memhouse 0.18.11 → 0.18.12

package/AGENTS.md

@@ -3,18 +3,18 @@
 Conventions for any coding agent in this repository — Claude Code, Codex, Gemini CLI,
 OpenCode, whatever comes next. `CLAUDE.md` points here; this file is the canonical copy.
 
-Constellation-wide rules (worktrees, branch naming, never pushing to `ramazanpolat/*`)
-live in [`~/agent-realm/CLAUDE.md`](../CLAUDE.md) and are not repeated here.
+Constellation-wide rules (worktrees, branch naming, which remotes are frozen) live in the
+parent directory's [`CLAUDE.md`](../CLAUDE.md) and are not repeated here.
 
 
 ## Release lines — read before tagging, publishing, or merging a release
 
-memhouse shipped two lines while zeo ran the pre-0.18 layout. Since its conversion there
-is one line; the rules below are kept because a second line can happen again.
+memhouse shipped two lines while the first production house ran the pre-0.18 layout. Since
+its conversion there is one line; the rules below are kept because a second line can happen again.
 
 | line | git branch | npm dist-tag | versions | who installs it |
 |---|---|---|---|---|
-| the one line | `main` (default) | `latest`, and `team` as an alias | 0.18.x | everyone — `npm install -g memhouse` (zeo was converted to the one layout with `memhouse convert`; `release/0.17` is retired) |
+| the 0.18 line | `release/0.18` (cut at v0.18.11; `main` stays the default branch) | `latest`, and `team` as an alias | 0.18.x | everyone — `npm install -g memhouse` (the production house was converted to the one layout with `memhouse convert`; `release/0.17` is retired) |
 
 Rules, each learned once:
 
@@ -28,18 +28,17 @@ Rules, each learned once:
   its own CHANGELOG entry, never assumed. The one-layout (0.18) renamed every room to
   `<member>_*`; anything touching room names ports with care (`house/HOUSE.md`).
 - **`memhouse update` follows the channel a machine was installed from** (`MEMHOUSE_CHANNEL`),
-  so a zeo machine never receives a team build by accident, and vice versa.
+  so a machine on the old line never receives a team build by accident, and vice versa.
 - **`master` is retired.** It was the pre-0.18 default; `main` is the default now. Do not
   branch from it, tag on it, or push to it.
 - **A publish is live when `npm view` says so.** `npm publish` prints `+ memhouse@x.y.z`;
   confirm with `npm view memhouse dist-tags --prefer-online`. A version that seems missing
   right after a publish is registry lag or a stale local npm cache (`npm cache verify`),
   not a "staged" publish. That misdiagnosis cost three releases.
-- **Which token.** The pilot's publish token lives in the macOS keychain as `npmjs-token`
-  (`~/.pilot-profile/online/npm.md` has the temp-userconfig recipe). Lend it to the one
-  command; never print it.
-- **One owner per line at a time.** Before releasing, check `ListAgents`/herdr for another
-  session on the same repo and agree who cuts it; the release record lives in `CHANGELOG.md`
+- **Which token.** The publish token is a secret reference, resolved at the moment of use
+  and lent to the one `npm publish` (a temporary userconfig); never print it.
+- **One owner per line at a time.** Before releasing, check for another
+  session working on the same repo and agree who cuts it; the release record lives in `CHANGELOG.md`
   on the line's branch and in `drills/`.
 
 ## What memhouse is

package/CHANGELOG.md

@@ -4,6 +4,19 @@ Versions before 0.8.0 were beta-only. Beta installs of 0.7.x and earlier should
 uninstall and reinstall — the 0.8.0 layout is new, and an in-place `update` +
 migration path is planned work, not a promise the old versions can cash.
 
+## 0.18.12 — 2026-10-29
+
+Release notes: [`docs/releases/v0.18.12.md`](docs/releases/v0.18.12.md).
+
+- **Skills:** each `/mem` skill's `allowed-tools` is restricted to the read-only memhouse
+  commands it teaches, instead of `Bash` as a whole. Any other command goes through the
+  normal permission prompt. `memhouse update` refreshes installed skills; then
+  `/reload-plugins`.
+- `misc/skill-allowlist-test.js` and `misc/env-guard-test.js` join `npm test`. Test tooling
+  reads its deploy targets from an untracked `deploy/targets.env`, and fixtures use stand-ins.
+- The 0.18 line is cut from `release/0.18`.
+- No drill was run for this patch release.
+
 ## 0.18.11 — 2026-10-10
 
 Release notes: [`docs/releases/v0.18.11.md`](docs/releases/v0.18.11.md). Read its upgrade
@@ -14,7 +27,7 @@ subagents once.
 - **Security:** `invite` no longer sends a stored credential to `--url` (G4).
 - The 0.18.10 pre-tag list is finished, and the gentar kit is v0.9.3.
 - The dashboard ships the license notices of every package it bundles (`public/THIRD_PARTY_NOTICES.txt`).
-- **No drill was run for this release; waived (2026-10-08) under the pilot's 0.18.10 ruling. The drill runs before 0.19.0.**
+- **No drill was run for this release; waived (2026-10-08) under the maintainer's 0.18.10 ruling. The drill runs before 0.19.0.**
 
 - **The dashboard now ships the license notices of what it bundles.** The built dashboard
   (`public/`) includes React, chart.js, lucide-react (ISC), react-markdown, the remark and
@@ -78,7 +91,7 @@ subagents once.
   earlier time than a sibling's, it moved ahead of it, renumbered every sibling after it,
   and the session forked and re-shipped whole. Now the shipper waits a pass (`held for one
   pass` in the log) and ranks it by its real start time. A file that never gets a
-  timestamped line stops holding the session after 10 minutes. (GLM-F1)
+  timestamped line stops holding the session after 10 minutes. (SUB-1)
 - **An option that takes no value no longer swallows the next word.**
   - `memhouse update --no-install yes` set no-install to "yes", and ran the npm install it
     was told to skip.
@@ -138,7 +151,7 @@ changed, the upgrade steps, and the status of the 0.18.10 pre-tag list.
 
 - **A security release; everyone on 0.18.x should upgrade.** It covers G23 (#20), the admin
   password off argv (#14) and the scoped share boundary (#13).
-- **No drill was run for this release; waived by the pilot (2026-10-08). The drill runs before 0.19.0.**
+- **No drill was run for this release; waived by the maintainer (2026-10-08). The drill runs before 0.19.0.**
 - **Moved to 0.18.11:** the subagent re-ship fix and the gentar kit v0.9.3 bump.
 - **Docs:** the repository now meets the documentation standard (#17): a short README,
   `docs/` tutorials and guides, `examples/`, and the `AGENTS.md` install section.
@@ -165,7 +178,7 @@ changed, the upgrade steps, and the status of the 0.18.10 pre-tag list.
   stdin), from `MEMHOUSE_ADMIN_PASSWORD` (so `with-secret` lends it to one command), from a
   credential this install already keeps for the same admin, or from a prompt. Before, giving
   `--admin-user` as a flag switched every other source off, so the only scriptable admin
-  path put the password on argv, where `ps` and shell history keep it. Found by O's sandbox
+  path put the password on argv, where `ps` and shell history keep it. Found in a sandbox
   rehearsal. **Deprecation:** `--admin-password <value>` still works in this release, with a
   warning, and is **removed in 0.19.0**, the next minor release after this one (deprecated
   2026-10-08). Move scripts to `MEMHOUSE_ADMIN_PASSWORD` or `--admin-password-file`.
@@ -265,14 +278,14 @@ The upgrade path itself, and a machine that stays the same machine.
 
 ## 0.18.5 — 2026-09-18
 
-The first release on **one line**: published to `latest` and `team` alike. zeo was converted to the one layout the same evening with `memhouse convert` (six members, every row count identical before and after, shares carried).
+The first release on **one line**: published to `latest` and `team` alike. The first production house was converted to the one layout the same evening with `memhouse convert` (six members, every row count identical before and after, shares carried).
 
-- **One release line.** With zeo converted to the one layout there is no 0.17 line to keep:
+- **One release line.** With the production house converted to the one layout there is no 0.17 line to keep:
   `latest` now points at the same 0.18.x build as `team` (kept as an alias), the publish
   guard and `AGENTS.md` say so, and `release/0.17` is retired.
 
 - **`memhouse convert` — an operator moves a pre-one-layout house to the one layout.**
-  Before 0.18 each member owned a database (`polat.messages`, `ALL ON polat.*`). `convert`
+  Before 0.18 each member owned a database (`sam.messages`, `ALL ON sam.*`). `convert`
   finds every such member, renames their five rooms into `mem.<name>_*` in one atomic
   statement (nothing copied), swaps the database-wide grant for the one wildcard, carries
   whole-house shares and row policies to the new names, drops the 0.17.1 refreshable
@@ -291,7 +304,7 @@ On the `team` channel. Found by the operator's own second machine on its first `
 
 - **`memhouse update` never crosses release lines on its own.** An unpinned 0.18.2 whose
   `team` tag had moved to 0.18.3 matched no tag, and the picker fell back to `latest` —
-  zeo's 0.17.1, a different house layout. A real member was downgraded on her first update.
+  the 0.17 line's 0.17.1, a different house layout. A real member was downgraded on her first update.
   The picker now follows the tag on the install's own major.minor line, and when no tag is
   on that line, or the registry does not answer, it stops and says so; `--channel` is the
   only way across.
@@ -422,7 +435,7 @@ possible.
   every adapter is watching and the variable that changes it. A name or directory that
   does not exist is refused against that adapter, never shipped from the default instead.
 
-- **One layout.** Every member's rooms are named for them — `mem.polat_messages`,
+- **One layout.** Every member's rooms are named for them — `mem.sam_messages`,
   `mem.alice_messages` — and one grant covers them: `GRANT … ON mem.<name>_* TO <name>
   WITH GRANT OPTION`. A wildcard on the member's own name, verified on 25.11 and 26.7: it
   lets the member create and rebuild their own rooms and share them, and reaches nothing
@@ -458,7 +471,7 @@ possible.
   (25.11, the default local tag).
 
 - **Bringing a housemate into a house you already own now works, and moves nothing.** A
-  member alone in their own database holds `ALL ON polat.*`. That grant is **dynamic** —
+  member alone in their own database holds `ALL ON sam.*`. That grant is **dynamic** —
   it covers rooms created later — so a housemate's rooms would be readable *and
   droppable* by the owner the moment they existed (both measured). `invite` used to
   refuse and point at a migration command that did not exist.
@@ -574,7 +587,7 @@ possible.
   fourteen places, which names nothing in a house holding `alice_messages`. Rather than
   teach fourteen query sites about prefixes, the `q()` helper in `reference/HOUSE.md` —
   the single connection every skill routes through — now rewrites room names after
-  `FROM`/`JOIN`. A needle like `LIKE '%messages%'` is untouched, and `FROM yigit_messages`
+  `FROM`/`JOIN`. A needle like `LIKE '%messages%'` is untouched, and `FROM bob_messages`
   is left alone so a shared room still reads.
 
   Written with `[[:space:]]` classes, not `\b`: **BSD `sed` does not support `\b`**, and
@@ -823,7 +836,7 @@ possible.
 
 - **The skills no longer fall back to a hardcoded `mem` house.** A house is a database
   named for its owner — `resolveConfig` defaults `MEMHOUSE_DB` to the connection's
-  username (`polat` ships into `polat.messages`), and `memhouse invite` mints a per-user
+  username (`sam` ships into `sam.messages`), and `memhouse invite` mints a per-user
   database. But the plugin skills hardcoded `${MEMHOUSE_DB:-mem}` in their connection
   recipes, so a config missing `MEMHOUSE_DB` would silently query a `mem` house that the
   user-named convention had moved on from. All eight skills now fall back to
@@ -858,10 +871,10 @@ possible.
 - **Read a friend's shared memory by naming their house.** A share is a read-only GRANT on
   a whole house (a ClickHouse database), and the rooms resolve by the connection's
   database — so `/mem:ask`, `/mem:search` and `/mem:sql` now recognize a house named in the
-  question ("how did yigit fix X", "search … in yigit", "query yigit's house"), resolve it
+  question ("how did bob fix X", "search … in bob", "query bob's house"), resolve it
   against `SHOW DATABASES`, and point the connection at that house with your own
   credentials, read-only. A name that matches a readable house wins over the `in <project>`
-  qualifier — otherwise "in yigit" silently filtered your own project column and returned
+  qualifier — otherwise "in bob" silently filtered your own project column and returned
   nothing. `/mem:hello` now names the phrase, and `/mem:users` still lists the houses shared
   with you.
 
@@ -1042,7 +1055,7 @@ now the whole install.
   stamp cannot be skipped) and `host` (a random fingerprint minted once per install).
 - **Joining any ClickHouse is two statements**: `CREATE USER` + `GRANT ALL ON <house>.*`.
   The member's own shipper creates and evolves the rooms.
-- The house name defaults to the username (`polat` ships to `polat.messages`) and is
+- The house name defaults to the username (`sam` ships to `sam.messages`) and is
   freely decoupled (`--db`); `system` and `information_schema` are refused everywhere —
   previously `--db system` granted a member everything on the server's own database.
 - Removed: per-member suffixed rooms, Merge rooms, the narrowed grant set,

package/SECURITY.md

@@ -64,5 +64,7 @@ makes the security model short, and worth stating without varnish.
 
 ## Reporting
 
-The repository is private during beta. Report security issues to the maintainer
-directly (ramazanpolat@gmail.com) rather than in a public channel.
+The repository is private during beta. Report a security issue privately, never in a
+public issue or channel: once the repository is public, through GitHub's private
+vulnerability reporting (the **Security** tab, **Report a vulnerability**); until then,
+to the maintainer through the channel that gave you access.

package/bin/memhouse.js

@@ -80,7 +80,7 @@ function resolveConfig() {
     url: pick('url', 'MEMHOUSE_URL', 'http://localhost:8123'),
     user: pick('user', 'MEMHOUSE_USER', 'memhouse_root'),
     password: pick('password', 'MEMHOUSE_PASSWORD', ''),
-    // The house defaults to the USER'S OWN NAME (`polat` ships into `polat.messages`),
+    // The house defaults to the USER'S OWN NAME (`sam` ships into `sam.messages`),
     // because a house is a database and the natural first house is your own. Any name
     // works — user 'alice' with house 'default' is a supported pairing.
     // ONE house name unless somebody has a reason. The member's rooms are named for them
@@ -770,7 +770,7 @@ function printLocalHouseOffer(engines) {
 // The ClickHouse user IS the identity; rooms are named for whatever the server answers
 // to currentUser(). The home directory only produces a SUGGESTION, and a suggestion that
 // had to be changed is printed rather than applied quietly — sanitizing collides
-// (`ramazan.polat` and `ramazan-polat` both land on `ramazan_polat`), so the human has to
+// (`jane.doe` and `jane-doe` both land on `jane_doe`), so the human has to
 // see it.
 function suggestMember() {
   const base = path.basename(os.homedir() || '');
@@ -1087,7 +1087,7 @@ async function cmdInstall({ interactive }) {
     for (const k of wanted) process.env[k] = parsed[k];
     // The invite also carries what the inviter's house is ON: its channel (a `team` house
     // is 0.18.x, published under `team`). Dropping it wrote an env with no pin, and the
-    // member's first `memhouse update` followed `latest` — zeo's 0.17 line — and
+    // member's first `memhouse update` followed `latest` — then the 0.17 line — and
     // downgraded a working team install onto the wrong layout. A flag still wins.
     for (const k of ['MEMHOUSE_CHANNEL', 'MEMHOUSE_EDITORS', 'MEMHOUSE_CLAUDE_ROOTS']) if (parsed[k]) process.env[k] = parsed[k];
     console.log(ok(`using the invite file ${String(flags.env)} (nothing persisted until the install proves out)`));
@@ -2500,7 +2500,7 @@ async function cmdUpdate() {
 // Every Claude Code instance on this machine, not just the default one.
 //
 // A pilot rarely has one. `~/.claude` is the stock install, `CLAUDE_CONFIG_DIR` points at
-// whichever they are running right now, and Kommander-style playbooks live under
+// whichever they are running right now, and playbook installs live under
 // `~/.claude-playbooks/<name>[/playbook]`, each a complete config directory with its own
 // skills/. Installing into one and calling it done leaves /mem:recall missing from
 // every other instance the pilot uses — silently, because a missing skill does not announce
@@ -4612,7 +4612,7 @@ async function cmdUninstall() {
         process.exitCode = 2; break;
       }
       // Who owns this house. A local deploy is the pilot's own machine and their own
-      // memory, so the house user is THEM — suggested from the OS username (`polat`, not
+      // memory, so the house user is THEM — suggested from the OS username (`sam`, not
       // `memhouse_root`) — created by the container itself at first init with full
       // rights. No admin/member split, no provisioning dance: a URI and a credential is
       // the whole install. The name is fixed at volume init exactly like the password,
@@ -4673,7 +4673,7 @@ async function cmdUninstall() {
       // STATED sources only, then the house user. priorCfg.db is unusable here: resolveConfig
       // computes a DEFAULT for it (the user's name, itself defaulted), so going through it
       // handed a fresh deploy `memhouse_root` as the house name while the superuser was
-      // 'polat' — the memory would live in a database named after a role account nobody
+      // 'sam' — the memory would live in a database named after a role account nobody
       // chose.
       const targetDb = flags.db || process.env.MEMHOUSE_DB || readEnvFile().MEMHOUSE_DB || 'mem';
       // Same check install runs, but EARLY — deploy initialises the container volume and

package/docs/guides/admin-password.md

@@ -40,7 +40,7 @@ options. It never hangs, and it never guesses.
 The best form: the value exists only in the one command's environment.
 
 ```bash
-with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:house-admin -- \
   memhouse invite alice --url https://house.example.com --admin-user default
 
 # 1Password

package/docs/guides/configuration.md

@@ -33,7 +33,7 @@ it:
 
 ```
 Watched directories (override with the variable shown, in the env file):
-    claude       ~/.claude, ~/.claude-playbooks/kommander, …   [MEMHOUSE_CLAUDE_ROOTS]
+    claude       ~/.claude, ~/.claude-playbooks/work, …        [MEMHOUSE_CLAUDE_ROOTS]
     codex        ~/.codex                                      [MEMHOUSE_CODEX_ROOTS]
     gemini-cli   ~/.gemini                                     [MEMHOUSE_GEMINI_CLI_ROOTS]
     cursor       ~/Library/Application Support/Cursor/User, …  [built-in]
@@ -43,7 +43,7 @@ Two kinds of line in the env file narrow it, or `--editors` / `--claude-roots` a
 
 ```
 MEMHOUSE_EDITORS='claude'
-MEMHOUSE_CLAUDE_ROOTS='~/.claude-playbooks/kommander-chaos'
+MEMHOUSE_CLAUDE_ROOTS='~/.claude-playbooks/work-team'
 ```
 
 - `MEMHOUSE_EDITORS` names the adapters to run.

package/docs/guides/install.md

@@ -64,7 +64,7 @@ MEMHOUSE_PASSWORD=… memhouse install --url https://house.example.com --user al
 memhouse install --env invite-alice.env
 
 # you hold the server's admin: memhouse creates the member, then ships as the member
-with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:house-admin -- \
   memhouse install --url https://house.example.com --admin-user default --member alice
 
 # you hold nothing: print the SQL for whoever administers the server

package/docs/guides/invite.md

@@ -33,7 +33,7 @@ memhouse invite alice --url https://house.example.com
    `--admin-password-file`, or from a prompt.
 
 ```bash
-with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:house-admin -- \
   memhouse invite alice --url https://house.example.com --admin-user default
 ```
 

package/docs/guides/storage.md

@@ -23,8 +23,8 @@ database once leaked into each other. A member can read their isolation back wit
 
 | | rooms | each member holds |
 |---|---|---|
-| alone on a laptop | `mem.polat_*` | one grant on `mem.polat_*` |
-| a team on one server | `mem.polat_*`, `mem.alice_*`, … | one grant each, on their own |
+| alone on a laptop | `mem.sam_*` | one grant on `mem.sam_*` |
+| a team on one server | `mem.sam_*`, `mem.alice_*`, … | one grant each, on their own |
 
 Reading across members is a `UNION ALL` over the rooms you hold: your own, and any shared
 with you. Naming a room you were not granted is an error, never a silent omission.

package/docs/releases/README.md

@@ -5,6 +5,7 @@ do, how to upgrade, what is deprecated and when it goes, and what was deferred.
 
 | version | date | headline |
 |---|---|---|
+| [0.18.12](v0.18.12.md) | 2026-10-29 | skills: allowed tools restricted to read-only commands |
 | [0.18.11](v0.18.11.md) | 2026-10-10 | sessions with subagents stop re-shipping; security: no stored credential sent to `invite --url` |
 | [0.18.10](v0.18.10.md) | 2026-10-08 | security: the admin password never on argv; no member password printed; a scoped share reaches only its scope |
 

package/docs/releases/v0.18.10.md

@@ -8,7 +8,7 @@ A security release:
 
 Everyone on 0.18.x should upgrade.
 
-**No drill was run for this release; waived by the pilot (2026-10-08). The drill runs before 0.19.0.**
+**No drill was run for this release; waived by the maintainer (2026-10-08). The drill runs before 0.19.0.**
 
 ```bash
 memhouse update        # or: npm install -g memhouse@latest, then memhouse update --no-install
@@ -34,14 +34,14 @@ The admin-assisted commands (`install --member`, `invite`, `passwd`, `convert`,
 5. a prompt, when there is a terminal to prompt on.
 
 ```bash
-with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:house-admin -- \
   memhouse invite alice --url https://house.example.com --admin-user default
 printf '%s' "$ADMIN_PASSWORD" | memhouse invite alice --url … --admin-user default --admin-password-file -
 ```
 
 Before this release, `--admin-user` as a flag switched every other source off. The only
 scriptable admin path therefore put the password on argv, where `ps` shows it for as long
-as the command runs and shell history keeps it. Found by O's sandbox rehearsal (finding 6).
+as the command runs and shell history keeps it. Found in a sandbox rehearsal (finding 6).
 With no source and no terminal, the command stops and prints the three ways above instead
 of hanging or guessing.
 
@@ -179,7 +179,7 @@ before release by four models. Three said "ship with fixes"; the fourth said "do
 mostly for pre-existing issues. Its pre-tag fixes are not all done, and this release was
 not held for them.
 
-Status of the 0.18.10 pre-tag list (`review-0.18.10-consolidated`):
+Status of the 0.18.10 pre-tag list (the consolidated pre-tag review):
 
 | item | what | status |
 |---|---|---|
@@ -197,7 +197,7 @@ Status of the 0.18.10 pre-tag list (`review-0.18.10-consolidated`):
 | G4 | `invite --url` connects with the stored credential to the invitee-facing URL | deferred to 0.18.11 (security) |
 | G26 | skills point at `../reference/HOUSE.md`; the file is `../../reference/HOUSE.md` | deferred to 0.18.11 |
 | G11 | an idle house's dashboard goes empty after the stats TTL | deferred to 0.18.11 |
-| GLM-F1 | a subagent file read before its first line is written re-sorts its siblings | deferred to 0.18.11 (with the RC) |
+| SUB-1 | a subagent file read before its first line is written re-sorts its siblings | deferred to 0.18.11 (with the RC) |
 
 ## Documentation
 
@@ -219,8 +219,8 @@ every tag and what it changed.
 - CI is green on `main` at the release commit: the syntax gate, unit tests, the
   one-layout and invite matrices, and a headless e2e on ClickHouse 25.11 and 26.7.
 - No live house was touched to prepare this release.
-- **No drill was run for this release; waived by the pilot (2026-10-08). The drill runs before 0.19.0.**
+- **No drill was run for this release; waived by the maintainer (2026-10-08). The drill runs before 0.19.0.**
   `AGENTS.md` asks for a drill before a release that changes a surface a person touches,
   and this one changes install, invite and share. A drill was prepared on the testbed, but
-  its setup was refused by this session's permission layer, and the pilot chose to release
+  its setup could not run in the release environment, and the maintainer chose to release
   without it.

package/docs/releases/v0.18.11.md

@@ -9,7 +9,7 @@ This release does three things:
   typed on the command line.
 - **The 0.18.10 pre-tag list is finished**, and the gentar test kit is bumped.
 
-**No drill was run for this release; waived (2026-10-08) under the pilot's 0.18.10 ruling. The drill runs before 0.19.0.**
+**No drill was run for this release; waived (2026-10-08) under the maintainer's 0.18.10 ruling. The drill runs before 0.19.0.**
 
 ## Read this before upgrading
 
@@ -27,13 +27,10 @@ rows. Two things widen that first pass:
 
 **Where that write lands, and when to do it (2026-10-08):**
 
-- The pilot's machines (macminim, macbokum) ship to **zeo.memhouse.io**: VM 146 on arf,
-  ClickHouse 26.7.4.58.
-- It is **not** LXC 112 "memhouse-production"; that is an archive, not a live house.
-- zeo's data disk still sits on arf's degraded array. It was backed up to SSD on
-  2026-10-08 (data and access storage), but the disk itself has not moved.
-- **Upgrade those machines only once zeo's data disk is off the degraded array, or once
-  the array is repaired. Time it against the SSD moves.**
+- Upgrade together any installs that ship the same session files (above).
+- A house whose data disk sits on degraded storage: back it up first (data and access
+  storage), and upgrade its machines only once the disk is off the degraded array or the
+  array is repaired.
 - Any house on healthy storage can upgrade normally.
 
 ```bash
@@ -78,7 +75,7 @@ Measured on a real house:
 
 - 1.07 M message rows written in 24 h, against 10.2 M in total;
 - one 6,120-line session stored 60 times in a day;
-- polat's house at about 19 M message rows for roughly 295 k real ones.
+- one member's house at about 19 M message rows for roughly 295 k real ones.
 
 What changed:
 
@@ -175,7 +172,7 @@ Earlier published packages carried those copies without the notices.
 | G4 `invite --url` and stored credentials (**security**) | #22 |
 | G26 skills' reference path | #22 |
 | G11 idle house's dashboard | #22 |
-| GLM-F1 unstamped subagent file | #21 |
+| SUB-1 unstamped subagent file | #21 |
 
 ## Verification
 
@@ -186,6 +183,5 @@ Earlier published packages carried those copies without the notices.
   - skill recipe 18/18;
   - invite 58/58;
   - one-layout 62/62.
-- **Second looks:** agy (gemini-3.8-flash-high) on #21 and #22. Codex was at its daily
-  quota.
-- **Labs:** kept light, because arf's RAID is degraded. No live house was touched.
+- **Second looks:** a second model reviewed #21 and #22.
+- **Labs:** kept light, because the lab host's RAID was degraded. No live house was touched.

package/docs/releases/v0.18.12.md

@@ -0,0 +1,59 @@
+# memhouse 0.18.12 — 2026-10-29
+
+A patch release on the 0.18 line. It does one thing for users:
+
+- **The `/mem` skills pre-approve read-only commands only.** Each skill's `allowed-tools`
+  now lists the memhouse read commands it teaches, instead of `Bash` as a whole.
+
+No drill was run for this patch release. Its one user-facing change is held by
+`misc/skill-allowlist-test.js`, which runs in `npm test`.
+
+## Upgrade
+
+```bash
+memhouse update        # refreshes the /mem skills wherever they are installed
+```
+
+Then reload the skills in Claude Code with `/reload-plugins`, or restart the session.
+
+If you upgraded with `npm install -g memhouse` instead, run `memhouse plugins install claude`
+once, so the installed skills match the package.
+
+Nothing else changes: same house layout, same schema, same daemons.
+
+## Changed
+
+### Skills: allowed tools restricted to read-only commands
+
+Each `/mem` skill's `allowed-tools` names the memhouse read commands it uses:
+
+| skill | runs without a prompt |
+|---|---|
+| `/mem:house` | `memhouse instance`, `whoami`, `status`, `stats`, `doctor`, and `share --list` (with or without `--json`) |
+| `/mem:recall` | `memhouse search`, `resume`, `sessions-query`, `status`, `whoami` |
+| `/mem:sql` | `memhouse sessions-query`, `stats`, `status`, `whoami` |
+| `/mem:access` | `memhouse whoami`, `status`, and `share --list` (with or without `--json`) |
+| `/mem:admin` | `memhouse whoami`, `status`, `instance` |
+
+Any other command goes through Claude Code's normal permission prompt, as does a read
+command with another command chained to it. Expect a prompt where a skill used to run a
+command without one; approve it as you would any other command.
+
+## Repository and tests
+
+These do not change the installed package's behaviour:
+
+- `misc/skill-allowlist-test.js` keeps every skill's `allowed-tools` to read-only memhouse
+  commands. It joins `npm test`.
+- The test tooling's deploy targets (lab address, test machine, engine checkout) are read
+  from an untracked `deploy/targets.env`. `deploy/targets.example.env` shows the shape.
+- Test fixtures, examples, drill records and docs use stand-in names, hosts and paths.
+  `misc/env-guard-test.js` checks tracked files for real environment values, and it joins
+  `npm test`.
+- Security reports go through GitHub's private vulnerability reporting (`SECURITY.md`).
+- The 0.18 line is now cut from the `release/0.18` branch. `AGENTS.md` and
+  `misc/publish-guard.js` say so.
+
+## Deferred
+
+Nothing new. Later work ships on the current line's next release.

package/docs/tutorials/01-first-house.md

@@ -41,8 +41,8 @@ This does four things:
 1. It starts ClickHouse in a container bound to `127.0.0.1:8123`, so only this machine
    can reach it. The data lives in a named volume.
 2. It creates two users. `memhouse_root` administers the house. A **member** named after
-   your OS user (`polat`, say) ships your sessions, and holds one grant: `mem.polat_*`.
-   Your rooms are `mem.polat_sessions`, `mem.polat_messages`, `mem.polat_tool_calls`, and
+   your OS user (`sam`, say) ships your sessions, and holds one grant: `mem.sam_*`.
+   Your rooms are `mem.sam_sessions`, `mem.sam_messages`, `mem.sam_tool_calls`, and
    so on.
 3. It writes both credentials to `~/.memhouse/env`, mode 600. A local house is the one
    case where the admin credential is kept, so that `memhouse invite` works later with

package/editors/claude.js

@@ -7,7 +7,7 @@ const HOME = os.homedir();
 
 // Discover all Claude Code config roots — ports memory-house agent-sync's
 // discover_roots("claude-code"). Claude sessions don't live only under ~/.claude:
-// every CLAUDE_CONFIG_DIR (e.g. Kommander playbook installs under
+// every CLAUDE_CONFIG_DIR (e.g. playbook installs under
 // ~/.claude-playbooks/<name>[/playbook]) has its own projects/ dir. A dir qualifies
 // as a root if it holds a projects/ subdir or a history.jsonl. Deduped by realpath.
 function discoverClaudeRoots() {
@@ -60,7 +60,7 @@ function getChats() {
       const dir = path.join(PROJECTS_DIR, projDir);
       try { if (!fs.statSync(dir).isDirectory()) continue; } catch { continue; }
 
-    // Decode folder path from dir name (e.g. -Users-fka-Code-foo -> /Users/fka/Code/foo)
+    // Decode folder path from dir name (e.g. -Users-user-Code-foo -> /Users/user/Code/foo)
     const decodedFolder = projDir.replace(/-/g, '/');
 
     // Read sessions-index.json for indexed sessions
@@ -293,7 +293,7 @@ function getMessages(chat) {
     // A subagent caught before its first line is written has no start time, so it ranks
     // last — and when its first line lands with an EARLIER timestamp than a sibling's, it
     // moves, renumbers every sibling after it, and the session forks and re-ships whole
-    // (GLM-F1). So a fresh one defers the whole session to the next pass, when it has a
+    // (SUB-1). So a fresh one defers the whole session to the next pass, when it has a
     // time. Bounded by age: a file that never gets a timestamped line stops deferring after
     // SUBAGENT_STAMP_GRACE_MS and ranks last, as before.
     if (info.firstTs === undefined && !unstamped) {

package/editors/cursor-agent.js

@@ -13,7 +13,7 @@ const name = 'cursor-agent';
 
 /**
  * Decode project directory name back to folder path.
- * e.g. "Users-fka-Code-Wapple" → "/Users/fka/Code/Wapple"
+ * e.g. "Users-user-Code-myapp" → "/Users/user/Code/myapp"
  */
 function decodeProjectDir(dirName) {
   // The encoding replaces "/" with "-". We reconstruct by prepending "/"

package/examples/01-local-one-machine/README.md

@@ -46,8 +46,8 @@ Trimmed from a run on a Linux VM with Docker, ClickHouse 26.7 and memhouse 0.18.
 == 1. a house: ClickHouse in a container, bound to loopback, plus the install
   ✓ ClickHouse starting via docker on http://localhost:8123 (loopback only)
   ✓ ClickHouse ready
-  ✓ member 'polat' holds mem.polat_* and nothing else; 'memhouse_root' administers the house
-  ✓ rooms for 'polat': polat_sessions, polat_messages, polat_tool_calls
+  ✓ member 'sam' holds mem.sam_* and nothing else; 'memhouse_root' administers the house
+  ✓ rooms for 'sam': sam_sessions, sam_messages, sam_tool_calls
   ✓ installed
   ✓ shipper started in the background (pid 617049) — loading your history now
 
@@ -55,10 +55,10 @@ Trimmed from a run on a Linux VM with Docker, ClickHouse 26.7 and memhouse 0.18.
 [memhouse] shipped 2 sessions (0 skipped) → 6 msg rows, 2 tool rows in 0.7s
 
 == 3. what the house holds
-  ✓ connected: http://localhost:8123 / mem as polat
+  ✓ connected: http://localhost:8123 / mem as sam
   ✓ house: 2 sessions, 6 messages (freshest ingest 2026-10-07 21:08:06 UTC)
   ✓ fleet: 1 active writer(s)
-     polat@testbed-7edeca38       0.18.9   last ship 0m ago
+     sam@linux-vm-1f2e3d4c        0.18.9   last ship 0m ago
   ✓ shipper: running — daemon (pid 617049)
 
 == 4. find a past conversation

package/examples/02-existing-clickhouse/README.md

@@ -74,10 +74,10 @@ Trimmed from a run against ClickHouse 26.7.1.1315 with memhouse 0.18.9 (the test
   credential from: MEMHOUSE_ADMIN_* environment
   may create users:    yes
 
-== 2. install: build member 'polat' with the admin credential, then verify as the member
-  ✓ created ClickHouse user 'polat'
-  ✓ granted 'polat' mem.polat_* — their rooms and nothing else; async_insert pinned
-  ✓ verified as 'polat' with the member credential
+== 2. install: build member 'sam' with the admin credential, then verify as the member
+  ✓ created ClickHouse user 'sam'
+  ✓ granted 'sam' mem.sam_* — their rooms and nothing else; async_insert pinned
+  ✓ verified as 'sam' with the member credential
   ✓ installed
   the admin credential was used for this install and not saved. To invite later:
      with-secret MEMHOUSE_ADMIN_PASSWORD=<reference> -- memhouse invite <name> --url … --admin-user admin
@@ -87,7 +87,7 @@ Trimmed from a run against ClickHouse 26.7.1.1315 with memhouse 0.18.9 (the test
 [memhouse] shipped 2 sessions (0 skipped) → 6 msg rows, 2 tool rows in 0.2s
 
 == 4. whoami: the credential this machine keeps, and what it may do
-  ✓ polat at https://ch.example.com:8443 — member
+  ✓ sam at https://ch.example.com:8443 — member
   may create users:    no
 
 == 5. status
@@ -108,8 +108,8 @@ Deletes the example's home. The member and its rooms stay in the house: dropping
 an administrator's decision. As the admin:
 
 ```sql
-DROP USER polat;
--- then each of mem.polat_sessions, _messages, _tool_calls, _meta, _events,
+DROP USER sam;
+-- then each of mem.sam_sessions, _messages, _tool_calls, _meta, _events,
 -- _session_stats, _session_model_stats, _session_tool_stats
 ```
 

package/memhouse/RESUME-AND-UPDATE.md

@@ -136,7 +136,7 @@ the supervisor's own restart line.
 ### The gap
 
 Nothing tells a running daemon that its files were replaced. `status` prints the version of
-the CLI you just typed, not the version the daemon is executing. On macminim a shipper ran
+the CLI you just typed, not the version the daemon is executing. On one machine a shipper ran
 **1d16h** out of a directory that had been moved.
 
 ### Why not `postinstall`

package/memhouse/capabilities.js

@@ -9,7 +9,7 @@
 //
 // SCOPE IS THE WHOLE POINT. A grant is `GRANT <privileges> ON <scope> TO <user>`, and a
 // privilege only means what its scope allows: an ordinary member holds CREATE DATABASE
-// inside `ON polat.*`, which lets them do nothing whatsoever about creating a NEW
+// inside `ON sam.*`, which lets them do nothing whatsoever about creating a NEW
 // database. Matching the privilege name anywhere in the text — which an earlier draft of
 // this did — reads that member as a server administrator. So parse the line, keep the
 // scope, and only count a privilege that is granted server-wide.

package/memhouse/convert.js

@@ -1,8 +1,8 @@
 // Convert a pre-one-layout house to the one layout — the plan, as SQL, pure.
 //
-// Before 0.18 every member owned a DATABASE named for them: `polat.messages`,
-// `polat.house_meta`, granted ALL ON polat.*. The one layout puts everyone in one database
-// as `mem.polat_messages`, `mem.polat_meta`, with one wildcard grant and nothing on the
+// Before 0.18 every member owned a DATABASE named for them: `sam.messages`,
+// `sam.house_meta`, granted ALL ON sam.*. The one layout puts everyone in one database
+// as `mem.sam_messages`, `mem.sam_meta`, with one wildcard grant and nothing on the
 // database itself. Moving is a RENAME per table — metadata only, nothing copied — plus the
 // grant swap, and shares re-expressed on the new names. The 0.17.1 dashboard views are
 // dropped: in the one layout the shipper fills the stat tables (a refreshable view needs

package/memhouse/delivery/PROMPT.md

@@ -79,6 +79,6 @@ the retained epochs are the only place that content still exists.
   when the user may want to dig deeper.
 - Other users' HOUSES (other databases on the same server) are readable only when
   shared with this credential (`/mem:access` on their side). Query a shared house by
-  qualified names — `polat.messages` — with the same CUR filter. An empty result
+  qualified names — `sam.messages` — with the same CUR filter. An empty result
   means "nothing visible", not "nothing ever happened".
 - Do not paste credentials from `{{ENV_FILE}}` into responses, commits, or logs.

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: recall past sessions and answer from them, run analytics, check the house, bring people in, and administer the server. Skills install as /mem:recall, /mem:sql, /mem:house, /mem:access, and /mem:admin.",
-  "version": "0.18.11",
+  "version": "0.18.12",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/delivery/plugin/reference/HOUSE.md

@@ -73,8 +73,8 @@ server, not by discipline.
 
 **The `sed` is what makes every query below work in both layouts** — write room names
 bare and it supplies the prefix when there is one. It rewrites only after `FROM`/`JOIN`,
-so a needle like `LIKE '%messages%'` is untouched, and `FROM yigit_messages` is left
-alone — the room name must follow whitespace, and there is none inside `yigit_messages`.
+so a needle like `LIKE '%messages%'` is untouched, and `FROM bob_messages` is left
+alone — the room name must follow whitespace, and there is none inside `bob_messages`.
 With no prefix set it expands to nothing and the query passes through verbatim.
 
 It is spelled with `[[:space:]]` classes rather than `\b` because **BSD `sed` does not
@@ -84,7 +84,7 @@ which is the right way round — but it fails.
 
 **Reading a housemate's memory.** A share is `GRANT SELECT ON mem.<them>_*` — their
 rooms, not the database. `SHOW TABLES` lists exactly what you may read: your own rooms plus
-any shared with you. Name a housemate's rooms in full (`FROM yigit_messages`); the `q()`
+any shared with you. Name a housemate's rooms in full (`FROM bob_messages`); the `q()`
 rewrite leaves an already-prefixed name alone, since applying yours would point at the
 wrong rooms. Say whose memory an answer came from.
 

package/memhouse/delivery/plugin/skills/access/SKILL.md

@@ -3,7 +3,7 @@ name: access
 description: Bring someone onto this memhouse ClickHouse, or let them read your house — mint a new member with their own house and the env file their install needs, grant a housemate read-only access to yours, list who can currently read it, or revoke. Use when the user says "invite X", "add X to memhouse", "get my friend set up", "share my memory with X", "let X see my sessions", "who can read my memory", "stop sharing with X". Inviting comes BEFORE sharing — you can only grant a user who already exists. Read-only by construction on the sharing side: a share can never let anyone write to or delete your memory.
 user-invocable: true
 argument-hint: "invite <name> | share <name> | list | revoke <name>"
-allowed-tools: Bash
+allowed-tools: Bash(memhouse whoami *), Bash(memhouse status *), Bash(memhouse share --list), Bash(memhouse share --list --json)
 ---
 
 # /mem:access — who exists, and who may read

package/memhouse/delivery/plugin/skills/admin/SKILL.md

@@ -3,7 +3,7 @@ name: admin
 description: Operate the memhouse ClickHouse as its administrator — list and inspect every user and house, provision or remove members, grant and revoke access, and read server-wide health (disk, parts, mutations, running queries). Use when the user asks to "do X as admin", "manage users", "drop a house", "see disk usage", "who is on this server", or when a member-scoped skill refused for want of privileges. Requires an administrator credential in the environment; says so plainly, and how to supply one, when there is not.
 user-invocable: true
 argument-hint: "<what you want done>"
-allowed-tools: Bash
+allowed-tools: Bash(memhouse whoami *), Bash(memhouse status *), Bash(memhouse instance *)
 ---
 
 # /mem:admin — operate the house as its administrator
@@ -128,7 +128,7 @@ Before any of them:
 
 1. **Look at the target and report what is really there** — row counts per room, who
    wrote them, the date span, which machines. A house you expected to be empty may not
-   be: one `ege` house looked disposable and held 3,733 messages belonging to somebody
+   be: one `carol` house looked disposable and held 3,733 messages belonging to somebody
    else entirely.
 2. **Name the collateral.** Dropping a user stops that account's shipper on every machine
    it runs on. Revoking a grant closes a share someone may be mid-query on. Rotating a

package/memhouse/delivery/plugin/skills/house/SKILL.md

@@ -3,7 +3,7 @@ name: house
 description: The state of your memory and who is around it — what memhouse is and how to use it, whether shipping is working, what the house holds (sessions, messages, tokens per editor), how fresh it is, which machines write into it, which houses you can read, and who can read yours. Use for "what is memhouse", "how do I use this", "is my memory working", "how much is stored", "when did it last ship", "which machines are shipping", "who can see my memory", "whose memory can I see", "who else is on this server" — and as the first answer when another /mem skill fails because nothing is configured yet, or before debugging why a search found nothing.
 user-invocable: true
 argument-hint: ""
-allowed-tools: Bash
+allowed-tools: Bash(memhouse instance *), Bash(memhouse whoami *), Bash(memhouse status *), Bash(memhouse stats *), Bash(memhouse doctor *), Bash(memhouse share --list), Bash(memhouse share --list --json)
 ---
 
 # /mem:house — what this is, whether it works, and who is around it

package/memhouse/delivery/plugin/skills/recall/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: recall
-description: Retrieve from past agent conversations and answer from them — search every session ever shipped from all 17 editors (Claude Code, Codex, Cursor, VS Code, Zed, Gemini CLI, …) across every project and machine, read the actual transcripts, and answer with citations. Use whenever the user refers to something not in the current context - "how did I fix X last time", "what approach did we settle on", "why did we choose Z", "find that conversation about Y", "did I ever try W", "what was I working on", "show my recent sessions", "sessions from last week", "remind me how I did it". Reach for this BEFORE saying you do not know about prior work. Also reads a housemate's memory when they name it ("how did yigit fix X"). For numbers rather than transcripts — spend, model mix, tool rankings — use /mem:sql.
+description: Retrieve from past agent conversations and answer from them — search every session ever shipped from all 17 editors (Claude Code, Codex, Cursor, VS Code, Zed, Gemini CLI, …) across every project and machine, read the actual transcripts, and answer with citations. Use whenever the user refers to something not in the current context - "how did I fix X last time", "what approach did we settle on", "why did we choose Z", "find that conversation about Y", "did I ever try W", "what was I working on", "show my recent sessions", "sessions from last week", "remind me how I did it". Reach for this BEFORE saying you do not know about prior work. Also reads a housemate's memory when they name it ("how did bob fix X"). For numbers rather than transcripts — spend, model mix, tool rankings — use /mem:sql.
 user-invocable: true
 argument-hint: "<question, terms, or 'recent sessions'>"
-allowed-tools: Bash
+allowed-tools: Bash(memhouse search *), Bash(memhouse resume *), Bash(memhouse sessions-query *), Bash(memhouse status *), Bash(memhouse whoami *)
 ---
 
 # /mem:recall — find it, read it, answer from it

package/memhouse/delivery/plugin/skills/sql/SKILL.md

@@ -3,7 +3,7 @@ name: sql
 description: Run read-only SQL over memhouse conversation memory for numbers rather than transcripts — token spend, cost by model or editor or project, tool-call rankings, activity over time, busiest days, cache-hit ratios, session length distributions, or any custom aggregate across the typed sessions/messages/tool_calls tables. Use when the user wants a figure, a ranking, a trend or a breakdown - "what did I spend on Opus", "which tools do I use most", "how many sessions per project", "my busiest week", "compare editors". For finding or answering FROM past conversations, use /mem:recall instead. Works over your own house, or a housemate's when they name it.
 user-invocable: true
 argument-hint: "<the question, or the SQL>"
-allowed-tools: Bash
+allowed-tools: Bash(memhouse sessions-query *), Bash(memhouse stats *), Bash(memhouse status *), Bash(memhouse whoami *)
 ---
 
 # /mem:sql — analytics over the rooms

package/memhouse/house/HOUSE.md

@@ -1,12 +1,12 @@
 # The house — a database, and the rooms in it
 
 **A house is a ClickHouse database.** Any database, named whatever its people name it —
-`polat`, `team_a`, even `default`. Its rooms are tables: `sessions`, `messages`,
+`sam`, `team_a`, even `default`. Its rooms are tables: `sessions`, `messages`,
 `tool_calls`. No views, no Merge rooms, no settings profile.
 
-**Every member's rooms are named for them, and one grant covers them.** `mem.polat_*`
-for polat, `mem.alice_*` for alice, in the same database — `mem` unless somebody has a
-reason. The grant is `GRANT … ON mem.polat_* TO polat WITH GRANT OPTION`: it lets the
+**Every member's rooms are named for them, and one grant covers them.** `mem.sam_*`
+for sam, `mem.alice_*` for alice, in the same database — `mem` unless somebody has a
+reason. The grant is `GRANT … ON mem.sam_* TO sam WITH GRANT OPTION`: it lets the
 member create and rebuild their own rooms, share them, and reach nothing else. Nobody is
 granted the database itself. A house with one member is a house of one, not a different
 kind of house — a colleague joins as one more member and nothing about the first changes.
@@ -19,7 +19,7 @@ Two columns say where every row came from:
 | `user_id` | who wrote it | `String MATERIALIZED currentUser()` — stamped by the server, unforgeable by clients. `async_insert = 0 CONST` is pinned on each user (`ADD SETTING`, which merges — a bare `SETTINGS` clause replaces the user's whole list) because an async flush stores the stamp as the empty string (measured on 25.11.9.34) |
 | `host` | which machine | the machine's fingerprint (`../host.js`) — derived from the OS machine id (random only where none can be read), so two machines with the same hostname cannot collide and renaming one cannot split its history |
 
-`WHERE user_id = 'alice'` is one person. `WHERE host = 'macbook-4127a95b'` is one
+`WHERE user_id = 'alice'` is one person. `WHERE host = 'my-laptop-1f2e3d4c'` is one
 machine. No filter is the whole house — which is what a team dashboard wants.
 
 ## Joining a house

package/memhouse/house/house.js

@@ -14,13 +14,13 @@
 // That pair IS the provenance model.
 //
 // ONE LAYOUT. A house is a database — `mem` unless somebody has a reason — and every
-// member's rooms in it carry the member's name: `mem.alice_messages`, `mem.polat_messages`.
+// member's rooms in it carry the member's name: `mem.alice_messages`, `mem.sam_messages`.
 // A member holds one grant, on the wildcard `mem.<name>_*`, and nothing else in the
 // database. That is the whole access model, and roomNames() below is the only place a
 // table name is produced.
 //
-//   alone on a laptop        mem.polat_*            a house of one
-//   a team on one server     mem.polat_*, mem.alice_*
+//   alone on a laptop        mem.sam_*              a house of one
+//   a team on one server     mem.sam_*, mem.alice_*
 //   an agency on a kernel    the same, in the kernel's `mem`
 //
 // Nobody ever holds ALL ON <db>.*. That grant is dynamic — it covers rooms created later —
@@ -460,7 +460,7 @@ const READ_SETTINGS = { final: 1, join_use_nulls: 1 };
  * The table a room type lands in. THE naming rule, and the only copy of it.
  *
  * ONE LAYOUT. Every member's rooms carry the member's own name: `mem.alice_messages`,
- * and `mem.polat_messages` even when polat is the only one in there. A house with one
+ * and `mem.sam_messages` even when sam is the only one in there. A house with one
  * member is a house of one, not a different kind of house — so there is no second case
  * here, no prefix to configure, and nothing for an invite file to carry.
  *

package/memhouse/self-update.js

@@ -3,7 +3,7 @@
 // `npm i -g memhouse@latest` replaces the files under the global prefix and does not touch
 // the running processes, so the shipper keeps parsing with the old adapters and the
 // dashboard keeps serving the old bundle. Nothing reports it: `status` prints the version
-// of the CLI you just typed, not the version the daemon is running. On macminim a shipper
+// of the CLI you just typed, not the version the daemon is running. On one machine a shipper
 // ran 1d16h out of a directory that had been MOVED — the fix was live, the machine was not.
 //
 // npm's own `postinstall` is the obvious hook and the wrong one. npm >= 12 blocks install

package/memhouse/server/queries.js

@@ -478,8 +478,8 @@ async function getChats(opts = {}) {
   // per call, three endpoints calling it — and getChats used ~4% of what it asked for.
     // In CHUNKS. The scope travels as `{scopeIds:Array(String)}` query parameters, and the
     // driver puts query parameters in the REQUEST URI — so a page of N sessions builds a URI
-    // of roughly 60 bytes per id, twice (ids and users). Zeo is reached through a Cloudflare
-    // tunnel, which rejects a URI far below ClickHouse's own 1 MiB `http_max_uri_size`: at
+    // of roughly 60 bytes per id, twice (ids and users). A house reached through a Cloudflare
+    // tunnel sits behind a proxy that rejects a URI far below ClickHouse's own 1 MiB `http_max_uri_size`: at
     // 925 sessions the request came back 500 with an EMPTY message (the driver reports a
     // transport-level refusal as `new Error('')`), so `/api/chats?limit=1000` — exactly what
     // the Sessions page asks for — returned 500 and the page rendered blank. 900 worked,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.18.11",
+  "version": "0.18.12",
   "description": "memhouse \u2014 agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {
@@ -34,7 +34,7 @@
     "start": "node bin/memhouse.js",
     "build": "cd ui && npm install && npm run build",
     "dev": "cd ui && npm run dev",
-    "test": "node misc/syntax-check.js && node misc/unit-test.js",
+    "test": "node misc/syntax-check.js && node misc/unit-test.js && node misc/env-guard-test.js && node misc/skill-allowlist-test.js",
     "test:house": "node misc/house-test.js",
     "prepack": "cd ui && npm install --no-audit --no-fund && npm run build",
     "prepublishOnly": "node misc/publish-guard.js"
@@ -50,7 +50,7 @@
     "analytics",
     "memhouse"
   ],
-  "author": "Ramazan Polat <ramazanpolat@gmail.com> (built on agentlytics by fkadev)",
+  "author": "Ramazan Polat (built on agentlytics by fkadev)",
   "license": "MIT",
   "engines": {
     "node": ">=24.0.0"

package/ui/README.md

@@ -0,0 +1,16 @@
+# React + Vite
+
+This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
+
+Currently, two official plugins are available:
+
+- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
+- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
+
+## React Compiler
+
+The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
+
+## Expanding the ESLint configuration
+
+If you are developing a production application, we recommend using TypeScript with type-aware lint rules enabled. Check out the [TS template](https://github.com/vitejs/vite/tree/main/packages/create-vite/template-react-ts) for information on how to integrate TypeScript and [`typescript-eslint`](https://typescript-eslint.io) in your project.