memhouse 0.18.12 → 0.20.1

package/memhouse/invitefile.js

@@ -13,13 +13,16 @@ const envfile = require('./envfile');
 
 const REQUIRED = ['MEMHOUSE_URL', 'MEMHOUSE_USER', 'MEMHOUSE_PASSWORD', 'MEMHOUSE_DB'];
 
+/** The names bare `memhouse` recognises as an invite file: `invite-<name>.env`. */
+function isInviteFileName(n) { return /^invite-[A-Za-z0-9_]+\.env$/.test(String(n)); }
+
 /** `invite-<name>.env` files in the given directories, first directory first. */
 function findInvites(dirs) {
   const out = [];
   for (const dir of dirs) {
     let names = [];
     try { names = fs.readdirSync(dir); } catch { continue; }
-    for (const n of names.sort()) if (/^invite-[A-Za-z0-9_]+\.env$/.test(n)) out.push({ file: path.join(dir, n), dir });
+    for (const n of names.sort()) if (isInviteFileName(n)) out.push({ file: path.join(dir, n), dir });
   }
   return out;
 }
@@ -35,4 +38,4 @@ function describeInvite(text) {
   };
 }
 
-module.exports = { findInvites, describeInvite, REQUIRED };
+module.exports = { isInviteFileName, findInvites, describeInvite, REQUIRED };

package/memhouse/plugin-copies.js

@@ -0,0 +1,176 @@
+// The /mem plugin's installed copies, and keeping them in step with the memhouse that runs them.
+//
+// `plugins install claude` copies memhouse/delivery/plugin into a Claude Code config dir and
+// binds the dir to this instance (memhouse/binding.js). Only `memhouse update` refreshed those
+// copies — and an upgrade with `npm install -g` never runs it, nor can update run behind a
+// registry mirror. A 0.18 copy then kept teaching the 0.18 rooms to agents on a schema-3 house,
+// where every documented query fails. So the copies are refreshed on the new version's first
+// run instead: any CLI call, or the shipper's start. A stamp in the home records the version
+// that last checked, so every later call costs one small read.
+//
+// Only copies BOUND TO THIS HOME are touched: a machine can run two instances on two versions,
+// and another instance's copy belongs to that instance's binary. A copy is never downgraded.
+// The Codex copy (memhouse/codex-plugin.js) is refreshed the same way, and only where
+// `plugins install codex` put it: its skill carries memhouse's ownership file and this home.
+// From a git checkout nothing happens unless MEMHOUSE_REFRESH_SKILLS=1: a checkout run with a
+// real MEMHOUSE_HOME would otherwise copy work-in-progress skills over the installed ones.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const PLUGIN_MARK = path.join('skills', 'mem', '.claude-plugin', 'plugin.json');
+const STAMP = 'skills-checked';
+const isPluginInstalled = (dir) => fs.existsSync(path.join(dir, PLUGIN_MARK));
+
+/** -1, 0, 1 for x.y.z versions; a prerelease sorts before its release. Unparseable -> null. */
+function compareVersions(a, b) {
+  const p = (v) => { const m = /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(String(v || '').trim()); return m ? [+m[1], +m[2], +m[3], m[4] ? 0 : 1] : null; };
+  const x = p(a); const y = p(b);
+  if (!x || !y) return null;
+  for (let i = 0; i < 4; i++) if (x[i] !== y[i]) return x[i] < y[i] ? -1 : 1;
+  return 0;
+}
+
+// Every Claude Code instance on this machine, not just the default one: CLAUDE_CONFIG_DIR, the
+// stock ~/.claude, and the playbook installs the adapter discovers (editors/claude.js).
+function claudeTargets() {
+  const seen = new Map(); // realpath -> { dir, why }
+  const add = (dir, why) => {
+    if (!dir) return;
+    let isDir = false;
+    try { isDir = fs.statSync(dir).isDirectory(); } catch { /* missing */ }
+    if (!isDir) return;
+    let rp; try { rp = fs.realpathSync(dir); } catch { rp = dir; }
+    if (!seen.has(rp)) seen.set(rp, { dir, why });
+  };
+  // The instance the caller is running under comes first, and is NOT subject to the
+  // adapter's "has this been used?" test — a fresh config dir has no projects/ yet, and it
+  // is exactly where the skills are wanted.
+  add(process.env.CLAUDE_CONFIG_DIR, 'CLAUDE_CONFIG_DIR');
+  add(path.join(os.homedir(), '.claude'), 'default');
+  try {
+    const { discoverClaudeRoots } = require(path.join(__dirname, '..', 'editors', 'claude'));
+    for (const r of discoverClaudeRoots()) add(r, 'playbook');
+  } catch { /* adapter unavailable — the two above still stand */ }
+  return [...seen.values()];
+}
+
+/**
+ * Replace the plugin copy in `dir` with `deliveryDir/plugin`, stamped with `version`.
+ * @param {(line: string) => void} [log]
+ * @returns {string} the copy's directory
+ */
+function installInto(dir, { deliveryDir, version, log = () => {} }) {
+  // The plugin was named `memhouse` until 0.10.0. A leftover copy under the old name
+  // would load BESIDE the new one — /memhouse:search and /mem:recall both resolving, one
+  // of them stale forever. Remove it only when it is provably OURS (it carries our
+  // plugin.json); a directory someone else named `memhouse` is not ours to delete.
+  const legacy = path.join(dir, 'skills', 'memhouse');
+  const legacyManifest = path.join(legacy, '.claude-plugin', 'plugin.json');
+  if (fs.existsSync(legacyManifest)) {
+    let lname = null;
+    try { lname = JSON.parse(fs.readFileSync(legacyManifest, 'utf-8')).name; } catch { /* unreadable */ }
+    if (lname === 'memhouse' || lname === 'mem') {
+      fs.rmSync(legacy, { recursive: true });
+      log(`removed the pre-0.10 plugin at ${legacy} (renamed to 'mem')`);
+    }
+  }
+  const dst = path.join(dir, 'skills', 'mem');
+  // REPLACE, not overlay. cpSync over an existing install refreshes the skills and
+  // leaves anything else standing — a machine that once had a build with extra skills
+  // kept offering /mem:replay and /mem:house forever, stale, beside the real ones.
+  // Ownership means OUR MANIFEST, checked by name — "any plugin.json" would have deleted
+  // an unrelated plugin that happened to pick the same directory name.
+  const dstManifest = path.join(dst, '.claude-plugin', 'plugin.json');
+  if (fs.existsSync(dstManifest)) {
+    let name = null;
+    try { name = JSON.parse(fs.readFileSync(dstManifest, 'utf-8')).name; } catch { /* unreadable */ }
+    if (name === 'mem' || name === 'memhouse') fs.rmSync(dst, { recursive: true });
+    else throw new Error(`skills/mem in ${dir} belongs to plugin '${name || '(unreadable manifest)'}' — refusing to replace it`);
+  }
+  fs.mkdirSync(dst, { recursive: true });
+  fs.cpSync(path.join(deliveryDir, 'plugin'), dst, { recursive: true });
+  // Stamp the manifest with THIS memhouse's version. The source plugin.json carries a
+  // FROZEN number — it sat at 0.11.0 through several releases, so every install
+  // advertised the wrong version (`memhouse --version` said one thing, the plugin
+  // another). The package version is the single truth; write it into the copy.
+  try {
+    const m = JSON.parse(fs.readFileSync(dstManifest, 'utf-8'));
+    if (m.version !== version) {
+      m.version = version;
+      fs.writeFileSync(dstManifest, `${JSON.stringify(m, null, 2)}\n`);
+    }
+  } catch { /* manifest unreadable — leave the copied one rather than guess */ }
+  return dst;
+}
+
+const real = (p) => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+
+/** The installed copy's version, or null. */
+function copyVersion(dir) {
+  try { return JSON.parse(fs.readFileSync(path.join(dir, PLUGIN_MARK), 'utf-8')).version || null; } catch { return null; }
+}
+
+/** The dir's binding to a memhouse home, or null (memhouse/binding.js). */
+function boundHome(dir) {
+  const { boundTo, readSettings } = require('./binding');
+  const b = boundTo(readSettings(dir));
+  return b && b.home ? b.home : null;
+}
+
+/**
+ * Copies bound to `home` and older than `version`.
+ * @returns {{dir: string, have: string|null}[]}
+ */
+function staleCopies({ home, version, targets = claudeTargets() }) {
+  const out = [];
+  for (const t of targets) {
+    if (!isPluginInstalled(t.dir)) continue;
+    const bound = boundHome(t.dir);
+    if (!bound || real(bound) !== real(home)) continue;
+    const have = copyVersion(t.dir);
+    const c = compareVersions(have, version);
+    if (have === null || c === -1) out.push({ dir: t.dir, have });
+  }
+  return out;
+}
+
+/** Is this memhouse running from a git checkout rather than an installed package? */
+function fromCheckout(repoRoot) {
+  return fs.existsSync(path.join(repoRoot, '.git'));
+}
+
+/**
+ * On a new version's first run: refresh the stale copies bound to this home. Cheap when the
+ * stamp already names this version. Never throws; returns what it refreshed.
+ * @returns {{refreshed: {dir: string, have: string|null}[], skipped: string|null, errors: string[]}}
+ */
+function refreshIfStale({ home, version, deliveryDir, repoRoot, env = process.env, targets = null, codexHome = null, log = () => {} }) {
+  const res = { refreshed: [], skipped: null, errors: [] };
+  try {
+    if (fromCheckout(repoRoot) && env.MEMHOUSE_REFRESH_SKILLS !== '1') { res.skipped = 'checkout'; return res; }
+    const stamp = path.join(home, STAMP);
+    let seen = null; try { seen = fs.readFileSync(stamp, 'utf-8').trim(); } catch { /* first run */ }
+    if (seen === version) { res.skipped = 'stamped'; return res; }
+    for (const s of staleCopies({ home, version, targets: targets || claudeTargets() })) {
+      try { installInto(s.dir, { deliveryDir, version }); res.refreshed.push(s); log(`/mem skills in ${s.dir} refreshed for ${version}${s.have ? ` (were ${s.have})` : ''} — reload them in Claude Code: /reload-plugins`); }
+      catch (e) { res.errors.push(`${s.dir}: ${String(e.message || e).split('\n')[0]}`); }
+    }
+    const cxp = require('./codex-plugin');
+    const cx = cxp.staleCopy({ codexHome: codexHome || cxp.codexHome(env), home, version, compareVersions });
+    if (cx) {
+      try {
+        // The block is rewritten only where it still stands: one taken out by hand stays out.
+        cxp.install({ codexHome: cx.codexHome, home: cx.home, bin: cx.bin, version, deliveryDir, onlyWhereInstalled: true });
+        res.refreshed.push({ dir: cx.codexHome, have: cx.have, codex: true });
+        log(`the memhouse skill and block in ${cx.codexHome} refreshed for ${version}${cx.have ? ` (were ${cx.have})` : ''} — they load in the next Codex session`);
+      } catch (e) { res.errors.push(`${cx.codexHome}: ${String(e.message || e).split('\n')[0]}`); }
+    }
+    // Stamp only when every copy is current, so a failure is tried again on the next run.
+    if (!res.errors.length && fs.existsSync(home)) { try { fs.writeFileSync(stamp, `${version}\n`); } catch { /* home not writable: check again next run */ } }
+  } catch (e) { res.errors.push(String(e.message || e).split('\n')[0]); }
+  return res;
+}
+
+module.exports = { PLUGIN_MARK, STAMP, isPluginInstalled, compareVersions, claudeTargets, installInto, copyVersion, boundHome, staleCopies, fromCheckout, refreshIfStale };

package/memhouse/provision.js

@@ -27,12 +27,17 @@ const { MEMBER_PIN, assertUsableName, roomPattern } = require('./house/house');
  *   SELECT, INSERT           the shipper writes, everything else reads
  *   ALTER, OPTIMIZE          ensureSchema adds columns in place; doctor compacts
  *   CREATE TABLE, DROP TABLE their own rooms on first ship; a rebuild on migrate
- *   ROW POLICY *             `share --only` scopes a grantee to a project or a session
+ *   CREATE/ALTER/DROP ROW POLICY   `share --only` scopes a grantee to a project or a session
+ *
+ * Not SHOW ROW POLICIES: held on any table, it makes all of system.row_policies readable (a
+ * SHOW privilege opens its system table, and that one is not filtered per table), so a member
+ * would list every other member's scoped shares. A share does not need it: memhouse keeps what it
+ * shared in the member's own meta, and the policies are created, replaced and dropped by name.
  */
 const ROOM_PRIVILEGES = [
   'SELECT', 'INSERT', 'ALTER', 'OPTIMIZE',
   'CREATE TABLE', 'DROP TABLE',
-  'CREATE ROW POLICY', 'ALTER ROW POLICY', 'DROP ROW POLICY', 'SHOW ROW POLICIES',
+  'CREATE ROW POLICY', 'ALTER ROW POLICY', 'DROP ROW POLICY',
 ];
 
 function roomGrant(db, member) {

package/memhouse/release-hint.js

@@ -0,0 +1,24 @@
+// What doctor says about a gap that a newer release might close (an unpriced model): whether a
+// newer release exists on the channel this install follows, from the registry's dist-tags.
+// Pure: the tags are given (bin/memhouse.js reads them once per doctor).
+
+const chan = require('./channel');
+
+/**
+ * @param {{version:string, pinned?:string|null, tags:Record<string,string>|null}} p
+ * @returns {{known:boolean, up:{target:string,channel:string}|null, channel:string|null}}
+ *   `known` only when the registry answered and this install follows a tag on it.
+ */
+function releaseState({ version, pinned = null, tags = null }) {
+  if (!tags) return { known: false, up: null, channel: null };
+  const channel = chan.pickChannel({ version, pinned, tags }).channel;
+  return { known: !!channel, up: chan.behind({ version, pinned, tags }), channel };
+}
+
+function pricingHint(state, version) {
+  if (state.up) return `memhouse update installs ${state.up.target} from '${state.up.channel}', which may price it`;
+  if (state.known) return `this is the latest release on '${state.channel}' (${version}) and it has no price for it: its cost stays unknown until a release adds one`;
+  return 'prices ship with each release: a newer one may add them (memhouse update), and on the latest one their cost stays unknown until a release does';
+}
+
+module.exports = { releaseState, pricingHint };

package/memhouse/resume.js

@@ -1,4 +1,4 @@
-// Resume: hand the pilot back into a session memhouse only ever read.
+// Resume: hand the user back into a session memhouse only ever read.
 //
 // Nothing here needs a schema change. A stored session already carries everything a
 // resume needs: `session_id` is canonical `<source>:<native-id>` (ship.js:575) and
@@ -8,8 +8,8 @@
 // Two rules, both learned the hard way in this repo:
 //
 //   1. PRINT the command, never run it. A wrong cwd or a stale id does not fail — it
-//      starts a NEW session, and the transcript the pilot wanted is still lost while the
-//      tool reports success. The pilot pastes it, sees what it does, and owns the result.
+//      starts a NEW session, and the transcript the user wanted is still lost while the
+//      tool reports success. The user pastes it, sees what it does, and owns the result.
 //
 //   2. Never write a flag from memory. Round 10 exists because a field name was asserted
 //      from a failed search rather than read from the source. Every entry below was read
@@ -101,7 +101,7 @@ function shq(s) {
 }
 
 /**
- * Resolve a stored session row into something the pilot can paste.
+ * Resolve a stored session row into something the user can paste.
  *
  * @param {{session_id: string, source?: string, folder?: string, origin?: string}} row
  * @returns {{ok: boolean, source: string, nativeId: string|null, folder: string,