feat: analytics parity — tool cost, date ranges, budgets, query explorer, replay, snapshots (v2.4.0)

Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
  Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
  with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
  Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
  its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
  status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
  reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
  ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files

Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.

scripts/import-history.js

@@ -30,6 +30,7 @@ const {
   getTranscriptSnapshotDir,
 } = require("../server/lib/claude-home");
 const { extractFirstUserText } = require("../server/lib/transcript-cache");
+const { isIgnoredCwd } = require("../server/lib/privacy");
 const CLAUDE_DIR = getClaudeHome();
 // The projects dir is read per call, not at load: CLAUDE_HOME can change while
 // the dashboard runs (Settings → Claude Code → Overview).
@@ -562,7 +563,7 @@ function importCompactions(dbModule, sessionId, mainAgentId, compactions) {
   if (!compactions || compactions.length === 0) return 0;
   const { db, stmts } = dbModule;
   const insertEvent = db.prepare(
-    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, ?, trim_event_data(?), ?)"
+    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, redact_text(?), trim_event_data(?), ?)"
   );
   let created = 0;
   for (let i = 0; i < compactions.length; i++) {
@@ -620,7 +621,7 @@ function importSubagents(dbModule, sessionId, mainAgentId, toolUses) {
   if (!toolUses || toolUses.length === 0) return 0;
   const { stmts } = dbModule;
   const insertEvent = dbModule.db.prepare(
-    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, ?, trim_event_data(?), ?)"
+    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, redact_text(?), trim_event_data(?), ?)"
   );
 
   let created = 0;
@@ -679,7 +680,7 @@ function importApiErrors(dbModule, sessionId, mainAgentId, apiErrors) {
   if (!apiErrors || apiErrors.length === 0) return 0;
   const { db } = dbModule;
   const insertEvent = db.prepare(
-    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, ?, trim_event_data(?), ?)"
+    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, redact_text(?), trim_event_data(?), ?)"
   );
   let created = 0;
   for (const err of apiErrors) {
@@ -996,7 +997,7 @@ function importSubagentFromJsonl(dbModule, sessionId, mainAgentId, subData) {
   // importSession level (subagents have their own JSONL with separate usage).
 
   const insertEvent = db.prepare(
-    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, ?, trim_event_data(?), ?)"
+    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, redact_text(?), trim_event_data(?), ?)"
   );
 
   // Spawn marker under the parent (main) agent — only emit once per subagent,
@@ -1185,6 +1186,8 @@ function reconcileSubagentParents(dbModule, sessionId, mainAgentId, parsedSubage
  */
 function importSession(dbModule, session) {
   const { db, stmts } = dbModule;
+  // A folder the user asked AgentHub to ignore (Settings → Privacy).
+  if (isIgnoredCwd(session.cwd)) return { skipped: true };
   const existing = stmts.getSession.get(session.sessionId);
   if (existing) {
     const meta = existing.metadata ? JSON.parse(existing.metadata) : {};
@@ -1192,7 +1195,7 @@ function importSession(dbModule, session) {
 
     const mainAgentId = `${session.sessionId}-main`;
     const insertEvent = db.prepare(
-      "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, ?, trim_event_data(?), ?)"
+      "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, redact_text(?), trim_event_data(?), ?)"
     );
     const importedData = JSON.stringify({ imported: true });
     let backfilled = false;
@@ -1591,7 +1594,7 @@ function importSession(dbModule, session) {
   // Create synthetic events at actual message timestamps so the activity heatmap
   // reflects when work actually happened, not just session start/end.
   const insertEvent = db.prepare(
-    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, ?, trim_event_data(?), ?)"
+    "INSERT INTO events (session_id, agent_id, event_type, tool_name, summary, data, created_at) VALUES (?, ?, ?, ?, redact_text(?), trim_event_data(?), ?)"
   );
   const importedData = JSON.stringify({ imported: true });