memhouse 0.18.10 → 0.18.12

package/bin/memhouse.js

@@ -42,17 +42,7 @@ const LOG_DIR = path.join(HOME_DIR, 'logs');
 const argv = process.argv.slice(2);
 const cmd = argv[0] && !argv[0].startsWith('-') ? argv[0] : null;
 const rest = cmd ? argv.slice(1) : argv;
-const flags = {};
-const positional = [];
-for (let i = 0; i < rest.length; i++) {
-  const a = rest[i];
-  if (a.startsWith('--')) {
-    const key = a.slice(2);
-    const next = rest[i + 1];
-    if (next !== undefined && !next.startsWith('--')) { flags[key] = next; i++; }
-    else flags[key] = true;
-  } else positional.push(a);
-}
+const { flags, positional } = require(path.join(REPO_ROOT, 'memhouse', 'flags')).parseArgv(rest);
 const JSON_OUT = flags.json === true;
 
 // Unknown flags stop the run — see memhouse/flags.js for why a shrug is not enough.
@@ -90,7 +80,7 @@ function resolveConfig() {
     url: pick('url', 'MEMHOUSE_URL', 'http://localhost:8123'),
     user: pick('user', 'MEMHOUSE_USER', 'memhouse_root'),
     password: pick('password', 'MEMHOUSE_PASSWORD', ''),
-    // The house defaults to the USER'S OWN NAME (`polat` ships into `polat.messages`),
+    // The house defaults to the USER'S OWN NAME (`sam` ships into `sam.messages`),
     // because a house is a database and the natural first house is your own. Any name
     // works — user 'alice' with house 'default' is a supported pairing.
     // ONE house name unless somebody has a reason. The member's rooms are named for them
@@ -341,6 +331,22 @@ async function ask(question, dflt) {
 // reason in .cause. `✗ not connected: fetch failed` names neither the host nor the problem,
 // while `ship` prints ECONNREFUSED for the identical condition — the three commands
 // disagreed about the same event.
+// Is `url` an HTTP endpoint that answers at all? ClickHouse's /ping needs no credential, so
+// this checks an address without sending one. Any HTTP response counts — a proxy that
+// wants auth on every path still proves the address is reachable.
+async function pingUrl(url) {
+  let target;
+  try { target = new URL('ping', String(url).endsWith('/') ? String(url) : `${url}/`); }
+  catch { return { ok: false, reason: 'not a URL' }; }
+  try {
+    await fetch(target, { signal: AbortSignal.timeout(8000), redirect: 'manual' });
+    return { ok: true };
+  } catch (e) {
+    const c = e && e.cause && (e.cause.code || e.cause.message);
+    return { ok: false, reason: c || (e && e.name === 'TimeoutError' ? 'timed out' : String(e && e.message || e)) };
+  }
+}
+
 function netReason(e) {
   const cause = e && e.cause;
   const inner = cause && (cause.message || cause.code);
@@ -358,7 +364,7 @@ function netReason(e) {
 // --admin-password (warned), then MEMHOUSE_ADMIN_PASSWORD, then the stored credential
 // of that SAME admin, then a TTY prompt. null = none, and the caller has been told how
 // to give one without putting it on the command line. See memhouse/admin-secret.js.
-async function adminPasswordFor(adminUser) {
+async function adminPasswordFor(adminUser, out = {}) {
   const as = require(path.join(REPO_ROOT, 'memhouse', 'admin-secret'));
   const file = readEnvFile();
   let r;
@@ -369,9 +375,11 @@ async function adminPasswordFor(adminUser) {
   } catch (e) { console.log(bad(e.message)); return null; }
   // stderr: `members --json` and friends must emit nothing but JSON on stdout.
   if (r.source === 'flag') console.error(warn(as.ARGV_WARNING));
+  out.source = r.source;
   if (r.password !== undefined) return r.password;
   if (process.stdin.isTTY) {
     const p = await askSecret(`  password for '${adminUser}'`);
+    out.source = 'prompt';
     if (p) return p;
     console.log(bad('no password given'));
     return null;
@@ -762,7 +770,7 @@ function printLocalHouseOffer(engines) {
 // The ClickHouse user IS the identity; rooms are named for whatever the server answers
 // to currentUser(). The home directory only produces a SUGGESTION, and a suggestion that
 // had to be changed is printed rather than applied quietly — sanitizing collides
-// (`ramazan.polat` and `ramazan-polat` both land on `ramazan_polat`), so the human has to
+// (`jane.doe` and `jane-doe` both land on `jane_doe`), so the human has to
 // see it.
 function suggestMember() {
   const base = path.basename(os.homedir() || '');
@@ -1079,7 +1087,7 @@ async function cmdInstall({ interactive }) {
     for (const k of wanted) process.env[k] = parsed[k];
     // The invite also carries what the inviter's house is ON: its channel (a `team` house
     // is 0.18.x, published under `team`). Dropping it wrote an env with no pin, and the
-    // member's first `memhouse update` followed `latest` — zeo's 0.17 line — and
+    // member's first `memhouse update` followed `latest` — then the 0.17 line — and
     // downgraded a working team install onto the wrong layout. A flag still wins.
     for (const k of ['MEMHOUSE_CHANNEL', 'MEMHOUSE_EDITORS', 'MEMHOUSE_CLAUDE_ROOTS']) if (parsed[k]) process.env[k] = parsed[k];
     console.log(ok(`using the invite file ${String(flags.env)} (nothing persisted until the install proves out)`));
@@ -2248,15 +2256,31 @@ function installKind() {
 async function cmdUpdate() {
   const { kind, root } = installKind();
   const cfg0 = resolveConfig();
-  // --channel pins for this run AND every later one: the point of pinning is that the next
-  // person to type `memhouse update` does not have to remember it.
-  if (flags.channel && flags.channel !== true && String(flags.channel) !== cfg0.channel) {
-    writeEnvFile({ ...cfg0, channel: String(flags.channel) });
-    console.log(ok(`channel pinned in ${short(ENV_FILE)}: ${flags.channel}`));
-  }
-  const pinned = flags.channel && flags.channel !== true ? String(flags.channel) : (cfg0.channel || null);
+  const asked = flags.channel && flags.channel !== true ? String(flags.channel) : null;
+  // What is PINNED is what the env file says. resolveConfig folds --channel into cfg0, so
+  // comparing the flag with cfg0.channel compared it with itself, and the pin was never
+  // written at all.
+  const stored = readEnvFile().MEMHOUSE_CHANNEL || null;
+  const pinned = asked || cfg0.channel || null;
   const tags = await chan.fetchTags();
   const pick = chan.pickChannel({ version: PKG.version, pinned, tags });
+  // --channel pins for this run AND every later one: the point of pinning is that the next
+  // person to type `memhouse update` does not have to remember it. Only a channel the
+  // registry actually has is pinned. The pin used to be written before anything was
+  // checked, so `--channel tema` (or any typo) left every later `update` following a tag
+  // that does not exist, --no-install included, which checks no channel at all (A5).
+  if (asked && asked !== stored) {
+    if (!tags) {
+      console.log(warn(`the registry did not answer, so channel '${asked}' cannot be checked — not pinned`));
+    } else if (!tags[asked]) {
+      console.log(bad(`no channel '${asked}' on the registry — nothing pinned, nothing changed`));
+      console.log(`  channels: ${Object.keys(tags).join(', ')}`);
+      return 1;
+    } else {
+      writeEnvFile({ ...cfg0, channel: asked });
+      console.log(ok(`channel pinned in ${short(ENV_FILE)}: ${asked}`));
+    }
+  }
   const latest = pick.target;
   if (JSON_OUT && flags.check) return console.log(JSON.stringify({ kind, root, current: PKG.version, channel: pick.channel, target: pick.target, reason: pick.reason, tags }, null, 2));
   console.log(`  installed  ${PKG.version}  (${kind}: ${root})`);
@@ -2264,12 +2288,18 @@ async function cmdUpdate() {
   console.log(`  target     ${pick.target || (tags ? 'nothing to install' : 'unknown — the registry did not answer')}`);
   if (latest && latest === PKG.version && kind !== 'checkout') console.log(ok('already current'));
   if (flags.check) return 0;
-  if (!pick.channel && kind !== 'checkout') {
+  // --no-install asks for the restart and the house checks only; the files are already in
+  // place, so which channel they came from does not matter. Refusing here for want of one
+  // made the command every nightly prints for itself ("memhouse update --no-install")
+  // return 1 on exactly the builds that print it — a tarball is on no registry tag — and
+  // leave the old shipper running the old code.
+  const noInstall = flags['no-install'] === true;
+  if (!pick.channel && kind !== 'checkout' && !noInstall) {
     console.log(warn('no automatic update for this install'));
     console.log(`  ${pick.reason}`);
     return 1;
   }
-  if (pick.channel && !pick.target && kind !== 'checkout') {
+  if (pick.channel && !pick.target && kind !== 'checkout' && !noInstall) {
     console.log(bad(`channel '${pick.channel}' has no version on the registry — nothing to install, nothing changed`));
     return 1;
   }
@@ -2279,7 +2309,9 @@ async function cmdUpdate() {
     console.log('  to keep a version around: npm install -g memhouse');
     return 1;
   }
-  if (kind === 'local-dep') {
+  // --no-install installs nothing, so where the files came from does not matter: restart and
+  // check the house. The refusal used to come first and turned it away (A6).
+  if (kind === 'local-dep' && !noInstall) {
     console.log(warn('this is a project dependency, not a global install'));
     console.log(`  upgrade it where it lives: npm install memhouse@${pick.channel || 'latest'}`);
     return 1;
@@ -2292,7 +2324,7 @@ async function cmdUpdate() {
   try { svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).status(); } catch { /* unsupported platform */ }
   const wasRunning = { shipper: !!pidOf('shipper'), dashboard: !!pidOf('dashboard') };
 
-  if (flags['no-install'] === true) {
+  if (noInstall) {
     // The files were already replaced by other means — a hand-typed `npm i -g`, a tarball,
     // a configuration manager. The npm/git half is exactly what such a pilot has already
     // done, and the half a bare install leaves undone (restart, migrations, schema heal)
@@ -2326,7 +2358,9 @@ async function cmdUpdate() {
       return 1;
     }
   }
-  console.log(ok('files updated'));
+  // Said only when something was installed. Under --no-install it claimed "files updated"
+  // for files nobody touched (A6).
+  if (!noInstall) console.log(ok('files updated'));
   // The house may have been converted to the one layout since this machine last ran:
   // the member's rooms moved from <name>.* to mem.<name>_*. Fix the env here, before the
   // shipper restarts, or its first pass refuses the old address forever.
@@ -2466,7 +2500,7 @@ async function cmdUpdate() {
 // Every Claude Code instance on this machine, not just the default one.
 //
 // A pilot rarely has one. `~/.claude` is the stock install, `CLAUDE_CONFIG_DIR` points at
-// whichever they are running right now, and Kommander-style playbooks live under
+// whichever they are running right now, and playbook installs live under
 // `~/.claude-playbooks/<name>[/playbook]`, each a complete config directory with its own
 // skills/. Installing into one and calling it done leaves /mem:recall missing from
 // every other instance the pilot uses — silently, because a missing skill does not announce
@@ -3709,14 +3743,36 @@ async function cmdInvite() {
   // itself is tried below — which works for whoever set the house up as its superuser.
   if (flags['admin-user'] === true) { console.log(bad('--admin-user needs a name, e.g. --admin-user default')); return 1; }
   let adminUser = (flags['admin-user'] ? String(flags['admin-user']) : '') || cfg.adminUser || undefined;
+  // Who named this admin decides where its credential may go (G4, memhouse/invite-target.js):
+  // one given for this command provisions at --url; one this install keeps provisions only
+  // at the house it was saved for.
+  const adminUserSource = flags['admin-user'] ? 'flag'
+    : (process.env.MEMHOUSE_ADMIN_USER ? 'env' : (adminUser ? 'file' : 'member'));
   let adminPass;
+  const pwSource = {};
   if (adminUser) {
     // --admin-password-file / --admin-password / MEMHOUSE_ADMIN_PASSWORD / the stored one
     // for this same admin / a prompt. `--admin-user` as a flag used to switch the
     // environment off, so the only scriptable path put the password on argv.
-    adminPass = await adminPasswordFor(adminUser);
+    adminPass = await adminPasswordFor(adminUser, pwSource);
     if (adminPass === null) return 1;
   }
+  const target = require(path.join(REPO_ROOT, 'memhouse', 'invite-target'))
+    .provisionTarget({ url, storedUrl: configuredUrl, adminUserSource, passwordSource: pwSource.source || null });
+  if (target.error) { console.log(bad(target.error)); return 1; }
+  // A stored credential is never sent to --url, so check that the INVITEE can reach it
+  // without one: ClickHouse answers /ping unauthenticated.
+  if (target.stored) {
+    const reach = await pingUrl(url);
+    if (!reach.ok) {
+      console.log(bad(`cannot reach ${url}: ${reach.reason}`));
+      console.log('  --url is the address the INVITEE will use, and invite checks it from here first.');
+      console.log('  A `deploy --local` house is bound to loopback on purpose, so no LAN address');
+      console.log('  reaches it and no invitee could either — publish it (tunnel, reverse proxy)');
+      console.log('  before inviting, or use --print-sql and let the invitee be told the address.');
+      return 1;
+    }
+  }
   if (!adminUser) {
     const c = requireConfig(cfg, 'invite');
     if (!c.user) return 1;
@@ -3735,20 +3791,18 @@ async function cmdInvite() {
     // unreachable host — a typo, a loopback-bound house, a tunnel that is down — come back
     // as "you are only a member", which sends the reader after a privilege they already
     // have. Caught on the testbed, where a wrong --url produced exactly that.
+    // The member credential is stored, so it is checked against the house it was saved for
+    // (target.url), never against --url; --url's reachability was checked above, unauthenticated.
     try {
-      await ch({ ...c, url }, 'SELECT 1', { database: '' });
+      await ch({ ...c, url: target.url }, 'SELECT 1', { database: '' });
     } catch (e) {
-      console.log(bad(`cannot reach ${url} as '${c.user}': ${netReason(e)}`));
-      console.log('  --url is the address the INVITEE will use, and invite checks it from here first.');
-      console.log('  A `deploy --local` house is bound to loopback on purpose, so no LAN address');
-      console.log('  reaches it and no invitee could either — publish it (tunnel, reverse proxy)');
-      console.log('  before inviting, or use --print-sql and let the invitee be told the address.');
+      console.log(bad(`cannot reach your house ${target.url} as '${c.user}': ${netReason(e)}`));
       return 1;
     }
     // What this credential may do, judged from its own grants and SCOPE-AWARE — a member
     // holds CREATE DATABASE inside `ON <their-db>.*`, which mints no new house at all.
     // Shared with `whoami` so the two can never disagree about who is an administrator.
-    const caps = capabilitiesFrom(await readGrants({ ...c, url }, c.user));
+    const caps = capabilitiesFrom(await readGrants({ ...c, url: target.url }, c.user));
     if (caps.canProvision) {
       adminUser = c.user; adminPass = c.password;
       console.log(ok(`inviting as your own credential '${c.user}' (it can create users and houses here)`));
@@ -3771,13 +3825,12 @@ async function cmdInvite() {
     }
   }
 
-  // WHERE to connect to provision. --url is the address the INVITEE will use — it may be
-  // a LAN IP or tunnel that is not this admin's own endpoint, and sending the stored
-  // credential there would hand it to whatever answers a typo'd or hostile --url. So the
-  // stored-credential path provisions at the admin's OWN configured cfg.url; only an
-  // EXPLICIT --admin-* (where the admin typed the target themselves) provisions at --url.
-  // Either way the invite FILE carries --url, the invitee's path.
-  const provisionUrl = flags['admin-user'] ? url : cfg.url;
+  // WHERE to connect to provision: decided above by provisionTarget(). A stored credential
+  // provisions at the house it was saved for; one given for this command, at --url. Either
+  // way the invite FILE carries --url, the invitee's path. (This used to read
+  // `flags['admin-user'] ? url : cfg.url` — but cfg.url IS --url once the flag is given, so
+  // the stored credential went to whatever --url named.)
+  const provisionUrl = target.url;
 
   // Is there already a house here, with somebody's memory in it? The house is created
   // with CREATE DATABASE IF NOT EXISTS, so inviting a name whose database already exists
@@ -4037,8 +4090,10 @@ async function cmdUninstall() {
   //
   //   (default)         daemons, service, runtime state. Config and identity KEPT.
   //   --credentials     also forget the house: the env file, with its password.
-  //   --full-removal    all of MEMHOUSE_HOME, fingerprint included. The next install is a
-  //                     NEW host whose rows do not join this machine's history.
+  //   --full-removal    all of MEMHOUSE_HOME, host.json included. The next install
+  //                     derives the same fingerprint from the OS machine id (0.18.6+), so it
+  //                     is the same host unless the machine was renamed meanwhile or has no
+  //                     readable machine id (then it falls back to random: a new host).
   //
   // No tier touches the house: transcripts live in ClickHouse and re-ship from the local
   // session stores regardless.
@@ -4059,8 +4114,9 @@ async function cmdUninstall() {
     if (flags.yes !== true && process.stdin.isTTY) {
       const id = hostjs.read(HOME_DIR);
       console.log(warn(`--full-removal also discards this machine's host identity${id ? ` (${id.id})` : ''}.`));
-      console.log('  Rows already shipped keep that name, a future install gets a new one, and');
-      console.log("  this machine then reads as two. Your transcripts themselves are safe.");
+      console.log('  A reinstall derives it again from this machine\'s own id, so it normally comes');
+      console.log('  back the same — unless the machine is renamed first, or has no readable machine');
+      console.log("  id, and then it reads as two machines. Your transcripts themselves are safe.");
       const a = (await ask('Remove everything, including the host identity? (yes/no)', 'no')).toLowerCase();
       if (a !== 'yes' && a !== 'y') { console.log('aborted — daemons are stopped, nothing was removed'); return; }
     }
@@ -4556,7 +4612,7 @@ async function cmdUninstall() {
         process.exitCode = 2; break;
       }
       // Who owns this house. A local deploy is the pilot's own machine and their own
-      // memory, so the house user is THEM — suggested from the OS username (`polat`, not
+      // memory, so the house user is THEM — suggested from the OS username (`sam`, not
       // `memhouse_root`) — created by the container itself at first init with full
       // rights. No admin/member split, no provisioning dance: a URI and a credential is
       // the whole install. The name is fixed at volume init exactly like the password,
@@ -4617,7 +4673,7 @@ async function cmdUninstall() {
       // STATED sources only, then the house user. priorCfg.db is unusable here: resolveConfig
       // computes a DEFAULT for it (the user's name, itself defaulted), so going through it
       // handed a fresh deploy `memhouse_root` as the house name while the superuser was
-      // 'polat' — the memory would live in a database named after a role account nobody
+      // 'sam' — the memory would live in a database named after a role account nobody
       // chose.
       const targetDb = flags.db || process.env.MEMHOUSE_DB || readEnvFile().MEMHOUSE_DB || 'mem';
       // Same check install runs, but EARLY — deploy initialises the container volume and

package/docs/guides/admin-password.md

@@ -40,7 +40,7 @@ options. It never hangs, and it never guesses.
 The best form: the value exists only in the one command's environment.
 
 ```bash
-with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:house-admin -- \
   memhouse invite alice --url https://house.example.com --admin-user default
 
 # 1Password

package/docs/guides/configuration.md

@@ -33,7 +33,7 @@ it:
 
 ```
 Watched directories (override with the variable shown, in the env file):
-    claude       ~/.claude, ~/.claude-playbooks/kommander, …   [MEMHOUSE_CLAUDE_ROOTS]
+    claude       ~/.claude, ~/.claude-playbooks/work, …        [MEMHOUSE_CLAUDE_ROOTS]
     codex        ~/.codex                                      [MEMHOUSE_CODEX_ROOTS]
     gemini-cli   ~/.gemini                                     [MEMHOUSE_GEMINI_CLI_ROOTS]
     cursor       ~/Library/Application Support/Cursor/User, …  [built-in]
@@ -43,7 +43,7 @@ Two kinds of line in the env file narrow it, or `--editors` / `--claude-roots` a
 
 ```
 MEMHOUSE_EDITORS='claude'
-MEMHOUSE_CLAUDE_ROOTS='~/.claude-playbooks/kommander-chaos'
+MEMHOUSE_CLAUDE_ROOTS='~/.claude-playbooks/work-team'
 ```
 
 - `MEMHOUSE_EDITORS` names the adapters to run.

package/docs/guides/install.md

@@ -64,7 +64,7 @@ MEMHOUSE_PASSWORD=… memhouse install --url https://house.example.com --user al
 memhouse install --env invite-alice.env
 
 # you hold the server's admin: memhouse creates the member, then ships as the member
-with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:house-admin -- \
   memhouse install --url https://house.example.com --admin-user default --member alice
 
 # you hold nothing: print the SQL for whoever administers the server

package/docs/guides/invite.md

@@ -33,7 +33,7 @@ memhouse invite alice --url https://house.example.com
    `--admin-password-file`, or from a prompt.
 
 ```bash
-with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:house-admin -- \
   memhouse invite alice --url https://house.example.com --admin-user default
 ```
 

package/docs/guides/storage.md

@@ -23,8 +23,8 @@ database once leaked into each other. A member can read their isolation back wit
 
 | | rooms | each member holds |
 |---|---|---|
-| alone on a laptop | `mem.polat_*` | one grant on `mem.polat_*` |
-| a team on one server | `mem.polat_*`, `mem.alice_*`, … | one grant each, on their own |
+| alone on a laptop | `mem.sam_*` | one grant on `mem.sam_*` |
+| a team on one server | `mem.sam_*`, `mem.alice_*`, … | one grant each, on their own |
 
 Reading across members is a `UNION ALL` over the rooms you hold: your own, and any shared
 with you. Naming a room you were not granted is an error, never a silent omission.
@@ -34,11 +34,14 @@ with you. Naming a room you were not granted is an error, never a silent omissio
 - **`user_id`** is stamped by the server: `MATERIALIZED currentUser()`. Async inserts are
   pinned off for members, so the stamp cannot be skipped. `WHERE user_id = 'alice'` is one
   person.
-- **`host`** is the machine. Each install mints a random fingerprint once and keeps it in
-  `$MEMHOUSE_HOME/host.json`, and every row carries `<hostname>-<8 hex>`. It is random,
-  not derived from the machine:
-  - a derived id would merge two laptops that both answer to `MacBook-Pro`;
-  - a derived id would split one machine in two when it is renamed.
+- **`host`** is the machine. Every row carries `<hostname>-<8 hex>`, where the 8 hex come
+  from a fingerprint of the OS's own machine id (IOPlatformUUID on macOS,
+  `/etc/machine-id` on Linux), hashed so the raw id never leaves the machine. It is kept in
+  `$MEMHOUSE_HOME/host.json`. It is not taken from the hostname:
+  - two laptops that both answer to `MacBook-Pro` still get different ids;
+  - a renamed machine keeps its id, and `status` reports the new name beside it;
+  - reinstalling, even after `uninstall --full-removal`, brings the same machine back
+    under the same id. Where no machine id can be read, it falls back to a random one.
 
   `memhouse status` shows this machine's id. `memhouse doctor` names every host in your
   rooms.

package/docs/guides/uninstall.md

@@ -12,8 +12,10 @@ npm uninstall -g memhouse            # then remove the package
 - **The default is the conservative one.** Stopping the shipper is routine: before an
   upgrade, while debugging, or when a laptop should go quiet for a week. It should not
   also mean "forget which house I use and who this machine is".
-- **`--full-removal` asks first.** A later reinstall mints a **new** machine identity, and
-  this machine then reads as two machines in your history.
+- **`--full-removal` asks first.** It deletes `host.json`. A later reinstall derives the
+  same identity again from the machine's own id, so your history stays one machine, unless
+  the machine was renamed in between or has no readable machine id. Then it comes back as
+  a new host.
 - **Your memory stays.** The rooms in ClickHouse are untouched by every tier. What the
   shipper wrote can be rebuilt from the local session stores with `memhouse ship --full`,
   for as long as the editors keep them.

package/docs/releases/README.md

@@ -5,6 +5,8 @@ do, how to upgrade, what is deprecated and when it goes, and what was deferred.
 
 | version | date | headline |
 |---|---|---|
+| [0.18.12](v0.18.12.md) | 2026-10-29 | skills: allowed tools restricted to read-only commands |
+| [0.18.11](v0.18.11.md) | 2026-10-10 | sessions with subagents stop re-shipping; security: no stored credential sent to `invite --url` |
 | [0.18.10](v0.18.10.md) | 2026-10-08 | security: the admin password never on argv; no member password printed; a scoped share reaches only its scope |
 
 Earlier versions: [`CHANGELOG.md`](../../CHANGELOG.md).

package/docs/releases/v0.18.10.md

@@ -8,7 +8,7 @@ A security release:
 
 Everyone on 0.18.x should upgrade.
 
-**No drill was run for this release; waived by the pilot (2026-10-08). The drill runs before 0.19.0.**
+**No drill was run for this release; waived by the maintainer (2026-10-08). The drill runs before 0.19.0.**
 
 ```bash
 memhouse update        # or: npm install -g memhouse@latest, then memhouse update --no-install
@@ -34,14 +34,14 @@ The admin-assisted commands (`install --member`, `invite`, `passwd`, `convert`,
 5. a prompt, when there is a terminal to prompt on.
 
 ```bash
-with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:house-admin -- \
   memhouse invite alice --url https://house.example.com --admin-user default
 printf '%s' "$ADMIN_PASSWORD" | memhouse invite alice --url … --admin-user default --admin-password-file -
 ```
 
 Before this release, `--admin-user` as a flag switched every other source off. The only
 scriptable admin path therefore put the password on argv, where `ps` shows it for as long
-as the command runs and shell history keeps it. Found by O's sandbox rehearsal (finding 6).
+as the command runs and shell history keeps it. Found in a sandbox rehearsal (finding 6).
 With no source and no terminal, the command stops and prints the three ways above instead
 of hanging or guessing.
 
@@ -179,7 +179,7 @@ before release by four models. Three said "ship with fixes"; the fourth said "do
 mostly for pre-existing issues. Its pre-tag fixes are not all done, and this release was
 not held for them.
 
-Status of the 0.18.10 pre-tag list (`review-0.18.10-consolidated`):
+Status of the 0.18.10 pre-tag list (the consolidated pre-tag review):
 
 | item | what | status |
 |---|---|---|
@@ -197,7 +197,7 @@ Status of the 0.18.10 pre-tag list (`review-0.18.10-consolidated`):
 | G4 | `invite --url` connects with the stored credential to the invitee-facing URL | deferred to 0.18.11 (security) |
 | G26 | skills point at `../reference/HOUSE.md`; the file is `../../reference/HOUSE.md` | deferred to 0.18.11 |
 | G11 | an idle house's dashboard goes empty after the stats TTL | deferred to 0.18.11 |
-| GLM-F1 | a subagent file read before its first line is written re-sorts its siblings | deferred to 0.18.11 (with the RC) |
+| SUB-1 | a subagent file read before its first line is written re-sorts its siblings | deferred to 0.18.11 (with the RC) |
 
 ## Documentation
 
@@ -219,8 +219,8 @@ every tag and what it changed.
 - CI is green on `main` at the release commit: the syntax gate, unit tests, the
   one-layout and invite matrices, and a headless e2e on ClickHouse 25.11 and 26.7.
 - No live house was touched to prepare this release.
-- **No drill was run for this release; waived by the pilot (2026-10-08). The drill runs before 0.19.0.**
+- **No drill was run for this release; waived by the maintainer (2026-10-08). The drill runs before 0.19.0.**
   `AGENTS.md` asks for a drill before a release that changes a surface a person touches,
   and this one changes install, invite and share. A drill was prepared on the testbed, but
-  its setup was refused by this session's permission layer, and the pilot chose to release
+  its setup could not run in the release environment, and the maintainer chose to release
   without it.