memhouse 0.4.4 → 0.7.0

package/mem-house/delivery/skills/memhouse-sql/SKILL.md

@@ -1,146 +0,0 @@
----
-name: memhouse-sql
-description: Run free-form read-only SQL against memhouse conversation memory (typed sessions/messages/tool_calls rooms on ClickHouse, one set per member). Use for ad-hoc analytics the other memhouse skills don't cover — token spend, model/editor usage, tool rankings, activity heatmaps, busiest days/projects, cache-hit ratios, or any custom question over conversation data.
-user-invocable: true
-argument-hint: "<question or SQL>"
-allowed-tools: Bash(set -a*), Bash(. *), Bash(curl*)
----
-
-# memhouse-sql — ad-hoc analytics
-
-If the user gives SQL, run it (append `FORMAT PrettyCompact` if no FORMAT
-given). If they give a question, write the SQL yourself from the schema below.
-
-**Read-only rule:** the shipper (`ship.js`) is the only writer. Never INSERT/ALTER/DROP
-from here. A member credential normally holds `ALL` on its **own three rooms** — enough
-to destroy that memory — and nothing at all on anyone else's. Reads need no scoping
-clause: the rooms you can name are already only yours, and there is no policy to work
-around.
-
-## Connection
-
-Credentials from `~/.memhouse/env` (or exported `MEMHOUSE_*`). Always read with
-`final=1` — every table is `ReplacingMergeTree(ingested_at)`, so without it you
-can double-count stale row versions — and `join_use_nulls=1`, which the session
-rollup depends on (see below):
-
-```bash
-set -a; [ -f ~/.memhouse/env ] && . ~/.memhouse/env; set +a
-curl -sS --fail-with-body --user "${MEMHOUSE_USER:-memhouse_root}:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "${MEMHOUSE_URL:-http://localhost:8123}/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1" <<'SQL'
-<the query>
-FORMAT PrettyCompact
-SQL
-```
-
-`FORMAT PrettyCompact` for display, `FORMAT JSONEachRow` to parse.
-
-## Room names — always suffixed
-
-Every member owns their own rooms, named for their ClickHouse user:
-`messages_<you>`, `sessions_<you>`, `tool_calls_<you>`. There are no unsuffixed rooms;
-the bare names fail with `UNKNOWN_TABLE` rather than returning nothing. You hold no grant
-on anyone else's rooms, so isolation is not something a query can work around.
-
-Resolve your own name once and substitute it into every table name below:
-
-```bash
-MEM_ME="$(curl -sS --fail-with-body --user "$MEMHOUSE_USER:$MEMHOUSE_PASSWORD" \
-  --data-binary "SELECT currentUser() FORMAT TabSeparated" \
-  "${MEMHOUSE_URL:-http://localhost:8123}/" | tr -d '\r\n')"
-# rooms: messages_$MEM_ME, sessions_$MEM_ME, tool_calls_$MEM_ME
-```
-
-**There is no `sessions_v` object.** The session rollup is a saved query over those same
-rooms — `memhouse sessions-query` prints it for whoever you are connected as, ready to
-paste into a `FROM (...) AS c` position.
-
-**Read the rollup with `join_use_nulls=1`.** The connection recipe above sets it. Without
-it, ClickHouse gives an unmatched `m.seq` a default instead of NULL, so a session with no
-messages reports `total_msgs = 1` rather than 0 — measured, not theoretical. A subquery
-has no `SETTINGS` clause of its own, so the setting has to come from the caller.
-
-If you hold `SELECT` on them, `all_messages` / `all_sessions` / `all_tool_calls` read
-across every member at once, narrowed to whatever grants you actually have — a Merge room
-reduces to the rooms the caller can read, so it fails closed rather than denying outright.
-
-## Schema (the house)
-
-| Object | Kind | Columns |
-|---|---|---|
-| `sessions_<you>` | table, 1 row/session | `session_id, source, host, name, mode, folder, project, git_branch, created_at, last_updated_at, message_count, path, extra JSON, user_id, ingested_at` |
-| `messages_<you>` | table, 1 row/message | `session_id, seq, source, host, ts, role, model, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, text, project, folder, is_subagent, extra JSON, line_hash, user_id, ingested_at` + FTS columns `text_ngram`/`text_word` (lowercased; see memhouse-search) |
-| `tool_calls_<you>` | table, 1 row/tool call | `session_id, seq, idx, source, host, tool_name, args, ts, project, folder, user_id, ingested_at` |
-| the rollup | **saved query**, not an object — `memhouse sessions-query` prints it | `session_id, source, host, name, mode, folder, project, git_branch, user_id, created_at, last_updated_at, started, ended, duration_sec, total_msgs, user_msgs, assistant_msgs, subagent_msgs, models, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, user_chars, assistant_chars, first_prompt` |
-
-Notes: `source` = editor id (`claude-code`, `codex`, `cursor`, `cursor-agent`,
-`vscode`, `zed`, `opencode`, `gemini-cli`, `windsurf`, `antigravity`, …);
-`seq` = message index within its session (0-based); `tool_calls.idx` = call
-index within the session; `user_id` is server-stamped (`currentUser()`);
-`models` in the rollup is an `Array(String)`. Exclude `''` and
-`'<synthetic>'` from model aggregates.
-
-## Examples
-
-Token spend by model:
-
-```sql
-SELECT model, sum(input_tokens) AS in_tok, sum(output_tokens) AS out_tok,
-       sum(cache_read_tokens) AS cache_read
-FROM messages_<you>
-WHERE model NOT IN ('', '<synthetic>')
-GROUP BY model
-ORDER BY out_tok DESC
-FORMAT PrettyCompact
-```
-
-Which tools do I use most (memhouse exclusive — memory-house has no tool table):
-
-```sql
-SELECT tool_name, count() AS calls, uniqExact(session_id) AS sessions
-FROM tool_calls_<you>
-GROUP BY tool_name
-ORDER BY calls DESC
-LIMIT 20
-FORMAT PrettyCompact
-```
-
-Busiest days, last two weeks:
-
-```sql
-SELECT toDate(ts) AS day, uniqExact(session_id) AS sessions, count() AS msgs
-FROM messages_<you>
-WHERE ts > now() - INTERVAL 14 DAY
-GROUP BY day
-ORDER BY day DESC
-FORMAT PrettyCompact
-```
-
-Activity by editor this week / subagent share:
-
-```sql
-SELECT source, count() AS msgs, countIf(is_subagent) AS subagent_msgs
-FROM messages_<you>
-WHERE ts > now() - INTERVAL 7 DAY
-GROUP BY source
-ORDER BY msgs DESC
-FORMAT PrettyCompact
-```
-
-Longest sessions by wall-clock:
-
-```sql
-SELECT name, project, source, duration_sec, total_msgs, output_tokens
-FROM (the rollup from `memhouse sessions-query`)
-ORDER BY duration_sec DESC
-LIMIT 10
-FORMAT PrettyCompact
-```
-
-## Output
-
-Run the query, present the result as a compact table, and add one or two lines
-of interpretation. Offer a natural follow-up cut (by source, by project, by
-host, by token volume) when relevant. Dollar costs are computed by the
-dashboard server from pricing.js — token sums here are the raw material, not
-dollars.

package/mem-house/per-member/provision.js

@@ -1,142 +0,0 @@
-#!/usr/bin/env node
-// mem — provision one member's rooms and grants. Idempotent; also the schema-rollout hook.
-//
-//   provision.js --member <name> [--merge] [--owner-grants]
-//
-// Run as the OWNER. Steps, all IF NOT EXISTS / re-runnable:
-//   1. create the member's three rooms from schema-member.sql.tpl
-//   2. grant the member their own three rooms, TWO statements each: `ALL` (not
-//      re-grantable), then `SELECT WITH GRANT OPTION`. The split is the point —
-//      `ALL` covers the mutation privileges the shipper's clear-then-insert needs
-//      without naming them, and attaching grant-option to `SELECT` alone makes a share
-//      read-only by construction. See the notes at the grants themselves.
-//
-//      THREE ROOMS, not four objects: the session rollup is a saved query over these
-//      same rooms, not a stored view, so it needs no object and no grant of its own.
-//   3. --merge: create/refresh the three Merge rooms, borrowing this member's columns
-//   4. grant the member SELECT on whichever Merge rooms exist — a Merge reduces to the
-//      rooms the caller can already read, so this is what makes the team room fail
-//      CLOSED rather than deny outright
-//
-// Grants are explicit, per room, and NEVER `ON mem.*` — a member who can read the whole
-// house can read every other member's rooms, which would make this a shared house with
-// longer table names. No wildcards are used anywhere; the only pattern in the design is
-// the Merge regex, anchored on a fixed room type.
-//
-// Env: MEM_URL / MEM_USER / MEM_PASSWORD / MEM_DB, falling back to MEMHOUSE_* and then
-// to the shipper's own defaults — http://localhost:8123, memhouse_root, mem.
-
-const fs = require('fs');
-const path = require('path');
-const { createClient } = require('@clickhouse/client');
-const { ROOM_TYPES, mergeRooms, assertUsableMember } = require('./rooms');
-
-const args = process.argv.slice(2);
-const flag = (n) => args.includes(`--${n}`);
-const opt = (n, d = null) => { const i = args.indexOf(`--${n}`); return i >= 0 ? args[i + 1] : d; };
-
-// Defaults MUST match what the shipper and CLI use, or an operator who overrides only
-// the thing that differs — a password, say — silently provisions rooms in a house the
-// product never reads, or fails to authenticate as a user that does not exist.
-const cfg = {
-  url: process.env.MEM_URL || process.env.MEMHOUSE_URL || 'http://localhost:8123',
-  username: process.env.MEM_USER || process.env.MEMHOUSE_USER || 'memhouse_root',
-  password: process.env.MEM_PASSWORD || process.env.MEMHOUSE_PASSWORD || '',
-  database: process.env.MEM_DB || process.env.MEMHOUSE_DB || 'mem',
-};
-
-// Statements are split on ';' at end of line — the templates contain no ';' inside a
-// statement body, and keeping the splitter dumb keeps the templates readable.
-function statements(sql) {
-  return sql
-    .split(/;\s*$/m)
-    .map((s) => s.replace(/^\s*--.*$/gm, '').trim())
-    .filter(Boolean);
-}
-
-/** Which of the three Merge rooms actually exist — a member may be provisioned first. */
-async function mergeRoomsPresent(client, database) {
-  const names = Object.values(mergeRooms());
-  const rs = await client.query({
-    query: `SELECT name FROM system.tables WHERE database = {db:String} AND name IN ({names:Array(String)}) ORDER BY name`,
-    query_params: { db: database, names },
-    format: 'JSONEachRow',
-  });
-  return (await rs.json()).map((r) => r.name);
-}
-
-async function main() {
-  const member = opt('member');
-  if (!member) { console.error('usage: provision.js --member <name> [--merge]'); process.exit(2); }
-  assertUsableMember(member);
-
-  const here = __dirname;
-
-  // Create the house with a client that has NOT selected it — on a fresh server the
-  // database does not exist yet, and selecting it fails before it can be created.
-  const bootstrap = createClient({ ...cfg, database: '' });
-  await bootstrap.command({ query: `CREATE DATABASE IF NOT EXISTS ${cfg.database}` });
-  await bootstrap.close();
-
-  console.log(`[mem] provisioning in ${cfg.url} database '${cfg.database}' as '${cfg.username}'`);
-  const client = createClient({ ...cfg, clickhouse_settings: { async_insert: 0 } });
-
-  // 1. rooms
-  const tpl = fs.readFileSync(path.join(here, 'schema-member.sql.tpl'), 'utf-8');
-  const roomSql = statements(tpl.replaceAll('{{MEMBER}}', member));
-  for (const q of roomSql) {
-    // allow_experimental_full_text_index: a no-op on 26.x, required on 25.x for the
-    // messages text indexes.
-    await client.command({ query: q, clickhouse_settings: { allow_experimental_full_text_index: 1 } });
-  }
-  console.log(`[mem] rooms ready for '${member}': ${ROOM_TYPES.map((t) => `${t}_${member}`).join(', ')}`);
-
-  // 2. grants — two statements per room, and the split is the point.
-  //
-  // ALL, NOT re-grantable: the member owns their room outright, DROP and TRUNCATE
-  // included, because it is their memory to destroy. It also covers the mutation
-  // privileges the shipper needs without naming them — the shipper clears a session's
-  // rows before re-inserting, and which of ALTER UPDATE / ALTER DELETE a server demands
-  // varies by version (`DELETE FROM` is a lightweight delete, implemented as
-  // `ALTER TABLE … UPDATE _row_exists = 0`, so 25.11 wants ALTER UPDATE where 26.7 wanted
-  // ALTER DELETE). Granting one and not the other produces a pass that fails elsewhere.
-  //
-  // SELECT, re-grantable: a share is READ-ONLY BY CONSTRUCTION rather than by convention.
-  // `GRANT ALL … WITH GRANT OPTION` expands to 45 privileges on 26.7 — DROP TABLE,
-  // TRUNCATE, CREATE ROW POLICY, SYSTEM DROP REPLICA among them — and every one of those
-  // would become something a member could hand to a colleague while meaning "let them
-  // read my sessions". Measured: with this split, `GRANT SELECT … TO bob` succeeds and
-  // `GRANT DROP TABLE … TO bob` is refused 497.
-  for (const t of ROOM_TYPES) {
-    const room = `${cfg.database}.${t}_${member}`;
-    await client.command({ query: `GRANT ALL ON ${room} TO ${member}` });
-    await client.command({ query: `GRANT SELECT ON ${room} TO ${member} WITH GRANT OPTION` });
-  }
-  console.log(`[mem] granted ALL on 3 rooms to '${member}'; SELECT is the only re-grantable one`);
-
-  // 3. Merge rooms
-  if (flag('merge')) {
-    const mtpl = fs.readFileSync(path.join(here, 'schema-merge.sql.tpl'), 'utf-8');
-    for (const q of statements(mtpl.replaceAll('{{TEMPLATE_MEMBER}}', member))) {
-      await client.command({ query: q });
-    }
-    console.log('[mem] merge rooms ready: all_sessions, all_messages, all_tool_calls');
-  }
-
-  // 4. Merge-room grants. Broad on purpose, and safe for the reason the whole layout
-  // rests on: a Merge table reduces to the underlying rooms the CALLER holds grants for.
-  // Measured on 25.11 — bob with SELECT on all_messages and nothing on messages_alice
-  // reads his own row and none of alice's, with `_table` showing only messages_bob, and
-  // no error. Withholding this grant does not make anything safer; it makes the team
-  // room deny outright instead of failing closed, which is a different and worse thing.
-  const merged = await mergeRoomsPresent(client, cfg.database);
-  for (const room of merged) {
-    await client.command({ query: `GRANT SELECT ON ${cfg.database}.${room} TO ${member}` });
-  }
-  if (merged.length) console.log(`[mem] granted SELECT on ${merged.join(', ')} to '${member}'`);
-  else console.log('[mem] no merge rooms yet — run once with --merge to create them');
-
-  await client.close();
-}
-
-main().catch((e) => { console.error(`[mem] provision failed: ${e.message}`); process.exit(1); });

package/mem-house/per-member/rooms.js

@@ -1,132 +0,0 @@
-// Room-name resolution.
-//
-// Every member owns their rooms, named TYPE-FIRST: `sessions_<member>`,
-// `messages_<member>`, `tool_calls_<member>`. Type-first is what lets the Merge rooms
-// anchor on a fixed room type (`^sessions_`) and never match themselves.
-//
-// THIS IS THE ONLY LAYOUT. There was a shared one — three rooms named `sessions`,
-// `messages`, `tool_calls`, with row policies narrowing each caller to their own rows —
-// and it is gone. A shared read is a Merge room plus a GRANT, which is strictly less
-// machinery than a policy that has to be right on every table and every read path; and
-// isolation by absent grant fails closed, where a row policy fails open the moment one is
-// missing.
-//
-// The member is never supplied by the caller — it is read back from the server with
-// currentUser(), the same value the rooms' user_id column is stamped with. A client that
-// could name its own member could write into someone else's rooms.
-//
-// `sessions_v` IS A SAVED QUERY, NOT A ROOM. It was briefly a stored view, which cost a
-// name inside the `^sessions_` namespace the Merge rooms select on (silently merged into
-// `all_sessions`, doubling every count), a fourth grant per member, and a fourth object to
-// provision, roll forward and drop. A saved query is substituted with the caller's own
-// room names and runs under the caller's credential, so it inherits their grants and
-// raises no view-ownership question at all.
-
-const ROOM_TYPES = ['sessions', 'messages', 'tool_calls'];
-
-// ClickHouse usernames are permissive; room names are not. Refuse anything that would
-// need quoting or could change how a Merge regex or a name-splitter reads.
-function assertUsableMember(member) {
-  if (typeof member !== 'string' || !/^[A-Za-z][A-Za-z0-9_]*$/.test(member)) {
-    throw new Error(`cannot build room names for user '${member}': expected [A-Za-z][A-Za-z0-9_]*`);
-  }
-}
-
-/**
- * The session rollup, as SQL text rather than a name.
- *
- * Two properties are load bearing: the join is a LEFT JOIN, so a session with no messages
- * still appears with zero aggregates instead of vanishing from every count; and
- * `join_use_nulls = 1` makes the unmatched message columns NULL so `coalesce` yields true
- * zeros rather than counting the placeholder row. The setting is applied by the CALLER (a
- * client setting, not a trailing SETTINGS clause) because this text is used as a subquery,
- * and a subquery cannot carry its own SETTINGS.
- */
-function sessionsRollup({ sessions, messages }) {
-  return `(
-    SELECT
-        s.session_id AS session_id,
-        any(s.source) AS source,
-        any(s.host) AS host,
-        any(s.name) AS name,
-        any(s.mode) AS mode,
-        any(s.folder) AS folder,
-        any(s.project) AS project,
-        any(s.git_branch) AS git_branch,
-        s.user_id AS user_id,
-        any(s.created_at) AS created_at,
-        any(s.last_updated_at) AS last_updated_at,
-        min(m.ts) AS started,
-        max(m.ts) AS ended,
-        coalesce(dateDiff('second', min(m.ts), max(m.ts)), 0) AS duration_sec,
-        count(m.seq) AS total_msgs,
-        countIf(m.role = 'user') AS user_msgs,
-        countIf(m.role = 'assistant') AS assistant_msgs,
-        countIf(m.is_subagent) AS subagent_msgs,
-        groupUniqArrayIf(m.model, m.model NOT IN ('', '<synthetic>')) AS models,
-        coalesce(sum(m.input_tokens), 0) AS input_tokens,
-        coalesce(sum(m.output_tokens), 0) AS output_tokens,
-        coalesce(sum(m.cache_read_tokens), 0) AS cache_read_tokens,
-        coalesce(sum(m.cache_write_tokens), 0) AS cache_write_tokens,
-        coalesce(sumIf(length(m.text), m.role = 'user'), 0) AS user_chars,
-        coalesce(sumIf(length(m.text), m.role = 'assistant'), 0) AS assistant_chars,
-        coalesce(substring(argMinIf(m.text, m.seq, m.role = 'user' AND m.text != ''), 1, 200), '') AS first_prompt
-    FROM ${sessions} AS s
-    LEFT JOIN ${messages} AS m ON m.session_id = s.session_id AND m.user_id = s.user_id
-    GROUP BY s.session_id, s.user_id
-  )`;
-}
-
-/**
- * The settings every read needs. `final` collapses ReplacingMergeTree versions;
- * `join_use_nulls` is what the rollup's coalesce depends on.
- */
-const READ_SETTINGS = { final: 1, join_use_nulls: 1 };
-
-/**
- * Names, given the member the server reported. Shared by every caller so the two
- * transports in the tree (@clickhouse/client and the CLI's raw fetch) cannot drift into
- * two different naming rules.
- *
- * `sessions_v` is the rollup as SQL text, usable in the same `FROM ... AS c` position a
- * view name would occupy — which is what lets the read layer treat it as just another
- * resolved name.
- */
-function roomNames(member, user = member) {
-  assertUsableMember(member);
-  const out = { member, user };
-  for (const t of ROOM_TYPES) out[t] = `${t}_${member}`;
-  out.sessions_v = sessionsRollup(out);
-  return out;
-}
-
-async function currentUser(client) {
-  const rs = await client.query({ query: 'SELECT currentUser() AS u', format: 'JSONEachRow' });
-  const rows = await rs.json();
-  const u = rows[0] && rows[0].u;
-  if (!u) throw new Error('could not determine currentUser()');
-  return u;
-}
-
-/**
- * Resolve the rooms for whoever this client is connected as.
- * Returns { sessions, messages, tool_calls, sessions_v, member, user }.
- *
- * `user` is the identity the server reports. Writers need the value itself, not just the
- * name it produces — see ship.js's delete, which must BIND the user rather than call
- * currentUser() inside a mutation, where it is not evaluated in the caller's context.
- */
-async function resolveRooms(client) {
-  const user = await currentUser(client);
-  return roomNames(user, user);
-}
-
-/** The three Merge rooms — team-wide read paths, owner-managed. */
-function mergeRooms() {
-  return { sessions: 'all_sessions', messages: 'all_messages', tool_calls: 'all_tool_calls' };
-}
-
-module.exports = {
-  ROOM_TYPES, READ_SETTINGS, assertUsableMember,
-  sessionsRollup, roomNames, currentUser, resolveRooms, mergeRooms,
-};

package/mem-house/server/server.js

@@ -1,228 +0,0 @@
-// mem-house server — the dashboard/API entrypoint.
-//
-// Speaks the agentlytics REST contract (same routes, same response shapes) over the
-// mem-house typed schema, so the UNMODIFIED agentlytics React SPA is the dashboard:
-// queries.js computes every response; this file is routing + config + stubs. Serves
-// the built SPA from the repo root's public/.
-//
-//   node mem-house/server/server.js        (env: MEMHOUSE_* per DESIGN.md; port 4640)
-
-const express = require('express');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const qy = require('./queries');
-
-const PORT = parseInt(process.env.MEMHOUSE_PORT || '4640', 10);
-// Localhost by default: the dashboard exposes full transcripts and a SQL console
-// with no auth. Remote access is an explicit opt-in (MEMHOUSE_HOST=0.0.0.0).
-const HOST = process.env.MEMHOUSE_HOST || '127.0.0.1';
-const PUBLIC_DIR = path.join(__dirname, '..', '..', 'public');
-const CONFIG_PATH = path.join(os.homedir(), '.memhouse', 'config.json');
-
-const app = express();
-app.use(express.json());
-if (fs.existsSync(PUBLIC_DIR)) app.use(express.static(PUBLIC_DIR));
-
-function readConfig() {
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')); } catch { return {}; }
-}
-function writeConfig(config) {
-  fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
-}
-const hiddenFolders = () => readConfig().hiddenProjects || [];
-
-function parseDateOpts(query) {
-  const opts = {};
-  if (query.dateFrom) opts.dateFrom = parseInt(query.dateFrom) || null;
-  if (query.dateTo) opts.dateTo = parseInt(query.dateTo) || null;
-  return opts;
-}
-
-// Route helper: async handler with the uniform 500 shape.
-const route = (fn) => async (req, res) => {
-  try { await fn(req, res); } catch (err) { res.status(500).json({ error: err.message }); }
-};
-
-app.get('/api/ping', (req, res) => res.json({ app: 'agentlytics', pid: process.pid }));
-app.get('/api/mode', (req, res) => res.json({ mode: 'local' }));
-
-app.get('/api/overview', route(async (req, res) => {
-  res.json(await qy.getOverview({ editor: req.query.editor || null, ...parseDateOpts(req.query), hiddenFolders: hiddenFolders() }));
-}));
-
-app.get('/api/daily-activity', route(async (req, res) => {
-  res.json(await qy.getDailyActivity({ editor: req.query.editor || null, ...parseDateOpts(req.query), hiddenFolders: hiddenFolders() }));
-}));
-
-app.get('/api/dashboard-stats', route(async (req, res) => {
-  res.json(await qy.getDashboardStats({ editor: req.query.editor || null, ...parseDateOpts(req.query), hiddenFolders: hiddenFolders() }));
-}));
-
-app.get('/api/chats', route(async (req, res) => {
-  const opts = {
-    editor: req.query.editor || null,
-    folder: req.query.folder || null,
-    named: req.query.named !== 'false',
-    limit: req.query.limit ? parseInt(req.query.limit) : 200,
-    offset: req.query.offset ? parseInt(req.query.offset) : 0,
-    ...parseDateOpts(req.query),
-    hiddenFolders: hiddenFolders(),
-  };
-  const [total, chats] = await Promise.all([qy.countChats(opts), qy.getChats(opts)]);
-  res.json({ total, chats });
-}));
-
-app.get('/api/chats/:id', route(async (req, res) => {
-  const result = await qy.getChat(req.params.id);
-  if (!result) return res.status(404).json({ error: 'Chat not found' });
-  res.json(result);
-}));
-
-app.get('/api/chats/:id/markdown', route(async (req, res) => {
-  const result = await qy.getChat(req.params.id);
-  if (!result) return res.status(404).json({ error: 'Chat not found' });
-  const lines = [];
-  const title = result.name || 'Untitled Session';
-  lines.push(`# ${title}\n`);
-  const meta = [];
-  if (result.source) meta.push(`**Editor:** ${result.source}`);
-  if (result.mode) meta.push(`**Mode:** ${result.mode}`);
-  if (result.folder) meta.push(`**Project:** ${result.folder}`);
-  if (result.createdAt) meta.push(`**Created:** ${new Date(result.createdAt).toISOString()}`);
-  if (result.lastUpdatedAt) meta.push(`**Updated:** ${new Date(result.lastUpdatedAt).toISOString()}`);
-  if (result.stats) {
-    meta.push(`**Messages:** ${result.stats.totalMessages}`);
-    if (result.stats.totalInputTokens) meta.push(`**Input Tokens:** ${result.stats.totalInputTokens}`);
-    if (result.stats.totalOutputTokens) meta.push(`**Output Tokens:** ${result.stats.totalOutputTokens}`);
-    const models = [...new Set(result.stats.models || [])];
-    if (models.length > 0) meta.push(`**Models:** ${models.join(', ')}`);
-  }
-  if (meta.length > 0) lines.push(meta.join('  \n') + '\n');
-  lines.push('---\n');
-  for (const msg of result.messages) {
-    const label = msg.role === 'user' ? '## User' : msg.role === 'assistant' ? '## Assistant' : `## ${msg.role.charAt(0).toUpperCase() + msg.role.slice(1)}`;
-    const modelTag = msg.model ? ` *(${msg.model})*` : '';
-    lines.push(`${label}${modelTag}\n`);
-    lines.push(msg.content + '\n');
-  }
-  const filename = title.replace(/[^a-zA-Z0-9_-]/g, '_').substring(0, 80) + '.md';
-  res.setHeader('Content-Type', 'text/markdown; charset=utf-8');
-  res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
-  res.send(lines.join('\n'));
-}));
-
-app.get('/api/projects', route(async (req, res) => {
-  res.json(await qy.getProjects({ ...parseDateOpts(req.query), hiddenFolders: hiddenFolders() }));
-}));
-
-app.get('/api/all-projects', route(async (req, res) => {
-  res.json(await qy.getProjects({ ...parseDateOpts(req.query), includeHidden: true }));
-}));
-
-app.get('/api/deep-analytics', route(async (req, res) => {
-  res.json(await qy.getDeepAnalytics({
-    editor: req.query.editor || null,
-    folder: req.query.folder || null,
-    limit: Math.min(parseInt(req.query.limit) || 500, 5000),
-    ...parseDateOpts(req.query),
-    hiddenFolders: hiddenFolders(),
-  }));
-}));
-
-app.get('/api/costs', route(async (req, res) => {
-  res.json(await qy.estimateCosts({
-    editor: req.query.editor || null,
-    folder: req.query.folder || null,
-    chatId: req.query.chatId || null,
-    ...parseDateOpts(req.query),
-    hiddenFolders: hiddenFolders(),
-  }));
-}));
-
-app.get('/api/cost-analytics', route(async (req, res) => {
-  res.json(await qy.getCostAnalytics({ editor: req.query.editor || null, ...parseDateOpts(req.query), hiddenFolders: hiddenFolders() }));
-}));
-
-app.get('/api/tool-calls', route(async (req, res) => {
-  const name = req.query.name;
-  if (!name) return res.status(400).json({ error: 'name query param required' });
-  // Same filter set as the analytics the drill-down is opened from.
-  res.json(await qy.getToolCalls(name, {
-    limit: Math.min(parseInt(req.query.limit) || 200, 1000),
-    folder: req.query.folder || null,
-    editor: req.query.editor || null,
-    ...parseDateOpts(req.query),
-    hiddenFolders: hiddenFolders(),
-  }));
-}));
-
-app.post('/api/query', route(async (req, res) => {
-  const { sql } = req.body;
-  if (!sql || typeof sql !== 'string') return res.status(400).json({ error: 'sql string required' });
-  const first = sql.trim().replace(/^--.*$/gm, '').trim().split(/\s+/)[0].toUpperCase();
-  if (!['SELECT', 'WITH', 'EXPLAIN', 'DESCRIBE', 'SHOW'].includes(first)) {
-    return res.status(403).json({ error: 'Only SELECT queries are allowed' });
-  }
-  try { res.json(await qy.rawQuery(sql)); }
-  catch (err) { res.status(400).json({ error: err.message }); }
-}));
-
-app.get('/api/schema', route(async (req, res) => res.json(await qy.schema())));
-
-app.get('/api/config', (req, res) => res.json(readConfig()));
-app.put('/api/config', route(async (req, res) => {
-  const config = readConfig();
-  Object.assign(config, req.body);
-  writeConfig(config);
-  res.json(config);
-}));
-
-// Real refetch: run one full shipper pass, streaming SSE like the root contract.
-app.get('/api/refetch', async (req, res) => {
-  res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', Connection: 'keep-alive' });
-  try {
-    const { runShip } = require('../shipper/ship');
-    res.write(`data: ${JSON.stringify({ scanned: 0, analyzed: 0, skipped: 0, total: 0 })}\n\n`);
-    const r = await runShip(qy.getClient(), { full: true });
-    res.write(`data: ${JSON.stringify({ done: true, total: r.sessions + r.skipped, analyzed: r.sessions })}\n\n`);
-  } catch (err) {
-    res.write(`data: ${JSON.stringify({ error: err.message })}\n\n`);
-  }
-  res.end();
-});
-
-// Not applicable to mem-house (dashboard renders these pages empty/absent).
-app.get('/api/usage', (req, res) => res.json([]));
-app.get('/api/artifacts', (req, res) => res.json([]));
-app.get('/api/artifact-content', (req, res) => res.status(404).json({ error: 'not available in mem-house' }));
-app.get('/api/mcps', (req, res) => res.json({
-  servers: [], toolCalls: [], matchedTools: {}, topSessions: [], projectMcps: [],
-  summary: { totalServers: 0, totalToolCalls: 0, uniqueTools: 0, sessionsWithTools: 0, editorsWithServers: [] },
-}));
-app.get('/api/gsd/projects', (req, res) => res.json([]));
-app.get('/api/gsd/phases', (req, res) => res.json([]));
-app.get('/api/gsd/plan', (req, res) => res.status(404).json({ error: 'not available in mem-house' }));
-app.get('/api/gsd/overview', (req, res) => res.json({ totalProjects: 0, totalPhases: 0, completedPhases: 0, activePhases: [], executingPhases: 0, plannedPhases: 0 }));
-app.get('/api/gsd/config', (req, res) => res.json(null));
-app.get('/api/gsd/phase-tokens', (req, res) => res.json([]));
-app.get('/api/gsd/file', (req, res) => res.json({ content: null }));
-app.get('/api/share-image', (req, res) => res.status(501).json({ error: 'not available in mem-house' }));
-app.get('/api/check-ai', (req, res) => res.status(501).json({ error: 'not available in mem-house' }));
-
-// SPA fallback
-app.get('*', (req, res) => {
-  const index = path.join(PUBLIC_DIR, 'index.html');
-  if (fs.existsSync(index)) res.sendFile(index);
-  else res.status(503).json({ error: 'UI not built — run: cd ui && npm install && npm run build' });
-});
-
-if (require.main === module) {
-  app.listen(PORT, HOST, () => {
-    console.log(`[mem-house] dashboard → http://localhost:${PORT} (house '${qy.config.database}' @ ${qy.config.url.replace(/\/\/.*@/, '//')})`
-      + (HOST !== '127.0.0.1' ? ` [bound to ${HOST} — remotely reachable]` : ''));
-  });
-}
-
-module.exports = app;