memhouse 0.18.4 → 0.18.6

package/bin/memhouse.js

@@ -453,6 +453,8 @@ Data         ship                 one incremental pass (--full | --loop [sec])
              instance             which memhouse this is: home, binary, house, rooms, scope, daemons, bound playbooks
              rooms                what your rooms are actually called (--json)
              members              who is in a house and what each can reach (--db, admin)
+             convert              operator: move a pre-one-layout house (a database per member) to the one layout
+                                  (--admin-user/--admin-password, --member, --print-sql, --dry-run, --guides --out DIR)
              start | stop |       shipper loop + dashboard as background daemons
              share <user>         let someone read this house (--only project=… |
                                   session=… | host=… | source=… | folder=… | since=… |
@@ -1640,13 +1642,29 @@ async function cmdStatus() {
   if (out.connected && !out.messages) console.log(ok(`house: empty — ${out.sessions} sessions, 0 messages (nothing shipped yet)`));
   else if (out.connected) console.log(ok(`house: ${out.sessions} sessions, ${out.messages} messages (freshest ingest ${out.freshest} UTC)`));
   if (out.fleet && out.fleet.length) {
-    const badOnes = out.fleet.filter((f) => f.verdict !== 'ok');
-    console.log((badOnes.length ? warn : ok)(`fleet: ${out.fleet.length} writer(s) known to this house`));
-    for (const f of out.fleet) {
+    // A writer appears in this list because it has rows — the list is GROUP BY over the
+    // messages, not a registry — so a machine that was re-identified (before host ids were
+    // derived from the machine) stays here forever, and cannot be tidied away without
+    // deleting its sessions. Retired writers are therefore folded into one line instead of
+    // shouting a permanent warning: they are history, not a fleet to maintain. `--all`
+    // prints every one. A writer is RETIRED when it has been silent past the cutoff; a
+    // pre-0.10 writer that is still active keeps its warning, because that one can still bite.
+    const RETIRED_MS = 14 * 24 * 3600 * 1000;
+    const retired = out.fleet.filter((f) => f.ageMs !== null && f.ageMs > RETIRED_MS);
+    const shown = flags.all === true ? out.fleet : out.fleet.filter((f) => !retired.includes(f));
+    const live = out.fleet.filter((f) => !retired.includes(f));
+    const badOnes = live.filter((f) => f.verdict !== 'ok');
+    console.log((badOnes.length ? warn : ok)(`fleet: ${live.length} active writer(s)${retired.length ? `, ${retired.length} retired` : ''}`));
+    for (const f of shown) {
       const mark = f.verdict === 'legacy' ? '  ⚠ pre-0.10 — upgrade it (or revoke its mutation grants); its re-ships delete retained parses'
         : f.verdict === 'outdated' ? '  ⚠ supports an older schema — refusing every pass until updated'
           : f.verdict === 'stale' ? '  • stale' : '';
-      console.log(`     ${f.writer.padEnd(28)} ${String(f.version || '?').padEnd(8)} last ship ${fleetAge(f.ageMs)}${mark}`);
+      const tag = retired.includes(f) ? '  · retired' : mark;
+      console.log(`     ${f.writer.padEnd(28)} ${String(f.version || '?').padEnd(8)} last ship ${fleetAge(f.ageMs)}${tag}`);
+    }
+    if (retired.length && flags.all !== true) {
+      const oldest = fleetAge(Math.max(...retired.map((f) => f.ageMs)));
+      console.log(`     ${String(`${retired.length} retired writer(s)`).padEnd(28)} ${' '.padEnd(8)} silent ${oldest} and longer — their sessions are still here:  memhouse status --all`);
     }
   }
   {
@@ -2000,6 +2018,10 @@ async function cmdDoctor() {
         : `token capture: ${zero.map((r) => `${r.source} (${r.n} messages)`).join(', ')} ship ZERO tokens — their cost shows as $0, not as unknown`,
       'that adapter does not extract usage; the messages are stored, the numbers are not');
   } catch { /* a house that cannot be read is already reported above */ }
+  try {
+    const moved = await adoptMovedHouse(cfg, { fix: false });
+    if (moved === 'moved') add(false, `rooms moved to mem.${physicalRoom('messages', cfg.user).replace(/_messages$/, '')}_* — this env still says MEMHOUSE_DB=${cfg.db}`, 'memhouse update   (rewrites the env and restarts the shipper)');
+  } catch { /* connection problems are reported above */ }
   const sh = shipperHealth();
   const shFail = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).describeFailure(sh.lastPass);
   add(sh.running && !shFail, `shipper${sh.via ? ` — ${sh.via}` : ''}${shFail ? ` — ${shFail}` : ''}`,
@@ -2221,6 +2243,25 @@ async function cmdUpdate() {
     }
   }
   console.log(ok('files updated'));
+  // The house may have been converted to the one layout since this machine last ran:
+  // the member's rooms moved from <name>.* to mem.<name>_*. Fix the env here, before the
+  // shipper restarts, or its first pass refuses the old address forever.
+  try { await adoptMovedHouse(resolveConfig()); } catch { /* doctor will say */ }
+
+  // Bring the house to the schema the NEW code expects, before any daemon restarts.
+  // A release that adds rooms (0.18.3's stat tables) used to land after the restart, so
+  // the freshly started shipper failed its first passes with "has no <member>_sessions…",
+  // `status` quoted that failure, and the dashboard served a page whose every request
+  // 500'd — all of it self-healing eventually, all of it alarming meanwhile. Two real
+  // members hit this within an hour of each other. The new binary owns the new schema, so
+  // it runs it here, in the one moment the daemons are already down.
+  {
+    const r = spawnSync(process.execPath, [path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js'), '--ensure-schema'],
+      { env: childEnv(resolveConfig()), encoding: 'utf-8', stdio: 'pipe', timeout: 120000 });
+    const said = `${r.stdout || ''}${r.stderr || ''}`.trim().split('\n').filter((l) => l.includes('[memhouse]')).pop();
+    if (r.status === 0) console.log(ok(`house schema current${said ? ` — ${said.replace('[memhouse] ', '')}` : ''}`));
+    else console.log(warn(`could not bring the house to this version's schema — the daemons start anyway; run: memhouse doctor${said ? `\n  ${said}` : ''}`));
+  }
 
   // Refresh the Claude plugin wherever it is ALREADY installed, so `update` keeps the
   // skills in lockstep with the package instead of leaving a stale `/mem:*` behind. Only
@@ -3417,6 +3458,30 @@ async function cmdWhoami() {
  * declined. Never touches the file's password: what it shows is the user, the house and
  * the server, which the guide beside the file shows too.
  */
+/**
+ * After the operator converted the house to the one layout, a member's env still says
+ * MEMHOUSE_DB=<their name>. Their rooms now live in `mem` as <name>_*. Detect that and
+ * rewrite the env: the member's `memhouse update` is the moment it happens, and doctor
+ * names it. Returns 'moved' (env rewritten), 'current', or 'unknown' (could not tell).
+ */
+async function adoptMovedHouse(cfg, { fix = true, quiet = false } = {}) {
+  if (!cfg.stated || !cfg.user) return 'unknown';
+  const mine = physicalRoom('messages', cfg.user);
+  let rows;
+  try {
+    rows = await chRows(cfg, `SELECT database, name FROM system.tables WHERE (database = ${sqlStr(cfg.db)} AND name IN ('messages', ${sqlStr(mine)})) OR (database = 'mem' AND name = ${sqlStr(mine)})`, { database: '' });
+  } catch { return 'unknown'; }
+  const has = (d, n) => rows.some((r) => r.database === d && r.name === n);
+  if (has(cfg.db, mine)) return 'current';
+  if (cfg.db !== 'mem' && has('mem', mine) && !has(cfg.db, 'messages')) {
+    if (!fix) return 'moved';
+    writeEnvFile({ ...cfg, db: 'mem' });
+    if (!quiet) console.log(ok(`your rooms moved: ${cfg.db}.messages is now mem.${mine} — ${short(ENV_FILE)} now says MEMHOUSE_DB=mem`));
+    return 'moved';
+  }
+  return 'current';
+}
+
 async function offerInvite() {
   const inv = require(path.join(REPO_ROOT, 'memhouse', 'invitefile'));
   // The current directory only. The guide says "from the directory holding the file", and
@@ -4014,6 +4079,93 @@ async function cmdUninstall() {
       console.log(r.sessions_v);
       break;
     }
+    case 'convert': {
+      // Operator: move a pre-one-layout house (a database per member) to the one layout.
+      // Discovers members by their databases, plans per member, executes as admin, records
+      // an event in each member's new events room. --print-sql shows the plan; --dry-run
+      // discovers and plans without touching anything; --guides <dir> renders
+      // MEMHOUSE-UPGRADE.md per member for the operator to hand out.
+      const convert = require(path.join(REPO_ROOT, 'memhouse', 'convert'));
+      const db = flags.db && flags.db !== true ? String(flags.db) : 'mem';
+      const au = flags['admin-user'] && flags['admin-user'] !== true ? String(flags['admin-user']) : (cfg.adminUser || null);
+      const ap = flags['admin-password'] && flags['admin-password'] !== true ? String(flags['admin-password']) : (cfg.adminPassword || '');
+      if (!au) { console.log(bad('convert needs an admin credential: --admin-user/--admin-password (or the one this instance keeps)')); process.exitCode = 1; break; }
+      const who = { ...cfg, user: au, password: ap };
+      const only = flags.member && flags.member !== true ? String(flags.member) : null;
+      // Candidates: a user whose own database holds `messages` and who has no rooms in `db` yet.
+      const cands = await chRows(who, `SELECT u.name AS member FROM system.users u WHERE u.name IN (SELECT database FROM system.tables WHERE name = 'messages') AND u.name NOT IN (SELECT replaceRegexpOne(name, '_messages$', '') FROM system.tables WHERE database = ${sqlStr(db)} AND name LIKE '%\\_messages') ORDER BY u.name`, { database: '' });
+      const members = cands.map((r) => r.member).filter((m) => !only || m === only);
+      if (!members.length) { console.log(ok(only ? `'${only}' has nothing to convert` : 'nothing to convert — no member still owns a database of their own')); break; }
+      console.log(ok(`${members.length} member(s) to convert into '${db}': ${members.join(', ')}`));
+      const plans = [];
+      for (const m of members) {
+        const shares = (await chRows(who, `SELECT DISTINCT user_name FROM system.grants WHERE access_type = 'SELECT' AND database = ${sqlStr(m)} AND (table = '' OR table IS NULL) AND user_name != ${sqlStr(m)}`, { database: '' })).map((r) => ({ reader: r.user_name }));
+        const policies = (await chRows(who, `SELECT name, table, select_filter AS filter, apply_to_list AS readers FROM system.row_policies WHERE database = ${sqlStr(m)}`, { database: '' })).map((r) => ({ name: r.name, table: r.table, filter: r.filter, readers: Array.isArray(r.readers) ? r.readers : [] }));
+        plans.push({ member: m, shares, policies, steps: convert.planMember({ member: m, db, shares, policies }) });
+      }
+      if (flags['print-sql'] === true || flags['dry-run'] === true) {
+        console.log(`CREATE DATABASE IF NOT EXISTS ${db};`);
+        for (const p of plans) console.log(`\n-- ${p.member}: ${p.shares.length} share(s), ${p.policies.length} row polic${p.policies.length === 1 ? 'y' : 'ies'}\n${convert.render(p.steps)}`);
+        if (flags['dry-run'] === true) console.log(`\n${warn('dry run — nothing executed')}`);
+        break;
+      }
+      if (flags.yes !== true && process.stdin.isTTY) {
+        const a = (await ask(`Convert ${members.length} member(s) now? Renames are instant and reversible only by renaming back. (yes/no)`, 'no')).toLowerCase();
+        if (a !== 'yes' && a !== 'y') { console.log('  nothing done.'); break; }
+      }
+      await ch(who, `CREATE DATABASE IF NOT EXISTS ${db}`, { database: '' });
+      let converted = 0;
+      for (const p of plans) {
+        let failed = null;
+        for (const st of p.steps) {
+          if (st.when === 'empty') {
+            const left = await chRows(who, `SELECT count() AS n FROM system.tables WHERE database = ${sqlStr(p.member)}`, { database: '' });
+            if (Number(left[0] && left[0].n) !== 0) { console.log(warn(`  ${p.member}: database kept — ${left[0].n} unexpected table(s) remain in it`)); continue; }
+          }
+          try { await ch(who, st.sql, { database: '' }); }
+          catch (e) {
+            const m = (e && e.message ? e.message : String(e)).split('\n')[0];
+            if (st.optional) { console.log(warn(`  ${p.member}: skipped — ${st.why}: ${m}`)); continue; }
+            failed = `${st.why}: ${m}`; break;
+          }
+        }
+        if (failed) { console.log(bad(`${p.member}: stopped — ${failed}`)); console.log('  what already ran stays (renames are visible in system.tables); fix and re-run: memhouse convert --member ' + p.member); process.exitCode = 1; continue; }
+        try {
+          const ev = physicalRoom('events', p.member);
+          const cols = new Set((await chRows(who, `SELECT name FROM system.columns WHERE database = ${sqlStr(db)} AND table = ${sqlStr(ev)} AND default_kind != 'MATERIALIZED'`, { database: '' })).map((r) => r.name)); // actor is MATERIALIZED currentUser()
+          const want = { event_at: 'now64(3)', kind: "'layout'", id: "'one-layout'", status: "'converted'", from_version: "'db-per-member'", to_version: "'one-layout'", actor: sqlStr(au), host: sqlStr(os.hostname()), rows_before: '0', rows_after: '0', detail: sqlStr(`renamed ${p.member}.* → ${db}.${p.member}_*; ${p.shares.length} share(s), ${p.policies.length} row polic(y/ies) carried`) };
+          const use = Object.keys(want).filter((c) => cols.has(c));
+          if (use.length) await ch(who, `INSERT INTO ${db}.${ev} (${use.join(', ')}) VALUES (${use.map((c) => want[c]).join(', ')})`, { database: '' });
+          else console.log(warn(`  ${p.member}: events room has none of the expected columns — no event recorded`));
+        } catch (e) { console.log(warn(`  ${p.member}: event not recorded — ${(e && e.message ? e.message : String(e)).split('\n')[0].slice(0, 120)}`)); }
+        // The rooms moved, but the house also needs what THIS version adds — the
+        // per-member stat tables the dashboard reads. `ensureSchema` makes them, and a
+        // plain `ship` never calls it, so leaving them to the member meant a dashboard
+        // that scanned millions of rows (or 500'd) until someone happened to run
+        // `ship --ensure-schema`. Create them here, as the admin, while we are already
+        // holding the member's rooms in mind.
+        try {
+          const st = convert.statTables(db, p.member);
+          for (const sql of st) await ch(who, sql, { database: '' });
+          if (st.length) console.log(ok(`  ${p.member}: dashboard tables created (${st.length})`));
+        } catch (e) { console.log(warn(`  ${p.member}: dashboard tables not created — their first ship will do it: ${(e && e.message ? e.message : String(e)).split('\n')[0].slice(0, 90)}`)); }
+        converted++;
+        console.log(ok(`${p.member}: rooms now ${db}.${p.member}_* — ${p.shares.length} share(s) carried${p.policies.length ? `, ${p.policies.length} row polic${p.policies.length === 1 ? 'y' : 'ies'}` : ''}`));
+      }
+      console.log(ok(`${converted}/${members.length} converted`));
+      if (flags.guides) {
+        const outDir = flags.out && flags.out !== true ? String(flags.out) : process.cwd();
+        fs.mkdirSync(outDir, { recursive: true });
+        const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'delivery', 'UPGRADE.md.tpl'), 'utf-8');
+        for (const p of plans) {
+          const rooms = [...ROOM_TYPES, ...META_TYPES].map((t) => `${db}.${physicalRoom(t, p.member)}`).join('\n');
+          const md = tpl.replaceAll('{{NAME}}', p.member).replaceAll('{{URL}}', cfg.url).replaceAll('{{DB}}', db).replaceAll('{{ROOMS}}', rooms)
+            .replaceAll('{{CHANNEL}}', cfg.channel || 'latest').replaceAll('{{OPERATOR}}', os.userInfo().username).replaceAll('{{VERSION}}', PKG.version).replaceAll('{{DATE}}', new Date().toISOString().slice(0, 10));
+          const f = path.join(outDir, `MEMHOUSE-UPGRADE-${p.member}.md`); fs.writeFileSync(f, md); console.log(ok(`guide written: ${short(f)}`));
+        }
+      }
+      break;
+    }
     case 'members': {
       // "Who is in this database, and what can each of them reach?" Before shared houses a
       // database had exactly one member and the question did not exist; this layout creates

package/memhouse/convert.js

@@ -0,0 +1,75 @@
+// Convert a pre-one-layout house to the one layout — the plan, as SQL, pure.
+//
+// Before 0.18 every member owned a DATABASE named for them: `polat.messages`,
+// `polat.house_meta`, granted ALL ON polat.*. The one layout puts everyone in one database
+// as `mem.polat_messages`, `mem.polat_meta`, with one wildcard grant and nothing on the
+// database itself. Moving is a RENAME per table — metadata only, nothing copied — plus the
+// grant swap, and shares re-expressed on the new names. The 0.17.1 dashboard views are
+// dropped: in the one layout the shipper fills the stat tables (a refreshable view needs
+// CREATE TABLE on the whole database, the grant this layout withholds).
+//
+// The operator runs it once, as an admin. Members then `memhouse update`; the new build
+// finds the moved rooms and repairs its own env (see adoptMovedHouse in the CLI and shipper).
+
+const { roomPattern, physicalRoom, ROOM_TYPES, META_TYPES, MEMBER_PIN } = require('./house/house');
+const { roomGrant } = require('./provision');
+
+const LEGACY = { messages: 'messages', sessions: 'sessions', tool_calls: 'tool_calls', meta: 'house_meta', events: 'house_events' };
+const STAT_VIEWS = ['session_stats_mv', 'session_model_stats_mv', 'session_tool_stats_mv'];
+const STAT_TABLES = ['session_stats', 'session_model_stats', 'session_tool_stats'];
+
+/**
+ * @param {object} p
+ * @param {string} p.member            the member (= the old database name)
+ * @param {string} [p.db='mem']        the one-layout house
+ * @param {Array<{reader:string}>} [p.shares]        whole-house reads granted to others (SELECT ON member.*)
+ * @param {Array<{name:string, table:string, filter:string, readers:string[]}>} [p.policies]  row policies on the old tables
+ * @returns {Array<{sql:string, why:string, optional?:boolean, when?:string}>}
+ */
+function planMember({ member, db = 'mem', shares = [], policies = [] }) {
+  const steps = [];
+  for (const v of STAT_VIEWS) steps.push({ sql: `DROP TABLE IF EXISTS ${member}.${v}`, why: '0.17.1 refreshable view — the shipper fills stats in the one layout' });
+  for (const t of STAT_TABLES) steps.push({ sql: `DROP TABLE IF EXISTS ${member}.${t}`, why: '0.17.1 stat table — recreated by the member\'s next ship in the new shape' });
+  const pairs = [...ROOM_TYPES, ...META_TYPES].map((t) => `${member}.${LEGACY[t]} TO ${db}.${physicalRoom(t, member)}`);
+  steps.push({ sql: `RENAME TABLE ${pairs.join(', ')}`, why: 'the five rooms move into the house under the member\'s name — one atomic rename, nothing copied' });
+  steps.push({ sql: `REVOKE ALL ON ${member}.* FROM ${member}`, why: 'the database-wide grant the old layout needed' });
+  steps.push({ sql: roomGrant(db, member), why: `their rooms — ${db}.${roomPattern(member)} — and nothing else` });
+  steps.push({ sql: `ALTER USER ${member} ADD SETTING ${MEMBER_PIN}`, why: 'user_id is stamped per row; async inserts would skip it', optional: true });
+  steps.push({ sql: `GRANT ALTER USER ON ${member} TO ${member}`, why: '`memhouse passwd` without an admin', optional: true });
+  steps.push({ sql: `GRANT SHOW USERS ON *.* TO ${member}`, why: 'names only, to know who to share with', optional: true });
+  steps.push({ sql: `GRANT REMOTE ON *.* TO ${member}`, why: '`memhouse relocate`', optional: true });
+  for (const s of shares) {
+    steps.push({ sql: `REVOKE SELECT ON ${member}.* FROM ${s.reader}`, why: `${s.reader}'s read of the old database`, optional: true });
+    steps.push({ sql: `GRANT SELECT ON ${db}.${roomPattern(member)} TO ${s.reader}`, why: `${s.reader} keeps reading ${member}'s rooms`, optional: true });
+  }
+  for (const p of policies) {
+    const type = Object.keys(LEGACY).find((k) => LEGACY[k] === p.table) || null;
+    if (!type) continue;
+    const readers = p.readers.length ? p.readers.join(', ') : 'ALL';
+    steps.push({ sql: `CREATE ROW POLICY OR REPLACE ${p.name} ON ${db}.${physicalRoom(type, member)} FOR SELECT USING ${p.filter} TO ${readers}`, why: `row policy '${p.name}' follows the room`, optional: true });
+    steps.push({ sql: `DROP ROW POLICY IF EXISTS ${p.name} ON ${member}.${p.table}`, why: 'its copy on the old name', optional: true });
+  }
+  steps.push({ sql: `DROP DATABASE IF EXISTS ${member}`, why: 'the emptied database', when: 'empty' });
+  return steps;
+}
+
+function render(steps) {
+  return steps.map((s) => `-- ${s.why}${s.optional ? ' (optional)' : ''}${s.when ? ` (only when ${s.when})` : ''}\n${s.sql};`).join('\n');
+}
+
+/**
+ * The CREATE statements for a member's dashboard tables, in the one layout. `convert` runs
+ * these so a converted house is complete the moment it is converted — the alternative was
+ * a dashboard with nothing precomputed until someone ran `ship --ensure-schema` by hand.
+ * Same source of truth the shipper uses, so the two cannot drift.
+ */
+function statTables(db, member) {
+  const house = require('./house/house');
+  // statCreateStatements builds unqualified names (the member runs it inside their own
+  // house); convert runs as the admin with no default database, so qualify every name.
+  return house.statCreateStatements(house.roomNames(member))
+    .map((sql) => sql.replace(/\b(CREATE TABLE IF NOT EXISTS |FROM )(?!\()/g, (m0) => m0)
+      .replace(new RegExp(`\\b(${member}_(?:session_stats|session_model_stats|session_tool_stats|sessions|messages|tool_calls|meta|events))\\b`, 'g'), `${db}.$1`));
+}
+
+module.exports = { planMember, render, statTables, LEGACY, STAT_VIEWS, STAT_TABLES };

package/memhouse/delivery/UPGRADE.md.tpl

@@ -0,0 +1,67 @@
+# Your memhouse moved — one command brings you along
+
+{{OPERATOR}} upgraded the house at `{{URL}}` to memhouse's **one layout**. Your memory is
+all still there; only its address changed. Where you had a database of your own
+(`{{NAME}}.messages`), you now have rooms named for you inside the shared house:
+
+```
+{{ROOMS}}
+```
+
+Nothing was copied or deleted — the tables were renamed in place. Your shares were carried
+over by the operator. Until you upgrade, your shipper stops adding new sessions (it refuses
+the old address rather than writing somewhere wrong); nothing is lost meanwhile.
+
+Do it yourself, or hand this page to your coding agent, from any directory:
+
+```
+claude "Read MEMHOUSE-UPGRADE.md and follow it. Ask me before each step that changes this machine."
+```
+
+## 1. Upgrade
+
+```
+memhouse update
+```
+
+That installs the new build from the channel you are on ({{CHANNEL}}), notices that your
+rooms moved, rewrites `~/.memhouse/env` to point at house `{{DB}}`, refreshes the `/mem`
+skills in your Claude config, and restarts the shipper. If `memhouse` is not installed on
+this machine at all: `npm install -g memhouse@{{CHANNEL}}`, then `memhouse status`.
+
+## 2. Check
+
+```
+memhouse instance
+memhouse status
+```
+
+`instance` should say house `{{DB}}`, member `{{NAME}}`, rooms `{{DB}}.{{NAME}}_*`, shipper
+running. `status` shows your session count — the same as before — and, after a few
+minutes, a fresh pass.
+
+## 3. What is different
+
+- **Reading a housemate.** In `/mem:recall`, a friend's memory is `{{DB}}.<friend>_messages`
+  — no database switch. `/mem:house` lists who can read yours.
+- **The dashboard** (`memhouse start`, then the printed URL) is faster: the tables it reads
+  are now filled by your own shipper at the end of each pass.
+- **Nothing to re-share.** Grants you gave or received were re-expressed on the new names.
+
+## If something looks wrong
+
+- `memhouse status` says *"last pass FAILED"* → `memhouse stop && memhouse start`.
+- `memhouse update` says it is *already current* but `instance` still shows house `{{NAME}}`
+  → run `memhouse doctor`; it names the fix.
+- Anything else: send {{OPERATOR}} the output of `memhouse doctor` — it prints no secrets.
+
+## For an agent following this page
+
+- Never print `~/.memhouse/env` or any `MEMHOUSE_*` value; the transcript you are in is
+  itself shipped into this house.
+- Run exactly the commands above. Do not create or drop tables, do not edit the env by
+  hand — `memhouse update` does the rewrite, and `memhouse doctor` names any remaining fix.
+- If `memhouse update` needs `sudo` (an `EACCES` from npm), that is the one place it is fine.
+- Stop and show the person the output when anything says ✗.
+
+memhouse {{VERSION}} · generated {{DATE}}

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: recall past sessions and answer from them, run analytics, check the house, bring people in, and administer the server. Skills install as /mem:recall, /mem:sql, /mem:house, /mem:access, and /mem:admin.",
-  "version": "0.18.4",
+  "version": "0.18.6",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/envfile.js

@@ -61,4 +61,11 @@ function credentialDrift(text, current = {}) {
   return { changed, values };
 }
 
-module.exports = { credentialDrift, parse, quoteShell, quoteSystemd, assertSingleLine };
+/** The env file text with one key set (replaced in place, or appended). Pure. */
+function setKey(text, key, value) {
+  const line = `${key}='${String(value).replace(/'/g, "'\\''")}'`;
+  const re = new RegExp(`^${key}=.*$`, 'm');
+  return re.test(text) ? text.replace(re, line) : `${text.replace(/\n*$/, '')}\n${line}\n`;
+}
+
+module.exports = { setKey, credentialDrift, parse, quoteShell, quoteSystemd, assertSingleLine };

package/memhouse/flags.js

@@ -16,8 +16,8 @@ const COMMAND_FLAGS = {
   null: [], help: [], version: [],
   whoami: ['admin'],
   share: ['only', 'revoke', 'list'],
-  discover: [], stats: [], stop: [], doctor: [], 'sessions-query': [], rooms: [], instance: [], members: ['db','admin-user','admin-password'],
-  status: [], start: [],
+  discover: [], stats: [], stop: [], doctor: [], 'sessions-query': [], rooms: [], instance: [], members: ['db','admin-user','admin-password'], convert: ['url','db','admin-user','admin-password','member','print-sql','dry-run','guides','out'],
+  status: ['all'], start: [],
   onboard: ['url', 'user', 'password', 'db', 'port', 'no-ship', 'target', 'house-port', 'tag', 'local'],
   install: ['url', 'user', 'password', 'db', 'port', 'no-ship', 'env', 'print-sql', 'member',
     'member-password', 'admin-user', 'admin-password', 'ensure-schema', 'rotate-password', 'force',

package/memhouse/host.js

@@ -53,6 +53,59 @@ function read(home = homeDir()) {
   return null;
 }
 
+/**
+ * A fingerprint of THIS MACHINE, not of this install.
+ *
+ * It used to be `randomBytes(16)`, which lives only in host.json — so wiping MEMHOUSE_HOME
+ * (`uninstall --full-removal`, a reset, a new laptop image) made the same physical machine
+ * come back as a stranger. One MacBook read as three writers in the fleet list, each
+ * holding a slice of the same machine's history.
+ *
+ * Now it is derived from a stable per-machine id — IOPlatformUUID on macOS,
+ * /etc/machine-id (or the D-Bus one) on Linux, MachineGuid on Windows — hashed with a
+ * fixed salt so the raw hardware id never leaves the machine and cannot be recovered from
+ * a row. Same machine, same fingerprint, reinstall after reinstall. Where no such id can
+ * be read, it falls back to random: an identity that is merely unstable is far better than
+ * one that collides, and the fallback is recorded so callers can say which happened.
+ *
+ * @returns {string} 32 hex characters
+ */
+function machineFingerprint(raw = stableMachineId()) {
+  const SALT = 'memhouse/host/v1'; // versioned: changing it re-identifies every machine
+  return raw
+    ? crypto.createHash('sha256').update(`${SALT}:${raw}`).digest('hex').slice(0, 32)
+    : crypto.randomBytes(16).toString('hex');
+}
+
+/** The OS's own machine id, or null when it cannot be read. Never stored, never shipped. */
+function stableMachineId() {
+  const run = (cmd, args) => {
+    try {
+      const r = require('child_process').execFileSync(cmd, args, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 4000 });
+      return String(r || '').trim() || null;
+    } catch { return null; }
+  };
+  try {
+    if (process.platform === 'darwin') {
+      const out = run('/usr/sbin/ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice']);
+      const m = out && /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out);
+      return m ? m[1] : null;
+    }
+    if (process.platform === 'linux') {
+      for (const f of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+        try { const v = fs.readFileSync(f, 'utf-8').trim(); if (v) return v; } catch { /* next */ }
+      }
+      return null;
+    }
+    if (process.platform === 'win32') {
+      const out = run('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid']);
+      const m = out && /MachineGuid\s+REG_SZ\s+(\S+)/.exec(out);
+      return m ? m[1] : null;
+    }
+  } catch { /* fall through */ }
+  return null;
+}
+
 /**
  * The identity of this machine, creating it on first use.
  *
@@ -69,7 +122,7 @@ function identity(home = homeDir()) {
   let rec = read(home);
   if (!rec) {
     rec = {
-      fingerprint: crypto.randomBytes(16).toString('hex'),
+      fingerprint: machineFingerprint(),
       hostname,
       platform: os.platform(),
       arch: os.arch(),
@@ -98,4 +151,4 @@ function identity(home = homeDir()) {
   };
 }
 
-module.exports = { identity, read, filePath, idFrom, FILE };
+module.exports = { identity, read, filePath, idFrom, machineFingerprint, stableMachineId, FILE };

package/memhouse/server/queries.js

@@ -27,23 +27,54 @@ const config = {
   database: process.env.MEMHOUSE_DB || process.env.MEMHOUSE_USER, // house defaults to the user's own name
 };
 
+/**
+ * The house may have moved under this process: the operator converts a pre-one-layout
+ * house and the member's rooms go from `<name>.*` to `mem.<name>_*`, while this server
+ * still holds the database its env named at boot. The shipper and `update` learned to
+ * adopt that; the dashboard did not, so every endpoint answered 500 behind a page that
+ * simply looked blank. Checked once at startup, cheap, and never fatal.
+ *
+ * @returns {Promise<'current'|'moved'|'unknown'>}
+ */
+async function adoptMovedHouse() {
+  const me = config.username;
+  if (!me || config.database === 'mem') return 'current';
+  const probe = createClient({ ...clientOptions(), database: 'system' });
+  try {
+    const rs = await probe.query({
+      query: `SELECT database, name FROM system.tables WHERE (database = {old:String} AND name IN ('messages', {mine:String})) OR (database = 'mem' AND name = {mine:String})`,
+      query_params: { old: config.database, mine: `${me}_messages` },
+      format: 'JSONEachRow',
+    });
+    const rows = await rs.json();
+    const has = (d, n) => rows.some((r) => r.database === d && r.name === n);
+    if (has(config.database, `${me}_messages`) || has(config.database, 'messages')) return 'current';
+    if (!has('mem', `${me}_messages`)) return 'unknown';
+    console.log(`[memhouse] rooms moved: ${config.database}.messages is now mem.${me}_messages — reading house 'mem'`);
+    config.database = 'mem';
+    _client = null; // rebuilt with the new database on the next call
+    return 'moved';
+  } catch { return 'unknown'; }
+  finally { try { await probe.close(); } catch { /* nothing to close */ } }
+}
+
 let _client = null;
-function getClient() {
-  if (_client) return _client;
-  _client = createClient({
-    // See the note in shipper/ship.js: the driver's ERROR-level dump lands ahead of every
-    // message we print, so a handled refusal reads like a crash. MEMHOUSE_DEBUG=1 restores it.
+function clientOptions() {
+  return {
     log: { level: process.env.MEMHOUSE_DEBUG ? ClickHouseLogLevel.DEBUG : ClickHouseLogLevel.OFF },
     url: config.url,
     username: config.username,
     password: config.password,
     database: config.database,
     request_timeout: 60000,
-    clickhouse_settings: {
-      ...READ_SETTINGS,
-      output_format_json_quote_64bit_integers: 0,
-    },
-  });
+    clickhouse_settings: { ...READ_SETTINGS, output_format_json_quote_64bit_integers: 0 },
+  };
+}
+function getClient() {
+  if (_client) return _client;
+  // See the note in shipper/ship.js: the driver's ERROR-level dump lands ahead of every
+  // message we print, so a handled refusal reads like a crash. MEMHOUSE_DEBUG=1 restores it.
+  _client = createClient(clientOptions());
   return _client;
 }
 
@@ -1101,7 +1132,7 @@ async function schema() {
   };
 }
 
-module.exports = {
+module.exports = { adoptMovedHouse,
   getClient, config,
   getOverview, getDailyActivity, getDashboardStats,
   getChats, countChats, getChat,

package/memhouse/server/server.js

@@ -435,6 +435,8 @@ app.get('*', (req, res) => {
 });
 
 if (require.main === module) {
+  // Before serving: has the house moved under us? (see queries.adoptMovedHouse)
+  qy.adoptMovedHouse().catch(() => {});
   app.listen(PORT, HOST, () => {
     console.log(`[memhouse] dashboard → http://localhost:${PORT} (house '${qy.config.database}' @ ${qy.config.url.replace(/\/\/.*@/, '//')})`
       + (HOST !== '127.0.0.1' ? ` [bound to ${HOST} — remotely reachable]` : ''));

package/memhouse/shipper/ship.js

@@ -200,7 +200,7 @@ function toInt(v) {
   return Number.isFinite(n) && n > 0 ? n : 0;
 }
 
-function makeClient() {
+function makeClient(override = {}) {
   // No house-shaped default. `memhouse` spawns this with the resolved config in the
   // environment, so a missing MEMHOUSE_URL here means the shipper was started some other
   // way — a stale service unit, a hand-rolled cron, a copied command — and the old
@@ -224,7 +224,7 @@ function makeClient() {
     url: process.env.MEMHOUSE_URL,
     username: process.env.MEMHOUSE_USER,
     password: process.env.MEMHOUSE_PASSWORD || '',
-    database: process.env.MEMHOUSE_DB || process.env.MEMHOUSE_USER, // house defaults to the user's own name
+    database: override.database || process.env.MEMHOUSE_DB || process.env.MEMHOUSE_USER, // house defaults to the user's own name
     // gzip the INSERT body. Measured on a real house behind a Cloudflare tunnel: a
     // 2000-row batch was ~27 MB of JSON and the insert spent 76s in NetworkReceive alone
     // (index build was 0.8s, CPU 1.1s) — the upload, not ClickHouse, was the whole cost.
@@ -1310,6 +1310,27 @@ async function printStats(client) {
 async function main() {
   const argv = process.argv.slice(2);
   let client = makeClient();
+  // The operator may have converted the house to the one layout since this env was
+  // written: the member's rooms moved from <name>.* to mem.<name>_*. Adopt that here —
+  // rewrite the env, point this process at `mem` — instead of refusing the old address on
+  // every pass until someone runs `memhouse update`.
+  try {
+    const me = process.env.MEMHOUSE_USER; const db = process.env.MEMHOUSE_DB || me;
+    if (me && db !== 'mem') {
+      const mine = `${me}_messages`;
+      // Probe through `system`: after a conversion the env's database no longer exists, and a
+      // session defaulting to it is refused before any query runs.
+      const probe = makeClient({ database: 'system' });
+      const rs = await probe.query({ query: `SELECT database, name FROM system.tables WHERE (database = '${db.replace(/'/g, "\\'")}' AND name IN ('messages', '${mine}')) OR (database = 'mem' AND name = '${mine}')`, format: 'JSONEachRow' });
+      const rows = await rs.json(); const has = (d, n) => rows.some((r) => r.database === d && r.name === n);
+      if (!has(db, mine) && !has(db, 'messages') && has('mem', mine)) {
+        const envPath = require('path').join(process.env.MEMHOUSE_HOME || require('path').join(require('os').homedir(), '.memhouse'), 'env');
+        try { const fs = require('fs'); fs.writeFileSync(envPath, require('../envfile').setKey(fs.readFileSync(envPath, 'utf-8'), 'MEMHOUSE_DB', 'mem')); } catch { /* env not writable: this process still adopts */ }
+        process.env.MEMHOUSE_DB = 'mem'; client = makeClient();
+        console.error(`[memhouse] your rooms moved: ${db}.messages is now mem.${mine} — env now says MEMHOUSE_DB=mem`);
+      }
+    }
+  } catch { /* unreachable or unreadable: the pass will say */ }
   try {
     if (argv.includes('--ensure-schema')) {
       const n = await ensureSchema(client);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.18.4",
+  "version": "0.18.6",
   "description": "memhouse \u2014 agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {