memhouse 0.11.3 → 0.12.6

package/bin/memhouse.js

@@ -141,18 +141,21 @@ function writeEnvFile(cfg) {
 }
 
 // ── ClickHouse over HTTP (small read-only queries; heavy ops go via ship.js) ───
-async function ch(cfg, sql, { database = cfg.db, settings = null } = {}) {
+async function ch(cfg, sql, { database = cfg.db, settings = null, timeout = 30000 } = {}) {
   // Both settings, always: `final` collapses ReplacingMergeTree versions, and
   // `join_use_nulls` is what the session rollup's coalesce depends on now that it is a
   // saved query rather than a view carrying its own SETTINGS clause.
   const params = new URLSearchParams({ final: '1', join_use_nulls: '1' });
   for (const [k, v] of Object.entries(settings || {})) params.set(k, String(v));
   if (database) params.set('database', database);
+  // Most CLI queries are small reads and 30s is plenty; a `relocate` copy of a whole room
+  // runs server-side but the HTTP response only returns when it FINISHES, so a large
+  // transfer needs a far longer ceiling — passed per call rather than raised for all.
   const res = await fetch(`${cfg.url.replace(/\/$/, '')}/?${params}`, {
     method: 'POST',
     body: sql,
     headers: { Authorization: 'Basic ' + Buffer.from(`${cfg.user}:${cfg.password}`).toString('base64') },
-    signal: AbortSignal.timeout(30000),
+    signal: AbortSignal.timeout(timeout),
   });
   const text = await res.text();
   if (!res.ok) throw new Error(text.trim().split('\n')[0]);
@@ -369,6 +372,12 @@ House        deploy --local       run ClickHouse in docker/podman, then install
              migrate              run every migration this house still needs
                                   [--dry-run] [--yes]  (copy + atomic swap; deletes nothing)
              migrate-rooms        the same, scoped to the rooms
+             relocate --to URL    copy this whole house to a NEW ClickHouse (server-to-
+                                  server) and repoint this install — the shipper does NOT
+                                  re-ingest. [--to-user --to-password --to-db]
+                                  [--from-native-host H] [--from-native-port N]
+                                  [--insecure-native] [--keep-shipper] [--dry-run] [--yes].
+                                  Source untouched.
              service install      run the shipper as a user service (systemd / launchd)
              service stop | start | restart | uninstall | status
 
@@ -678,6 +687,11 @@ GRANT SELECT ON ${db}.* TO ${member} WITH GRANT OPTION;
 -- trust model, flagged by \`memhouse doctor\`, and re-asserted on every \`ship --ensure-schema\`.
 GRANT ALTER USER ON ${member} TO ${member};
 
+-- See the OTHER members, read-only. SHOW USERS lets \`/mem:users\` list who is on this
+-- ClickHouse (names only — no passwords, no data) so a member can find who to share with.
+-- It grants no read of anyone's rows; reading a housemate's memory still needs /mem:share.
+GRANT SHOW USERS ON *.* TO ${member};
+
 -- Pin async_insert on the user (ADD SETTING merges; a bare SETTINGS clause would replace
 -- the user's whole list). The pin keeps the user_id stamp honest: a MATERIALIZED
 -- currentUser() is computed during the INSERT, and an async flush stores it as the empty
@@ -786,8 +800,14 @@ async function adminBootstrap(cfg, admin) {
     // self-rotation.
     try { await q(`GRANT ALTER USER ON ${admin.member} TO ${admin.member}`, { database: '' }); }
     catch { /* admin without access-management: passwd stays admin-assisted for this member */ }
+    // See the OTHER members, read-only: SHOW USERS lets `/mem:users` list who is on this
+    // ClickHouse (names only — no passwords, no data) so a member can find who to share
+    // with. It grants no read of anyone's rows; that still needs an explicit /mem:share.
+    // Best-effort like ALTER USER above — an admin without access-management just skips it.
+    try { await q(`GRANT SHOW USERS ON *.* TO ${admin.member}`, { database: '' }); }
+    catch { /* no access-management: /mem:users section 4 stays admin-only for this member */ }
     await q(`ALTER USER ${admin.member} ADD SETTING ${MEMBER_PIN}`, { database: '' });
-    console.log(ok(`granted the house: ALL ON ${cfg.db}.* to '${admin.member}', async_insert pinned`));
+    console.log(ok(`granted the house: ALL ON ${cfg.db}.* to '${admin.member}', SHOW USERS, async_insert pinned`));
   } catch (e) {
     console.log(bad(`could not grant the house to '${admin.member}': ${e.message}`));
     if (createdUser) {
@@ -867,6 +887,40 @@ async function sortingKeyProblem(cfg) {
   } catch { return null; }  // unreachable house is a different check's problem
 }
 
+// Start the shipper as a BACKGROUND daemon instead of blocking install on a full first
+// pass. A fresh member's first ship loads the ENTIRE local backlog — yigido's was 558
+// sessions / 224s — and running it synchronously (the old `run(SHIP_JS)`) made `install`
+// sit silent for minutes and read as hung. Detached, install returns at once, the history
+// loads in the background, and the loop keeps shipping. Mirrors cmdStart's shipper daemon,
+// and defers to an installed service rather than running a second shipper beside it.
+//
+// Must be called AFTER finishInvite: rotation rewrites the env file, so the daemon has to
+// be spawned from a RE-READ config (resolveConfig()) or it would carry the old password.
+function startShipperBackground(cfg) {
+  let svc = { installed: false, running: false };
+  try { svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).status(); } catch { /* unsupported platform */ }
+  if (svc.installed) {
+    console.log(svc.running
+      ? ok('shipping runs under the installed service — nothing to start')
+      : warn('a shipper service is installed but stopped — start it:  memhouse service start'));
+    return;
+  }
+  const existing = pidOf('shipper');
+  if (existing) { console.log(ok(`shipper already running in the background (pid ${existing})`)); return; }
+  fs.mkdirSync(RUN_DIR, { recursive: true });
+  fs.mkdirSync(LOG_DIR, { recursive: true });
+  const logPath = path.join(LOG_DIR, 'shipper.log');
+  const log = fs.openSync(logPath, 'a');
+  const child = spawn(process.execPath, [SHIP_JS, '--loop', String(flags.interval || 300)], {
+    env: childEnv(cfg), detached: true, stdio: ['ignore', log, log],
+  });
+  fs.writeFileSync(path.join(RUN_DIR, 'shipper.pid'), String(child.pid));
+  child.unref();
+  console.log(ok(`shipper started in the background (pid ${child.pid}) — loading your history now`));
+  console.log('  a large first ship can take a few minutes; watch it finish with:  memhouse status');
+  console.log('  dashboard (browse / search / analyze):  memhouse start');
+}
+
 async function cmdInstall({ interactive }) {
   // --env <file>: an INVITE intake. The file carries MEMHOUSE_URL/USER/PASSWORD/DB from
   // `memhouse invite` on the admin's machine; loading it into the environment BEFORE
@@ -962,12 +1016,14 @@ async function cmdInstall({ interactive }) {
       console.log(ok(`host identity: ${me.id}`));
       console.log(`  every machine you install as '${cfg.user}' writes into the same rooms; this is what tells them apart`);
     }
-    if (flags['no-ship'] !== true && run(SHIP_JS, [], cfg) !== 0) return 1;
     console.log(ok('installed'));
     console.log('  adding a housemate later is two statements for the admin:');
     console.log(`     CREATE USER <name> IDENTIFIED BY '…';  GRANT ALL ON ${cfg.db}.* TO <name>;`);
     printGettingStarted(cfg);
     await finishInvite(cfg);
+    // The first ship loads the whole backlog; do it in the background so install returns
+    // now. resolveConfig() re-reads the env file finishInvite may have just rotated.
+    if (flags['no-ship'] !== true) startShipperBackground(resolveConfig());
     return 0;
   }
 
@@ -1118,12 +1174,11 @@ async function cmdInstall({ interactive }) {
     console.log(ok(`host identity: ${me.id}`));
     console.log(`  every machine you install as '${cfg.user}' writes into the same rooms; this is what tells them apart`);
   }
-  if (flags['no-ship'] !== true) {
-    if (run(SHIP_JS, [], cfg) !== 0) return 1;
-  }
   console.log(ok('installed'));
   printGettingStarted(cfg);
   await finishInvite(cfg);
+  // Background first ship — same reasoning as the invite branch above.
+  if (flags['no-ship'] !== true) startShipperBackground(resolveConfig());
   return 0;
 }
 
@@ -2010,6 +2065,30 @@ async function cmdUpdate() {
   }
   console.log(ok('files updated'));
 
+  // Refresh the Claude plugin wherever it is ALREADY installed, so `update` keeps the
+  // skills in lockstep with the package instead of leaving a stale `/mem:*` behind. Only
+  // dirs that already have it are touched — update never installs the plugin somewhere new.
+  // The files copied are the ones npm/git just put on disk; the manifest is stamped with
+  // the FRESH package version read off disk (this process still runs the pre-upgrade code,
+  // so its in-memory PKG.version is a release behind).
+  try {
+    let fresh = PKG.version;
+    try { fresh = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'package.json'), 'utf-8')).version || fresh; } catch { /* keep in-memory */ }
+    const installed = claudeTargets().filter((t) => isPluginInstalled(t.dir));
+    for (const t of installed) {
+      const dst = installPluginInto(t.dir);
+      try {
+        const mf = path.join(dst, '.claude-plugin', 'plugin.json');
+        const m = JSON.parse(fs.readFileSync(mf, 'utf-8'));
+        if (m.version !== fresh) { m.version = fresh; fs.writeFileSync(mf, `${JSON.stringify(m, null, 2)}\n`); }
+      } catch { /* leave the stamp installPluginInto wrote */ }
+      console.log(ok(`plugin refreshed in ${short(t.dir)}`));
+    }
+    if (installed.length) console.log('  reload it in Claude Code:  /reload-plugins  (or restart the session)');
+  } catch (e) {
+    console.log(warn(`could not refresh Claude plugins: ${e.message.split('\n')[0]}`));
+  }
+
   // Restarting is the half a bare `npm i -g` leaves undone. The daemons notice on their own
   // within a loop interval (memhouse/self-update.js), but a pilot who typed `update` should
   // not have to wait for it, and the dashboard's stale bundle is visible immediately.
@@ -2171,6 +2250,17 @@ function installPluginInto(dir) {
   }
   fs.mkdirSync(dst, { recursive: true });
   fs.cpSync(path.join(DELIVERY, 'plugin'), dst, { recursive: true });
+  // Stamp the manifest with THIS memhouse's version. The source plugin.json carries a
+  // FROZEN number — it sat at 0.11.0 through several releases, so every install
+  // advertised the wrong version (`memhouse --version` said one thing, the plugin
+  // another). The package version is the single truth; write it into the copy.
+  try {
+    const m = JSON.parse(fs.readFileSync(dstManifest, 'utf-8'));
+    if (m.version !== PKG.version) {
+      m.version = PKG.version;
+      fs.writeFileSync(dstManifest, `${JSON.stringify(m, null, 2)}\n`);
+    }
+  } catch { /* manifest unreadable — leave the copied one rather than guess */ }
   return dst;
 }
 
@@ -2523,6 +2613,211 @@ async function cmdMigrate({ component = null, quiet = false, assumeYes = false }
   return 0;
 }
 
+/**
+ * `memhouse relocate --to <url>` — copy a whole house to a NEW ClickHouse, server-to-
+ * server, then repoint this install at it. The point is to move WITHOUT the shipper
+ * re-ingesting: once the new host holds a faithful copy, the shipper's skip predicate
+ * sees every old session already present and ships only genuinely new work.
+ *
+ * The copy is a ClickHouse remoteSecure() INSERT SELECT — the destination pulls each room
+ * directly from the source over the native protocol; the pilot's laptop is never in the
+ * data path. Provenance is carried, not restamped (insert_allow_materialized_columns=1),
+ * exactly as `migrate`'s rebuildRoom does, so a shared house keeps every member's user_id.
+ *
+ * Nothing on the SOURCE is touched — relocate only reads it and only writes the
+ * destination and the local env file, so a failed run leaves the old house intact.
+ *
+ * SECURITY: the source password is spliced into the remoteSecure() call, which runs on
+ * the DESTINATION and lands in ITS query_log. Two consequences, both stated to the pilot:
+ * it never touches THIS transcript (the SQL is never printed), but rotate the source
+ * credential afterward if the destination's logs are not yours to trust.
+ *
+ * Flags: --to (required), --to-user/--to-password/--to-db (default: the source's),
+ * --from-native-port (default 9440), --insecure-native (remote()+9000, no TLS),
+ * --keep-shipper (don't stop it for the copy), --dry-run, --yes.
+ */
+async function cmdRelocate() {
+  const rel = require(path.join(REPO_ROOT, 'memhouse', 'house', 'relocate.js'));
+  const house = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
+  const stated = (f) => flags[f] !== undefined && flags[f] !== true;
+
+  const to = flags.to;
+  if (!to || to === true) { console.log(bad('relocate needs a destination:  memhouse relocate --to <url>')); return 1; }
+  const src = requireConfig(resolveConfig(), 'relocate');
+  const dest = {
+    url: to,
+    user: stated('to-user') ? flags['to-user'] : src.user,
+    password: stated('to-password') ? flags['to-password'] : src.password,
+    db: stated('to-db') ? flags['to-db'] : src.db,
+    port: src.port, stated: true,
+  };
+  if (sameEndpoint(src.url, dest.url)) {
+    console.log(bad(`source and destination are the same server (${dest.url}) — nothing to relocate`)); return 1;
+  }
+  for (const [n, who] of [[src.db, 'source house'], [dest.db, 'destination house']]) {
+    try { house.assertUsableName(n, who); } catch (e) { console.log(bad(e.message)); return 1; }
+  }
+
+  const sq = (s) => `'${String(s).replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+  const bq = (s) => `\`${String(s).replace(/`/g, '``')}\``;
+  const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl'), 'utf-8');
+  let nat;
+  try {
+    nat = rel.nativeEndpoint(src.url, {
+      host: stated('from-native-host') ? flags['from-native-host'] : null,
+      port: stated('from-native-port') ? flags['from-native-port'] : null,
+      insecure: flags['insecure-native'] === true,
+    });
+  } catch (e) { console.log(bad(e.message)); return 1; }
+
+  const countFinal = async (cfg, t) => Number((await chRows(cfg, `SELECT count() AS c FROM ${bq(t)}`, { database: cfg.db }))[0]?.c || 0);
+
+  // ── preflight: source reachable, current schema, and its counts ──────────────────
+  let srcMember;
+  try { srcMember = (await chRows(src, 'SELECT currentUser() AS u', { database: '' }))[0]?.u; }
+  catch (e) { console.log(bad(`source not reachable: ${netReason(e)}`)); return 1; }
+  try {
+    const rec = await chRows(src, "SELECT value FROM house_meta FINAL WHERE key = 'schema_version'", { database: src.db });
+    const v = rec.length ? Number(rec[0].value) || 0 : 0;
+    if (v !== SCHEMA_VERSION) {
+      console.log(bad(`source house is at schema ${v || 'pre-record'}; this memhouse is ${SCHEMA_VERSION}.`));
+      console.log('  Migrate the source first, then relocate:  memhouse migrate');
+      return 1;
+    }
+  } catch {
+    console.log(bad('source house has no house_meta — migrate it first:  memhouse migrate'));
+    return 1;
+  }
+  const base = {};
+  for (const t of ROOM_TYPES) base[t] = await countFinal(src, t);
+
+  // ── preflight: destination reachable ─────────────────────────────────────────────
+  let destMember;
+  try { destMember = (await chRows(dest, 'SELECT currentUser() AS u', { database: '' }))[0]?.u; }
+  catch (e) { console.log(bad(`destination not reachable: ${netReason(e)}`)); return 1; }
+
+  console.log(`  relocate  ${src.user}@${new URL(src.url).host} (house '${src.db}')`);
+  console.log(`        ->  ${dest.user}@${new URL(dest.url).host} (house '${dest.db}')`);
+  console.log(`  source rooms: sessions ${base.sessions}, messages ${base.messages}, tool_calls ${base.tool_calls}`);
+  console.log(`  copy transport: ${nat.fn}(${nat.addr})  [source password never printed]`);
+
+  if (flags['dry-run'] === true) {
+    console.log(warn('dry run — nothing was created, copied, or repointed'));
+    return 0;
+  }
+  if (flags.yes !== true) {
+    const a = (await ask(`Copy this house to ${new URL(dest.url).host} and repoint this install? (yes/no)`, 'no')).toLowerCase();
+    if (a !== 'yes' && a !== 'y') return console.log('aborted'), 1;
+  }
+
+  // ── freeze the source shipper (best-effort) ──────────────────────────────────────
+  let restart = null;
+  const health = shipperHealth();
+  if (health.running && flags['keep-shipper'] !== true) {
+    if (String(health.via || '').startsWith('service')) {
+      const svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js'));
+      const st = svc.status();
+      const stop = st.kind === 'systemd'
+        ? ['systemctl', ['--user', 'stop', 'memhouse-shipper']]
+        : ['launchctl', ['bootout', `gui/${process.getuid()}/com.memhouse.shipper`]];
+      const r = spawnSync(stop[0], stop[1], { stdio: 'pipe', encoding: 'utf-8' });
+      if (r.status === 0) { console.log(ok('shipper stopped for the copy')); restart = { kind: 'service', st }; }
+      else console.log(warn(`could not stop the shipper (${(r.stderr || '').trim().split('\n')[0] || 'exit ' + r.status}); continuing — late writes dedupe`));
+    } else {
+      const pid = pidOf('shipper');
+      if (pid) { try { process.kill(pid, 'SIGTERM'); console.log(ok(`shipper daemon stopped (pid ${pid})`)); restart = { kind: 'daemon' }; } catch { /* raced */ } }
+    }
+  }
+
+  try {
+    // ── schema on the destination (no ingest) ──────────────────────────────────────
+    await ch(dest, `CREATE DATABASE IF NOT EXISTS ${bq(dest.db)}`, { database: '' });
+    for (const t of [...META_TYPES, ...ROOM_TYPES]) {
+      await ch(dest, createStatement(tpl, t, t).replace('CREATE TABLE ', 'CREATE TABLE IF NOT EXISTS '),
+        { database: dest.db, settings: { allow_experimental_full_text_index: 1 } });
+    }
+    const destBefore = await countFinal(dest, 'messages');
+    if (destBefore > 0 && flags.yes !== true) {
+      console.log(warn(`destination already holds ${destBefore} messages — copy is idempotent (ReplacingMergeTree dedupes), continuing`));
+    }
+
+    // ── probe native reachability BEFORE the big copy (never logs the password) ─────
+    const probe = `SELECT count() AS c FROM ${nat.fn}(${sq(nat.addr)}, ${sq(src.db)}, 'sessions', ${sq(src.user)}, ${sq(src.password)})`;
+    try { await chRows(dest, probe, { database: dest.db, timeout: 60000 }); }
+    catch (e) {
+      console.log(bad(`the destination cannot reach the source over ${nat.fn} at ${nat.addr}: ${netReason(e)}`));
+      console.log('  open the source native port (default 9440 TLS), or pass --from-native-port / --insecure-native.');
+      throw new Error('relocate-preflight');
+    }
+
+    // ── copy each table, provenance carried ────────────────────────────────────────
+    for (const t of [...ROOM_TYPES, ...META_TYPES]) {
+      const destCols = (await chRows(dest, `SELECT name FROM system.columns WHERE database = ${sq(dest.db)} AND table = ${sq(t)}`, { database: dest.db })).map((r) => r.name);
+      const srcCols = (await chRows(src, `SELECT name FROM system.columns WHERE database = ${sq(src.db)} AND table = ${sq(t)}`, { database: src.db })).map((r) => r.name);
+      const cols = rel.copyColumns(destCols, srcCols);
+      if (!cols.length) { console.log(warn(`${t}: no shared columns — skipped`)); continue; }
+      const list = cols.map(bq).join(', ');
+      // house_meta carries only durable facts; the per-host heartbeats regenerate.
+      const where = t === 'house_meta'
+        ? " WHERE key IN ('schema_version','min_writer_schema','house_id') OR key LIKE 'share:%'" : '';
+      const copySql = `INSERT INTO ${bq(t)} (${list}) SELECT ${list} FROM ${nat.fn}(${sq(nat.addr)}, ${sq(src.db)}, ${sq(t)}, ${sq(src.user)}, ${sq(src.password)})${where}`
+        + ' SETTINGS insert_allow_materialized_columns = 1, allow_experimental_full_text_index = 1';
+      await ch(dest, copySql, { database: dest.db, timeout: 3600000 });
+      console.log(ok(`${t}: copied`));
+    }
+
+    // ── verify — the hard gate before repointing ───────────────────────────────────
+    let allGood = true;
+    for (const t of ROOM_TYPES) {
+      const d = await countFinal(dest, t);
+      const good = d >= base[t];
+      console.log((good ? ok : bad)(`${t}: source ${base[t]} -> dest ${d}`));
+      if (!good) allGood = false;
+    }
+    if (!allGood) {
+      console.log(bad('row counts do not match — NOT repointing. The source is untouched; inspect the destination.'));
+      throw new Error('relocate-verify');
+    }
+
+    // ── repoint the local config (old env kept alongside) ──────────────────────────
+    try { fs.copyFileSync(ENV_FILE, `${ENV_FILE}.pre-relocate`); console.log(ok(`previous config kept at ${`${ENV_FILE}.pre-relocate`.replace(os.homedir(), '~')}`)); }
+    catch { /* no prior env file — first config */ }
+    writeEnvFile(dest);
+    console.log(ok(`config repointed to ${dest.url} (house '${dest.db}')`));
+  } catch (e) {
+    if (!['relocate-preflight', 'relocate-verify'].includes(e.message)) console.log(bad(`relocate failed: ${e.message.split('\n')[0]}`));
+    console.log(warn('the SOURCE house was not touched — your data is safe there.'));
+    if (restart) console.log(warn('the shipper was stopped; restart it:  memhouse service start   (or  memhouse start)'));
+    return 1;
+  }
+
+  // ── restart the shipper against the new host ─────────────────────────────────────
+  if (restart) {
+    if (restart.kind === 'service') {
+      const st = restart.st;
+      const start = st.kind === 'systemd'
+        ? ['systemctl', ['--user', 'start', 'memhouse-shipper']]
+        : ['launchctl', ['bootstrap', `gui/${process.getuid()}`, st.path]];
+      const r = spawnSync(start[0], start[1], { stdio: 'pipe', encoding: 'utf-8' });
+      console.log(r.status === 0 ? ok('shipper restarted — now writing to the new host')
+        : warn('restart the shipper yourself:  memhouse service start'));
+    } else {
+      console.log(warn('restart the shipper to pick up the new host:  memhouse start  (or  memhouse service start)'));
+    }
+  } else if (shipperHealth().running) {
+    console.log(warn('a shipper is still running against the OLD host — restart it to pick up the new config.'));
+  }
+
+  console.log('');
+  console.log(ok('relocate complete.'));
+  console.log('  the shipper will NOT re-ingest: every copied session is already present, so its');
+  console.log('  skip predicate ships only new work from here.');
+  console.log('  verify:  memhouse status');
+  console.log('  keep the OLD house until you are satisfied, then decommission it.');
+  if (!flags['insecure-native']) console.log(warn('the source password reached the destination server (its query_log) — rotate it if those logs are not yours to trust.'));
+  return 0;
+}
+
 /**
  * `memhouse nightly [--out DIR]` — build an installable, version-stamped tarball from
  * this checkout, without publishing anything.
@@ -3011,6 +3306,7 @@ async function cmdUninstall() {
     case 'nightly': process.exitCode = await cmdNightly(); break;
     case 'migrate': process.exitCode = await cmdMigrate({}); break;
     case 'migrate-rooms': process.exitCode = await cmdMigrate({ component: 'rooms' }); break;
+    case 'relocate': process.exitCode = await cmdRelocate(); break;
     case 'deploy': {
       const dep = require(path.join(REPO_ROOT, 'memhouse', 'deploy.js'));
       if (flags.down) {

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: ask, search, browse, analyze, check, share, and invite across all 17 supported editors and machines. Skills install as /mem:hello, /mem:ask, /mem:search, /mem:sessions, /mem:share, /mem:invite, /mem:sql, /mem:status, and /mem:users.",
-  "version": "0.11.0",
+  "version": "0.12.6",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/delivery/plugin/skills/ask/SKILL.md

@@ -39,7 +39,7 @@ if [ -z "${MEMHOUSE_URL:-}" ] || [ -z "${MEMHOUSE_USER:-}" ]; then
 fi
 
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT JSONEachRow
 SQL
@@ -57,7 +57,7 @@ about a FRIEND's memory — "how did yigit fix X", "in yigit's house", "ask yigi
    that is not `system` / `information_schema` / `default` and not your own `$MEMHOUSE_DB`
    is a house shared with you. Match the named person to one; set `HOUSE=yigit`. With no
    house named, `HOUSE=$MEMHOUSE_DB`.
-2. **Point the connection at it:** replace `database=${MEMHOUSE_DB:-mem}` with
+2. **Point the connection at it:** replace `database=${MEMHOUSE_DB:-$MEMHOUSE_USER}` with
    `database=<HOUSE>` in the recipe above. The rooms (`messages`, `sessions`) resolve by
    the connection's database, so retrieval, the transcript read, and the citation all run
    against that house — leave the table names bare.

package/memhouse/delivery/plugin/skills/hello/SKILL.md

@@ -26,7 +26,7 @@ set -a; [ -f "$MH_ENV" ] && . "$MH_ENV"; set +a
 if [ -n "${MEMHOUSE_URL:-}" ] && [ -n "${MEMHOUSE_USER:-}" ]; then
   curl -sS -m 5 --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
     --data-binary "SELECT uniqExact(session_id), count(), formatDateTime(min(ts),'%Y-%m-%d') FROM messages" \
-    "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&readonly=1" 2>&1
+    "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&readonly=1" 2>&1
 else
   echo "NOT_CONFIGURED"
 fi
@@ -103,5 +103,19 @@ Also worth naming: `memhouse start` serves a dashboard at http://localhost:4640
 browsing and analytics outside the chat, and everything here is read-only for agents —
 only the shipper writes.
 
+**Freshness check** — quietly compare the installed client to the latest release; mention
+it ONLY if there's a real gap (don't clutter the welcome otherwise):
+
+```bash
+INSTALLED=$(memhouse version 2>/dev/null | head -1 | tr -d '[:space:]')
+LATEST=$(curl -sS -m 5 https://registry.npmjs.org/memhouse/latest 2>/dev/null | sed -n 's/.*"version":"\([^"]*\)".*/\1/p')
+echo "installed=${INSTALLED:-unknown} latest=${LATEST:-unknown}"
+```
+
+If the installed version is a MINOR or MAJOR behind (or many patches), add one line:
+"heads-up — you're on 0.A.B, 0.C.D is out; `memhouse update` upgrades it and refreshes
+these `/mem:*` skills." A patch or two behind isn't worth mentioning here. Never run the
+update yourself.
+
 End by offering one concrete action: a search for something they mentioned recently, or
 `/mem:status` if they seem unsure it's working. One offer, not a menu.

package/memhouse/delivery/plugin/skills/search/SKILL.md

@@ -50,7 +50,7 @@ fi
 # in 50 samples). What actually leaks a credential is PRINTING it, which the rule above
 # covers.
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL
@@ -155,7 +155,7 @@ the connection's `database`, so one change redirects every query in this skill.
    "in yigit", "house yigit", "from yigit" — set `HOUSE=yigit`; otherwise leave
    `HOUSE=$MEMHOUSE_DB`.
 2. **Point the connection at it:** in the recipe above, replace
-   `database=${MEMHOUSE_DB:-mem}` with `database=<HOUSE>`. Leave the table names bare —
+   `database=${MEMHOUSE_DB:-$MEMHOUSE_USER}` with `database=<HOUSE>`. Leave the table names bare —
    they resolve to that house. Nothing else in the query changes.
 3. **A house wins over `in <project>`.** A name that matches a readable house is a HOUSE,
    not a project filter — otherwise "in yigit" silently filters YOUR house's project

package/memhouse/delivery/plugin/skills/sessions/SKILL.md

@@ -57,7 +57,7 @@ fi
 # in 50 samples). What actually leaks a credential is PRINTING it, which the rule above
 # covers.
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL

package/memhouse/delivery/plugin/skills/share/SKILL.md

@@ -39,7 +39,7 @@ fi
 # NO readonly=1 on this skill's grant/revoke calls — GRANT is refused under readonly.
 # The list query below still pins it.
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}" <<'SQL'
 <the statement>
 SQL
 ```

package/memhouse/delivery/plugin/skills/sql/SKILL.md

@@ -84,7 +84,7 @@ fi
 # in 50 samples). What actually leaks a credential is PRINTING it, which the rule above
 # covers.
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL
@@ -106,7 +106,7 @@ friend's memory by pointing the connection at THEIR house — same credentials,
 `database`. `SHOW DATABASES` lists what you may read; a name that is not `system` /
 `information_schema` / `default` and not your own `$MEMHOUSE_DB` is a house shared with
 you. When the user names one ("query yigit's house", "on yigit", "from yigit"), replace
-`database=${MEMHOUSE_DB:-mem}` with `database=<house>` in the connection recipe and leave
+`database=${MEMHOUSE_DB:-$MEMHOUSE_USER}` with `database=<house>` in the connection recipe and leave
 the table names bare — or, to join across houses in one query, qualify tables explicitly
 (`yigit.messages`). Read-only: a refused SELECT means that house was not shared with you.
 

package/memhouse/delivery/plugin/skills/status/SKILL.md

@@ -36,7 +36,7 @@ if [ -z "${MEMHOUSE_URL:-}" ] || [ -z "${MEMHOUSE_USER:-}" ]; then
 fi
 
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&final=1&join_use_nulls=1&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL
@@ -106,9 +106,34 @@ rows but NO `client_*` record is a **pre-0.10 memhouse still writing** — flag
 re-ships delete retained parses, and the fixes are upgrade it or (as admin)
 `REVOKE ALTER DELETE, ALTER UPDATE ON <db>.* FROM <member>`.
 
+**5. Client freshness** — is the installed memhouse behind the published release? This is a
+shell check, not SQL (it reads the local binary and the npm registry, no house involved):
+
+```bash
+INSTALLED=$(memhouse version 2>/dev/null | head -1 | tr -d '[:space:]')
+LATEST=$(curl -sS -m 5 https://registry.npmjs.org/memhouse/latest 2>/dev/null | sed -n 's/.*"version":"\([^"]*\)".*/\1/p')
+echo "installed=${INSTALLED:-unknown} latest=${LATEST:-unknown}"
+```
+
+Compare the two as `MAJOR.MINOR.PATCH`. Report freshness, and size the nudge to the gap:
+
+- **up to date** (installed ≥ latest) — one line: "client 0.X.Y, current."
+- **small gap** (same major+minor, a patch or two behind) — a gentle note: "a newer patch
+  0.X.Z is out; `memhouse update` when convenient."
+- **big gap** (latest MAJOR or MINOR is ahead, or many patches) — surface it prominently and
+  **offer to update**: "your memhouse is 0.A.B but 0.C.D is released — run **`memhouse
+  update`** to upgrade; it also refreshes the `/mem:*` plugin, then `/reload-plugins`."
+- either side **unknown** (no binary on PATH, or the registry did not answer) — say which,
+  don't guess. A plugin-only install with no CLI can't self-update; point at
+  `npm i -g memhouse`.
+
+Never run `memhouse update` yourself — it restarts daemons and may migrate the house.
+Offer the command; the pilot runs it.
+
 ## Presenting it
 
 Lead with one line of verdict ("healthy: N sessions across M editors, last ingest X
 minutes ago" — or the one thing wrong). Then the per-editor table, then anything from
-sections 3–4 that needs action. Skip empty sections; do not pad. If the house is
-unreachable, say which URL refused and stop — never guess another endpoint.
+sections 3–5 that needs action. A **big version gap (section 5) is an action** — put the
+`memhouse update` offer near the top, not buried. Skip empty sections; do not pad. If the
+house is unreachable, say which URL refused and stop — never guess another endpoint.

package/memhouse/delivery/plugin/skills/users/SKILL.md

@@ -37,7 +37,7 @@ if [ -z "${MEMHOUSE_URL:-}" ] || [ -z "${MEMHOUSE_USER:-}" ]; then
 fi
 
 curl -sS --fail-with-body --user "$MEMHOUSE_USER:${MEMHOUSE_PASSWORD:-}" \
-  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-mem}&readonly=1" <<'SQL'
+  --data-binary @- "$MEMHOUSE_URL/?database=${MEMHOUSE_DB:-$MEMHOUSE_USER}&readonly=1" <<'SQL'
 <the query>
 FORMAT PrettyCompact
 SQL

package/memhouse/house/relocate.js

@@ -0,0 +1,59 @@
+// Pure helpers for `memhouse relocate` — the host-to-host copy that moves a whole house
+// to a new ClickHouse and repoints the shipper, WITHOUT the shipper re-ingesting from
+// local session files. The orchestration lives in bin/memhouse.js (cmdRelocate); the
+// transport-free, side-effect-free decisions live here so they can be unit-tested.
+//
+// See docs/design/host-repoint-reconciliation.md for the wider design this is one piece
+// of. Relocate is the "data does follow the pointer, on purpose" path.
+
+// The two room columns that are MATERIALIZED and DERIVED from `text` — the lowercased,
+// text-indexed copies. They are recomputed by the destination table's own expression on
+// INSERT, so they are never carried across; carrying them would also fail, since they are
+// not insertable even with insert_allow_materialized_columns.
+const DERIVED = ['text_ngram', 'text_word'];
+
+// house_meta keys that are DURABLE facts of the house — worth carrying to the new host.
+// Everything else in house_meta is a per-host heartbeat (client_version, client_schema,
+// last_ship:<writer>) that the new shipper rewrites for itself on its first run; carrying
+// a stale one would misreport which machine last shipped until that run lands.
+function isDurableMetaKey(key) {
+  return key === 'schema_version'
+    || key === 'min_writer_schema'
+    || key === 'house_id'            // forward-compat: harmless if absent today
+    || /^share:/.test(key);
+}
+
+/**
+ * The columns to carry when copying `srcTable` into `destTable`, given both sides' column
+ * lists. The intersection (a column the destination lacks cannot be written; one the
+ * source lacks cannot be read) minus the derived pair. Order follows the destination, so
+ * the SELECT and INSERT lists line up positionally.
+ */
+function copyColumns(destCols, srcCols) {
+  const src = new Set(srcCols);
+  return destCols.filter((c) => src.has(c) && !DERIVED.includes(c));
+}
+
+/**
+ * Resolve the ClickHouse NATIVE endpoint to read the source house from, given its HTTP(S)
+ * URL. remoteSecure()/remote() speak the native TCP protocol, NOT HTTP — a different port
+ * from the one in MEMHOUSE_URL. Secure (TLS) native defaults to 9440; plain to 9000.
+ *
+ * @param url        the source MEMHOUSE_URL (http(s)://host:8123)
+ * @param opts.host  override the host — the DESTINATION's route to the source may differ
+ *                   from the pilot's URL (NAT, split-horizon DNS, a private peering name)
+ * @param opts.port  override the native port
+ * @param opts.insecure  use remote() + plain 9000 instead of remoteSecure() + 9440
+ * @returns { fn: 'remoteSecure'|'remote', host, port, addr: 'host:port' }
+ */
+function nativeEndpoint(url, { host = null, port = null, insecure = false } = {}) {
+  if (!host) {
+    try { host = new URL(url).hostname; } catch { throw new Error(`source URL is not a URL: ${url}`); }
+  }
+  if (!host) throw new Error(`source URL has no host: ${url}`);
+  const fn = insecure ? 'remote' : 'remoteSecure';
+  const p = String(port || (insecure ? 9000 : 9440));
+  return { fn, host, port: p, addr: `${host}:${p}` };
+}
+
+module.exports = { DERIVED, isDurableMetaKey, copyColumns, nativeEndpoint };

package/memhouse/shipper/ship.js

@@ -9,8 +9,9 @@
 // columns instead of a raw JSON blob.
 //
 // Data-plane rules (binding, see DESIGN.md):
-//   - JSONEachRow, batches <= 2000 rows, async_insert=0 on EVERY insert — the house
-//     stamps user_id MATERIALIZED currentUser(), which is empty during async flushes.
+//   - JSONEachRow, gzip-compressed request body, batches capped at 2000 rows OR ~4 MB
+//     (whichever first), async_insert=0 on EVERY insert — the house stamps user_id
+//     MATERIALIZED currentUser(), which is empty during async flushes.
 //   - DateTime64 values travel as 'YYYY-MM-DD HH:MM:SS.mmm' UTC strings (plain
 //     format; ISO 'T'/'Z' forms parse unreliably under JSONEachRow). Nullable → null.
 //   - Int64-bound values are integer-coerced (some adapters emit fractional ms).
@@ -68,7 +69,12 @@ const {
 // house_events would otherwise roll out to nobody.
 const ALL_TABLES = [...ROOM_TYPES, ...META_TYPES];
 
-const BATCH_ROWS = 2000;   // insert batch ceiling (binding)
+const BATCH_ROWS = 2000;   // insert batch ceiling by ROW COUNT
+// …and by BYTES. A row cap alone let a batch of 2000 wide messages reach ~27 MB, and
+// pushing that up through a proxy/tunnel is what dominated insert time (see createClient).
+// Flush at whichever ceiling hits first so no single upload is enormous, even uncompressed.
+// Override with MEMHOUSE_BATCH_BYTES for a tighter (slow link) or looser (LAN) path.
+const BATCH_BYTES = Math.max(256 * 1024, Number(process.env.MEMHOUSE_BATCH_BYTES) || 4 * 1024 * 1024);
 const TEXT_MAX = 50000;    // messages.text truncation
 const ARGS_MAX = 20000;    // tool_calls.args truncation
 
@@ -218,6 +224,11 @@ function makeClient() {
     username: process.env.MEMHOUSE_USER,
     password: process.env.MEMHOUSE_PASSWORD || '',
     database: process.env.MEMHOUSE_DB || process.env.MEMHOUSE_USER, // house defaults to the user's own name
+    // gzip the INSERT body. Measured on a real house behind a Cloudflare tunnel: a
+    // 2000-row batch was ~27 MB of JSON and the insert spent 76s in NetworkReceive alone
+    // (index build was 0.8s, CPU 1.1s) — the upload, not ClickHouse, was the whole cost.
+    // Conversation text compresses ~5-10x, so this turns tens of MB on the wire into a few.
+    compression: { request: true },
     request_timeout: 300000, // full re-ships move tens of MB; don't cut inserts short
     clickhouse_settings: {
       // Int64/UInt64 back as JSON numbers — our values (counts, tokens) are < 2^53.
@@ -1011,6 +1022,7 @@ async function runShip(client, opts = {}) {
   reportAdapterErrors(warned);
 
   const batches = { sessions: [], messages: [], tool_calls: [] };
+  const batchBytes = { sessions: 0, messages: 0, tool_calls: 0 };
   const flush = async (table) => {
     if (!batches[table].length) return;
     await client.insert({
@@ -1020,10 +1032,15 @@ async function runShip(client, opts = {}) {
       clickhouse_settings: { async_insert: 0 }, // binding: user_id stamping breaks otherwise
     });
     batches[table] = [];
+    batchBytes[table] = 0;
   };
   const push = async (table, row) => {
     batches[table].push(row);
-    if (batches[table].length >= BATCH_ROWS) await flush(table);
+    // Accumulate the serialized size so a few very wide rows (a 50k-char message) flush the
+    // batch as readily as 2000 small ones. The client re-serializes on insert; this extra
+    // stringify is trivial next to the network time it exists to bound.
+    batchBytes[table] += Buffer.byteLength(JSON.stringify(row));
+    if (batches[table].length >= BATCH_ROWS || batchBytes[table] >= BATCH_BYTES) await flush(table);
   };
 
   const seen = new Set(); // adapters must not double-ship a session id within a pass

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.11.3",
+  "version": "0.12.6",
   "description": "memhouse — agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {