superlocalmemory 4.0.10 → 4.1.0

package/src/superlocalmemory/server/routes/evolution.py

@@ -330,3 +330,181 @@ def evolution_lineage(request: Request, skill_name: str = ""):
     finally:
         if conn is not None:
             conn.close()
+
+
+# ---------------------------------------------------------------------------
+# Approving a quarantined skill
+#
+# A mutation that passes blind verification stops at VERIFIED_QUARANTINED and
+# waits. Nothing moved it from there: auto-approval is off by default, correctly
+# — this system rewrites the instructions an AI follows, and doing that without
+# a person saying yes is not a default anyone should ship. But there was no way
+# for the person to say yes either, so every verified improvement sat in a
+# quarantine directory permanently.
+#
+# This is that path. It does NOT change the default: approval remains explicit,
+# per-candidate, and recorded in the transition chain with who did it.
+# ---------------------------------------------------------------------------
+
+
+class ApproveSkillRequest(BaseModel):
+    """Which candidate to approve. Named by record id, not by skill name.
+
+    A skill can have several candidates over time and only one of them is the
+    one being looked at. Approving "the latest candidate for skill X" would make
+    the outcome depend on when the call happened to arrive.
+    """
+
+    record_id: str
+
+
+_APPROVABLE = ("verified_quarantined", "promoted")
+
+
+@router.post("/api/evolution/approve")
+def evolution_approve(request: Request, body: ApproveSkillRequest):
+    """Activate a quarantined skill mutation after human approval."""
+    _require_manage(request)
+    try:
+        from superlocalmemory.evolution.evolution_store import EvolutionStore
+        from superlocalmemory.evolution.skill_activator import SkillActivator
+        from superlocalmemory.evolution.types import EvolutionStatus
+
+        profile_id = get_active_profile()
+        store = EvolutionStore(str(MEMORY_DIR / "memory.db"))
+
+        record = store.get_record(body.record_id, profile_id)
+        if record is None:
+            return {"success": False, "error": "No such evolution candidate"}
+
+        # Prefer the transition chain over the record's own column: the chain is
+        # the audited history and the column is a cache of its last entry.
+        latest = store.get_latest_status(body.record_id, profile_id)
+        current = (latest.value if latest is not None
+                   else getattr(record.status, "value", ""))
+
+        if current not in _APPROVABLE:
+            # Refusing an already-active candidate matters: activating twice
+            # would overwrite the backup taken the first time with the mutation
+            # itself, and the rollback target would become the thing being
+            # rolled back.
+            return {
+                "success": False,
+                "error": (
+                    f"Candidate is {current!r}; only a verified candidate "
+                    "awaiting approval can be activated"
+                ),
+                "status": current,
+            }
+
+        if not record.quarantine_dir_name:
+            return {
+                "success": False,
+                "error": "Candidate has no quarantined artifact to activate",
+            }
+
+        actor = "dashboard"
+
+        # Approval is recorded BEFORE the file moves, activation after. The
+        # order matters in both directions:
+        #
+        # * recording both afterwards means a successful activation whose log
+        #   write fails leaves the skill live and the record saying it is not —
+        #   so the next approval attempt is allowed, and activating twice
+        #   overwrites the backup that rollback restores from.
+        # * recording both beforehand would claim a mutation is live when the
+        #   file move failed.
+        #
+        # Approved-then-nothing is a state a person can act on. Live-but-unknown
+        # is not.
+        store.append_transition(
+            body.record_id, profile_id,
+            EvolutionStatus(current), EvolutionStatus.APPROVED,
+            actor_id=actor, reason="approved by request",
+        )
+        try:
+            activation = SkillActivator().activate(
+                record.skill_name, record.quarantine_dir_name, actor_id=actor,
+            )
+        except Exception as exc:
+            # The approval stands and the mutation did not go live. Recorded as
+            # such rather than left dangling.
+            store.append_transition(
+                body.record_id, profile_id,
+                EvolutionStatus.APPROVED, EvolutionStatus.REJECTED,
+                actor_id=actor, reason=f"activation failed: {exc}",
+            )
+            raise
+        store.append_transition(
+            body.record_id, profile_id,
+            EvolutionStatus.APPROVED, EvolutionStatus.ACTIVE,
+            actor_id=actor, reason="activated from quarantine",
+            metadata={"content_hash": activation.get("content_hash", "")},
+        )
+
+        return {
+            "success": True,
+            "record_id": body.record_id,
+            "skill_name": record.skill_name,
+            "status": EvolutionStatus.ACTIVE.value,
+            "live_path": activation.get("live_path"),
+            "backup_path": activation.get("backup_path"),
+            "content_hash": activation.get("content_hash"),
+            # So the caller knows how to undo it without reading the source.
+            "rollback": "POST /api/evolution/rollback",
+        }
+    except FileNotFoundError as exc:
+        return {"success": False, "error": f"Quarantined artifact missing: {exc}"}
+    except Exception:
+        logger.exception("evolution_approve error")
+        return {"success": False, "error": "Internal server error"}
+
+
+class RollbackSkillRequest(BaseModel):
+    skill_name: str
+    #: Optional, so the reversal can be recorded against the candidate it
+    #: reverses. Without it the file is restored and the log still says active,
+    #: which reads as "this mutation is live" forever.
+    record_id: str = ""
+
+
+@router.post("/api/evolution/rollback")
+def evolution_rollback(request: Request, body: RollbackSkillRequest):
+    """Restore a skill's previous instructions after an approval goes wrong.
+
+    Approval is reversible, and it has to be: the reason a person is in this
+    loop is that a verified mutation can still be a bad one, and finding that
+    out happens after it is live.
+    """
+    _require_manage(request)
+    try:
+        from superlocalmemory.evolution.evolution_store import EvolutionStore
+        from superlocalmemory.evolution.skill_activator import SkillActivator
+        from superlocalmemory.evolution.types import EvolutionStatus
+
+        result = SkillActivator().rollback(body.skill_name)
+
+        # Record the reversal. A restored file with the log still reading
+        # "active" says the mutation is live when it is not, and that is the
+        # record an audit would read.
+        if body.record_id:
+            try:
+                store = EvolutionStore(str(MEMORY_DIR / "memory.db"))
+                pid = get_active_profile()
+                latest = store.get_latest_status(body.record_id, pid)
+                store.append_transition(
+                    body.record_id, pid,
+                    latest or EvolutionStatus.ACTIVE,
+                    EvolutionStatus.ROLLED_BACK,
+                    actor_id="dashboard", reason="rolled back by request",
+                )
+            except Exception as exc:  # pragma: no cover — the file is restored
+                logger.warning("rollback recorded no transition: %s", exc)
+                result["transition_recorded"] = False
+
+        return {"success": True, **result}
+    except FileNotFoundError as exc:
+        return {"success": False, "error": f"No backup to restore: {exc}"}
+    except Exception:
+        logger.exception("evolution_rollback error")
+        return {"success": False, "error": "Internal server error"}

package/src/superlocalmemory/server/routes/ingest.py

@@ -81,6 +81,14 @@ async def ingest(req: IngestRequest, request: Request):
             request,
             actor_kind="http-ingest",
         )
+        # Machine authentication says which process is calling. It does not say
+        # whether that caller's user may write to this workspace. Every other
+        # write route asks that question; this one did not, so a viewer could
+        # write through it in a workspace that requires a login.
+        from superlocalmemory.access.rbac import Permission
+        from superlocalmemory.server.rbac_enforce import require_permission
+
+        require_permission(request, Permission.WRITE, profile=engine._profile_id)
         command = build_engine_ingestion_command(engine)
         receipt, created = command.submit_with_status(IngestionRequest(
             content=req.content,

package/src/superlocalmemory/server/routes/learning_telemetry.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 import logging
 import sqlite3
 from pathlib import Path
+from superlocalmemory.learning.signal_kinds import FEEDBACK_ONLY_SQL
 
 logger = logging.getLogger("superlocalmemory.routes.learning")
 
@@ -24,7 +25,7 @@ class ReadOnlyRankerStore:
         try:
             row = connection.execute(
                 "SELECT COUNT(*) AS count FROM learning_signals "
-                "WHERE profile_id = ?",
+                f"WHERE profile_id = ?{FEEDBACK_ONLY_SQL}",
                 (profile_id,),
             ).fetchone()
             return int(row["count"] if row else 0)

package/src/superlocalmemory/server/routes/memories.py

@@ -13,6 +13,11 @@ from typing import Optional
 
 from fastapi import APIRouter, HTTPException, Query, Request
 
+from superlocalmemory.core.config import BROWSE_PAGE_SIZE
+from superlocalmemory.storage.database import (
+    visible_fact_clause_for_connection,
+)
+
 from .helpers import (
     SearchRequest,
     dict_factory,
@@ -131,10 +136,20 @@ def _admit_http_mutation(request: Request, operation: str) -> None:
         resolve_principal,
     )
 
+    from superlocalmemory.core.admission import _company_mode_active
+
+    # Both switches, the same rule the other entry points use. Reading
+    # config.toml alone left this path treating a workspace as personal after
+    # the dashboard toggle had turned per-user access on -- so a write refused
+    # everywhere else was admitted here.
     deployment = getattr(request.app.state, "deployment", None)
-    is_enterprise = bool(deployment and deployment.is_enterprise)
-    tier = "enterprise" if is_enterprise else "personal"
-    mode = "company" if is_enterprise else "local"
+    if deployment is None:
+        from superlocalmemory.core.admission import _resolve_deployment
+
+        deployment = _resolve_deployment()
+    company = _company_mode_active(deployment)
+    tier = "enterprise" if company else "personal"
+    mode = "company" if company else "local"
 
     principal_info = resolve_principal(request)
     principal = str(principal_info.get("user_id") or "")
@@ -388,7 +403,7 @@ async def get_memories(
     cluster_id: Optional[int] = None,
     min_importance: Optional[int] = None,
     tags: Optional[str] = None,
-    limit: int = Query(50, ge=1, le=200),
+    limit: int = Query(BROWSE_PAGE_SIZE, ge=1, le=200),
     offset: int = Query(0, ge=0),
     filter: Optional[str] = Query(
         None,
@@ -444,15 +459,24 @@ async def get_memories(
                 scope_where = "profile_id = ?"
                 scope_params = [active_profile]
 
+            # Withheld rows are excluded from BOTH the page and the total. On
+            # the author's store this list served 24 model-authored summaries
+            # in its first 50 rows and reported 5,218 memories against 3,919
+            # real ones -- the count a user reads, inflated by exactly the
+            # 1,299 rows 4.0.10 withheld.
+            visible = visible_fact_clause_for_connection(conn)
             query = (
                 "SELECT fact_id as id, memory_id, content, fact_type as category, "
                 "confidence as importance, access_count, "
                 "created_at, created_at as updated_at, "
                 "session_id as project_name, scope, shared_with "
-                f"FROM atomic_facts WHERE {scope_where}"
+                f"FROM atomic_facts WHERE {scope_where}{visible}"
             )
             params = list(scope_params)
-            count_base = f"SELECT COUNT(*) as total FROM atomic_facts WHERE {scope_where}"
+            count_base = (
+                "SELECT COUNT(*) as total FROM atomic_facts "
+                f"WHERE {scope_where}{visible}"
+            )
         else:
             query = """
                 SELECT id, content, summary, category, project_name, project_path,
@@ -656,6 +680,11 @@ async def search_memories(request: Request, body: SearchRequest):
                 lambda: engine.recall(
                     body.query, limit=body.limit, fast=True,
                     window=_window or None,
+                    # Name the surface. A recall with no name leaves no record
+                    # an outcome can be matched to, and a search typed into the
+                    # dashboard is one continuous thread of use, not a
+                    # conversation turn.
+                    session_id=f"dashboard:{get_active_profile()}",
                 ),
             )
             # A run_in_executor thread cannot be cancelled, and wait_for() on it
@@ -803,6 +832,13 @@ async def get_summary(request: Request, kind: str = "day", target: str = ""):
     except Exception:
         raise _internal_error("Summary generation error")
 
+    # Say why, not just what. The response already reported that a summary was
+    # assembled rather than written; someone seeing a plainer result than they
+    # expected still had no way to learn that a written one needs a model, and
+    # would reasonably read the feature as broken.
+    from superlocalmemory.core.mode_capability import llm_capability
+
+    generated = str(getattr(result, "generated_by", "") or "")
     return {
         "kind": result.kind,
         "profile_id": result.profile_id,
@@ -812,6 +848,12 @@ async def get_summary(request: Request, kind: str = "day", target: str = ""):
         "source_fact_ids": result.source_fact_ids,
         "source_count": len(result.source_fact_ids),
         "metadata": result.metadata,
+        "capability": llm_capability(
+            cfg,
+            # This call has just been made, so its outcome is the honest answer
+            # about availability -- better than asking the configuration again.
+            llm_reachable=generated.startswith("llm"),
+        ),
     }
 
 
@@ -992,7 +1034,7 @@ async def get_clusters(request: Request):
 async def get_cluster_detail(
     request: Request,
     cluster_id: str,
-    limit: int = Query(50, ge=1, le=200),
+    limit: int = Query(BROWSE_PAGE_SIZE, ge=1, le=200),
 ):
     """Get detailed view of a specific cluster (scene)."""
     try:

package/src/superlocalmemory/server/routes/timeline.py

@@ -17,6 +17,9 @@ import sqlite3
 from fastapi import APIRouter, Query
 from fastapi.responses import JSONResponse
 from superlocalmemory.server.routes.helpers import DB_PATH, get_active_profile, get_read_connection
+from superlocalmemory.storage.database import (
+    visible_fact_clause_for_connection,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -82,6 +85,7 @@ async def get_timeline(
             "confidence, session_id "
             "FROM atomic_facts "
             "WHERE profile_id = ? AND created_at >= ? AND lifecycle = 'active' "
+            f"{visible_fact_clause_for_connection(conn)} "
             "ORDER BY created_at DESC LIMIT ?",
             (pid, start_date, INTERNAL_CEILING),
         ).fetchall()

package/src/superlocalmemory/server/routes/v3_api.py

@@ -8,14 +8,45 @@ from __future__ import annotations
 
 import json
 import logging
+from pathlib import Path
 import os
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse
+from superlocalmemory.core.config import CANONICAL_RECALL_LIMIT
+from superlocalmemory.core.status_contract import (
+    COUNT_QUERIES,
+    counts_from_sqlite,
+    projection_queue_depth,
+    store_size_mb,
+)
 from superlocalmemory.server.routes.helpers import SLM_VERSION, get_read_connection
 from superlocalmemory.server.route_mutations import authorize_route_mutation
 
 logger = logging.getLogger(__name__)
 
+def _signal_session_id() -> str:
+    """A name for the caller, for matching an outcome back to this recall.
+
+    The agent id the request arrived under, when it arrived under one. Falls
+    back to the workspace, which keeps dashboard and scripted traffic separable
+    from an agent's. Never empty: an unnamed recall leaves no record.
+    """
+    try:
+        from superlocalmemory.mcp.agent_context import get_current_agent_id
+
+        agent = str(get_current_agent_id() or "").strip()
+        if agent:
+            return f"agent:{agent}"
+    except Exception:  # noqa: BLE001 -- naming the caller must never fail a read
+        pass
+    try:
+        from superlocalmemory.server.routes.helpers import get_active_profile
+
+        return f"api:{get_active_profile()}"
+    except Exception:  # noqa: BLE001
+        return "api:default"
+
+
 router = APIRouter(prefix="/api/v3", tags=["v3"])
 
 
@@ -102,20 +133,15 @@ async def dashboard(request: Request):
 
         # Read stats directly from SQLite (dashboard doesn't load engine)
         memory_count = 0
-        fact_count = 0
+        counts = dict.fromkeys(COUNT_QUERIES, 0)
+        queue_depth = 0
         db_path = config.base_dir / "memory.db"
         if db_path.exists():
             try:
                 conn = get_read_connection(db_path)
+                counts = counts_from_sqlite(conn, active_profile)
+                queue_depth = projection_queue_depth(conn)
                 cursor = conn.cursor()
-                try:
-                    cursor.execute(
-                        "SELECT COUNT(*) FROM atomic_facts WHERE profile_id = ?",
-                        (active_profile,),
-                    )
-                    fact_count = cursor.fetchone()[0]
-                except Exception:
-                    pass
                 try:
                     try:
                         cursor.execute(
@@ -143,10 +169,23 @@ async def dashboard(request: Request):
             "provider": config.llm.provider or "none",
             "model": config.llm.model or "",
             "memory_count": memory_count,
-            "fact_count": fact_count,
             "profile": active_profile,
             "base_dir": str(config.base_dir),
             "version": SLM_VERSION,
+            # The counts and the store's own address were missing here while
+            # every other status surface carried them, so the one surface a
+            # person actually looks at could not answer "is the graph healthy".
+            "db_path": str(db_path),
+            "db_size_mb": store_size_mb(db_path),
+            "profile_generation": get_profile_runtime(
+                request.app.state,
+            ).snapshot.generation,
+            # Facts stored but not yet in the graph and vector projections. A
+            # number that does not fall is a projection that has stopped
+            # keeping up, which is otherwise invisible: nothing errors, the
+            # memory is safely in SQLite, and recall just quietly gets worse.
+            "projection_queue_depth": queue_depth,
+            **counts,
         }
         payload.update(dashboard_mode_fields(config.mode))
         return payload
@@ -495,12 +534,45 @@ async def set_full_config(request: Request):
         _emb_fields = ("embedding_provider", "embedding_endpoint", "embedding_key",
                        "embedding_model", "embedding_dimension")
         if any(k in body for k in _emb_fields):
+            _old_emb = config.embedding
+            _new_provider = body.get("embedding_provider", "")
+            _new_model = body.get("embedding_model", "")
+            _new_dim = int(body.get("embedding_dimension", 0) or 0)
+            # The same range the other save route enforces. Without it a
+            # dashboard save with no dimension field stored a width of zero.
+            if _new_dim and not (64 <= _new_dim <= 8192):
+                return JSONResponse(
+                    {"error": f"Dimension must be 64-8192, got {_new_dim}"},
+                    status_code=400,
+                )
+            # The SECOND way to change the embedding model, and it was
+            # unguarded. Switching mode from the dashboard carries the embedding
+            # fields, so a width that the store cannot hold arrived here
+            # untouched while the other route refused it — one door bolted, the
+            # other open.
+            if not bool(body.get("force")):
+                _refusal = _refuse_incompatible_embedding(
+                    config, config.embedding, _new_model, _new_dim,
+                    new_provider=_new_provider,
+                )
+                if _refusal is not None:
+                    return _refusal
             config.embedding = EmbeddingConfig(
-                provider=body.get("embedding_provider", ""),
+                provider=_new_provider,
                 api_endpoint=body.get("embedding_endpoint", ""),
                 api_key=body.get("embedding_key", ""),
-                model_name=body.get("embedding_model", ""),
-                dimension=int(body.get("embedding_dimension", 0) or 0),
+                model_name=_new_model,
+                dimension=_new_dim or _old_emb.dimension,
+                # Not naming these reset them to defaults, so every embedding
+                # save from the dashboard silently put the local model back to
+                # whatever ships — the exact defect the other route had.
+                ollama_model=(
+                    _new_model if _new_provider == "ollama" and _new_model
+                    else _old_emb.ollama_model
+                ),
+                ollama_base_url=_old_emb.ollama_base_url,
+                api_version=_old_emb.api_version,
+                deployment_name=_old_emb.deployment_name,
             )
 
         # When the mode actually changed, apply the new mode's structural presets
@@ -571,6 +643,85 @@ async def get_embedding_config(request: Request):
         return _internal_error()
 
 
+def _refuse_incompatible_embedding(
+    config, old_emb, new_model, new_dim, new_provider=None,
+):
+    """None when the change is safe, otherwise the 409 to return instead.
+
+    Fail-open on anything it cannot determine: a store with no vectors yet, a
+    model server that is not running, an unreadable database. Refusing on
+    "I could not tell" would block a legitimate first-time setup, and the
+    dimension a caller declares is still checked against the store either way.
+    """
+    from fastapi.responses import JSONResponse as _JSON
+
+    try:
+        from superlocalmemory.core.ollama_validator import (
+            EMBEDDING,
+            stored_embedding_dimension,
+            validate_ollama_model,
+        )
+
+        db_path = Path(config.base_dir) / "memory.db"
+        stored = stored_embedding_dimension(db_path)
+        if stored is None:
+            return None
+
+        # The provider being SAVED, falling back to the current one when the
+        # caller is not changing it. Reading only the current provider meant
+        # that SWITCHING to a local model never probed at all — and switching
+        # is exactly when the width changes.
+        effective_provider = (
+            new_provider
+            if new_provider is not None
+            else getattr(old_emb, "provider", "")
+        )
+        measured = None
+        if effective_provider == "ollama" or getattr(old_emb, "provider", "") == "ollama":
+            # The model being SAVED, not the one already configured. Probing the
+            # old one always matched the stored width and therefore always
+            # allowed the change — the guard measured the thing it was not
+            # protecting against.
+            probe = validate_ollama_model(
+                new_model or getattr(old_emb, "ollama_model", ""),
+                EMBEDDING,
+                base_url=getattr(old_emb, "ollama_base_url", "")
+                or "http://localhost:11434",
+            )
+            measured = probe.dimension if probe.ok else None
+
+        declared = int(new_dim or 0)
+        if measured is None and declared <= 0:
+            # Nothing to compare: the server could not be asked and the caller
+            # named no width. Allowing is the fail-open the first-time setup
+            # needs; the other route's probe still guards the common path.
+            return None
+        effective = measured if measured is not None else declared
+        if effective == stored:
+            return None
+
+        return _JSON(
+            {
+                "error": "embedding_width_mismatch",
+                "stored_dimension": stored,
+                "requested_dimension": effective,
+                "model_name": new_model,
+                "detail": (
+                    f"{new_model} produces {effective}-dimensional vectors and "
+                    f"this store holds {stored}-dimensional ones. Vectors of "
+                    f"different widths cannot be compared, so every memory "
+                    f"already stored would become unfindable by meaning. "
+                    f"Rebuild them first with: slm db migrate — or resend with "
+                    f"force=true if they have already been rebuilt."
+                ),
+            },
+            status_code=409,
+        )
+    except Exception:  # noqa: BLE001 - never block a save on the check failing
+        logger.exception("embedding width pre-check failed; allowing the save")
+        return None
+
+
 @router.put("/embedding/config")
 async def set_embedding_config(request: Request):
     """Update embedding configuration independently of mode switch."""
@@ -591,13 +742,34 @@ async def set_embedding_config(request: Request):
         new_key = body.get("api_key", config.embedding.api_key)
 
         old_emb = config.embedding
+
+        # A width that disagrees with what the store already holds is refused
+        # here, at the moment of writing, not merely offered as a check the
+        # caller may or may not have run. Vectors of different widths cannot be
+        # compared, so the store would keep answering similarity questions and
+        # every answer would be noise. ``force=true`` is the escape hatch for
+        # somebody who has already re-embedded.
+        if not bool(body.get("force")):
+            refusal = _refuse_incompatible_embedding(
+                config, old_emb, new_model, new_dim, new_provider=new_provider,
+            )
+            if refusal is not None:
+                return refusal
+
         config.embedding = EmbeddingConfig(
             model_name=new_model,
             dimension=new_dim,
             provider=new_provider,
             api_endpoint=new_endpoint,
             api_key=new_key,
-            ollama_model=old_emb.ollama_model,
+            # In Ollama mode the embedder resolves its model from
+            # ``ollama_model``, so keeping the old value here made a rename a
+            # no-op that still answered "success". A caller naming a model gets
+            # that model.
+            ollama_model=(
+                new_model if new_provider == "ollama" and new_model
+                else old_emb.ollama_model
+            ),
             ollama_base_url=old_emb.ollama_base_url,
             api_version=old_emb.api_version,
             deployment_name=old_emb.deployment_name,
@@ -1018,7 +1190,7 @@ async def recall_trace(request: Request):
     try:
         body = await request.json()
         query = body.get("query", "")
-        limit = body.get("limit", 10)
+        limit = body.get("limit", CANONICAL_RECALL_LIMIT)
         window = body.get("window", "") or ""
         as_of_raw = (body.get("as_of", "") or "").strip()
         raw_known_as_of = body.get("known_as_of", "")
@@ -1073,6 +1245,10 @@ async def recall_trace(request: Request):
                 window=window or None, as_of=_as_of,
                 known_as_of=_known_as_of, valid_at=_valid_at,
                 include_unknown=include_unknown,
+                # Whoever asked, by the name they arrived under. Without a name
+                # the record of this recall is discarded and no outcome
+                # reported afterwards can be matched back to it.
+                session_id=_signal_session_id(),
             ),
         )
         elapsed_ms = round((_time.monotonic() - t0) * 1000, 1)

package/src/superlocalmemory/server/ui.py

@@ -231,14 +231,30 @@ def create_app() -> FastAPI:
                 "<p><a href='/api/docs'>API Documentation</a></p>"
                 "</body></html>"
             )
-        from superlocalmemory.server.asset_versions import render_index
         from superlocalmemory import __version__ as _v
 
         # __SLM_VERSION__ was substituted only by the unified daemon, so the
         # dashboard's upgrade detector did nothing when served from here.
-        return render_index(
-            index_path, UI_DIR, substitutions={"__SLM_VERSION__": _v},
-        )
+        # Asset versioning is cosmetic. It must never be why this page 500s.
+        #
+        # The import is deferred (house style, keeps startup lean), which means
+        # it resolves at REQUEST time — so when `pip install -e .` replaced the
+        # installed package underneath a running daemon, this route began
+        # answering "Internal Server Error" on the dashboard while every other
+        # endpoint was fine. A stale hand-written version string is a trifle; a
+        # blank page is not. Fall back to the file as written.
+        try:
+            from superlocalmemory.server.asset_versions import render_index
+
+            return render_index(
+                index_path, UI_DIR, substitutions={"__SLM_VERSION__": _v},
+            )
+        except Exception as exc:  # noqa: BLE001 — serve the page regardless
+            logger.warning(
+                "asset version rewrite unavailable, serving index.html as "
+                "written: %s: %s", type(exc).__name__, exc,
+            )
+            return index_path.read_text().replace("__SLM_VERSION__", _v)
 
     @application.get("/favicon.ico", include_in_schema=False)
     async def favicon():