memhouse 0.12.5 → 0.12.7

package/bin/memhouse.js

@@ -667,15 +667,13 @@ CREATE USER IF NOT EXISTS ${member} IDENTIFIED BY '${password.replace(/'/g, "\\'
 
 ${rooms.trim()}
 
--- The whole database. ALL on your own house reaches nothing outside it — the database is
--- the boundary — and it is what lets the shipper create and evolve its own tables.
-GRANT ALL ON ${db}.* TO ${member};
-
--- SELECT again, WITH GRANT OPTION — sharing, made self-serve and read-only by
--- construction. This is what lets the member run \`GRANT SELECT ON ${db}.* TO <friend>\`
--- themselves (/mem:share) without an operator, while the grant-option stops at SELECT:
--- they can open a read-only window into their own memory and can hand on nothing more.
-GRANT SELECT ON ${db}.* TO ${member} WITH GRANT OPTION;
+-- The whole database, WITH GRANT OPTION. ALL on your own house reaches nothing outside it
+-- — the database is the boundary — and it lets the shipper create and evolve its own
+-- tables. The grant option makes the member the real owner: they can hand on any of their
+-- own data (\`/mem:share\` still opens only a read-only SELECT window, but the owner is not
+-- boxed into read-only sharing of their own house). Scoped to this db, and no CREATE USER
+-- rides with it — a member still cannot mint accounts or reach another house.
+GRANT ALL ON ${db}.* TO ${member} WITH GRANT OPTION;
 
 -- Self-scoped ALTER USER: the member may change THEIR OWN password and no one else's.
 -- \`ON ${member}\` names exactly this user, so \`memhouse passwd\` needs no admin, and an
@@ -687,6 +685,11 @@ GRANT SELECT ON ${db}.* TO ${member} WITH GRANT OPTION;
 -- trust model, flagged by \`memhouse doctor\`, and re-asserted on every \`ship --ensure-schema\`.
 GRANT ALTER USER ON ${member} TO ${member};
 
+-- See the OTHER members, read-only. SHOW USERS lets \`/mem:users\` list who is on this
+-- ClickHouse (names only — no passwords, no data) so a member can find who to share with.
+-- It grants no read of anyone's rows; reading a housemate's memory still needs /mem:share.
+GRANT SHOW USERS ON *.* TO ${member};
+
 -- Pin async_insert on the user (ADD SETTING merges; a bare SETTINGS clause would replace
 -- the user's whole list). The pin keeps the user_id stamp honest: a MATERIALIZED
 -- currentUser() is computed during the INSERT, and an async flush stores it as the empty
@@ -783,11 +786,12 @@ async function adminBootstrap(cfg, admin) {
   // reaches nothing outside the database, and it is what lets the member's own shipper
   // create and evolve the rooms (--ensure-schema below).
   try {
-    await q(`GRANT ALL ON ${cfg.db}.* TO ${admin.member}`, { database: '' });
-    // SELECT again, WITH GRANT OPTION: what /mem:share rides on. The member can open a
-    // read-only window into their OWN house for a housemate-to-be — and can hand on
-    // nothing more, because the grant option stops at SELECT.
-    await q(`GRANT SELECT ON ${cfg.db}.* TO ${admin.member} WITH GRANT OPTION`, { database: '' });
+    // ALL, WITH GRANT OPTION: the database is theirs, so they may do anything with their
+    // own data AND hand any of it on. /mem:share still opens only a read-only window (it
+    // grants SELECT), but the owner is not boxed into read-only sharing of their own house.
+    // Scoped to their db: the grant option reaches nothing outside it, and no CREATE USER
+    // comes with it, so a member still cannot mint accounts or touch another house.
+    await q(`GRANT ALL ON ${cfg.db}.* TO ${admin.member} WITH GRANT OPTION`, { database: '' });
     // Self-scoped ALTER USER — the member owns their own password (memhouse passwd needs
     // no admin; an invitee can rotate the password the inviter set). Non-escalating: the
     // grant names this one user, so it reaches no other account. Best-effort: a house on
@@ -795,8 +799,14 @@ async function adminBootstrap(cfg, admin) {
     // self-rotation.
     try { await q(`GRANT ALTER USER ON ${admin.member} TO ${admin.member}`, { database: '' }); }
     catch { /* admin without access-management: passwd stays admin-assisted for this member */ }
+    // See the OTHER members, read-only: SHOW USERS lets `/mem:users` list who is on this
+    // ClickHouse (names only — no passwords, no data) so a member can find who to share
+    // with. It grants no read of anyone's rows; that still needs an explicit /mem:share.
+    // Best-effort like ALTER USER above — an admin without access-management just skips it.
+    try { await q(`GRANT SHOW USERS ON *.* TO ${admin.member}`, { database: '' }); }
+    catch { /* no access-management: /mem:users section 4 stays admin-only for this member */ }
     await q(`ALTER USER ${admin.member} ADD SETTING ${MEMBER_PIN}`, { database: '' });
-    console.log(ok(`granted the house: ALL ON ${cfg.db}.* to '${admin.member}', async_insert pinned`));
+    console.log(ok(`granted the house: ALL ON ${cfg.db}.* to '${admin.member}', SHOW USERS, async_insert pinned`));
   } catch (e) {
     console.log(bad(`could not grant the house to '${admin.member}': ${e.message}`));
     if (createdUser) {

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: ask, search, browse, analyze, check, share, and invite across all 17 supported editors and machines. Skills install as /mem:hello, /mem:ask, /mem:search, /mem:sessions, /mem:share, /mem:invite, /mem:sql, /mem:status, and /mem:users.",
-  "version": "0.12.5",
+  "version": "0.12.7",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/delivery/plugin/skills/hello/SKILL.md

@@ -103,5 +103,19 @@ Also worth naming: `memhouse start` serves a dashboard at http://localhost:4640
 browsing and analytics outside the chat, and everything here is read-only for agents —
 only the shipper writes.
 
+**Freshness check** — quietly compare the installed client to the latest release; mention
+it ONLY if there's a real gap (don't clutter the welcome otherwise):
+
+```bash
+INSTALLED=$(memhouse version 2>/dev/null | head -1 | tr -d '[:space:]')
+LATEST=$(curl -sS -m 5 https://registry.npmjs.org/memhouse/latest 2>/dev/null | sed -n 's/.*"version":"\([^"]*\)".*/\1/p')
+echo "installed=${INSTALLED:-unknown} latest=${LATEST:-unknown}"
+```
+
+If the installed version is a MINOR or MAJOR behind (or many patches), add one line:
+"heads-up — you're on 0.A.B, 0.C.D is out; `memhouse update` upgrades it and refreshes
+these `/mem:*` skills." A patch or two behind isn't worth mentioning here. Never run the
+update yourself.
+
 End by offering one concrete action: a search for something they mentioned recently, or
 `/mem:status` if they seem unsure it's working. One offer, not a menu.

package/memhouse/delivery/plugin/skills/status/SKILL.md

@@ -106,9 +106,34 @@ rows but NO `client_*` record is a **pre-0.10 memhouse still writing** — flag
 re-ships delete retained parses, and the fixes are upgrade it or (as admin)
 `REVOKE ALTER DELETE, ALTER UPDATE ON <db>.* FROM <member>`.
 
+**5. Client freshness** — is the installed memhouse behind the published release? This is a
+shell check, not SQL (it reads the local binary and the npm registry, no house involved):
+
+```bash
+INSTALLED=$(memhouse version 2>/dev/null | head -1 | tr -d '[:space:]')
+LATEST=$(curl -sS -m 5 https://registry.npmjs.org/memhouse/latest 2>/dev/null | sed -n 's/.*"version":"\([^"]*\)".*/\1/p')
+echo "installed=${INSTALLED:-unknown} latest=${LATEST:-unknown}"
+```
+
+Compare the two as `MAJOR.MINOR.PATCH`. Report freshness, and size the nudge to the gap:
+
+- **up to date** (installed ≥ latest) — one line: "client 0.X.Y, current."
+- **small gap** (same major+minor, a patch or two behind) — a gentle note: "a newer patch
+  0.X.Z is out; `memhouse update` when convenient."
+- **big gap** (latest MAJOR or MINOR is ahead, or many patches) — surface it prominently and
+  **offer to update**: "your memhouse is 0.A.B but 0.C.D is released — run **`memhouse
+  update`** to upgrade; it also refreshes the `/mem:*` plugin, then `/reload-plugins`."
+- either side **unknown** (no binary on PATH, or the registry did not answer) — say which,
+  don't guess. A plugin-only install with no CLI can't self-update; point at
+  `npm i -g memhouse`.
+
+Never run `memhouse update` yourself — it restarts daemons and may migrate the house.
+Offer the command; the pilot runs it.
+
 ## Presenting it
 
 Lead with one line of verdict ("healthy: N sessions across M editors, last ingest X
 minutes ago" — or the one thing wrong). Then the per-editor table, then anything from
-sections 3–4 that needs action. Skip empty sections; do not pad. If the house is
-unreachable, say which URL refused and stop — never guess another endpoint.
+sections 3–5 that needs action. A **big version gap (section 5) is an action** — put the
+`memhouse update` offer near the top, not buried. Skip empty sections; do not pad. If the
+house is unreachable, say which URL refused and stop — never guess another endpoint.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.12.5",
+  "version": "0.12.7",
   "description": "memhouse — agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {