_count > 50 ? "warn" : "ok";
+          return json({ status, version: pkgVersion(), backend, profile: profile ?? "default", db_path: getDbPath(), hostname: hostname3, memories: { total: stats.total, expired: stats.expired_count, expired_due: stats.expired_due_count, pinned: stats.pinned_count }, agents, projects });
         } catch (e) {
           return json({ status: "error", version: pkgVersion(), backend, error: e instanceof Error ? e.message : String(e) }, 503);
         }