memhouse 0.3.2 → 0.4.3

package/public/index.html

@@ -7,7 +7,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@300;400;500;600;700&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-CCPh7a2Z.js"></script>
+    <script type="module" crossorigin src="/assets/index-CtH-5i95.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DV6ONi_F.css">
   </head>
   <body>

package/ui/src/App.jsx

@@ -349,8 +349,9 @@ export default function App() {
 
             <div className="text-[12px] font-medium mb-1.5" style={{ color: 'var(--c-white)' }}>Team Sharing</div>
             <div className="text-[10px] mb-1" style={{ color: 'var(--c-text3)' }}>
-              Relay join is not supported in memhouse — team sharing is kernel-based
-              (members + grants + row-level security). See mem-house/delivery/kernel-install.md.
+              Relay join is not supported in memhouse — team sharing is kernel-based. Each
+              member owns their own rooms and shares by granting SELECT on them.
+              See mem-house/delivery/kernel-install.md.
             </div>
             <pre
               className="text-[11px] px-3 py-2 overflow-x-auto"

package/ui/src/pages/SqlViewer.jsx

@@ -9,22 +9,29 @@ import PageHeader from '../components/PageHeader'
 ChartJS.register(ArcElement, Tooltip, Legend, CategoryScale, LinearScale, BarElement, PointElement, LineElement, Filler)
 
 // Two backends share this SPA: the typed mem-house house (sessions / messages /
-// tool_calls + the sessions_v rollup) and the legacy agentlytics cache (chats /
-// chat_stats). Both are ClickHouse — the flavor is detected from /api/schema
-// (sessions_v present → typed) and the matching example set is offered.
+// tool_calls + the session rollup) and the legacy agentlytics cache (chats /
+// chat_stats). Both are ClickHouse, and the flavor comes from /api/schema.
+//
+// The typed examples are TEMPLATED, not literal. A per-member house names its rooms for
+// the member and has no `sessions_v` object at all — the rollup is a saved query — so
+// `/api/schema` reports the resolved names and `{{room}}` tokens are substituted here.
+// Detecting the flavor by `tables.includes('sessions_v')` stopped working for the same
+// reason: it reported an indeterminate schema and offered nothing.
 const TYPED_EXAMPLES = [
-  { label: 'Sessions per editor', sql: `SELECT source, count() AS count FROM sessions_v GROUP BY source ORDER BY count DESC` },
-  { label: 'Top 10 projects', sql: `SELECT project, count() AS sessions, sum(total_msgs) AS messages FROM sessions_v WHERE project != '' GROUP BY project ORDER BY sessions DESC LIMIT 10` },
-  { label: 'Messages per day', sql: `SELECT toDate(ts) AS day, count() AS count FROM messages GROUP BY day ORDER BY day` },
-  { label: 'Top models', sql: `SELECT model, count() AS count FROM messages WHERE model NOT IN ('', '<synthetic>') GROUP BY model ORDER BY count DESC LIMIT 10` },
-  { label: 'Top tools', sql: `SELECT tool_name, count() AS count FROM tool_calls GROUP BY tool_name ORDER BY count DESC LIMIT 15` },
-  { label: 'Token usage by editor', sql: `SELECT source, sum(input_tokens) AS input_tokens, sum(output_tokens) AS output_tokens FROM sessions_v GROUP BY source ORDER BY input_tokens DESC` },
-  { label: 'Sessions by mode', sql: `SELECT mode, count() AS count FROM sessions_v WHERE mode != '' GROUP BY mode ORDER BY count DESC` },
-  { label: 'Hourly distribution', sql: `SELECT toHour(ts) AS hour, count() AS count FROM messages GROUP BY hour ORDER BY hour` },
-  // Grouped by (session_id, user_id), matching the table's ORDER BY. In a team-pool
-  // house two members can ship the same adapter-local session id; grouping on
-  // session_id alone would merge them and make any(source) an arbitrary member's.
-  { label: 'Full-text search', sql: `SELECT session_id, user_id, any(source) AS source, count() AS hits FROM messages WHERE text_ngram LIKE '%clickhouse%' GROUP BY session_id, user_id ORDER BY hits DESC LIMIT 10` },
+  { label: 'Sessions per editor', sql: `SELECT source, count() AS count FROM {{sessions_v}} AS c GROUP BY source ORDER BY count DESC` },
+  { label: 'Top 10 projects', sql: `SELECT project, count() AS sessions, sum(total_msgs) AS messages FROM {{sessions_v}} AS c WHERE project != '' GROUP BY project ORDER BY sessions DESC LIMIT 10` },
+  { label: 'Messages per day', sql: `SELECT toDate(ts) AS day, count() AS count FROM {{messages}} GROUP BY day ORDER BY day` },
+  { label: 'Top models', sql: `SELECT model, count() AS count FROM {{messages}} WHERE model NOT IN ('', '<synthetic>') GROUP BY model ORDER BY count DESC LIMIT 10` },
+  { label: 'Top tools', sql: `SELECT tool_name, count() AS count FROM {{tool_calls}} GROUP BY tool_name ORDER BY count DESC LIMIT 15` },
+  { label: 'Token usage by editor', sql: `SELECT source, sum(input_tokens) AS input_tokens, sum(output_tokens) AS output_tokens FROM {{sessions_v}} AS c GROUP BY source ORDER BY input_tokens DESC` },
+  { label: 'Sessions by mode', sql: `SELECT mode, count() AS count FROM {{sessions_v}} AS c WHERE mode != '' GROUP BY mode ORDER BY count DESC` },
+  { label: 'Hourly distribution', sql: `SELECT toHour(ts) AS hour, count() AS count FROM {{messages}} GROUP BY hour ORDER BY hour` },
+  // Grouped by (session_id, user_id), matching the room's ORDER BY. `{{messages}}` is
+  // the caller's own room, where user_id is constant — but point the same query at a
+  // team `Merge` room (all_messages) and two members can carry the same adapter-local
+  // session id; grouping on session_id alone would merge them and make any(source) an
+  // arbitrary member's.
+  { label: 'Full-text search', sql: `SELECT session_id, user_id, any(source) AS source, count() AS hits FROM {{messages}} WHERE text_ngram LIKE '%clickhouse%' GROUP BY session_id, user_id ORDER BY hits DESC LIMIT 10` },
 ]
 const LEGACY_EXAMPLES = [
   { label: 'Sessions per editor', sql: `SELECT source, count() AS count FROM chats GROUP BY source ORDER BY count DESC` },
@@ -37,6 +44,12 @@ const LEGACY_EXAMPLES = [
   { label: 'Hourly distribution', sql: `SELECT toHour(toDateTime(intDiv(created_at, 1000))) AS hour, count() AS count FROM chats WHERE created_at IS NOT NULL GROUP BY hour ORDER BY hour` },
 ]
 
+// `{{room}}` -> the resolved name (or, for the rollup on a per-member house, the whole
+// subquery). Same token shape the server's own query layer uses.
+function applyRooms(sql, rooms) {
+  return sql.replace(/\{\{([a-z_]+)\}\}/g, (m, name) => rooms[name] ?? m)
+}
+
 export default function SqlViewer() {
   const { dark } = useTheme()
   // Three states, and they must stay distinguishable: 'loading' while /api/schema is
@@ -58,13 +71,18 @@ export default function SqlViewer() {
   useEffect(() => {
     fetchSchema().then(s => {
       setSchema(s)
-      // Three outcomes, not two. The typed house has the sessions_v rollup; the
-      // legacy one has chats. Anything else — an error object with no `tables`, a
-      // half-applied schema with neither marker — is indeterminate, and offering
-      // either set would hand the user queries that error.
+      // Three outcomes, not two. The typed house is whichever one /api/schema resolved
+      // rooms for; the legacy one has `chats`. Anything else — an error object with no
+      // `tables`, a half-applied schema with neither marker — is indeterminate, and
+      // offering either set would hand the user queries that error.
+      //
+      // `rooms` is the authority, not a table name: a per-member house has no
+      // `sessions_v` object, so the old `tables.includes('sessions_v')` test called a
+      // perfectly healthy typed house indeterminate.
       const tables = s?.tables
-      const ex = !Array.isArray(tables) ? null
-        : tables.includes('sessions_v') ? TYPED_EXAMPLES
+      const rooms = s?.rooms
+      const ex = rooms?.sessions ? TYPED_EXAMPLES.map(e => ({ ...e, sql: applyRooms(e.sql, rooms) }))
+        : !Array.isArray(tables) ? null
           : tables.includes('chats') ? LEGACY_EXAMPLES
             : null
       setExamples(ex)

package/mem-house/rls.sql

@@ -1,17 +0,0 @@
--- mem-house — own-only row-level security (the sharing model's isolation half).
---
--- Applied by the KERNEL (or the mayor, who has ACCESS MANAGEMENT) — the agency owner
--- cannot CREATE ROW POLICY by design. Binds to the kernel's `member` role, so every
--- registered member sees only their own rows; the owner (not a member) sees the whole
--- house. For a shared team pool instead, apply NO policy — just the owner's GRANTs.
---
--- Substitute `memhouse` if the operator named the house differently. Policies bind to
--- physical tables; views (sessions_v) inherit the querying user's policy via messages/
--- sessions.
-
-CREATE ROW POLICY IF NOT EXISTS own_sessions ON memhouse.sessions
-    FOR SELECT USING user_id = currentUser() TO member;
-CREATE ROW POLICY IF NOT EXISTS own_messages ON memhouse.messages
-    FOR SELECT USING user_id = currentUser() TO member;
-CREATE ROW POLICY IF NOT EXISTS own_tool_calls ON memhouse.tool_calls
-    FOR SELECT USING user_id = currentUser() TO member;

package/mem-house/schema.sql

@@ -1,145 +0,0 @@
--- mem-house HOUSE schema — the typed common session store (see DESIGN.md).
---
--- Applied by the agency OWNER (`memhouse_root`) inside its own house; names are
--- UNQUALIFIED so this works whatever the operator named the house. Requires
--- ClickHouse >= 26.2 natively; 25.11 also works because the shipper passes
--- allow_experimental_full_text_index=1 per-query when applying this file
--- (the messages text indexes are still gated on 25.x; 26.x+ ignores the flag).
---
--- Parse-on-client: the shipper runs the 17 editor adapters and ships TYPED rows —
--- these tables are the contract. `extra JSON` on each table is the escape hatch for
--- adapter fields not yet normalized (never lose data to the schema).
---
--- Versioning/idempotency: ReplacingMergeTree(ingested_at) everywhere. `messages` is
--- keyed (session_id, user_id, seq): re-shipping a grown or corrected session
--- REPLACES stale rows (latest-wins) instead of accumulating variants, and the
--- user_id in every key means two members shipping the same adapter-local
--- session_id can never collapse or overwrite each other's rows. Identity is
--- server-stamped (`user_id MATERIALIZED currentUser()`; writers must use
--- async_insert=0) and is the RLS anchor (rls.sql). Readers should query with the
--- `final=1` setting.
---
--- session_id is CANONICAL and globally unique: '<source>:<adapter-local id>',
--- stamped by the shipper. Adapter-local ids are only unique within one editor;
--- the source prefix makes every key, incremental comparison, delete, view join,
--- and API id collision-free across editors. `source` remains a plain column for
--- filtering.
---
--- BREAKING (pre-release): the user_id-in-key change alters ORDER BY, which
--- CREATE TABLE IF NOT EXISTS will NOT apply to an existing house — recreate with
--- `memhouse reset` (or DROP the tables and re-run --ensure-schema). The
--- source-prefixed session_id change needs no DDL, but rows shipped before it
--- linger under their old bare ids — run `memhouse reset` once after upgrading.
-
--- One row per session (adapter-level metadata; aggregates live in sessions_v).
-CREATE TABLE IF NOT EXISTS sessions
-(
-    session_id String,
-    source LowCardinality(String),
-    host LowCardinality(String),
-    name String DEFAULT '',
-    mode LowCardinality(String) DEFAULT '',
-    folder String DEFAULT '',
-    project String DEFAULT '',
-    git_branch String DEFAULT '',
-    created_at Nullable(DateTime64(3, 'UTC')),
-    last_updated_at Nullable(DateTime64(3, 'UTC')),
-    message_count UInt32 DEFAULT 0,
-    path String DEFAULT '',
-    extra JSON,
-    user_id String MATERIALIZED currentUser(),
-    ingested_at DateTime64(3, 'UTC') DEFAULT now64(3)
-)
-ENGINE = ReplacingMergeTree(ingested_at)
-ORDER BY (session_id, user_id);
-
--- One row per message. FTS: two lower(text) materialized columns each carry one
--- text index (ngram for substring/LIKE, word for token match) — query with
--- lowercased terms, SELECT `text` for display.
-CREATE TABLE IF NOT EXISTS messages
-(
-    session_id String,
-    seq UInt32,
-    source LowCardinality(String),
-    host LowCardinality(String),
-    ts DateTime64(3, 'UTC'),
-    role LowCardinality(String),
-    model LowCardinality(String) DEFAULT '',
-    input_tokens UInt64 DEFAULT 0,
-    output_tokens UInt64 DEFAULT 0,
-    cache_read_tokens UInt64 DEFAULT 0,
-    cache_write_tokens UInt64 DEFAULT 0,
-    text String,
-    project String DEFAULT '',
-    folder String DEFAULT '',
-    is_subagent Bool DEFAULT false,
-    extra JSON,
-    line_hash UInt64,
-    user_id String MATERIALIZED currentUser(),
-    ingested_at DateTime64(3, 'UTC') DEFAULT now64(3),
-    text_ngram String MATERIALIZED lower(text),
-    text_word  String MATERIALIZED lower(text),
-    INDEX idx_text_ngram text_ngram TYPE text(tokenizer = ngrams(3)) GRANULARITY 1,
-    INDEX idx_text_word  text_word  TYPE text(tokenizer = splitByNonAlpha) GRANULARITY 1
-)
-ENGINE = ReplacingMergeTree(ingested_at)
-ORDER BY (session_id, user_id, seq);
-
--- One row per tool call (memory-house has no equivalent; this powers the tool
--- analytics). `seq` = owning message's seq; `idx` = call index within the session.
-CREATE TABLE IF NOT EXISTS tool_calls
-(
-    session_id String,
-    seq UInt32,
-    idx UInt32,
-    source LowCardinality(String),
-    host LowCardinality(String),
-    tool_name LowCardinality(String),
-    args String DEFAULT '{}',
-    ts DateTime64(3, 'UTC'),
-    project String DEFAULT '',
-    folder String DEFAULT '',
-    user_id String MATERIALIZED currentUser(),
-    ingested_at DateTime64(3, 'UTC') DEFAULT now64(3)
-)
-ENGINE = ReplacingMergeTree(ingested_at)
-ORDER BY (session_id, user_id, idx);
-
--- Analytics-ready rollup: session metadata + message aggregates. Query with final=1.
--- LEFT JOIN (not INNER): stable-empty sessions are deliberately stored (the row
--- absorbs the incremental skip) and must stay visible with zero aggregates, not
--- vanish from every dashboard count. join_use_nulls makes unmatched message
--- columns NULL so count(m.seq)/coalesce produce true zeros instead of counting
--- the placeholder row.
-CREATE OR REPLACE VIEW sessions_v AS
-SELECT
-    s.session_id AS session_id,
-    any(s.source) AS source,
-    any(s.host) AS host,
-    any(s.name) AS name,
-    any(s.mode) AS mode,
-    any(s.folder) AS folder,
-    any(s.project) AS project,
-    any(s.git_branch) AS git_branch,
-    s.user_id AS user_id,
-    any(s.created_at) AS created_at,
-    any(s.last_updated_at) AS last_updated_at,
-    min(m.ts) AS started,
-    max(m.ts) AS ended,
-    coalesce(dateDiff('second', min(m.ts), max(m.ts)), 0) AS duration_sec,
-    count(m.seq) AS total_msgs,
-    countIf(m.role = 'user') AS user_msgs,
-    countIf(m.role = 'assistant') AS assistant_msgs,
-    countIf(m.is_subagent) AS subagent_msgs,
-    groupUniqArrayIf(m.model, m.model NOT IN ('', '<synthetic>')) AS models,
-    coalesce(sum(m.input_tokens), 0) AS input_tokens,
-    coalesce(sum(m.output_tokens), 0) AS output_tokens,
-    coalesce(sum(m.cache_read_tokens), 0) AS cache_read_tokens,
-    coalesce(sum(m.cache_write_tokens), 0) AS cache_write_tokens,
-    coalesce(sumIf(length(m.text), m.role = 'user'), 0) AS user_chars,
-    coalesce(sumIf(length(m.text), m.role = 'assistant'), 0) AS assistant_chars,
-    coalesce(substring(argMinIf(m.text, m.seq, m.role = 'user' AND m.text != ''), 1, 200), '') AS first_prompt
-FROM sessions AS s
-LEFT JOIN messages AS m ON m.session_id = s.session_id AND m.user_id = s.user_id
-GROUP BY s.session_id, s.user_id
-SETTINGS join_use_nulls = 1;