memhouse 0.12.7 → 0.14.0

package/README.md

@@ -76,12 +76,22 @@ memhouse update [--check]                  upgrade, restart daemons, check the s
 memhouse start | stop                      dashboard + shipper as daemons
 memhouse service install | uninstall       survive a reboot
 memhouse deploy --local | --down           stand up (or remove) a local house
-memhouse plugins install claude            /mem:search, :sessions, :sql —
-                                           into every Claude Code config dir found
+memhouse invite <name>                     mint a member + house, hand them one env file
+memhouse passwd                            rotate this member's password
+memhouse migrate | migrate-rooms [--dry-run] [--yes]
+                                           run whatever this house still needs
+memhouse relocate --to <url>               copy this house to a new ClickHouse, then repoint
+memhouse nightly [--out DIR]               build an installable tarball from this checkout
+memhouse plugins install claude            9 skills — ask, hello, invite, search,
+                                           sessions, share, sql, status, users — into
+                                           every Claude Code config dir found
 memhouse prompt                            memory snippet for an agent's system prompt
 memhouse prompt --install                  an install prompt, rendered for this machine
 ```
 
+Any command's own usage: `memhouse <command> --help` (or `-h`) — always prints usage,
+never runs the command.
+
 Every command works both ways: interactive for you, `--yes` / flags / `--json` for
 an agent — so an agent can install its own memory unattended.
 

package/bin/memhouse.js

@@ -28,6 +28,7 @@ const {
   SCHEMA_VERSION, MIN_WRITER_SCHEMA, MIGRATIONS, META_TYPES, createStatement,
 } = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
 const envfile = require(path.join(REPO_ROOT, 'memhouse', 'envfile'));
+const { consumeSecretChunk } = require(path.join(REPO_ROOT, 'memhouse', 'secret-input'));
 
 const HOME_DIR = process.env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse');
 const ENV_FILE = path.join(HOME_DIR, 'env');
@@ -270,16 +271,20 @@ function askSecret(label, dflt = '') {
     const wasRaw = stdin.isRaw;
     stdin.setRawMode(true); stdin.resume(); stdin.setEncoding('utf-8');
     let buf = '';
-    const onData = (ch) => {
-      if (ch === '\r' || ch === '\n' || ch === '\u0004') {
-        stdin.removeListener('data', onData);
-        stdin.setRawMode(!!wasRaw); stdin.pause();
-        process.stdout.write('\n');
-        return resolve(buf || dflt);
-      }
-      if (ch === '\u0003') { process.stdout.write('\n'); process.exit(130); }
-      if (ch === '\u007f' || ch === '\b') { buf = buf.slice(0, -1); return; }
-      buf += ch;
+    // One 'data' event carries a CHUNK, not a keystroke — see memhouse/secret-input.js
+    // for why that distinction is load-bearing and what it broke.
+    let done = false;
+    const onData = (chunk) => {
+      if (done) return;
+      const r = consumeSecretChunk(buf, chunk);
+      buf = r.buf;
+      if (r.interrupted) { process.stdout.write('\n'); process.exit(130); }
+      if (!r.done) return;
+      done = true;
+      stdin.removeListener('data', onData);
+      stdin.setRawMode(!!wasRaw); stdin.pause();
+      process.stdout.write('\n');
+      resolve(buf || dflt);
     };
     stdin.on('data', onData);
   });
@@ -325,8 +330,11 @@ Setup        onboard              interactive wizard: discover → configure →
                                   --env FILE installs from an invite file (see: invite)
              invite <name>        mint a member + house on the server and write the env
                                   file their install needs (--url --admin-user
-                                  --admin-password [--db NAME] [--out FILE]); local
-                                  machine untouched
+                                  [--admin-password, else prompted] [--db NAME]
+                                  [--out FILE]); local machine untouched. Refuses a house
+                                  that already holds someone's messages — --adopt if
+                                  sharing it is intended. Not an admin? --print-sql gives
+                                  the statements to hand to whoever is
              passwd               rotate this member's password + rewrite the env file
                                   (admin-assisted: --admin-user --admin-password)
                                   --print-sql            print the SQL, run it yourself
@@ -690,6 +698,12 @@ GRANT ALTER USER ON ${member} TO ${member};
 -- It grants no read of anyone's rows; reading a housemate's memory still needs /mem:share.
 GRANT SHOW USERS ON *.* TO ${member};
 
+-- \`memhouse relocate\` runs FROM the destination, pulling the source over remoteSecure() —
+-- a table function ClickHouse gates behind its own access type, separate from GRANT ALL on
+-- a database. Without this, relocate fails at the native-reachability probe with
+-- ACCESS_DENIED (source untouched, nothing lost — just unusable until granted).
+GRANT REMOTE ON *.* TO ${member};
+
 -- Pin async_insert on the user (ADD SETTING merges; a bare SETTINGS clause would replace
 -- the user's whole list). The pin keeps the user_id stamp honest: a MATERIALIZED
 -- currentUser() is computed during the INSERT, and an async flush stores it as the empty
@@ -805,8 +819,16 @@ async function adminBootstrap(cfg, admin) {
     // Best-effort like ALTER USER above — an admin without access-management just skips it.
     try { await q(`GRANT SHOW USERS ON *.* TO ${admin.member}`, { database: '' }); }
     catch { /* no access-management: /mem:users section 4 stays admin-only for this member */ }
+    // REMOTE: `memhouse relocate` runs FROM the destination, pulling the source over
+    // remoteSecure() — a table function ClickHouse gates behind its own access type,
+    // separate from any GRANT ALL on a database. Without it every relocate a member runs
+    // fails at the native-reachability probe with ACCESS_DENIED, source untouched, no
+    // data lost — just relocate unusable until an admin grants this by hand. Best-effort
+    // like the two grants above.
+    try { await q(`GRANT REMOTE ON *.* TO ${admin.member}`, { database: '' }); }
+    catch { /* no access-management: relocate stays admin-assisted for this member */ }
     await q(`ALTER USER ${admin.member} ADD SETTING ${MEMBER_PIN}`, { database: '' });
-    console.log(ok(`granted the house: ALL ON ${cfg.db}.* to '${admin.member}', SHOW USERS, async_insert pinned`));
+    console.log(ok(`granted the house: ALL ON ${cfg.db}.* to '${admin.member}', SHOW USERS, REMOTE, async_insert pinned`));
   } catch (e) {
     console.log(bad(`could not grant the house to '${admin.member}': ${e.message}`));
     if (createdUser) {
@@ -2898,7 +2920,7 @@ async function cmdNightly() {
  */
 async function cmdInvite() {
   const name = positional[0];
-  if (!name) { console.log('usage: memhouse invite <name> --url <house-url> --admin-user … --admin-password … [--db <house>] [--out <file>]'); return 2; }
+  if (!name) { console.log('usage: memhouse invite <name> --url <house-url> [--admin-user … [--admin-password …]] [--db <house>] [--out <file>] [--adopt] [--print-sql]'); return 2; }
   try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(name, 'member'); }
   catch (e) { console.log(bad(e.message)); return 1; }
   const cfg = resolveConfig();
@@ -2921,27 +2943,106 @@ async function cmdInvite() {
   try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(db, 'house'); }
   catch (e) { console.log(bad(e.message)); return 1; }
 
+  // The way out for someone who is NOT the administrator. Being unable to invite is not a
+  // bug to be worked around — a member holds no CREATE USER by design — but "ask your
+  // admin" is only useful if you can hand them something exact. This prints the same
+  // statements adminBootstrap would run, so the person with the credential runs four
+  // lines instead of installing anything. Nothing is contacted and nothing is written.
+  if (flags['print-sql'] === true) {
+    const password = flags['member-password'] && flags['member-password'] !== true
+      ? String(flags['member-password']) : generatePassword();
+    console.log(`-- memhouse: give '${name}' an account and their own house on this ClickHouse.`);
+    console.log(`-- Run as a user with ACCESS MANAGEMENT (a stock 'default' will do).`);
+    console.log(memberSql(db, name, password));
+    console.log('-- Then send them these four lines — they are a credential, so use a channel');
+    console.log('-- you trust (croc, a password manager), not chat:');
+    console.log(`--   MEMHOUSE_URL='${url}'`);
+    console.log(`--   MEMHOUSE_USER='${name}'`);
+    console.log(`--   MEMHOUSE_PASSWORD='${password}'`);
+    console.log(`--   MEMHOUSE_DB='${db}'`);
+    console.log(`-- They install with:  memhouse install --url ${url} --user ${name} --password '…' --db ${db}`);
+    return 0;
+  }
+
   // Whose credential mints the member. Explicit --admin-* wins; otherwise TRY THE
-  // CONFIGURED ONE — an install made as an admin-capable ClickHouse user (access
-  // management) can invite with no extra flags, which is the common case for the person
-  // who set the house up. Fall back to asking only when the stored credential cannot
-  // read system.users (the proxy for "can it provision").
+  // CONFIGURED ONE — a `deploy --local` house makes its member the superuser
+  // (CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1), so the person who stood the house up
+  // invites with no extra flags.
   let adminUser = flags['admin-user'];
   let adminPass = flags['admin-password'];
   if (!adminUser) {
     const c = requireConfig(cfg, 'invite');
     if (!c.user) return 1;
+    // Ask what this credential may actually DO, not whether it can look at a table.
+    // The old probe was `SELECT 1 FROM system.users` — but since 0.12.6 every member is
+    // granted SHOW USERS, so every member passed it, was told "it can manage users on
+    // this house", and then died at CREATE DATABASE with a raw ACCESS_DENIED. A probe
+    // that says yes to everyone is worse than no probe: it turns "you are not an admin"
+    // into a confusing failure three steps later.
+    //
+    // chRows appends FORMAT itself, so DO NOT pass one — a statement carrying FORMAT
+    // twice is a syntax error, which the catch below turned into "no grants" and refused
+    // EVERY credential, a real superuser included. Only a clean machine could show that:
+    // this machine's credential is a member either way, so the bug was invisible here.
+    // Reachability FIRST, and reported as itself. Folding it into the grants read makes an
+    // unreachable host — a typo, a loopback-bound house, a tunnel that is down — come back
+    // as "you are only a member", which sends the reader after a privilege they already
+    // have. Caught on the testbed, where a wrong --url produced exactly that.
     try {
-      await ch({ ...c, url }, 'SELECT 1 FROM system.users LIMIT 1', { database: '' });
+      await ch({ ...c, url }, 'SELECT 1', { database: '' });
+    } catch (e) {
+      console.log(bad(`cannot reach ${url} as '${c.user}': ${netReason(e)}`));
+      console.log('  --url is the address the INVITEE will use, and invite checks it from here first.');
+      console.log('  A `deploy --local` house is bound to loopback on purpose, so no LAN address');
+      console.log('  reaches it and no invitee could either — publish it (tunnel, reverse proxy)');
+      console.log('  before inviting, or use --print-sql and let the invitee be told the address.');
+      return 1;
+    }
+    let grants = '';
+    try {
+      const g = await chRows({ ...c, url }, `SHOW GRANTS FOR ${c.user}`, { database: '' });
+      grants = g.map((r) => Object.values(r).join(' ')).join('\n');
+    } catch { /* reachable but grants unreadable — treated as "not an admin" below */ }
+    // Two capabilities, and a superuser states them in more than one shape: CREATE USER
+    // may arrive as itself or under ACCESS MANAGEMENT, and the database half may be an
+    // explicit CREATE DATABASE or the umbrella CREATE on *.* — which is what
+    // `deploy --local` grants. Match the meaning, not one spelling.
+    const canMintUsers = /\bACCESS MANAGEMENT\b|\bCREATE USER\b/.test(grants);
+    const canMintHouses = /\bCREATE DATABASE\b/.test(grants)
+      || grants.split('\n').some((l) => /\bCREATE\b/.test(l) && /\bON \*\.\*/.test(l));
+    const canProvision = canMintUsers && canMintHouses;
+    if (canProvision) {
       adminUser = c.user; adminPass = c.password;
-      console.log(ok(`inviting as your own credential '${c.user}' (it can manage users on this house)`));
-    } catch {
-      console.log(bad('your configured credential cannot create users on this house.'));
-      console.log('  Pass an admin that can:  --admin-user <a> --admin-password <p>');
+      console.log(ok(`inviting as your own credential '${c.user}' (it can create users and houses here)`));
+    } else {
+      console.log(bad(`'${c.user}' is a MEMBER of this ClickHouse, not an administrator — it cannot create accounts.`));
+      console.log('  Inviting mints a ClickHouse user and a database, which needs CREATE USER and');
+      console.log('  CREATE DATABASE. A member deliberately holds neither: that is the boundary that');
+      console.log('  keeps one housemate out of another house.');
+      console.log('');
+      console.log('  If you RUN this ClickHouse — use the admin credential you created it with');
+      console.log('  (for a stock server that is `default`); memhouse never stores it, so pass it');
+      console.log('  per invite and it is used for one connection and discarded:');
+      console.log(`     memhouse invite ${name} --url ${url} --admin-user default`);
+      console.log('     (leave --admin-password off and it is prompted for, so it stays out of');
+      console.log('      your shell history and the process list)');
+      console.log('');
+      console.log('  If SOMEONE ELSE runs it — you cannot invite, and no flag changes that.');
+      console.log('  Print the statements and send them to whoever administers the server:');
+      console.log(`     memhouse invite ${name} --url ${url} --print-sql`);
       return 1;
     }
   } else if (adminPass === undefined) {
-    console.log(bad('--admin-user given without --admin-password')); return 1;
+    // Prompt rather than refuse. A password given as --admin-password lands in the
+    // process list for the life of the request and in shell history unless the caller
+    // remembered a leading space; asking for it keeps it in this process only.
+    // Non-TTY (an agent, CI) still gets the old refusal — there is nobody to ask.
+    if (!process.stdin.isTTY) {
+      console.log(bad('--admin-user given without --admin-password (no TTY to prompt on)'));
+      return 1;
+    }
+    adminPass = await askSecret(`  password for '${adminUser}'`);
+    if (!adminPass) { console.log(bad('no password given')); return 1; }
   }
 
   // WHERE to connect to provision. --url is the address the INVITEE will use — it may be
@@ -2951,6 +3052,42 @@ async function cmdInvite() {
   // EXPLICIT --admin-* (where the admin typed the target themselves) provisions at --url.
   // Either way the invite FILE carries --url, the invitee's path.
   const provisionUrl = flags['admin-user'] ? url : cfg.url;
+
+  // Is there already a house here, with somebody's memory in it? The house is created
+  // with CREATE DATABASE IF NOT EXISTS, so inviting a name whose database already exists
+  // ADOPTS it — same output as a fresh one, and the invitee lands on top of rows that are
+  // not theirs. (The user half is safe: adminBootstrap refuses an existing ClickHouse
+  // user, so no sitting member's password is ever rotated out from under them.)
+  //
+  // Found the hard way: an invite meant for one person was sent to another, who shipped
+  // 3,733 messages under it. Re-inviting the intended person reported success and handed
+  // them the first person's memory, with nothing on any surface saying so.
+  //
+  // Read-only, best-effort: an admin that cannot count rows should not lose the ability
+  // to invite, and a house that does not exist yet is the ordinary case.
+  const adminCfg = { ...cfg, url: provisionUrl, user: adminUser, password: adminPass || '', db, stated: true };
+  let occupied = null;
+  try {
+    const exists = await chRows(adminCfg, `SELECT count() AS n FROM system.tables WHERE database = '${db.replace(/'/g, "\\'")}' AND name = 'messages'`, { database: '' });
+    if (Number(exists[0] && exists[0].n) > 0) {
+      const r = await chRows(adminCfg, 'SELECT count() AS msgs, uniqExact(user_id) AS writers FROM messages', { database: db });
+      const msgs = Number(r[0] && r[0].msgs) || 0;
+      if (msgs > 0) occupied = { msgs, writers: Number(r[0].writers) || 0 };
+    }
+  } catch { /* cannot tell — provisioning below will surface any real access problem */ }
+  if (occupied && flags.adopt !== true) {
+    console.log(bad(`house '${db}' already exists and holds ${occupied.msgs} messages from ${occupied.writers} writer(s) — NOT inviting.`));
+    console.log(`  Inviting '${name}' here would hand them somebody else's memory, and their`);
+    console.log('  first ship would land on top of it. Nothing has been changed.');
+    console.log('  Pick a different handle:   memhouse invite <other-name> --url …');
+    console.log(`  Or a different house:      memhouse invite ${name} --url … --db <house>`);
+    console.log(`  If sharing this house IS the intent, say so:  --adopt`);
+    return 1;
+  }
+  if (occupied) {
+    console.log(warn(`adopting existing house '${db}' — ${occupied.msgs} messages already here (--adopt)`));
+  }
+
   const built = await adminBootstrap({ ...cfg, url: provisionUrl, db, stated: true }, {
     user: adminUser, password: adminPass || '', member: name, quiet: true,
   });
@@ -3202,6 +3339,13 @@ async function cmdUninstall() {
   if (flags.version === true || process.argv.slice(2).some((a) => a === '-v' || a === '-V')) {
     console.log(PKG.version); return;
   }
+  // `memhouse <cmd> --help` (or `-h`) must never reach a command's own logic — passwd,
+  // invite, uninstall and friends act on first call with no separate confirm step, so a
+  // --help that fell through to the default branch would DO the thing instead of
+  // describing it. One check ahead of the switch, for every command, is the whole fix.
+  if (cmd && (flags.help === true || process.argv.slice(2).some((a) => a === '-h' || a === '--help'))) {
+    console.log(HELP); return;
+  }
   const cfg = resolveConfig();
 
   switch (cmd) {

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
-  "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: ask, search, browse, analyze, check, share, and invite across all 17 supported editors and machines. Skills install as /mem:hello, /mem:ask, /mem:search, /mem:sessions, /mem:share, /mem:invite, /mem:sql, /mem:status, and /mem:users.",
-  "version": "0.12.7",
+  "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: ask, search, browse, analyze, check, share, and invite across all 17 supported editors and machines, plus administration of the ClickHouse behind it. Skills install as /mem:hello, /mem:ask, /mem:search, /mem:sessions, /mem:share, /mem:invite, /mem:sql, /mem:status, /mem:users, and /mem:admin.",
+  "version": "0.14.0",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/delivery/plugin/skills/admin/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: admin
+description: Operate the memhouse ClickHouse as its administrator — list and inspect every user and house, provision or remove members, grant and revoke access, and read server-wide health (disk, parts, mutations, running queries). Use when the user asks to "do X as admin", "manage users", "drop a house", "see disk usage", "who is on this server", or when a member-scoped skill refused for want of privileges. Requires an admin credential; says so plainly when there is not one.
+user-invocable: true
+argument-hint: "<what you want done>"
+allowed-tools: Bash
+---
+
+# /mem:admin — operate the house as its administrator
+
+A member owns one database. An **administrator** owns the ClickHouse: every house, every
+account, every grant. This skill is the second one, and it is the only skill allowed to
+act outside the caller's own house.
+
+Everything here runs through the same rule as `/mem:invite`: **an admin password must
+never enter this conversation.** memhouse ships this transcript into the house you are
+administering, so a password pasted in chat is a password published to the archive.
+Resolve it from the environment or a file, never from a prompt, and never echo it.
+
+## 1. Find an admin credential — never ask for one in chat
+
+Try these in order and stop at the first that works. **Never print any of these files or
+the variables in them** — no `cat`, no `env | grep`, no `set -x`.
+
+```bash
+MH_HOME="${MEMHOUSE_HOME:-$HOME/.memhouse}"
+# a) an explicit admin credential in the environment
+ADM_U=${MEMHOUSE_ADMIN_USER-}; ADM_P=${MEMHOUSE_ADMIN_PASSWORD-}
+# b) an admin env file kept beside the member config
+if [ -z "$ADM_U" ] && [ -f "$MH_HOME/admin.env" ]; then
+  set -a; . "$MH_HOME/admin.env"; set +a
+  ADM_U=${MEMHOUSE_ADMIN_USER:-${MEMHOUSE_USER-}}; ADM_P=${MEMHOUSE_ADMIN_PASSWORD:-${MEMHOUSE_PASSWORD-}}
+fi
+# c) the ordinary member credential — on a house the pilot stood up themselves
+#    (memhouse deploy --local) the member IS the superuser
+set -a; [ -f "$MH_HOME/env" ] && . "$MH_HOME/env"; set +a
+: "${ADM_U:=${MEMHOUSE_USER-}}"; : "${ADM_P:=${MEMHOUSE_PASSWORD-}}"
+```
+
+Then **prove** it is actually an admin rather than assuming — a member can often read
+`system.users` while holding nothing else:
+
+```bash
+curl -sS --fail-with-body --user "$ADM_U:$ADM_P" \
+  --data-binary "SHOW GRANTS FOR $ADM_U FORMAT TSV" "$MEMHOUSE_URL/"
+```
+
+Admin means the grants carry `ACCESS MANAGEMENT`, or `CREATE USER`/`CREATE DATABASE` at
+`*.*` — not merely `SHOW USERS`, which every member has. If none of a/b/c qualifies,
+**stop and say so**:
+
+> This needs administrator access to the ClickHouse at `<url>`, and the credential
+> configured here is the member account `<user>` — it owns its own house and nothing
+> else. To use `/mem:admin`, put an admin credential in `~/.memhouse/admin.env`
+> (`MEMHOUSE_ADMIN_USER=` / `MEMHOUSE_ADMIN_PASSWORD=`, mode 600) or export
+> `MEMHOUSE_ADMIN_USER` / `MEMHOUSE_ADMIN_PASSWORD`, then ask again. Whoever operates
+> the server has it; on a house from `memhouse deploy --local` it is the account already
+> in `~/.memhouse/env`.
+
+Do not offer to carry on with reduced powers, do not suggest the user paste a password
+into the chat, and do not improvise around the refusal. Say which of a/b/c you tried.
+
+## 2. Run the request
+
+Use the resolved credential for every query. `--fail-with-body` so ClickHouse's own error
+is visible; add `&readonly=1` on anything that only reads.
+
+```bash
+adm() { curl -sS --fail-with-body --user "$ADM_U:$ADM_P" --data-binary "$1" "$MEMHOUSE_URL/${2-}"; }
+adm "SELECT …  FORMAT PrettyCompact" "?readonly=1"
+```
+
+Reads worth knowing — reach for these before inventing SQL:
+
+| Question | Query |
+|---|---|
+| who exists | `SELECT name FROM system.users ORDER BY name` |
+| what can someone do | `SHOW GRANTS FOR <user>` |
+| every house and its size | `SELECT database, formatReadableSize(sum(bytes_on_disk)) AS disk, sum(rows) AS rows FROM system.parts WHERE active GROUP BY database ORDER BY sum(bytes_on_disk) DESC` |
+| a house's rooms | `SELECT table, formatReadableSize(sum(bytes_on_disk)) AS disk, sum(rows) AS rows FROM system.parts WHERE active AND database = '<db>' GROUP BY table` |
+| who writes where | `SELECT user_id, host, count() FROM <db>.messages GROUP BY user_id, host` |
+| running queries | `SELECT query_id, user, elapsed, formatReadableSize(memory_usage) AS mem, substring(query,1,120) AS q FROM system.processes` |
+| unfinished mutations | `SELECT database, table, mutation_id, command, parts_to_do, latest_fail_reason FROM system.mutations WHERE NOT is_done` |
+| merge backlog | `SELECT database, table, elapsed, progress FROM system.merges` |
+
+Writes follow the shapes memhouse itself uses, so an admin-made member is identical to an
+invited one — a member gets `GRANT ALL ON <db>.* … WITH GRANT OPTION`, plus `SHOW USERS`,
+self-scoped `ALTER USER`, `REMOTE`, and the async-insert pin. **Prefer the CLI over raw
+SQL when one exists**: `memhouse invite <name> --url …` provisions a member correctly
+(and refuses a house that already holds someone's messages); this skill is for the things
+it does not cover.
+
+## 3. Destructive work — look first, then confirm
+
+`DROP DATABASE`, `DROP USER`, `REVOKE`, `ALTER … DELETE`, `TRUNCATE`, `KILL QUERY` and
+password rotation all change something a person depends on. There are no backups and no
+undo: a dropped house is gone, and the transcripts behind it may have aged out of the
+editors that produced them.
+
+Before any of them:
+
+1. **Look at the target and report what is actually there** — row counts per room, who
+   wrote them, the date span, which machines. A house you expected to be empty may not
+   be.
+2. **Name the collateral.** Dropping a user stops that account's shipper on every machine
+   it runs on. Revoking a grant closes a share the other person may be mid-query on.
+   Rotating a password breaks every machine shipping under it.
+3. **Get an explicit yes for that specific object**, quoting the counts you just read.
+   A general "yes do admin things" is not consent to drop a populated house.
+4. **Verify afterwards** and say what is now true.
+
+If the user has already told you exactly what to destroy and why, and the counts match
+their description, proceed — do not re-litigate a decision they have made. Report the
+outcome plainly, including the row counts destroyed.
+
+## Never
+
+Never accept an admin password typed into the conversation, and never print one — not in
+a command, not in an echo, not in an error. If a command needs it, expand a shell
+variable (`--admin-password "$ADM_P"`), so the value never appears in the transcript.
+
+Never widen a member's grants beyond what `memhouse invite` issues without the user
+asking for that specific privilege and being told what it allows. Never grant
+`ACCESS MANAGEMENT`, `CREATE USER`, or anything at `*.*` casually — those make a second
+administrator.
+
+Never touch a house that is not the subject of the request. Never run a destructive
+statement whose predicate you have not first run as a `SELECT`.

package/memhouse/delivery/plugin/skills/invite/SKILL.md

@@ -30,9 +30,10 @@ substituted into a command — that burns the credential into the transcript on
    Only ask about a **shared house** if the user brings one up; default is the invitee's
    own house (omit --db; never pass `--db default` for "the default house").
 
-3. TRY IT BARE FIRST — run this via the Bash tool. `memhouse invite` uses the caller's
-   OWN configured credential when it can manage users, which is the common case for
-   whoever set the house up, so no admin is needed:
+3. TRY IT BARE FIRST — run this via the Bash tool, from the directory the file should
+   land in (step 4). `memhouse invite` uses the caller's OWN configured credential when
+   it can manage users, which is the common case for whoever set the house up, so no
+   admin is needed:
 
    ```
    memhouse invite <name> --url <url> [--db <shared-house>]
@@ -41,25 +42,89 @@ substituted into a command — that burns the credential into the transcript on
    If it prints `invite written: …`, go to step 4 — you are done, and no admin secret
    ever touched this conversation.
 
-   ONLY if it fails with "your configured credential cannot create users" does
-   provisioning need a real admin. Do NOT take the admin password in chat — memhouse
-   archives this transcript. Hand the user the line to run THEMSELVES (a leading space
-   keeps it out of shell history):
+   Otherwise read WHICH refusal came back; they need different answers.
 
-   ```
-   memhouse invite <name> --url <url> [--db <shared-house>] --admin-user <admin> --admin-password 'PASTE_IT_HERE'
-   ```
+   **"cannot reach `<url>` …"** — nothing to do with privileges. The address is wrong,
+   or the house is bound to loopback (`memhouse deploy --local` binds to 127.0.0.1 on
+   purpose, so no LAN address reaches it and no invitee could either). Ask the user for
+   the address the invitee will actually use; do not retry with a guess.
+
+   **"`<user>` is a MEMBER of this ClickHouse, not an administrator"** — inviting needs
+   CREATE USER and CREATE DATABASE, which a member deliberately does not hold. Two cases,
+   and you must ask which one applies rather than assuming:
+
+   - **They run the ClickHouse.** They have the admin credential; memhouse never stores
+     it. Do NOT take that password in chat — memhouse archives this transcript. Hand them
+     the line to run THEMSELVES, and leave `--admin-password` OFF so it is prompted for,
+     keeping it out of both the process list and shell history:
+
+     ```
+     memhouse invite <name> --url <url> [--db <shared-house>] --admin-user <admin>
+     ```
+
+     **You cannot run that line yourself.** The prompt needs a TTY and your Bash tool has
+     none, so it refuses with "no TTY to prompt on" — and the fix is NOT to add
+     `--admin-password`, which would put the credential in this transcript. The user runs
+     it in their own terminal; you wait for them to say it is done.
+
+   - **Somebody else runs it.** They cannot invite, and no flag changes that. Print the
+     statements for whoever administers the server — this contacts nothing and needs no
+     credential:
+
+     ```
+     memhouse invite <name> --url <url> [--db <shared-house>] --print-sql
+     ```
 
-4. When it succeeds it prints `invite written: invite-<name>.env`. Relay to the user:
-   - hand `invite-<name>.env` to the invitee over a trusted channel (croc, a password
-     manager — not chat); the file IS a password
-   - the invitee runs `memhouse install --env invite-<name>.env` — it OFFERS to change
-     the password to one only they know (they were granted rotation on their own account),
-     then deletes the file; so the password you set stops working once they install
-   - once installed, sharing works: `/mem:share <name>` on either side
+     The output ends with the four `MEMHOUSE_*` lines the invitee needs. Those lines are
+     a credential: tell the user to send them over a trusted channel, and **never print
+     them into the conversation yourself**.
+
+   **If it refuses with "house `<db>` already exists and holds N messages", STOP.** That
+   house is somebody's memory, and inviting into it would hand the invitee someone else's
+   sessions. Do not pass `--adopt` on your own initiative — report the row count and the
+   writer count to the user and let them choose: a different handle, a different `--db`,
+   or `--adopt` if sharing that house is genuinely what they want.
+
+4. **Put the file where the user can attach it.** The CLI writes `invite-<name>.env`
+   into the CURRENT directory, and the user has to send it by hand — so run the command
+   from their downloads directory (on macOS and most Linux desktops `~/Downloads`), or
+   move it there afterwards. Never leave it in a git repo: it is a password, and
+   `invite-*.env` is only gitignored in this repo, not in whatever checkout the user
+   happened to be standing in.
+
+   Confirm it is there and still mode `600`, and say the full path. **Never print the
+   file's contents** — the password inside would land in a transcript memhouse ships.
+
+5. **Say whether the house was fresh.** Run
+   `memhouse stats` or query `SELECT count() FROM <db>.messages` and tell the user
+   plainly: a brand-new house reads 0. This is a second line of defence behind step 3's
+   refusal, and it is how the user learns the invitee is starting clean.
+
+6. **Write the message the user will send.** They are about to hand over a file plus an
+   explanation, so compose it for them rather than making them write it. Put it in a
+   fenced block they can copy whole, and cover:
+   - what memhouse is, in a sentence or two — the invitee may never have heard of it
+   - that the attached `invite-<name>.env` IS a password: don't forward it, don't paste
+     it into chat
+   - `npm install -g memhouse` (Node 24+, no flags, nothing compiles), then
+     `memhouse install --env invite-<name>.env`
+   - that install OFFERS to change the password to one only they know, then deletes the
+     file — so they should say yes, because the inviter knows the current one
+   - `memhouse onboard` to start shipping, `memhouse status` to check it worked
+   - that their house is theirs alone; the inviter cannot read it unless they run
+     `/mem:share <inviter>`
+
+   If the invitee is REPLACING an existing setup (they were shipping under another
+   credential), add `memhouse ship --full` after the install — a plain incremental pass
+   skips sessions the new house has no record of, so their history would not follow them.
+
+   Then: once installed, sharing works both ways — `/mem:share <name>`.
 
 ## Never
 
 Never create a ClickHouse user by running raw SQL with an admin password you were given
 in chat. Never invent an admin credential. Never suggest granting beyond what `memhouse
 invite` does. If the binary is absent, stop and say so — do not improvise the SQL.
+
+Never print the invite file's contents, and never pass `--adopt` unless the user asked
+for it after being told what is already in that house.

package/memhouse/secret-input.js

@@ -0,0 +1,39 @@
+// Consuming a hidden-input chunk, as pure logic so it can be tested without a terminal.
+//
+// The subtlety this exists for: a raw-mode stdin 'data' event carries a CHUNK, not a
+// keystroke. While someone types, each chunk happens to be one character, so a handler
+// that compares the whole chunk against '\r' looks correct for as long as anyone tests it
+// by hand. The moment a password is PASTED — which is how a credential out of a password
+// manager actually arrives — the chunk is 'hunter2\r', equal to no terminator, and the
+// prompt hangs forever with the secret sitting in the buffer. Anything piping input hits
+// the same wall.
+//
+// So: walk the chunk. Callers own the terminal; this owns the decision.
+
+const ENTER = ['\r', '\n', '\u0004'];   // CR, LF, EOT
+const INTERRUPT = '\u0003';             // ctrl-C
+const ERASE = ['\u007f', '\b'];         // DEL, BS
+
+/**
+ * Fold one chunk into the accumulated buffer.
+ *
+ * @param {string} buf      what has been read so far
+ * @param {string} chunk    the raw 'data' payload (may hold any number of characters)
+ * @returns {{buf: string, done: boolean, interrupted: boolean}}
+ *   `done` — a terminator was seen; `buf` is the final value and anything after the
+ *   terminator in the same chunk is deliberately discarded (it belongs to whatever
+ *   prompt comes next, not this one).
+ *   `interrupted` — ctrl-C was seen; the caller decides how to exit.
+ */
+function consumeSecretChunk(buf, chunk) {
+  let out = String(buf == null ? '' : buf);
+  for (const ch of String(chunk == null ? '' : chunk)) {
+    if (ch === INTERRUPT) return { buf: out, done: false, interrupted: true };
+    if (ENTER.includes(ch)) return { buf: out, done: true, interrupted: false };
+    if (ERASE.includes(ch)) { out = out.slice(0, -1); continue; }
+    out += ch;
+  }
+  return { buf: out, done: false, interrupted: false };
+}
+
+module.exports = { consumeSecretChunk };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "memhouse",
-  "version": "0.12.7",
-  "description": "memhouse — agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
+  "version": "0.14.0",
+  "description": "memhouse \u2014 agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {
     "memhouse": "./bin/memhouse.js"