memhouse 0.11.2 → 0.12.5

package/README.md

@@ -336,6 +336,11 @@ Deeper reading: `memhouse/DESIGN.md` (the four bets),
 `memhouse/per-member/SCHEMA.md`, `memhouse/delivery/kernel-install.md`,
 `memhouse/COMPETITION.md`.
 
+Deferred designs (captured, not yet built): `docs/design/host-repoint-reconciliation.md`
+— what should happen when the shipper is repointed at a new, empty host (house identity,
+local binding state, and a refuse-then-`init-here` gate so transcripts never land on the
+wrong server).
+
 In constellation terms (`TERMINOLOGY.md`) memhouse is an **agency**: a **house**
 — the `mem` database — plus a **resident** working in it, the shipper. The house
 alone would hold; the shipper is what makes it act. It competes with

package/bin/memhouse.js

@@ -141,18 +141,21 @@ function writeEnvFile(cfg) {
 }
 
 // ── ClickHouse over HTTP (small read-only queries; heavy ops go via ship.js) ───
-async function ch(cfg, sql, { database = cfg.db, settings = null } = {}) {
+async function ch(cfg, sql, { database = cfg.db, settings = null, timeout = 30000 } = {}) {
   // Both settings, always: `final` collapses ReplacingMergeTree versions, and
   // `join_use_nulls` is what the session rollup's coalesce depends on now that it is a
   // saved query rather than a view carrying its own SETTINGS clause.
   const params = new URLSearchParams({ final: '1', join_use_nulls: '1' });
   for (const [k, v] of Object.entries(settings || {})) params.set(k, String(v));
   if (database) params.set('database', database);
+  // Most CLI queries are small reads and 30s is plenty; a `relocate` copy of a whole room
+  // runs server-side but the HTTP response only returns when it FINISHES, so a large
+  // transfer needs a far longer ceiling — passed per call rather than raised for all.
   const res = await fetch(`${cfg.url.replace(/\/$/, '')}/?${params}`, {
     method: 'POST',
     body: sql,
     headers: { Authorization: 'Basic ' + Buffer.from(`${cfg.user}:${cfg.password}`).toString('base64') },
-    signal: AbortSignal.timeout(30000),
+    signal: AbortSignal.timeout(timeout),
   });
   const text = await res.text();
   if (!res.ok) throw new Error(text.trim().split('\n')[0]);
@@ -369,6 +372,12 @@ House        deploy --local       run ClickHouse in docker/podman, then install
              migrate              run every migration this house still needs
                                   [--dry-run] [--yes]  (copy + atomic swap; deletes nothing)
              migrate-rooms        the same, scoped to the rooms
+             relocate --to URL    copy this whole house to a NEW ClickHouse (server-to-
+                                  server) and repoint this install — the shipper does NOT
+                                  re-ingest. [--to-user --to-password --to-db]
+                                  [--from-native-host H] [--from-native-port N]
+                                  [--insecure-native] [--keep-shipper] [--dry-run] [--yes].
+                                  Source untouched.
              service install      run the shipper as a user service (systemd / launchd)
              service stop | start | restart | uninstall | status
 
@@ -867,6 +876,40 @@ async function sortingKeyProblem(cfg) {
   } catch { return null; }  // unreachable house is a different check's problem
 }
 
+// Start the shipper as a BACKGROUND daemon instead of blocking install on a full first
+// pass. A fresh member's first ship loads the ENTIRE local backlog — yigido's was 558
+// sessions / 224s — and running it synchronously (the old `run(SHIP_JS)`) made `install`
+// sit silent for minutes and read as hung. Detached, install returns at once, the history
+// loads in the background, and the loop keeps shipping. Mirrors cmdStart's shipper daemon,
+// and defers to an installed service rather than running a second shipper beside it.
+//
+// Must be called AFTER finishInvite: rotation rewrites the env file, so the daemon has to
+// be spawned from a RE-READ config (resolveConfig()) or it would carry the old password.
+function startShipperBackground(cfg) {
+  let svc = { installed: false, running: false };
+  try { svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).status(); } catch { /* unsupported platform */ }
+  if (svc.installed) {
+    console.log(svc.running
+      ? ok('shipping runs under the installed service — nothing to start')
+      : warn('a shipper service is installed but stopped — start it:  memhouse service start'));
+    return;
+  }
+  const existing = pidOf('shipper');
+  if (existing) { console.log(ok(`shipper already running in the background (pid ${existing})`)); return; }
+  fs.mkdirSync(RUN_DIR, { recursive: true });
+  fs.mkdirSync(LOG_DIR, { recursive: true });
+  const logPath = path.join(LOG_DIR, 'shipper.log');
+  const log = fs.openSync(logPath, 'a');
+  const child = spawn(process.execPath, [SHIP_JS, '--loop', String(flags.interval || 300)], {
+    env: childEnv(cfg), detached: true, stdio: ['ignore', log, log],
+  });
+  fs.writeFileSync(path.join(RUN_DIR, 'shipper.pid'), String(child.pid));
+  child.unref();
+  console.log(ok(`shipper started in the background (pid ${child.pid}) — loading your history now`));
+  console.log('  a large first ship can take a few minutes; watch it finish with:  memhouse status');
+  console.log('  dashboard (browse / search / analyze):  memhouse start');
+}
+
 async function cmdInstall({ interactive }) {
   // --env <file>: an INVITE intake. The file carries MEMHOUSE_URL/USER/PASSWORD/DB from
   // `memhouse invite` on the admin's machine; loading it into the environment BEFORE
@@ -962,12 +1005,14 @@ async function cmdInstall({ interactive }) {
       console.log(ok(`host identity: ${me.id}`));
       console.log(`  every machine you install as '${cfg.user}' writes into the same rooms; this is what tells them apart`);
     }
-    if (flags['no-ship'] !== true && run(SHIP_JS, [], cfg) !== 0) return 1;
     console.log(ok('installed'));
     console.log('  adding a housemate later is two statements for the admin:');
     console.log(`     CREATE USER <name> IDENTIFIED BY '…';  GRANT ALL ON ${cfg.db}.* TO <name>;`);
     printGettingStarted(cfg);
     await finishInvite(cfg);
+    // The first ship loads the whole backlog; do it in the background so install returns
+    // now. resolveConfig() re-reads the env file finishInvite may have just rotated.
+    if (flags['no-ship'] !== true) startShipperBackground(resolveConfig());
     return 0;
   }
 
@@ -1118,12 +1163,11 @@ async function cmdInstall({ interactive }) {
     console.log(ok(`host identity: ${me.id}`));
     console.log(`  every machine you install as '${cfg.user}' writes into the same rooms; this is what tells them apart`);
   }
-  if (flags['no-ship'] !== true) {
-    if (run(SHIP_JS, [], cfg) !== 0) return 1;
-  }
   console.log(ok('installed'));
   printGettingStarted(cfg);
   await finishInvite(cfg);
+  // Background first ship — same reasoning as the invite branch above.
+  if (flags['no-ship'] !== true) startShipperBackground(resolveConfig());
   return 0;
 }
 
@@ -2010,6 +2054,30 @@ async function cmdUpdate() {
   }
   console.log(ok('files updated'));
 
+  // Refresh the Claude plugin wherever it is ALREADY installed, so `update` keeps the
+  // skills in lockstep with the package instead of leaving a stale `/mem:*` behind. Only
+  // dirs that already have it are touched — update never installs the plugin somewhere new.
+  // The files copied are the ones npm/git just put on disk; the manifest is stamped with
+  // the FRESH package version read off disk (this process still runs the pre-upgrade code,
+  // so its in-memory PKG.version is a release behind).
+  try {
+    let fresh = PKG.version;
+    try { fresh = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'package.json'), 'utf-8')).version || fresh; } catch { /* keep in-memory */ }
+    const installed = claudeTargets().filter((t) => isPluginInstalled(t.dir));
+    for (const t of installed) {
+      const dst = installPluginInto(t.dir);
+      try {
+        const mf = path.join(dst, '.claude-plugin', 'plugin.json');
+        const m = JSON.parse(fs.readFileSync(mf, 'utf-8'));
+        if (m.version !== fresh) { m.version = fresh; fs.writeFileSync(mf, `${JSON.stringify(m, null, 2)}\n`); }
+      } catch { /* leave the stamp installPluginInto wrote */ }
+      console.log(ok(`plugin refreshed in ${short(t.dir)}`));
+    }
+    if (installed.length) console.log('  reload it in Claude Code:  /reload-plugins  (or restart the session)');
+  } catch (e) {
+    console.log(warn(`could not refresh Claude plugins: ${e.message.split('\n')[0]}`));
+  }
+
   // Restarting is the half a bare `npm i -g` leaves undone. The daemons notice on their own
   // within a loop interval (memhouse/self-update.js), but a pilot who typed `update` should
   // not have to wait for it, and the dashboard's stale bundle is visible immediately.
@@ -2171,6 +2239,17 @@ function installPluginInto(dir) {
   }
   fs.mkdirSync(dst, { recursive: true });
   fs.cpSync(path.join(DELIVERY, 'plugin'), dst, { recursive: true });
+  // Stamp the manifest with THIS memhouse's version. The source plugin.json carries a
+  // FROZEN number — it sat at 0.11.0 through several releases, so every install
+  // advertised the wrong version (`memhouse --version` said one thing, the plugin
+  // another). The package version is the single truth; write it into the copy.
+  try {
+    const m = JSON.parse(fs.readFileSync(dstManifest, 'utf-8'));
+    if (m.version !== PKG.version) {
+      m.version = PKG.version;
+      fs.writeFileSync(dstManifest, `${JSON.stringify(m, null, 2)}\n`);
+    }
+  } catch { /* manifest unreadable — leave the copied one rather than guess */ }
   return dst;
 }
 
@@ -2523,6 +2602,211 @@ async function cmdMigrate({ component = null, quiet = false, assumeYes = false }
   return 0;
 }
 
+/**
+ * `memhouse relocate --to <url>` — copy a whole house to a NEW ClickHouse, server-to-
+ * server, then repoint this install at it. The point is to move WITHOUT the shipper
+ * re-ingesting: once the new host holds a faithful copy, the shipper's skip predicate
+ * sees every old session already present and ships only genuinely new work.
+ *
+ * The copy is a ClickHouse remoteSecure() INSERT SELECT — the destination pulls each room
+ * directly from the source over the native protocol; the pilot's laptop is never in the
+ * data path. Provenance is carried, not restamped (insert_allow_materialized_columns=1),
+ * exactly as `migrate`'s rebuildRoom does, so a shared house keeps every member's user_id.
+ *
+ * Nothing on the SOURCE is touched — relocate only reads it and only writes the
+ * destination and the local env file, so a failed run leaves the old house intact.
+ *
+ * SECURITY: the source password is spliced into the remoteSecure() call, which runs on
+ * the DESTINATION and lands in ITS query_log. Two consequences, both stated to the pilot:
+ * it never touches THIS transcript (the SQL is never printed), but rotate the source
+ * credential afterward if the destination's logs are not yours to trust.
+ *
+ * Flags: --to (required), --to-user/--to-password/--to-db (default: the source's),
+ * --from-native-port (default 9440), --insecure-native (remote()+9000, no TLS),
+ * --keep-shipper (don't stop it for the copy), --dry-run, --yes.
+ */
+async function cmdRelocate() {
+  const rel = require(path.join(REPO_ROOT, 'memhouse', 'house', 'relocate.js'));
+  const house = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
+  const stated = (f) => flags[f] !== undefined && flags[f] !== true;
+
+  const to = flags.to;
+  if (!to || to === true) { console.log(bad('relocate needs a destination:  memhouse relocate --to <url>')); return 1; }
+  const src = requireConfig(resolveConfig(), 'relocate');
+  const dest = {
+    url: to,
+    user: stated('to-user') ? flags['to-user'] : src.user,
+    password: stated('to-password') ? flags['to-password'] : src.password,
+    db: stated('to-db') ? flags['to-db'] : src.db,
+    port: src.port, stated: true,
+  };
+  if (sameEndpoint(src.url, dest.url)) {
+    console.log(bad(`source and destination are the same server (${dest.url}) — nothing to relocate`)); return 1;
+  }
+  for (const [n, who] of [[src.db, 'source house'], [dest.db, 'destination house']]) {
+    try { house.assertUsableName(n, who); } catch (e) { console.log(bad(e.message)); return 1; }
+  }
+
+  const sq = (s) => `'${String(s).replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+  const bq = (s) => `\`${String(s).replace(/`/g, '``')}\``;
+  const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl'), 'utf-8');
+  let nat;
+  try {
+    nat = rel.nativeEndpoint(src.url, {
+      host: stated('from-native-host') ? flags['from-native-host'] : null,
+      port: stated('from-native-port') ? flags['from-native-port'] : null,
+      insecure: flags['insecure-native'] === true,
+    });
+  } catch (e) { console.log(bad(e.message)); return 1; }
+
+  const countFinal = async (cfg, t) => Number((await chRows(cfg, `SELECT count() AS c FROM ${bq(t)}`, { database: cfg.db }))[0]?.c || 0);
+
+  // ── preflight: source reachable, current schema, and its counts ──────────────────
+  let srcMember;
+  try { srcMember = (await chRows(src, 'SELECT currentUser() AS u', { database: '' }))[0]?.u; }
+  catch (e) { console.log(bad(`source not reachable: ${netReason(e)}`)); return 1; }
+  try {
+    const rec = await chRows(src, "SELECT value FROM house_meta FINAL WHERE key = 'schema_version'", { database: src.db });
+    const v = rec.length ? Number(rec[0].value) || 0 : 0;
+    if (v !== SCHEMA_VERSION) {
+      console.log(bad(`source house is at schema ${v || 'pre-record'}; this memhouse is ${SCHEMA_VERSION}.`));
+      console.log('  Migrate the source first, then relocate:  memhouse migrate');
+      return 1;
+    }
+  } catch {
+    console.log(bad('source house has no house_meta — migrate it first:  memhouse migrate'));
+    return 1;
+  }
+  const base = {};
+  for (const t of ROOM_TYPES) base[t] = await countFinal(src, t);
+
+  // ── preflight: destination reachable ─────────────────────────────────────────────
+  let destMember;
+  try { destMember = (await chRows(dest, 'SELECT currentUser() AS u', { database: '' }))[0]?.u; }
+  catch (e) { console.log(bad(`destination not reachable: ${netReason(e)}`)); return 1; }
+
+  console.log(`  relocate  ${src.user}@${new URL(src.url).host} (house '${src.db}')`);
+  console.log(`        ->  ${dest.user}@${new URL(dest.url).host} (house '${dest.db}')`);
+  console.log(`  source rooms: sessions ${base.sessions}, messages ${base.messages}, tool_calls ${base.tool_calls}`);
+  console.log(`  copy transport: ${nat.fn}(${nat.addr})  [source password never printed]`);
+
+  if (flags['dry-run'] === true) {
+    console.log(warn('dry run — nothing was created, copied, or repointed'));
+    return 0;
+  }
+  if (flags.yes !== true) {
+    const a = (await ask(`Copy this house to ${new URL(dest.url).host} and repoint this install? (yes/no)`, 'no')).toLowerCase();
+    if (a !== 'yes' && a !== 'y') return console.log('aborted'), 1;
+  }
+
+  // ── freeze the source shipper (best-effort) ──────────────────────────────────────
+  let restart = null;
+  const health = shipperHealth();
+  if (health.running && flags['keep-shipper'] !== true) {
+    if (String(health.via || '').startsWith('service')) {
+      const svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js'));
+      const st = svc.status();
+      const stop = st.kind === 'systemd'
+        ? ['systemctl', ['--user', 'stop', 'memhouse-shipper']]
+        : ['launchctl', ['bootout', `gui/${process.getuid()}/com.memhouse.shipper`]];
+      const r = spawnSync(stop[0], stop[1], { stdio: 'pipe', encoding: 'utf-8' });
+      if (r.status === 0) { console.log(ok('shipper stopped for the copy')); restart = { kind: 'service', st }; }
+      else console.log(warn(`could not stop the shipper (${(r.stderr || '').trim().split('\n')[0] || 'exit ' + r.status}); continuing — late writes dedupe`));
+    } else {
+      const pid = pidOf('shipper');
+      if (pid) { try { process.kill(pid, 'SIGTERM'); console.log(ok(`shipper daemon stopped (pid ${pid})`)); restart = { kind: 'daemon' }; } catch { /* raced */ } }
+    }
+  }
+
+  try {
+    // ── schema on the destination (no ingest) ──────────────────────────────────────
+    await ch(dest, `CREATE DATABASE IF NOT EXISTS ${bq(dest.db)}`, { database: '' });
+    for (const t of [...META_TYPES, ...ROOM_TYPES]) {
+      await ch(dest, createStatement(tpl, t, t).replace('CREATE TABLE ', 'CREATE TABLE IF NOT EXISTS '),
+        { database: dest.db, settings: { allow_experimental_full_text_index: 1 } });
+    }
+    const destBefore = await countFinal(dest, 'messages');
+    if (destBefore > 0 && flags.yes !== true) {
+      console.log(warn(`destination already holds ${destBefore} messages — copy is idempotent (ReplacingMergeTree dedupes), continuing`));
+    }
+
+    // ── probe native reachability BEFORE the big copy (never logs the password) ─────
+    const probe = `SELECT count() AS c FROM ${nat.fn}(${sq(nat.addr)}, ${sq(src.db)}, 'sessions', ${sq(src.user)}, ${sq(src.password)})`;
+    try { await chRows(dest, probe, { database: dest.db, timeout: 60000 }); }
+    catch (e) {
+      console.log(bad(`the destination cannot reach the source over ${nat.fn} at ${nat.addr}: ${netReason(e)}`));
+      console.log('  open the source native port (default 9440 TLS), or pass --from-native-port / --insecure-native.');
+      throw new Error('relocate-preflight');
+    }
+
+    // ── copy each table, provenance carried ────────────────────────────────────────
+    for (const t of [...ROOM_TYPES, ...META_TYPES]) {
+      const destCols = (await chRows(dest, `SELECT name FROM system.columns WHERE database = ${sq(dest.db)} AND table = ${sq(t)}`, { database: dest.db })).map((r) => r.name);
+      const srcCols = (await chRows(src, `SELECT name FROM system.columns WHERE database = ${sq(src.db)} AND table = ${sq(t)}`, { database: src.db })).map((r) => r.name);
+      const cols = rel.copyColumns(destCols, srcCols);
+      if (!cols.length) { console.log(warn(`${t}: no shared columns — skipped`)); continue; }
+      const list = cols.map(bq).join(', ');
+      // house_meta carries only durable facts; the per-host heartbeats regenerate.
+      const where = t === 'house_meta'
+        ? " WHERE key IN ('schema_version','min_writer_schema','house_id') OR key LIKE 'share:%'" : '';
+      const copySql = `INSERT INTO ${bq(t)} (${list}) SELECT ${list} FROM ${nat.fn}(${sq(nat.addr)}, ${sq(src.db)}, ${sq(t)}, ${sq(src.user)}, ${sq(src.password)})${where}`
+        + ' SETTINGS insert_allow_materialized_columns = 1, allow_experimental_full_text_index = 1';
+      await ch(dest, copySql, { database: dest.db, timeout: 3600000 });
+      console.log(ok(`${t}: copied`));
+    }
+
+    // ── verify — the hard gate before repointing ───────────────────────────────────
+    let allGood = true;
+    for (const t of ROOM_TYPES) {
+      const d = await countFinal(dest, t);
+      const good = d >= base[t];
+      console.log((good ? ok : bad)(`${t}: source ${base[t]} -> dest ${d}`));
+      if (!good) allGood = false;
+    }
+    if (!allGood) {
+      console.log(bad('row counts do not match — NOT repointing. The source is untouched; inspect the destination.'));
+      throw new Error('relocate-verify');
+    }
+
+    // ── repoint the local config (old env kept alongside) ──────────────────────────
+    try { fs.copyFileSync(ENV_FILE, `${ENV_FILE}.pre-relocate`); console.log(ok(`previous config kept at ${`${ENV_FILE}.pre-relocate`.replace(os.homedir(), '~')}`)); }
+    catch { /* no prior env file — first config */ }
+    writeEnvFile(dest);
+    console.log(ok(`config repointed to ${dest.url} (house '${dest.db}')`));
+  } catch (e) {
+    if (!['relocate-preflight', 'relocate-verify'].includes(e.message)) console.log(bad(`relocate failed: ${e.message.split('\n')[0]}`));
+    console.log(warn('the SOURCE house was not touched — your data is safe there.'));
+    if (restart) console.log(warn('the shipper was stopped; restart it:  memhouse service start   (or  memhouse start)'));
+    return 1;
+  }
+
+  // ── restart the shipper against the new host ─────────────────────────────────────
+  if (restart) {
+    if (restart.kind === 'service') {
+      const st = restart.st;
+      const start = st.kind === 'systemd'
+        ? ['systemctl', ['--user', 'start', 'memhouse-shipper']]
+        : ['launchctl', ['bootstrap', `gui/${process.getuid()}`, st.path]];
+      const r = spawnSync(start[0], start[1], { stdio: 'pipe', encoding: 'utf-8' });
+      console.log(r.status === 0 ? ok('shipper restarted — now writing to the new host')
+        : warn('restart the shipper yourself:  memhouse service start'));
+    } else {
+      console.log(warn('restart the shipper to pick up the new host:  memhouse start  (or  memhouse service start)'));
+    }
+  } else if (shipperHealth().running) {
+    console.log(warn('a shipper is still running against the OLD host — restart it to pick up the new config.'));
+  }
+
+  console.log('');
+  console.log(ok('relocate complete.'));
+  console.log('  the shipper will NOT re-ingest: every copied session is already present, so its');
+  console.log('  skip predicate ships only new work from here.');
+  console.log('  verify:  memhouse status');
+  console.log('  keep the OLD house until you are satisfied, then decommission it.');
+  if (!flags['insecure-native']) console.log(warn('the source password reached the destination server (its query_log) — rotate it if those logs are not yours to trust.'));
+  return 0;
+}
+
 /**
  * `memhouse nightly [--out DIR]` — build an installable, version-stamped tarball from
  * this checkout, without publishing anything.
@@ -3011,6 +3295,7 @@ async function cmdUninstall() {
     case 'nightly': process.exitCode = await cmdNightly(); break;
     case 'migrate': process.exitCode = await cmdMigrate({}); break;
     case 'migrate-rooms': process.exitCode = await cmdMigrate({ component: 'rooms' }); break;
+    case 'relocate': process.exitCode = await cmdRelocate(); break;
     case 'deploy': {
       const dep = require(path.join(REPO_ROOT, 'memhouse', 'deploy.js'));
       if (flags.down) {

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: ask, search, browse, analyze, check, share, and invite across all 17 supported editors and machines. Skills install as /mem:hello, /mem:ask, /mem:search, /mem:sessions, /mem:share, /mem:invite, /mem:sql, /mem:status, and /mem:users.",
-  "version": "0.11.0",
+  "version": "0.12.5",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/delivery/plugin/skills/ask/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ask
-description: Answer a question FROM conversation memory — retrieve the relevant past sessions out of the memhouse ClickHouse store, read the actual transcripts, and synthesize an answer with citations. Use when the user asks something their past work already answered, e.g. "how did I fix X last time", "what approach did we settle on for Y", "why did we choose Z", "have I solved this error before", "what did the reviewer say about W". This is the retrieve-and-answer skill; /mem:search is find-the-session, /mem:sql is run-a-query.
+description: Answer a question FROM conversation memory — retrieve the relevant past sessions out of the memhouse ClickHouse store, read the actual transcripts, and synthesize an answer with citations. Use when the user asks something their past work already answered, e.g. "how did I fix X last time", "what approach did we settle on for Y", "why did we choose Z", "have I solved this error before", "what did the reviewer say about W". Also answers from a friend's house shared with you when they name it ("how did yigit fix X", "ask yigit's memory"). This is the retrieve-and-answer skill; /mem:search is find-the-session, /mem:sql is run-a-query.
 user-invocable: true
 argument-hint: "<question about past work>"
 allowed-tools: Bash
@@ -39,7 +39,7 @@ if [ -z "${MEMHOUSE_URL:-}" ] || [ -z "${MEMHOUSE_USER:-}" ]; then
 fi
 
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT JSONEachRow
 SQL
@@ -47,6 +47,25 @@ SQL
 
 `readonly=1` is pinned on every request: this skill never writes.
 
+## Answering from another person's house (shared with you)
+
+The house is a ClickHouse database; a share is a read-only GRANT on it. When the user asks
+about a FRIEND's memory — "how did yigit fix X", "in yigit's house", "ask yigit's memory",
+"from yigit" — answer from THEIR house without changing your credentials:
+
+1. **Resolve the house.** `SHOW DATABASES` returns what your credential may read; a name
+   that is not `system` / `information_schema` / `default` and not your own `$MEMHOUSE_DB`
+   is a house shared with you. Match the named person to one; set `HOUSE=yigit`. With no
+   house named, `HOUSE=$MEMHOUSE_DB`.
+2. **Point the connection at it:** replace `database=${MEMHOUSE_DB:-$MEMHOUSE_USER}` with
+   `database=<HOUSE>` in the recipe above. The rooms (`messages`, `sessions`) resolve by
+   the connection's database, so retrieval, the transcript read, and the citation all run
+   against that house — leave the table names bare.
+3. **Cite the house.** Say whose memory the answer came from ("from yigit's house") so the
+   user never mistakes a friend's session for their own.
+4. **Read-only, thin by design.** A refused SELECT means the house was not shared with you
+   (or the share was revoked) — say so; never guess another database.
+
 ## The method — retrieve, read, answer, cite
 
 **Escaping, before anything touches SQL.** Search terms, session ids and user ids are

package/memhouse/delivery/plugin/skills/hello/SKILL.md

@@ -26,7 +26,7 @@ set -a; [ -f "$MH_ENV" ] && . "$MH_ENV"; set +a
 if [ -n "${MEMHOUSE_URL:-}" ] && [ -n "${MEMHOUSE_USER:-}" ]; then
   curl -sS -m 5 --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
     --data-binary "SELECT uniqExact(session_id), count(), formatDateTime(min(ts),'%Y-%m-%d') FROM messages" \
-    "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&readonly=1" 2>&1
+    "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&readonly=1" 2>&1
 else
   echo "NOT_CONFIGURED"
 fi
@@ -92,6 +92,12 @@ And around other people — **inviting comes before sharing**:
   hand them one env file; they install with it and have their own memory
 - `/mem:share <name>` — once they exist, open a read-only window into YOUR memory
   (`/mem:share revoke <name>` closes it); `/mem:users` shows who's around
+- **Read a friend's shared memory** — once they've shared theirs with you, name their
+  house right in the question: `/mem:ask <question> in <their-house>`, or
+  `/mem:search <terms> in <their-house>` / `/mem:sql … on <their-house>`. It reads THEIR
+  house read-only, with your own credentials; `/mem:users` lists the houses shared with
+  you. (A house is a whole ClickHouse database — sharing grants read on it, not on single
+  sessions.)
 
 Also worth naming: `memhouse start` serves a dashboard at http://localhost:4640 for
 browsing and analytics outside the chat, and everything here is read-only for agents —

package/memhouse/delivery/plugin/skills/search/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: search
-description: Full-text search across ALL shipped agent conversations — every session from all 17 supported editors (Claude Code, Codex, Cursor, VS Code, Zed, OpenCode, Gemini CLI, …), every project, every machine — stored in the memhouse ClickHouse. Use whenever the user refers to something from the past that isn't in the current context, e.g. "what did I say about X", "find that conversation about Y", "when did I work on Z", "did I ever try W", "the chat where we discussed it", "remind me how I did it". Reach for this before saying you don't know about prior work.
+description: Full-text search across ALL shipped agent conversations — every session from all 17 supported editors (Claude Code, Codex, Cursor, VS Code, Zed, OpenCode, Gemini CLI, …), every project, every machine — stored in the memhouse ClickHouse. Use whenever the user refers to something from the past that isn't in the current context, e.g. "what did I say about X", "find that conversation about Y", "when did I work on Z", "did I ever try W", "the chat where we discussed it", "remind me how I did it". Searches your own house by default, or a friend's house shared with you when they name it ("find X in yigit's memory"). Reach for this before saying you don't know about prior work.
 user-invocable: true
 argument-hint: "<search terms> [in <project>] [last <N> days] [from <editor>]"
 allowed-tools: Bash
@@ -50,7 +50,7 @@ fi
 # in 50 samples). What actually leaks a credential is PRINTING it, which the rule above
 # covers.
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL
@@ -142,9 +142,32 @@ LIMIT 10
 FORMAT PrettyCompact
 ```
 
+## Reading another person's house (shared with you)
+
+Every house is its own ClickHouse database on the same server; a share is a read-only
+GRANT on that database. To read a friend's memory you keep YOUR credentials and point the
+connection at THEIR house — the rooms (`messages`, `sessions`, `tool_calls`) resolve by
+the connection's `database`, so one change redirects every query in this skill.
+
+1. **Resolve the target house.** `SHOW DATABASES` lists what your credential may read; the
+   names that are not `system` / `information_schema` / `default` and not your own
+   `$MEMHOUSE_DB` are houses shared with you. If the user names one — "yigit's memory",
+   "in yigit", "house yigit", "from yigit" — set `HOUSE=yigit`; otherwise leave
+   `HOUSE=$MEMHOUSE_DB`.
+2. **Point the connection at it:** in the recipe above, replace
+   `database=${MEMHOUSE_DB:-$MEMHOUSE_USER}` with `database=<HOUSE>`. Leave the table names bare —
+   they resolve to that house. Nothing else in the query changes.
+3. **A house wins over `in <project>`.** A name that matches a readable house is a HOUSE,
+   not a project filter — otherwise "in yigit" silently filters YOUR house's project
+   column and returns nothing. If a real project in your own house shares the name, keep
+   the possessive ("<name>'s memory") or say "project <name>" to force the project reading.
+4. **Read-only, thin by design.** If the SELECT is refused, that house was not shared with
+   you (or the share was revoked) — say so; never guess another database.
+
 ## Qualifiers
 
-- `in <project>` → `AND m.project ILIKE '%<project>%'`
+- `in <project>` → `AND m.project ILIKE '%<project>%'` — but a name matching a readable
+  house is a HOUSE (see above), not a project.
 - `last N days` → `AND m.ts > now() - INTERVAL N DAY`
 - `from <editor>` → `AND m.source = '<id>'` (ids: `claude-code`, `codex`,
   `cursor`, `cursor-agent`, `vscode`, `zed`, `opencode`, `gemini-cli`,

package/memhouse/delivery/plugin/skills/sessions/SKILL.md

@@ -57,7 +57,7 @@ fi
 # in 50 samples). What actually leaks a credential is PRINTING it, which the rule above
 # covers.
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL

package/memhouse/delivery/plugin/skills/share/SKILL.md

@@ -39,7 +39,7 @@ fi
 # NO readonly=1 on this skill's grant/revoke calls — GRANT is refused under readonly.
 # The list query below still pins it.
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}" <<'SQL'
 <the statement>
 SQL
 ```

package/memhouse/delivery/plugin/skills/sql/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: sql
-description: Run free-form read-only SQL against memhouse conversation memory (typed sessions/messages/tool_calls tables on ClickHouse, shared by the house). Use for ad-hoc analytics the other memhouse skills don't cover — token spend, model/editor usage, tool rankings, activity heatmaps, busiest days/projects, cache-hit ratios, or any custom question over conversation data.
+description: Run free-form read-only SQL against memhouse conversation memory (typed sessions/messages/tool_calls tables on ClickHouse, shared by the house). Use for ad-hoc analytics the other memhouse skills don't cover — token spend, model/editor usage, tool rankings, activity heatmaps, busiest days/projects, cache-hit ratios, or any custom question over conversation data — over your own house, or a friend's house shared with you when they name it.
 user-invocable: true
 argument-hint: "<question or SQL>"
 allowed-tools: Bash
@@ -84,7 +84,7 @@ fi
 # in 50 samples). What actually leaks a credential is PRINTING it, which the rule above
 # covers.
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL
@@ -100,6 +100,16 @@ writes into the same tables; `user_id` (stamped by the server) says whose row it
 `host` says which machine shipped it. Filter with `WHERE user_id = '<name>'` when you want
 one person, or leave it off for the whole house.
 
+**Another person's house (shared with you).** A house is a database; a share is a
+read-only GRANT on it. Because the rooms resolve by the connection's database, you read a
+friend's memory by pointing the connection at THEIR house — same credentials, different
+`database`. `SHOW DATABASES` lists what you may read; a name that is not `system` /
+`information_schema` / `default` and not your own `$MEMHOUSE_DB` is a house shared with
+you. When the user names one ("query yigit's house", "on yigit", "from yigit"), replace
+`database=${MEMHOUSE_DB:-$MEMHOUSE_USER}` with `database=<house>` in the connection recipe and leave
+the table names bare — or, to join across houses in one query, qualify tables explicitly
+(`yigit.messages`). Read-only: a refused SELECT means that house was not shared with you.
+
 **Keep the SQL heredoc quoted (`<<'SQL'`).** This skill once told the agent to substitute
 a shell variable into the table names, which cannot expand inside a quoted heredoc — so
 the agent unquotes it, and then the SEARCH TERMS expand too. Both instances driving this

package/memhouse/delivery/plugin/skills/status/SKILL.md

@@ -36,7 +36,7 @@ if [ -z "${MEMHOUSE_URL:-}" ] || [ -z "${MEMHOUSE_USER:-}" ]; then
 fi
 
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL

package/memhouse/delivery/plugin/skills/users/SKILL.md

@@ -37,7 +37,7 @@ if [ -z "${MEMHOUSE_URL:-}" ] || [ -z "${MEMHOUSE_USER:-}" ]; then
 fi
 
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL

package/memhouse/house/relocate.js

@@ -0,0 +1,59 @@
+// Pure helpers for `memhouse relocate` — the host-to-host copy that moves a whole house
+// to a new ClickHouse and repoints the shipper, WITHOUT the shipper re-ingesting from
+// local session files. The orchestration lives in bin/memhouse.js (cmdRelocate); the
+// transport-free, side-effect-free decisions live here so they can be unit-tested.
+//
+// See docs/design/host-repoint-reconciliation.md for the wider design this is one piece
+// of. Relocate is the "data does follow the pointer, on purpose" path.
+
+// The two room columns that are MATERIALIZED and DERIVED from `text` — the lowercased,
+// text-indexed copies. They are recomputed by the destination table's own expression on
+// INSERT, so they are never carried across; carrying them would also fail, since they are
+// not insertable even with insert_allow_materialized_columns.
+const DERIVED = ['text_ngram', 'text_word'];
+
+// house_meta keys that are DURABLE facts of the house — worth carrying to the new host.
+// Everything else in house_meta is a per-host heartbeat (client_version, client_schema,
+// last_ship:<writer>) that the new shipper rewrites for itself on its first run; carrying
+// a stale one would misreport which machine last shipped until that run lands.
+function isDurableMetaKey(key) {
+  return key === 'schema_version'
+    || key === 'min_writer_schema'
+    || key === 'house_id'            // forward-compat: harmless if absent today
+    || /^share:/.test(key);
+}
+
+/**
+ * The columns to carry when copying `srcTable` into `destTable`, given both sides' column
+ * lists. The intersection (a column the destination lacks cannot be written; one the
+ * source lacks cannot be read) minus the derived pair. Order follows the destination, so
+ * the SELECT and INSERT lists line up positionally.
+ */
+function copyColumns(destCols, srcCols) {
+  const src = new Set(srcCols);
+  return destCols.filter((c) => src.has(c) && !DERIVED.includes(c));
+}
+
+/**
+ * Resolve the ClickHouse NATIVE endpoint to read the source house from, given its HTTP(S)
+ * URL. remoteSecure()/remote() speak the native TCP protocol, NOT HTTP — a different port
+ * from the one in MEMHOUSE_URL. Secure (TLS) native defaults to 9440; plain to 9000.
+ *
+ * @param url        the source MEMHOUSE_URL (http(s)://host:8123)
+ * @param opts.host  override the host — the DESTINATION's route to the source may differ
+ *                   from the pilot's URL (NAT, split-horizon DNS, a private peering name)
+ * @param opts.port  override the native port
+ * @param opts.insecure  use remote() + plain 9000 instead of remoteSecure() + 9440
+ * @returns { fn: 'remoteSecure'|'remote', host, port, addr: 'host:port' }
+ */
+function nativeEndpoint(url, { host = null, port = null, insecure = false } = {}) {
+  if (!host) {
+    try { host = new URL(url).hostname; } catch { throw new Error(`source URL is not a URL: ${url}`); }
+  }
+  if (!host) throw new Error(`source URL has no host: ${url}`);
+  const fn = insecure ? 'remote' : 'remoteSecure';
+  const p = String(port || (insecure ? 9000 : 9440));
+  return { fn, host, port: p, addr: `${host}:${p}` };
+}
+
+module.exports = { DERIVED, isDurableMetaKey, copyColumns, nativeEndpoint };

package/memhouse/shipper/ship.js

@@ -9,8 +9,9 @@
 // columns instead of a raw JSON blob.
 //
 // Data-plane rules (binding, see DESIGN.md):
-//   - JSONEachRow, batches <= 2000 rows, async_insert=0 on EVERY insert — the house
-//     stamps user_id MATERIALIZED currentUser(), which is empty during async flushes.
+//   - JSONEachRow, gzip-compressed request body, batches capped at 2000 rows OR ~4 MB
+//     (whichever first), async_insert=0 on EVERY insert — the house stamps user_id
+//     MATERIALIZED currentUser(), which is empty during async flushes.
 //   - DateTime64 values travel as 'YYYY-MM-DD HH:MM:SS.mmm' UTC strings (plain
 //     format; ISO 'T'/'Z' forms parse unreliably under JSONEachRow). Nullable → null.
 //   - Int64-bound values are integer-coerced (some adapters emit fractional ms).
@@ -68,7 +69,12 @@ const {
 // house_events would otherwise roll out to nobody.
 const ALL_TABLES = [...ROOM_TYPES, ...META_TYPES];
 
-const BATCH_ROWS = 2000;   // insert batch ceiling (binding)
+const BATCH_ROWS = 2000;   // insert batch ceiling by ROW COUNT
+// …and by BYTES. A row cap alone let a batch of 2000 wide messages reach ~27 MB, and
+// pushing that up through a proxy/tunnel is what dominated insert time (see createClient).
+// Flush at whichever ceiling hits first so no single upload is enormous, even uncompressed.
+// Override with MEMHOUSE_BATCH_BYTES for a tighter (slow link) or looser (LAN) path.
+const BATCH_BYTES = Math.max(256 * 1024, Number(process.env.MEMHOUSE_BATCH_BYTES) || 4 * 1024 * 1024);
 const TEXT_MAX = 50000;    // messages.text truncation
 const ARGS_MAX = 20000;    // tool_calls.args truncation
 
@@ -218,6 +224,11 @@ function makeClient() {
     username: process.env.MEMHOUSE_USER,
     password: process.env.MEMHOUSE_PASSWORD || '',
     database: process.env.MEMHOUSE_DB || process.env.MEMHOUSE_USER, // house defaults to the user's own name
+    // gzip the INSERT body. Measured on a real house behind a Cloudflare tunnel: a
+    // 2000-row batch was ~27 MB of JSON and the insert spent 76s in NetworkReceive alone
+    // (index build was 0.8s, CPU 1.1s) — the upload, not ClickHouse, was the whole cost.
+    // Conversation text compresses ~5-10x, so this turns tens of MB on the wire into a few.
+    compression: { request: true },
     request_timeout: 300000, // full re-ships move tens of MB; don't cut inserts short
     clickhouse_settings: {
       // Int64/UInt64 back as JSON numbers — our values (counts, tokens) are < 2^53.
@@ -1011,6 +1022,7 @@ async function runShip(client, opts = {}) {
   reportAdapterErrors(warned);
 
   const batches = { sessions: [], messages: [], tool_calls: [] };
+  const batchBytes = { sessions: 0, messages: 0, tool_calls: 0 };
   const flush = async (table) => {
     if (!batches[table].length) return;
     await client.insert({
@@ -1020,10 +1032,15 @@ async function runShip(client, opts = {}) {
       clickhouse_settings: { async_insert: 0 }, // binding: user_id stamping breaks otherwise
     });
     batches[table] = [];
+    batchBytes[table] = 0;
   };
   const push = async (table, row) => {
     batches[table].push(row);
-    if (batches[table].length >= BATCH_ROWS) await flush(table);
+    // Accumulate the serialized size so a few very wide rows (a 50k-char message) flush the
+    // batch as readily as 2000 small ones. The client re-serializes on insert; this extra
+    // stringify is trivial next to the network time it exists to bound.
+    batchBytes[table] += Buffer.byteLength(JSON.stringify(row));
+    if (batches[table].length >= BATCH_ROWS || batchBytes[table] >= BATCH_BYTES) await flush(table);
   };
 
   const seen = new Set(); // adapters must not double-ship a session id within a pass

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.11.2",
+  "version": "0.12.5",
   "description": "memhouse — agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {