memhouse 0.18.3 → 0.18.5

package/bin/memhouse.js

@@ -453,6 +453,8 @@ Data         ship                 one incremental pass (--full | --loop [sec])
              instance             which memhouse this is: home, binary, house, rooms, scope, daemons, bound playbooks
              rooms                what your rooms are actually called (--json)
              members              who is in a house and what each can reach (--db, admin)
+             convert              operator: move a pre-one-layout house (a database per member) to the one layout
+                                  (--admin-user/--admin-password, --member, --print-sql, --dry-run, --guides --out DIR)
              start | stop |       shipper loop + dashboard as background daemons
              share <user>         let someone read this house (--only project=… |
                                   session=… | host=… | source=… | folder=… | since=… |
@@ -1013,8 +1015,13 @@ async function cmdInstall({ interactive }) {
     } catch { /* not a URL; the missing-fields check above already spoke */ }
     // Clear ambient MEMHOUSE_* so ONLY the file speaks (exported vars normally win over the
     // file; an invite intake is the one place they must not).
-    for (const k of ['MEMHOUSE_URL', 'MEMHOUSE_USER', 'MEMHOUSE_PASSWORD', 'MEMHOUSE_DB', 'MEMHOUSE_PORT']) delete process.env[k];
+    for (const k of ['MEMHOUSE_URL', 'MEMHOUSE_USER', 'MEMHOUSE_PASSWORD', 'MEMHOUSE_DB', 'MEMHOUSE_PORT', 'MEMHOUSE_CHANNEL', 'MEMHOUSE_EDITORS', 'MEMHOUSE_CLAUDE_ROOTS']) delete process.env[k];
     for (const k of wanted) process.env[k] = parsed[k];
+    // The invite also carries what the inviter's house is ON: its channel (a `team` house
+    // is 0.18.x, published under `team`). Dropping it wrote an env with no pin, and the
+    // member's first `memhouse update` followed `latest` — zeo's 0.17 line — and
+    // downgraded a working team install onto the wrong layout. A flag still wins.
+    for (const k of ['MEMHOUSE_CHANNEL', 'MEMHOUSE_EDITORS', 'MEMHOUSE_CLAUDE_ROOTS']) if (parsed[k]) process.env[k] = parsed[k];
     console.log(ok(`using the invite file ${String(flags.env)} (nothing persisted until the install proves out)`));
     _inviteFileToShred = path.resolve(String(flags.env));
     _inviteWantsRotate = parsed.MEMHOUSE_INVITE === '1';
@@ -1995,6 +2002,10 @@ async function cmdDoctor() {
         : `token capture: ${zero.map((r) => `${r.source} (${r.n} messages)`).join(', ')} ship ZERO tokens — their cost shows as $0, not as unknown`,
       'that adapter does not extract usage; the messages are stored, the numbers are not');
   } catch { /* a house that cannot be read is already reported above */ }
+  try {
+    const moved = await adoptMovedHouse(cfg, { fix: false });
+    if (moved === 'moved') add(false, `rooms moved to mem.${physicalRoom('messages', cfg.user).replace(/_messages$/, '')}_* — this env still says MEMHOUSE_DB=${cfg.db}`, 'memhouse update   (rewrites the env and restarts the shipper)');
+  } catch { /* connection problems are reported above */ }
   const sh = shipperHealth();
   const shFail = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).describeFailure(sh.lastPass);
   add(sh.running && !shFail, `shipper${sh.via ? ` — ${sh.via}` : ''}${shFail ? ` — ${shFail}` : ''}`,
@@ -2216,6 +2227,10 @@ async function cmdUpdate() {
     }
   }
   console.log(ok('files updated'));
+  // The house may have been converted to the one layout since this machine last ran:
+  // the member's rooms moved from <name>.* to mem.<name>_*. Fix the env here, before the
+  // shipper restarts, or its first pass refuses the old address forever.
+  try { await adoptMovedHouse(resolveConfig()); } catch { /* doctor will say */ }
 
   // Refresh the Claude plugin wherever it is ALREADY installed, so `update` keeps the
   // skills in lockstep with the package instead of leaving a stale `/mem:*` behind. Only
@@ -3412,6 +3427,30 @@ async function cmdWhoami() {
  * declined. Never touches the file's password: what it shows is the user, the house and
  * the server, which the guide beside the file shows too.
  */
+/**
+ * After the operator converted the house to the one layout, a member's env still says
+ * MEMHOUSE_DB=<their name>. Their rooms now live in `mem` as <name>_*. Detect that and
+ * rewrite the env: the member's `memhouse update` is the moment it happens, and doctor
+ * names it. Returns 'moved' (env rewritten), 'current', or 'unknown' (could not tell).
+ */
+async function adoptMovedHouse(cfg, { fix = true, quiet = false } = {}) {
+  if (!cfg.stated || !cfg.user) return 'unknown';
+  const mine = physicalRoom('messages', cfg.user);
+  let rows;
+  try {
+    rows = await chRows(cfg, `SELECT database, name FROM system.tables WHERE (database = ${sqlStr(cfg.db)} AND name IN ('messages', ${sqlStr(mine)})) OR (database = 'mem' AND name = ${sqlStr(mine)})`, { database: '' });
+  } catch { return 'unknown'; }
+  const has = (d, n) => rows.some((r) => r.database === d && r.name === n);
+  if (has(cfg.db, mine)) return 'current';
+  if (cfg.db !== 'mem' && has('mem', mine) && !has(cfg.db, 'messages')) {
+    if (!fix) return 'moved';
+    writeEnvFile({ ...cfg, db: 'mem' });
+    if (!quiet) console.log(ok(`your rooms moved: ${cfg.db}.messages is now mem.${mine} — ${short(ENV_FILE)} now says MEMHOUSE_DB=mem`));
+    return 'moved';
+  }
+  return 'current';
+}
+
 async function offerInvite() {
   const inv = require(path.join(REPO_ROOT, 'memhouse', 'invitefile'));
   // The current directory only. The guide says "from the directory holding the file", and
@@ -4009,6 +4048,82 @@ async function cmdUninstall() {
       console.log(r.sessions_v);
       break;
     }
+    case 'convert': {
+      // Operator: move a pre-one-layout house (a database per member) to the one layout.
+      // Discovers members by their databases, plans per member, executes as admin, records
+      // an event in each member's new events room. --print-sql shows the plan; --dry-run
+      // discovers and plans without touching anything; --guides <dir> renders
+      // MEMHOUSE-UPGRADE.md per member for the operator to hand out.
+      const convert = require(path.join(REPO_ROOT, 'memhouse', 'convert'));
+      const db = flags.db && flags.db !== true ? String(flags.db) : 'mem';
+      const au = flags['admin-user'] && flags['admin-user'] !== true ? String(flags['admin-user']) : (cfg.adminUser || null);
+      const ap = flags['admin-password'] && flags['admin-password'] !== true ? String(flags['admin-password']) : (cfg.adminPassword || '');
+      if (!au) { console.log(bad('convert needs an admin credential: --admin-user/--admin-password (or the one this instance keeps)')); process.exitCode = 1; break; }
+      const who = { ...cfg, user: au, password: ap };
+      const only = flags.member && flags.member !== true ? String(flags.member) : null;
+      // Candidates: a user whose own database holds `messages` and who has no rooms in `db` yet.
+      const cands = await chRows(who, `SELECT u.name AS member FROM system.users u WHERE u.name IN (SELECT database FROM system.tables WHERE name = 'messages') AND u.name NOT IN (SELECT replaceRegexpOne(name, '_messages$', '') FROM system.tables WHERE database = ${sqlStr(db)} AND name LIKE '%\\_messages') ORDER BY u.name`, { database: '' });
+      const members = cands.map((r) => r.member).filter((m) => !only || m === only);
+      if (!members.length) { console.log(ok(only ? `'${only}' has nothing to convert` : 'nothing to convert — no member still owns a database of their own')); break; }
+      console.log(ok(`${members.length} member(s) to convert into '${db}': ${members.join(', ')}`));
+      const plans = [];
+      for (const m of members) {
+        const shares = (await chRows(who, `SELECT DISTINCT user_name FROM system.grants WHERE access_type = 'SELECT' AND database = ${sqlStr(m)} AND (table = '' OR table IS NULL) AND user_name != ${sqlStr(m)}`, { database: '' })).map((r) => ({ reader: r.user_name }));
+        const policies = (await chRows(who, `SELECT name, table, select_filter AS filter, apply_to_list AS readers FROM system.row_policies WHERE database = ${sqlStr(m)}`, { database: '' })).map((r) => ({ name: r.name, table: r.table, filter: r.filter, readers: Array.isArray(r.readers) ? r.readers : [] }));
+        plans.push({ member: m, shares, policies, steps: convert.planMember({ member: m, db, shares, policies }) });
+      }
+      if (flags['print-sql'] === true || flags['dry-run'] === true) {
+        console.log(`CREATE DATABASE IF NOT EXISTS ${db};`);
+        for (const p of plans) console.log(`\n-- ${p.member}: ${p.shares.length} share(s), ${p.policies.length} row polic${p.policies.length === 1 ? 'y' : 'ies'}\n${convert.render(p.steps)}`);
+        if (flags['dry-run'] === true) console.log(`\n${warn('dry run — nothing executed')}`);
+        break;
+      }
+      if (flags.yes !== true && process.stdin.isTTY) {
+        const a = (await ask(`Convert ${members.length} member(s) now? Renames are instant and reversible only by renaming back. (yes/no)`, 'no')).toLowerCase();
+        if (a !== 'yes' && a !== 'y') { console.log('  nothing done.'); break; }
+      }
+      await ch(who, `CREATE DATABASE IF NOT EXISTS ${db}`, { database: '' });
+      let converted = 0;
+      for (const p of plans) {
+        let failed = null;
+        for (const st of p.steps) {
+          if (st.when === 'empty') {
+            const left = await chRows(who, `SELECT count() AS n FROM system.tables WHERE database = ${sqlStr(p.member)}`, { database: '' });
+            if (Number(left[0] && left[0].n) !== 0) { console.log(warn(`  ${p.member}: database kept — ${left[0].n} unexpected table(s) remain in it`)); continue; }
+          }
+          try { await ch(who, st.sql, { database: '' }); }
+          catch (e) {
+            const m = (e && e.message ? e.message : String(e)).split('\n')[0];
+            if (st.optional) { console.log(warn(`  ${p.member}: skipped — ${st.why}: ${m}`)); continue; }
+            failed = `${st.why}: ${m}`; break;
+          }
+        }
+        if (failed) { console.log(bad(`${p.member}: stopped — ${failed}`)); console.log('  what already ran stays (renames are visible in system.tables); fix and re-run: memhouse convert --member ' + p.member); process.exitCode = 1; continue; }
+        try {
+          const ev = physicalRoom('events', p.member);
+          const cols = new Set((await chRows(who, `SELECT name FROM system.columns WHERE database = ${sqlStr(db)} AND table = ${sqlStr(ev)} AND default_kind != 'MATERIALIZED'`, { database: '' })).map((r) => r.name)); // actor is MATERIALIZED currentUser()
+          const want = { event_at: 'now64(3)', kind: "'layout'", id: "'one-layout'", status: "'converted'", from_version: "'db-per-member'", to_version: "'one-layout'", actor: sqlStr(au), host: sqlStr(os.hostname()), rows_before: '0', rows_after: '0', detail: sqlStr(`renamed ${p.member}.* → ${db}.${p.member}_*; ${p.shares.length} share(s), ${p.policies.length} row polic(y/ies) carried`) };
+          const use = Object.keys(want).filter((c) => cols.has(c));
+          if (use.length) await ch(who, `INSERT INTO ${db}.${ev} (${use.join(', ')}) VALUES (${use.map((c) => want[c]).join(', ')})`, { database: '' });
+          else console.log(warn(`  ${p.member}: events room has none of the expected columns — no event recorded`));
+        } catch (e) { console.log(warn(`  ${p.member}: event not recorded — ${(e && e.message ? e.message : String(e)).split('\n')[0].slice(0, 120)}`)); }
+        converted++;
+        console.log(ok(`${p.member}: rooms now ${db}.${p.member}_* — ${p.shares.length} share(s) carried${p.policies.length ? `, ${p.policies.length} row polic${p.policies.length === 1 ? 'y' : 'ies'}` : ''}`));
+      }
+      console.log(ok(`${converted}/${members.length} converted`));
+      if (flags.guides) {
+        const outDir = flags.out && flags.out !== true ? String(flags.out) : process.cwd();
+        fs.mkdirSync(outDir, { recursive: true });
+        const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'delivery', 'UPGRADE.md.tpl'), 'utf-8');
+        for (const p of plans) {
+          const rooms = [...ROOM_TYPES, ...META_TYPES].map((t) => `${db}.${physicalRoom(t, p.member)}`).join('\n');
+          const md = tpl.replaceAll('{{NAME}}', p.member).replaceAll('{{URL}}', cfg.url).replaceAll('{{DB}}', db).replaceAll('{{ROOMS}}', rooms)
+            .replaceAll('{{CHANNEL}}', cfg.channel || 'latest').replaceAll('{{OPERATOR}}', os.userInfo().username).replaceAll('{{VERSION}}', PKG.version).replaceAll('{{DATE}}', new Date().toISOString().slice(0, 10));
+          const f = path.join(outDir, `MEMHOUSE-UPGRADE-${p.member}.md`); fs.writeFileSync(f, md); console.log(ok(`guide written: ${short(f)}`));
+        }
+      }
+      break;
+    }
     case 'members': {
       // "Who is in this database, and what can each of them reach?" Before shared houses a
       // database had exactly one member and the question did not exist; this layout creates

package/memhouse/channel.js

@@ -32,9 +32,22 @@ function pickChannel({ version, pinned = null, tags = null }) {
   if (isPrerelease(version)) {
     return { channel: null, target: null, reason: `${version} is on no registry tag — a tarball or checkout build; update it by installing a newer tarball, or pin a channel: memhouse update --channel <tag>` };
   }
-  return { channel: 'latest', target: t.latest || null, reason: tags ? 'following latest' : 'following latest (registry did not answer)' };
+  // A release that matches no tag any more (the tag moved on) stays on ITS LINE: the tag
+  // whose target shares this version's major.minor. Falling back to `latest` moved a
+  // 0.18.2 team member to 0.17.1 — a different house layout — on her first update.
+  const line = lineOf(version);
+  const sameLine = Object.entries(t).filter(([, v]) => lineOf(v) === line).map(([k]) => k);
+  if (sameLine.length) {
+    const k = sameLine.includes('latest') ? 'latest' : sameLine[0];
+    return { channel: k, target: t[k], reason: `following '${k}' — the tag on the ${line}.x line this install is on` };
+  }
+  if (!tags) return { channel: null, target: null, reason: 'the registry did not answer — cannot tell which line to follow; retry, or: memhouse update --channel <tag>' };
+  return { channel: null, target: null, reason: `${version} is on the ${line}.x line and no registry tag points at ${line}.x — crossing lines is a decision: memhouse update --channel <tag>` };
 }
 
+/** "0.18" of "0.18.2" — the line a version belongs to. */
+function lineOf(v) { const m = /^(\d+)\.(\d+)/.exec(String(v || '')); return m ? `${m[1]}.${m[2]}` : ''; }
+
 /** The registry's dist-tags, or null when it cannot be reached. Abbreviated document, small. */
 async function fetchTags(fetchImpl = globalThis.fetch) {
   try {
@@ -47,4 +60,4 @@ async function fetchTags(fetchImpl = globalThis.fetch) {
   } catch { return null; }
 }
 
-module.exports = { pickChannel, fetchTags, isPrerelease };
+module.exports = { pickChannel, fetchTags, isPrerelease, lineOf };

package/memhouse/convert.js

@@ -0,0 +1,60 @@
+// Convert a pre-one-layout house to the one layout — the plan, as SQL, pure.
+//
+// Before 0.18 every member owned a DATABASE named for them: `polat.messages`,
+// `polat.house_meta`, granted ALL ON polat.*. The one layout puts everyone in one database
+// as `mem.polat_messages`, `mem.polat_meta`, with one wildcard grant and nothing on the
+// database itself. Moving is a RENAME per table — metadata only, nothing copied — plus the
+// grant swap, and shares re-expressed on the new names. The 0.17.1 dashboard views are
+// dropped: in the one layout the shipper fills the stat tables (a refreshable view needs
+// CREATE TABLE on the whole database, the grant this layout withholds).
+//
+// The operator runs it once, as an admin. Members then `memhouse update`; the new build
+// finds the moved rooms and repairs its own env (see adoptMovedHouse in the CLI and shipper).
+
+const { roomPattern, physicalRoom, ROOM_TYPES, META_TYPES, MEMBER_PIN } = require('./house/house');
+const { roomGrant } = require('./provision');
+
+const LEGACY = { messages: 'messages', sessions: 'sessions', tool_calls: 'tool_calls', meta: 'house_meta', events: 'house_events' };
+const STAT_VIEWS = ['session_stats_mv', 'session_model_stats_mv', 'session_tool_stats_mv'];
+const STAT_TABLES = ['session_stats', 'session_model_stats', 'session_tool_stats'];
+
+/**
+ * @param {object} p
+ * @param {string} p.member            the member (= the old database name)
+ * @param {string} [p.db='mem']        the one-layout house
+ * @param {Array<{reader:string}>} [p.shares]        whole-house reads granted to others (SELECT ON member.*)
+ * @param {Array<{name:string, table:string, filter:string, readers:string[]}>} [p.policies]  row policies on the old tables
+ * @returns {Array<{sql:string, why:string, optional?:boolean, when?:string}>}
+ */
+function planMember({ member, db = 'mem', shares = [], policies = [] }) {
+  const steps = [];
+  for (const v of STAT_VIEWS) steps.push({ sql: `DROP TABLE IF EXISTS ${member}.${v}`, why: '0.17.1 refreshable view — the shipper fills stats in the one layout' });
+  for (const t of STAT_TABLES) steps.push({ sql: `DROP TABLE IF EXISTS ${member}.${t}`, why: '0.17.1 stat table — recreated by the member\'s next ship in the new shape' });
+  const pairs = [...ROOM_TYPES, ...META_TYPES].map((t) => `${member}.${LEGACY[t]} TO ${db}.${physicalRoom(t, member)}`);
+  steps.push({ sql: `RENAME TABLE ${pairs.join(', ')}`, why: 'the five rooms move into the house under the member\'s name — one atomic rename, nothing copied' });
+  steps.push({ sql: `REVOKE ALL ON ${member}.* FROM ${member}`, why: 'the database-wide grant the old layout needed' });
+  steps.push({ sql: roomGrant(db, member), why: `their rooms — ${db}.${roomPattern(member)} — and nothing else` });
+  steps.push({ sql: `ALTER USER ${member} ADD SETTING ${MEMBER_PIN}`, why: 'user_id is stamped per row; async inserts would skip it', optional: true });
+  steps.push({ sql: `GRANT ALTER USER ON ${member} TO ${member}`, why: '`memhouse passwd` without an admin', optional: true });
+  steps.push({ sql: `GRANT SHOW USERS ON *.* TO ${member}`, why: 'names only, to know who to share with', optional: true });
+  steps.push({ sql: `GRANT REMOTE ON *.* TO ${member}`, why: '`memhouse relocate`', optional: true });
+  for (const s of shares) {
+    steps.push({ sql: `REVOKE SELECT ON ${member}.* FROM ${s.reader}`, why: `${s.reader}'s read of the old database`, optional: true });
+    steps.push({ sql: `GRANT SELECT ON ${db}.${roomPattern(member)} TO ${s.reader}`, why: `${s.reader} keeps reading ${member}'s rooms`, optional: true });
+  }
+  for (const p of policies) {
+    const type = Object.keys(LEGACY).find((k) => LEGACY[k] === p.table) || null;
+    if (!type) continue;
+    const readers = p.readers.length ? p.readers.join(', ') : 'ALL';
+    steps.push({ sql: `CREATE ROW POLICY OR REPLACE ${p.name} ON ${db}.${physicalRoom(type, member)} FOR SELECT USING ${p.filter} TO ${readers}`, why: `row policy '${p.name}' follows the room`, optional: true });
+    steps.push({ sql: `DROP ROW POLICY IF EXISTS ${p.name} ON ${member}.${p.table}`, why: 'its copy on the old name', optional: true });
+  }
+  steps.push({ sql: `DROP DATABASE IF EXISTS ${member}`, why: 'the emptied database', when: 'empty' });
+  return steps;
+}
+
+function render(steps) {
+  return steps.map((s) => `-- ${s.why}${s.optional ? ' (optional)' : ''}${s.when ? ` (only when ${s.when})` : ''}\n${s.sql};`).join('\n');
+}
+
+module.exports = { planMember, render, LEGACY, STAT_VIEWS, STAT_TABLES };

package/memhouse/delivery/UPGRADE.md.tpl

@@ -0,0 +1,67 @@
+# Your memhouse moved — one command brings you along
+
+{{OPERATOR}} upgraded the house at `{{URL}}` to memhouse's **one layout**. Your memory is
+all still there; only its address changed. Where you had a database of your own
+(`{{NAME}}.messages`), you now have rooms named for you inside the shared house:
+
+```
+{{ROOMS}}
+```
+
+Nothing was copied or deleted — the tables were renamed in place. Your shares were carried
+over by the operator. Until you upgrade, your shipper stops adding new sessions (it refuses
+the old address rather than writing somewhere wrong); nothing is lost meanwhile.
+
+Do it yourself, or hand this page to your coding agent, from any directory:
+
+```
+claude "Read MEMHOUSE-UPGRADE.md and follow it. Ask me before each step that changes this machine."
+```
+
+## 1. Upgrade
+
+```
+memhouse update
+```
+
+That installs the new build from the channel you are on ({{CHANNEL}}), notices that your
+rooms moved, rewrites `~/.memhouse/env` to point at house `{{DB}}`, refreshes the `/mem`
+skills in your Claude config, and restarts the shipper. If `memhouse` is not installed on
+this machine at all: `npm install -g memhouse@{{CHANNEL}}`, then `memhouse status`.
+
+## 2. Check
+
+```
+memhouse instance
+memhouse status
+```
+
+`instance` should say house `{{DB}}`, member `{{NAME}}`, rooms `{{DB}}.{{NAME}}_*`, shipper
+running. `status` shows your session count — the same as before — and, after a few
+minutes, a fresh pass.
+
+## 3. What is different
+
+- **Reading a housemate.** In `/mem:recall`, a friend's memory is `{{DB}}.<friend>_messages`
+  — no database switch. `/mem:house` lists who can read yours.
+- **The dashboard** (`memhouse start`, then the printed URL) is faster: the tables it reads
+  are now filled by your own shipper at the end of each pass.
+- **Nothing to re-share.** Grants you gave or received were re-expressed on the new names.
+
+## If something looks wrong
+
+- `memhouse status` says *"last pass FAILED"* → `memhouse stop && memhouse start`.
+- `memhouse update` says it is *already current* but `instance` still shows house `{{NAME}}`
+  → run `memhouse doctor`; it names the fix.
+- Anything else: send {{OPERATOR}} the output of `memhouse doctor` — it prints no secrets.
+
+## For an agent following this page
+
+- Never print `~/.memhouse/env` or any `MEMHOUSE_*` value; the transcript you are in is
+  itself shipped into this house.
+- Run exactly the commands above. Do not create or drop tables, do not edit the env by
+  hand — `memhouse update` does the rewrite, and `memhouse doctor` names any remaining fix.
+- If `memhouse update` needs `sudo` (an `EACCES` from npm), that is the one place it is fine.
+- Stop and show the person the output when anything says ✗.
+
+memhouse {{VERSION}} · generated {{DATE}}

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: recall past sessions and answer from them, run analytics, check the house, bring people in, and administer the server. Skills install as /mem:recall, /mem:sql, /mem:house, /mem:access, and /mem:admin.",
-  "version": "0.18.3",
+  "version": "0.18.5",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/envfile.js

@@ -61,4 +61,11 @@ function credentialDrift(text, current = {}) {
   return { changed, values };
 }
 
-module.exports = { credentialDrift, parse, quoteShell, quoteSystemd, assertSingleLine };
+/** The env file text with one key set (replaced in place, or appended). Pure. */
+function setKey(text, key, value) {
+  const line = `${key}='${String(value).replace(/'/g, "'\\''")}'`;
+  const re = new RegExp(`^${key}=.*$`, 'm');
+  return re.test(text) ? text.replace(re, line) : `${text.replace(/\n*$/, '')}\n${line}\n`;
+}
+
+module.exports = { setKey, credentialDrift, parse, quoteShell, quoteSystemd, assertSingleLine };

package/memhouse/flags.js

@@ -16,7 +16,7 @@ const COMMAND_FLAGS = {
   null: [], help: [], version: [],
   whoami: ['admin'],
   share: ['only', 'revoke', 'list'],
-  discover: [], stats: [], stop: [], doctor: [], 'sessions-query': [], rooms: [], instance: [], members: ['db','admin-user','admin-password'],
+  discover: [], stats: [], stop: [], doctor: [], 'sessions-query': [], rooms: [], instance: [], members: ['db','admin-user','admin-password'], convert: ['url','db','admin-user','admin-password','member','print-sql','dry-run','guides','out'],
   status: [], start: [],
   onboard: ['url', 'user', 'password', 'db', 'port', 'no-ship', 'target', 'house-port', 'tag', 'local'],
   install: ['url', 'user', 'password', 'db', 'port', 'no-ship', 'env', 'print-sql', 'member',

package/memhouse/shipper/ship.js

@@ -200,7 +200,7 @@ function toInt(v) {
   return Number.isFinite(n) && n > 0 ? n : 0;
 }
 
-function makeClient() {
+function makeClient(override = {}) {
   // No house-shaped default. `memhouse` spawns this with the resolved config in the
   // environment, so a missing MEMHOUSE_URL here means the shipper was started some other
   // way — a stale service unit, a hand-rolled cron, a copied command — and the old
@@ -224,7 +224,7 @@ function makeClient() {
     url: process.env.MEMHOUSE_URL,
     username: process.env.MEMHOUSE_USER,
     password: process.env.MEMHOUSE_PASSWORD || '',
-    database: process.env.MEMHOUSE_DB || process.env.MEMHOUSE_USER, // house defaults to the user's own name
+    database: override.database || process.env.MEMHOUSE_DB || process.env.MEMHOUSE_USER, // house defaults to the user's own name
     // gzip the INSERT body. Measured on a real house behind a Cloudflare tunnel: a
     // 2000-row batch was ~27 MB of JSON and the insert spent 76s in NetworkReceive alone
     // (index build was 0.8s, CPU 1.1s) — the upload, not ClickHouse, was the whole cost.
@@ -1310,6 +1310,27 @@ async function printStats(client) {
 async function main() {
   const argv = process.argv.slice(2);
   let client = makeClient();
+  // The operator may have converted the house to the one layout since this env was
+  // written: the member's rooms moved from <name>.* to mem.<name>_*. Adopt that here —
+  // rewrite the env, point this process at `mem` — instead of refusing the old address on
+  // every pass until someone runs `memhouse update`.
+  try {
+    const me = process.env.MEMHOUSE_USER; const db = process.env.MEMHOUSE_DB || me;
+    if (me && db !== 'mem') {
+      const mine = `${me}_messages`;
+      // Probe through `system`: after a conversion the env's database no longer exists, and a
+      // session defaulting to it is refused before any query runs.
+      const probe = makeClient({ database: 'system' });
+      const rs = await probe.query({ query: `SELECT database, name FROM system.tables WHERE (database = '${db.replace(/'/g, "\\'")}' AND name IN ('messages', '${mine}')) OR (database = 'mem' AND name = '${mine}')`, format: 'JSONEachRow' });
+      const rows = await rs.json(); const has = (d, n) => rows.some((r) => r.database === d && r.name === n);
+      if (!has(db, mine) && !has(db, 'messages') && has('mem', mine)) {
+        const envPath = require('path').join(process.env.MEMHOUSE_HOME || require('path').join(require('os').homedir(), '.memhouse'), 'env');
+        try { const fs = require('fs'); fs.writeFileSync(envPath, require('../envfile').setKey(fs.readFileSync(envPath, 'utf-8'), 'MEMHOUSE_DB', 'mem')); } catch { /* env not writable: this process still adopts */ }
+        process.env.MEMHOUSE_DB = 'mem'; client = makeClient();
+        console.error(`[memhouse] your rooms moved: ${db}.messages is now mem.${mine} — env now says MEMHOUSE_DB=mem`);
+      }
+    }
+  } catch { /* unreachable or unreadable: the pass will say */ }
   try {
     if (argv.includes('--ensure-schema')) {
       const n = await ensureSchema(client);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.18.3",
+  "version": "0.18.5",
   "description": "memhouse \u2014 agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {