memhouse 0.18.1 → 0.18.2

package/bin/memhouse.js

@@ -273,14 +273,24 @@ function portOf(u) {
 // "not running" for every correctly service-managed install, and `doctor` fails on a
 // healthy machine. Returns { running, via }.
 function shipperHealth() {
+  // "running" is the pid; whether it is DOING anything is the log. Both, always.
+  const lastPass = (() => {
+    try {
+      const passlog = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog'));
+      const f = path.join(LOG_DIR, 'shipper.log'); const st = fs.statSync(f);
+      const fd = fs.openSync(f, 'r'); const len = Math.min(st.size, 65536); const buf = Buffer.alloc(len);
+      fs.readSync(fd, buf, 0, len, st.size - len); fs.closeSync(fd);
+      return passlog.lastPass(buf.toString('utf-8'));
+    } catch { return { outcome: null }; }
+  })();
   const pid = pidOf('shipper');
-  if (pid) return { running: true, via: `daemon (pid ${pid})` };
+  if (pid) return { running: true, via: `daemon (pid ${pid})`, lastPass };
   try {
     const svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js'));
     const st = svc.status();
-    if (st.installed) return { running: st.running, via: `service (${st.kind})` };
+    if (st.installed) return { running: st.running, via: `service (${st.kind})`, lastPass };
   } catch { /* no service integration on this platform */ }
-  return { running: false, via: null };
+  return { running: false, via: null, lastPass };
 }
 
 // Room routing for the CLI's own queries. The shipper and dashboard resolve rooms through
@@ -405,7 +415,9 @@ Setup        onboard              interactive wizard: discover → configure →
                                   --print-sql            print the SQL, run it yourself
                                   with admin: --admin-user --admin-password [--member NAME]
                                   builds house + user + rooms + grants, then verifies as
-                                  the member. The admin credential is never stored.
+                                  the member. The admin credential IS written to the env
+                                  file (mode 600) so invite/members need no flags; delete
+                                  those two lines if you would rather pass it each time.
                                   --env FILE installs from an invite file (see: invite)
              invite <name>        mint a member and write the env file their install needs
                                   (--url [--db NAME] [--out FILE]; --admin-user and
@@ -969,6 +981,16 @@ function startShipperBackground(cfg) {
   console.log('  dashboard (browse / search / analyze):  memhouse start');
 }
 
+// The store is node:sqlite, stable from Node 24. On 22 everything green-lights and the
+// SQLite-backed adapters silently ship nothing — 36 messages went out before anyone noticed.
+// doctor said so; install and onboard did not. Now they refuse, with the same sentence.
+function engineOk() {
+  const major = Number(process.versions.node.split('.')[0]);
+  if (major >= 24) return true;
+  console.log(bad(`node ${process.versions.node} — need >= 24 — node:sqlite is stable there; the SQLite-backed adapters need it`));
+  process.exitCode = 1; return false;
+}
+
 async function cmdInstall({ interactive }) {
   // --env <file>: an INVITE intake. The file carries MEMHOUSE_URL/USER/PASSWORD/DB from
   // `memhouse invite` on the admin's machine; loading it into the environment BEFORE
@@ -985,6 +1007,10 @@ async function cmdInstall({ interactive }) {
     // this machine with a file that cannot authenticate on the invitee's.
     const missing = wanted.filter((k) => !parsed[k]);
     if (missing.length) { console.log(bad(`--env ${flags.env} is missing ${missing.join(', ')} — not a complete invite file?`)); return 1; }
+    try {
+      const h = new URL(String(parsed.MEMHOUSE_URL || '')).hostname;
+      if (/^(localhost|127\.0\.0\.1|\[?::1\]?)$/.test(h)) console.log(warn(`${parsed.MEMHOUSE_URL} is loopback — it points at THIS machine; only right if a tunnel or port-forward puts the house here`));
+    } catch { /* not a URL; the missing-fields check above already spoke */ }
     // Clear ambient MEMHOUSE_* so ONLY the file speaks (exported vars normally win over the
     // file; an invite intake is the one place they must not).
     for (const k of ['MEMHOUSE_URL', 'MEMHOUSE_USER', 'MEMHOUSE_PASSWORD', 'MEMHOUSE_DB', 'MEMHOUSE_PORT']) delete process.env[k];
@@ -1285,6 +1311,18 @@ async function finishInvite(cfg) {
     }
     if (go) {
       const code = await cmdPasswd({ quiet: true });
+      if (code === 0) {
+        // The rotation rewrote the env FILE. But --env hoisted the invite's values into
+        // process.env, and resolveConfig prefers process.env over the file — so the
+        // shipper spawned a few lines later got the INVITE password, which the rotation
+        // had just killed, and failed every pass with "Authentication failed" while every
+        // fresh CLI call (reading the file) worked. A drill member watched an empty house
+        // for twelve minutes. Adopt what the file now says before anything else is spawned.
+        const drift = envfile.credentialDrift(fs.readFileSync(ENV_FILE, 'utf-8'), process.env);
+        for (const k of drift.changed) process.env[k] = drift.values[k];
+        if (drift.values.MEMHOUSE_PASSWORD !== undefined && flags.password !== undefined) flags.password = drift.values.MEMHOUSE_PASSWORD;
+        if (cfg) cfg.password = process.env.MEMHOUSE_PASSWORD;
+      }
       if (code !== 0) {
         // Rotation failed and its own state may be uncertain — KEEP the invite file (it
         // still carries the password the config was just written from) so nothing is
@@ -1323,7 +1361,8 @@ function printGettingStarted(cfg) {
   console.log('                                     /mem:sql, /mem:access, /mem:admin');
   console.log(`     ${mh} search <terms>         find a past conversation right now`);
   console.log(`     ${mh} doctor                 every line a check mark = healthy`);
-  console.log('  The house keeps shipping as you work; nothing else to do.');
+  if (flags['no-ship'] === true) console.log('  Shipping is OFF (--no-ship). Start it when ready:  memhouse start');
+  else console.log('  The house keeps shipping as you work; nothing else to do.');
 }
 
 async function cmdOnboard() {
@@ -1605,7 +1644,12 @@ async function cmdStatus() {
       console.log(`     ${f.writer.padEnd(28)} ${String(f.version || '?').padEnd(8)} last ship ${fleetAge(f.ageMs)}${mark}`);
     }
   }
-  console.log(out.shipper.running ? ok(`shipper: running — ${out.shipper.via}`) : warn('shipper: not running'));
+  {
+    const fail = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).describeFailure(out.shipper.lastPass);
+    console.log(!out.shipper.running ? warn('shipper: not running')
+      : fail ? warn(`shipper: running — ${out.shipper.via} — but ${fail}`)
+      : ok(`shipper: running — ${out.shipper.via}`));
+  }
   console.log(out.daemons.dashboard ? ok(`dashboard: running (pid ${out.daemons.dashboard})`) : warn('dashboard: not running'));
   if (out.daemons.dashboard) console.log(`  dashboard → http://localhost:${runningPort(cfg)}`);
   // Exit non-zero when the house is unreachable. `status` is what a health check, a
@@ -1952,7 +1996,9 @@ async function cmdDoctor() {
       'that adapter does not extract usage; the messages are stored, the numbers are not');
   } catch { /* a house that cannot be read is already reported above */ }
   const sh = shipperHealth();
-  add(sh.running, `shipper${sh.via ? ` — ${sh.via}` : ''}`, 'memhouse start (or: memhouse service install)');
+  const shFail = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).describeFailure(sh.lastPass);
+  add(sh.running && !shFail, `shipper${sh.via ? ` — ${sh.via}` : ''}${shFail ? ` — ${shFail}` : ''}`,
+    shFail ? (sh.lastPass.auth ? 'memhouse stop && memhouse start' : 'read: ~/.memhouse/logs/shipper.log') : 'memhouse start (or: memhouse service install)');
   add(!!pidOf('dashboard'), 'dashboard daemon', 'memhouse start');
   add(fs.existsSync(path.join(REPO_ROOT, 'public', 'index.html')), 'dashboard UI built', 'built automatically by memhouse start');
 
@@ -3891,8 +3937,8 @@ async function cmdUninstall() {
     // fall through to HELP: forty lines of help and exit 0 is not what --version means.
     case 'version': console.log(PKG.version); break;
     case 'discover': await cmdDiscover(); break;
-    case 'onboard': process.exitCode = await cmdOnboard(); break;
-    case 'install': process.exitCode = await cmdInstall({ interactive: false }); break;
+    case 'onboard': if (!engineOk()) break; process.exitCode = await cmdOnboard(); break;
+    case 'install': if (!engineOk()) break; process.exitCode = await cmdInstall({ interactive: false }); break;
     case 'setup': {
       // Dual-mode like install: --yes (with any --url/--user/--password/--db/
       // --port overrides, already resolved into cfg) skips every prompt so

package/memhouse/delivery/INVITATION.md.tpl

@@ -38,6 +38,10 @@ going on. Do not print its contents — the last line of it is a password.
 {{INSTALL}}
 
 On most Linux distros the global install needs `sudo`; if `npm` says `EACCES`, that is why.
+If you handed this page to an agent and it reports that a permission classifier blocked the
+install (a global `npm install` is exactly what such classifiers stop), run this one line
+yourself in a terminal and tell the agent to continue from step 2 — that is the intended
+split: the person installs software, the agent does the rest.
 `memhouse --version` should print `{{VERSION}}`.
 
 ## 2. Join the house

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: recall past sessions and answer from them, run analytics, check the house, bring people in, and administer the server. Skills install as /mem:recall, /mem:sql, /mem:house, /mem:access, and /mem:admin.",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/envfile.js

@@ -46,4 +46,19 @@ function assertSingleLine(env) {
   }
 }
 
-module.exports = { parse, quoteShell, quoteSystemd, assertSingleLine };
+/**
+ * Which connection values in an env file's text differ from what a process currently holds.
+ * A running shipper was spawned with one credential; `install --env` rotates the password
+ * and rewrites the file, and a member can `memhouse passwd` under a running daemon. In
+ * both cases the FILE is the truth and the process copy is stale. Pure; used by the
+ * shipper (adopt on auth failure) and by install (adopt before spawning).
+ */
+function credentialDrift(text, current = {}) {
+  const file = parse(String(text || ''));
+  const keys = ['MEMHOUSE_URL', 'MEMHOUSE_USER', 'MEMHOUSE_PASSWORD', 'MEMHOUSE_DB'];
+  const changed = keys.filter((k) => file[k] !== undefined && file[k] !== current[k]);
+  const values = Object.fromEntries(changed.map((k) => [k, file[k]]));
+  return { changed, values };
+}
+
+module.exports = { credentialDrift, parse, quoteShell, quoteSystemd, assertSingleLine };

package/memhouse/provision.js

@@ -61,7 +61,10 @@ function plan({ db, member, password = null }) {
     { sql: `CREATE DATABASE IF NOT EXISTS ${db}`, why: 'the house', optional: false },
   ];
   if (password !== null) {
-    steps.push({ sql: `CREATE USER IF NOT EXISTS ${member} IDENTIFIED BY ${sqlString(password)}`, why: 'the member', optional: false });
+    // No IF NOT EXISTS. The live path checks first and refuses an existing user; the printed
+    // plan used to no-op here, apply the grants, and hand out a password the server never saw —
+    // found on a realm that mints its own users. Now it fails loudly on line one instead.
+    steps.push({ sql: `CREATE USER ${member} IDENTIFIED BY ${sqlString(password)}`, why: 'the member — fails if it already exists; then this password is NOT theirs', optional: false });
   }
   steps.push(
     { sql: roomGrant(db, member), why: `their rooms — ${db}.${roomPattern(member)} — and nothing else in the house`, optional: false },

package/memhouse/shipper/passlog.js

@@ -0,0 +1,37 @@
+// What the shipper's log says about its LAST pass.
+//
+// A daemon whose every pass fails is "running" by pid. A drill member's shipper failed
+// auth for twelve minutes while `status` said "shipper: running" and `doctor` was green,
+// and she — and her agent — read an empty house as "still catching up". The log beside
+// it had the answer on every pass. This reads it. Pure; the CLI reads the file.
+//
+// Lines have no timestamps, so "last" is textual order: the later of the last success
+// line and the last failure line wins.
+
+const OK = /\[memhouse\] shipped (\d+) sessions[^\n]*?→ (\d+) msg rows/;
+const FAIL = /\[memhouse\] pass failed: ([^\n]*)/;
+
+/** @returns {{outcome:'ok'|'failed'|null, sessions?:number, rows?:number, why?:string, auth?:boolean}} */
+function lastPass(logText) {
+  const text = String(logText || '');
+  let lastOk = -1; let lastFail = -1; let okM = null; let failM = null;
+  for (const m of text.matchAll(new RegExp(OK.source, 'g'))) { lastOk = m.index; okM = m; }
+  for (const m of text.matchAll(new RegExp(FAIL.source, 'g'))) { lastFail = m.index; failM = m; }
+  if (lastOk < 0 && lastFail < 0) return { outcome: null };
+  if (lastFail > lastOk) {
+    const why = failM[1].trim();
+    return { outcome: 'failed', why, auth: /Authentication failed|ACCESS_DENIED|Not enough privileges/i.test(why) };
+  }
+  return { outcome: 'ok', sessions: Number(okM[1]), rows: Number(okM[2]) };
+}
+
+/** One line for a person: null when there is nothing to say (no passes yet, or the last one was fine). */
+function describeFailure(lp) {
+  if (!lp || lp.outcome !== 'failed') return null;
+  const why = lp.why.length > 90 ? `${lp.why.slice(0, 87)}…` : lp.why;
+  return lp.auth
+    ? `the last pass FAILED — ${why} — restart it: memhouse stop && memhouse start`
+    : `the last pass FAILED — ${why} — see: memhouse doctor`;
+}
+
+module.exports = { lastPass, describeFailure };

package/memhouse/shipper/ship.js

@@ -1251,7 +1251,7 @@ async function printStats(client) {
 
 async function main() {
   const argv = process.argv.slice(2);
-  const client = makeClient();
+  let client = makeClient();
   try {
     if (argv.includes('--ensure-schema')) {
       const n = await ensureSchema(client);
@@ -1289,6 +1289,7 @@ async function main() {
           `${r.msgRows} msg rows, ${r.toolRows} tool rows in ${((Date.now() - t0) / 1000).toFixed(1)}s`);
       } catch (e) {
         failed = true;
+        var adoptedCredential = false;
         // A connection failure arrives as an AggregateError whose own `message` is empty,
         // so this printed "[memhouse] pass failed:" and nothing else, after 35 lines of
         // driver internals. Dig out a cause and name the fix; `status` and `doctor`
@@ -1299,7 +1300,22 @@ async function main() {
         if (/ECONNREFUSED|fetch failed|ENOTFOUND|EAI_AGAIN|socket hang up/i.test(why + causes.join(' '))) {
           console.error(`[memhouse] ${process.env.MEMHOUSE_URL} did not answer — is the house running?`);
         } else if (/Authentication failed|ACCESS_DENIED|Not enough privileges/i.test(why)) {
-          console.error(`[memhouse] the credential in ${process.env.MEMHOUSE_HOME || '~/.memhouse'}/env was rejected by ${process.env.MEMHOUSE_URL}`);
+          // This process was spawned with one credential; the env FILE may hold a newer one
+          // — `install --env` rotates the invite password and rewrites the file, and
+          // `memhouse passwd` can run under a live daemon. Retrying the dead copy for
+          // 300s a pass while the file beside it is right is what a drill member watched
+          // for twelve minutes. Adopt the file, rebuild the client, retry now.
+          const envPath = require('path').join(process.env.MEMHOUSE_HOME || require('path').join(require('os').homedir(), '.memhouse'), 'env');
+          let drift = { changed: [] };
+          try { drift = require('../envfile').credentialDrift(require('fs').readFileSync(envPath, 'utf-8'), process.env); } catch { /* no file: nothing to adopt */ }
+          if (drift.changed.length) {
+            for (const k of drift.changed) process.env[k] = drift.values[k];
+            client = makeClient();
+            adoptedCredential = true;
+            console.error(`[memhouse] ${envPath} holds a newer ${drift.changed.map((k) => k.replace('MEMHOUSE_', '').toLowerCase()).join('/')} — adopting it and retrying now`);
+          } else {
+            console.error(`[memhouse] the credential this shipper holds was rejected by ${process.env.MEMHOUSE_URL} (and ${envPath} says the same)`);
+          }
         } else if (/does not exist|UNKNOWN_TABLE|UNKNOWN_DATABASE/i.test(why)) {
           console.error('[memhouse] the house is missing a room this pass needed');
         }
@@ -1314,7 +1330,7 @@ async function main() {
       }
       full = false; // --full applies to the first pass only; loop passes stay incremental
       if (loop) {
-        const waitMs = failed ? Math.min(retryMs, intervalSec * 1000) : intervalSec * 1000;
+        const waitMs = failed ? (adoptedCredential ? 1000 : Math.min(retryMs, intervalSec * 1000)) : intervalSec * 1000;
         if (failed) {
           console.error(`[memhouse] retrying in ${Math.round(waitMs / 1000)}s`);
           retryMs = Math.min(retryMs * 2, intervalSec * 1000);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "memhouse \u2014 agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {