memhouse 0.18.5 → 0.18.7

package/bin/memhouse.js

@@ -28,6 +28,7 @@ const {
   SCHEMA_VERSION, MIN_WRITER_SCHEMA, MIGRATIONS, META_TYPES, createStatement,
 } = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
 const envfile = require(path.join(REPO_ROOT, 'memhouse', 'envfile'));
+const chan = require(path.join(REPO_ROOT, 'memhouse', 'channel'));
 const { consumeSecretChunk } = require(path.join(REPO_ROOT, 'memhouse', 'secret-input'));
 const { capabilitiesFrom } = require(path.join(REPO_ROOT, 'memhouse', 'capabilities'));
 const { unknownFlags, allowedFlags, suggestFlag } = require(path.join(REPO_ROOT, 'memhouse', 'flags'));
@@ -1612,6 +1613,7 @@ async function cmdStatus() {
     daemons: { shipper: pidOf('shipper'), dashboard: pidOf('dashboard') },
     dashboard_url: pidOf('dashboard') ? `http://localhost:${runningPort(cfg)}` : null,
     shipper: shipperHealth(),
+      update: null, // filled below from the registry; null when current, offline, or a checkout build
     // Which machine this is, in the rooms' own terms. All of a member's machines write
     // into one set of rooms, so `WHERE host = ...` is how the pilot separates this laptop
     // from the other one — and they cannot type it if nothing ever prints it.
@@ -1628,6 +1630,10 @@ async function cmdStatus() {
     out.messages = Number(m[0]?.msgs || 0);
     out.freshest = m[0]?.freshest || null;
     out.fleet = await fleetState(cfg);
+    // Nobody runs `update --check`. A member sat four days behind a release that fixed the
+    // very thing they were about to hit, with nothing on any screen saying so.
+    try { out.update = chan.behind({ version: PKG.version, pinned: cfg.channel || null, tags: await chan.fetchTags() }); }
+    catch { /* offline: say nothing rather than guess */ }
   } catch (e) { out.connected = false; out.error = netReason(e); }
 
   if (JSON_OUT) { console.log(JSON.stringify(out, null, 2)); return out.connected ? 0 : 1; }
@@ -1642,13 +1648,29 @@ async function cmdStatus() {
   if (out.connected && !out.messages) console.log(ok(`house: empty — ${out.sessions} sessions, 0 messages (nothing shipped yet)`));
   else if (out.connected) console.log(ok(`house: ${out.sessions} sessions, ${out.messages} messages (freshest ingest ${out.freshest} UTC)`));
   if (out.fleet && out.fleet.length) {
-    const badOnes = out.fleet.filter((f) => f.verdict !== 'ok');
-    console.log((badOnes.length ? warn : ok)(`fleet: ${out.fleet.length} writer(s) known to this house`));
-    for (const f of out.fleet) {
+    // A writer appears in this list because it has rows — the list is GROUP BY over the
+    // messages, not a registry — so a machine that was re-identified (before host ids were
+    // derived from the machine) stays here forever, and cannot be tidied away without
+    // deleting its sessions. Retired writers are therefore folded into one line instead of
+    // shouting a permanent warning: they are history, not a fleet to maintain. `--all`
+    // prints every one. A writer is RETIRED when it has been silent past the cutoff; a
+    // pre-0.10 writer that is still active keeps its warning, because that one can still bite.
+    const RETIRED_MS = 14 * 24 * 3600 * 1000;
+    const retired = out.fleet.filter((f) => f.ageMs !== null && f.ageMs > RETIRED_MS);
+    const shown = flags.all === true ? out.fleet : out.fleet.filter((f) => !retired.includes(f));
+    const live = out.fleet.filter((f) => !retired.includes(f));
+    const badOnes = live.filter((f) => f.verdict !== 'ok');
+    console.log((badOnes.length ? warn : ok)(`fleet: ${live.length} active writer(s)${retired.length ? `, ${retired.length} retired` : ''}`));
+    for (const f of shown) {
       const mark = f.verdict === 'legacy' ? '  ⚠ pre-0.10 — upgrade it (or revoke its mutation grants); its re-ships delete retained parses'
         : f.verdict === 'outdated' ? '  ⚠ supports an older schema — refusing every pass until updated'
           : f.verdict === 'stale' ? '  • stale' : '';
-      console.log(`     ${f.writer.padEnd(28)} ${String(f.version || '?').padEnd(8)} last ship ${fleetAge(f.ageMs)}${mark}`);
+      const tag = retired.includes(f) ? '  · retired' : mark;
+      console.log(`     ${f.writer.padEnd(28)} ${String(f.version || '?').padEnd(8)} last ship ${fleetAge(f.ageMs)}${tag}`);
+    }
+    if (retired.length && flags.all !== true) {
+      const oldest = fleetAge(Math.max(...retired.map((f) => f.ageMs)));
+      console.log(`     ${String(`${retired.length} retired writer(s)`).padEnd(28)} ${' '.padEnd(8)} silent ${oldest} and longer — their sessions are still here:  memhouse status --all`);
     }
   }
   {
@@ -1657,6 +1679,7 @@ async function cmdStatus() {
       : fail ? warn(`shipper: running — ${out.shipper.via} — but ${fail}`)
       : ok(`shipper: running — ${out.shipper.via}`));
   }
+  if (out.update) console.log(warn(`update available: ${out.update.target} on '${out.update.channel}' — you have ${PKG.version} — run: memhouse update`));
   console.log(out.daemons.dashboard ? ok(`dashboard: running (pid ${out.daemons.dashboard})`) : warn('dashboard: not running'));
   if (out.daemons.dashboard) console.log(`  dashboard → http://localhost:${runningPort(cfg)}`);
   // Exit non-zero when the house is unreachable. `status` is what a health check, a
@@ -2006,6 +2029,12 @@ async function cmdDoctor() {
     const moved = await adoptMovedHouse(cfg, { fix: false });
     if (moved === 'moved') add(false, `rooms moved to mem.${physicalRoom('messages', cfg.user).replace(/_messages$/, '')}_* — this env still says MEMHOUSE_DB=${cfg.db}`, 'memhouse update   (rewrites the env and restarts the shipper)');
   } catch { /* connection problems are reported above */ }
+  {
+    // The same shape doctor gives everything else: what is wrong, and the command.
+    let up = null;
+    try { up = chan.behind({ version: PKG.version, pinned: cfg.channel || null, tags: await chan.fetchTags() }); } catch { /* offline */ }
+    if (up) add(false, `memhouse ${PKG.version} — ${up.target} is out on '${up.channel}'`, 'memhouse update');
+  }
   const sh = shipperHealth();
   const shFail = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).describeFailure(sh.lastPass);
   add(sh.running && !shFail, `shipper${sh.via ? ` — ${sh.via}` : ''}${shFail ? ` — ${shFail}` : ''}`,
@@ -2146,7 +2175,6 @@ function installKind() {
 // Each of those has cost a real machine real sessions. This command owns all three.
 async function cmdUpdate() {
   const { kind, root } = installKind();
-  const chan = require(path.join(REPO_ROOT, 'memhouse', 'channel'));
   const cfg0 = resolveConfig();
   // --channel pins for this run AND every later one: the point of pinning is that the next
   // person to type `memhouse update` does not have to remember it.
@@ -2232,6 +2260,21 @@ async function cmdUpdate() {
   // shipper restarts, or its first pass refuses the old address forever.
   try { await adoptMovedHouse(resolveConfig()); } catch { /* doctor will say */ }
 
+  // Bring the house to the schema the NEW code expects, before any daemon restarts.
+  // A release that adds rooms (0.18.3's stat tables) used to land after the restart, so
+  // the freshly started shipper failed its first passes with "has no <member>_sessions…",
+  // `status` quoted that failure, and the dashboard served a page whose every request
+  // 500'd — all of it self-healing eventually, all of it alarming meanwhile. Two real
+  // members hit this within an hour of each other. The new binary owns the new schema, so
+  // it runs it here, in the one moment the daemons are already down.
+  {
+    const r = spawnSync(process.execPath, [path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js'), '--ensure-schema'],
+      { env: childEnv(resolveConfig()), encoding: 'utf-8', stdio: 'pipe', timeout: 120000 });
+    const said = `${r.stdout || ''}${r.stderr || ''}`.trim().split('\n').filter((l) => l.includes('[memhouse]')).pop();
+    if (r.status === 0) console.log(ok(`house schema current${said ? ` — ${said.replace('[memhouse] ', '')}` : ''}`));
+    else console.log(warn(`could not bring the house to this version's schema — the daemons start anyway; run: memhouse doctor${said ? `\n  ${said}` : ''}`));
+  }
+
   // Refresh the Claude plugin wherever it is ALREADY installed, so `update` keeps the
   // skills in lockstep with the package instead of leaving a stale `/mem:*` behind. Only
   // dirs that already have it are touched — update never installs the plugin somewhere new.
@@ -4107,6 +4150,17 @@ async function cmdUninstall() {
           if (use.length) await ch(who, `INSERT INTO ${db}.${ev} (${use.join(', ')}) VALUES (${use.map((c) => want[c]).join(', ')})`, { database: '' });
           else console.log(warn(`  ${p.member}: events room has none of the expected columns — no event recorded`));
         } catch (e) { console.log(warn(`  ${p.member}: event not recorded — ${(e && e.message ? e.message : String(e)).split('\n')[0].slice(0, 120)}`)); }
+        // The rooms moved, but the house also needs what THIS version adds — the
+        // per-member stat tables the dashboard reads. `ensureSchema` makes them, and a
+        // plain `ship` never calls it, so leaving them to the member meant a dashboard
+        // that scanned millions of rows (or 500'd) until someone happened to run
+        // `ship --ensure-schema`. Create them here, as the admin, while we are already
+        // holding the member's rooms in mind.
+        try {
+          const st = convert.statTables(db, p.member);
+          for (const sql of st) await ch(who, sql, { database: '' });
+          if (st.length) console.log(ok(`  ${p.member}: dashboard tables created (${st.length})`));
+        } catch (e) { console.log(warn(`  ${p.member}: dashboard tables not created — their first ship will do it: ${(e && e.message ? e.message : String(e)).split('\n')[0].slice(0, 90)}`)); }
         converted++;
         console.log(ok(`${p.member}: rooms now ${db}.${p.member}_* — ${p.shares.length} share(s) carried${p.policies.length ? `, ${p.policies.length} row polic${p.policies.length === 1 ? 'y' : 'ies'}` : ''}`));
       }

package/memhouse/channel.js

@@ -60,4 +60,27 @@ async function fetchTags(fetchImpl = globalThis.fetch) {
   } catch { return null; }
 }
 
-module.exports = { pickChannel, fetchTags, isPrerelease, lineOf };
+/**
+ * Is this install behind its channel? Pure — the caller supplies the tags, so nothing here
+ * reaches the network and `status` stays offline-safe.
+ *
+ * Only a strictly newer target counts: a prerelease, a version ahead of the tag, or a
+ * registry that did not answer all return null, because "unknown" must never read as
+ * "you are behind" on a health screen someone gates on.
+ *
+ * @returns {{target: string, channel: string}|null}
+ */
+function behind({ version, pinned = null, tags = null }) {
+  if (!tags) return null;
+  const pick = pickChannel({ version, pinned, tags });
+  if (!pick.target || pick.target === version) return null;
+  const n = (v) => String(v).split('-')[0].split('.').map(Number);
+  const [a, b] = [n(pick.target), n(version)];
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] || 0) > (b[i] || 0)) return { target: pick.target, channel: pick.channel };
+    if ((a[i] || 0) < (b[i] || 0)) return null;
+  }
+  return null;
+}
+
+module.exports = { behind, pickChannel, fetchTags, isPrerelease, lineOf };

package/memhouse/convert.js

@@ -57,4 +57,19 @@ function render(steps) {
   return steps.map((s) => `-- ${s.why}${s.optional ? ' (optional)' : ''}${s.when ? ` (only when ${s.when})` : ''}\n${s.sql};`).join('\n');
 }
 
-module.exports = { planMember, render, LEGACY, STAT_VIEWS, STAT_TABLES };
+/**
+ * The CREATE statements for a member's dashboard tables, in the one layout. `convert` runs
+ * these so a converted house is complete the moment it is converted — the alternative was
+ * a dashboard with nothing precomputed until someone ran `ship --ensure-schema` by hand.
+ * Same source of truth the shipper uses, so the two cannot drift.
+ */
+function statTables(db, member) {
+  const house = require('./house/house');
+  // statCreateStatements builds unqualified names (the member runs it inside their own
+  // house); convert runs as the admin with no default database, so qualify every name.
+  return house.statCreateStatements(house.roomNames(member))
+    .map((sql) => sql.replace(/\b(CREATE TABLE IF NOT EXISTS |FROM )(?!\()/g, (m0) => m0)
+      .replace(new RegExp(`\\b(${member}_(?:session_stats|session_model_stats|session_tool_stats|sessions|messages|tool_calls|meta|events))\\b`, 'g'), `${db}.$1`));
+}
+
+module.exports = { planMember, render, statTables, LEGACY, STAT_VIEWS, STAT_TABLES };

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: recall past sessions and answer from them, run analytics, check the house, bring people in, and administer the server. Skills install as /mem:recall, /mem:sql, /mem:house, /mem:access, and /mem:admin.",
-  "version": "0.18.5",
+  "version": "0.18.7",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/flags.js

@@ -17,7 +17,7 @@ const COMMAND_FLAGS = {
   whoami: ['admin'],
   share: ['only', 'revoke', 'list'],
   discover: [], stats: [], stop: [], doctor: [], 'sessions-query': [], rooms: [], instance: [], members: ['db','admin-user','admin-password'], convert: ['url','db','admin-user','admin-password','member','print-sql','dry-run','guides','out'],
-  status: [], start: [],
+  status: ['all'], start: [],
   onboard: ['url', 'user', 'password', 'db', 'port', 'no-ship', 'target', 'house-port', 'tag', 'local'],
   install: ['url', 'user', 'password', 'db', 'port', 'no-ship', 'env', 'print-sql', 'member',
     'member-password', 'admin-user', 'admin-password', 'ensure-schema', 'rotate-password', 'force',

package/memhouse/host.js

@@ -53,6 +53,59 @@ function read(home = homeDir()) {
   return null;
 }
 
+/**
+ * A fingerprint of THIS MACHINE, not of this install.
+ *
+ * It used to be `randomBytes(16)`, which lives only in host.json — so wiping MEMHOUSE_HOME
+ * (`uninstall --full-removal`, a reset, a new laptop image) made the same physical machine
+ * come back as a stranger. One MacBook read as three writers in the fleet list, each
+ * holding a slice of the same machine's history.
+ *
+ * Now it is derived from a stable per-machine id — IOPlatformUUID on macOS,
+ * /etc/machine-id (or the D-Bus one) on Linux, MachineGuid on Windows — hashed with a
+ * fixed salt so the raw hardware id never leaves the machine and cannot be recovered from
+ * a row. Same machine, same fingerprint, reinstall after reinstall. Where no such id can
+ * be read, it falls back to random: an identity that is merely unstable is far better than
+ * one that collides, and the fallback is recorded so callers can say which happened.
+ *
+ * @returns {string} 32 hex characters
+ */
+function machineFingerprint(raw = stableMachineId()) {
+  const SALT = 'memhouse/host/v1'; // versioned: changing it re-identifies every machine
+  return raw
+    ? crypto.createHash('sha256').update(`${SALT}:${raw}`).digest('hex').slice(0, 32)
+    : crypto.randomBytes(16).toString('hex');
+}
+
+/** The OS's own machine id, or null when it cannot be read. Never stored, never shipped. */
+function stableMachineId() {
+  const run = (cmd, args) => {
+    try {
+      const r = require('child_process').execFileSync(cmd, args, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 4000 });
+      return String(r || '').trim() || null;
+    } catch { return null; }
+  };
+  try {
+    if (process.platform === 'darwin') {
+      const out = run('/usr/sbin/ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice']);
+      const m = out && /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out);
+      return m ? m[1] : null;
+    }
+    if (process.platform === 'linux') {
+      for (const f of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+        try { const v = fs.readFileSync(f, 'utf-8').trim(); if (v) return v; } catch { /* next */ }
+      }
+      return null;
+    }
+    if (process.platform === 'win32') {
+      const out = run('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid']);
+      const m = out && /MachineGuid\s+REG_SZ\s+(\S+)/.exec(out);
+      return m ? m[1] : null;
+    }
+  } catch { /* fall through */ }
+  return null;
+}
+
 /**
  * The identity of this machine, creating it on first use.
  *
@@ -69,7 +122,7 @@ function identity(home = homeDir()) {
   let rec = read(home);
   if (!rec) {
     rec = {
-      fingerprint: crypto.randomBytes(16).toString('hex'),
+      fingerprint: machineFingerprint(),
       hostname,
       platform: os.platform(),
       arch: os.arch(),
@@ -98,4 +151,4 @@ function identity(home = homeDir()) {
   };
 }
 
-module.exports = { identity, read, filePath, idFrom, FILE };
+module.exports = { identity, read, filePath, idFrom, machineFingerprint, stableMachineId, FILE };

package/memhouse/server/queries.js

@@ -27,23 +27,54 @@ const config = {
   database: process.env.MEMHOUSE_DB || process.env.MEMHOUSE_USER, // house defaults to the user's own name
 };
 
+/**
+ * The house may have moved under this process: the operator converts a pre-one-layout
+ * house and the member's rooms go from `<name>.*` to `mem.<name>_*`, while this server
+ * still holds the database its env named at boot. The shipper and `update` learned to
+ * adopt that; the dashboard did not, so every endpoint answered 500 behind a page that
+ * simply looked blank. Checked once at startup, cheap, and never fatal.
+ *
+ * @returns {Promise<'current'|'moved'|'unknown'>}
+ */
+async function adoptMovedHouse() {
+  const me = config.username;
+  if (!me || config.database === 'mem') return 'current';
+  const probe = createClient({ ...clientOptions(), database: 'system' });
+  try {
+    const rs = await probe.query({
+      query: `SELECT database, name FROM system.tables WHERE (database = {old:String} AND name IN ('messages', {mine:String})) OR (database = 'mem' AND name = {mine:String})`,
+      query_params: { old: config.database, mine: `${me}_messages` },
+      format: 'JSONEachRow',
+    });
+    const rows = await rs.json();
+    const has = (d, n) => rows.some((r) => r.database === d && r.name === n);
+    if (has(config.database, `${me}_messages`) || has(config.database, 'messages')) return 'current';
+    if (!has('mem', `${me}_messages`)) return 'unknown';
+    console.log(`[memhouse] rooms moved: ${config.database}.messages is now mem.${me}_messages — reading house 'mem'`);
+    config.database = 'mem';
+    _client = null; // rebuilt with the new database on the next call
+    return 'moved';
+  } catch { return 'unknown'; }
+  finally { try { await probe.close(); } catch { /* nothing to close */ } }
+}
+
 let _client = null;
-function getClient() {
-  if (_client) return _client;
-  _client = createClient({
-    // See the note in shipper/ship.js: the driver's ERROR-level dump lands ahead of every
-    // message we print, so a handled refusal reads like a crash. MEMHOUSE_DEBUG=1 restores it.
+function clientOptions() {
+  return {
     log: { level: process.env.MEMHOUSE_DEBUG ? ClickHouseLogLevel.DEBUG : ClickHouseLogLevel.OFF },
     url: config.url,
     username: config.username,
     password: config.password,
     database: config.database,
     request_timeout: 60000,
-    clickhouse_settings: {
-      ...READ_SETTINGS,
-      output_format_json_quote_64bit_integers: 0,
-    },
-  });
+    clickhouse_settings: { ...READ_SETTINGS, output_format_json_quote_64bit_integers: 0 },
+  };
+}
+function getClient() {
+  if (_client) return _client;
+  // See the note in shipper/ship.js: the driver's ERROR-level dump lands ahead of every
+  // message we print, so a handled refusal reads like a crash. MEMHOUSE_DEBUG=1 restores it.
+  _client = createClient(clientOptions());
   return _client;
 }
 
@@ -1101,7 +1132,7 @@ async function schema() {
   };
 }
 
-module.exports = {
+module.exports = { adoptMovedHouse,
   getClient, config,
   getOverview, getDailyActivity, getDashboardStats,
   getChats, countChats, getChat,

package/memhouse/server/server.js

@@ -435,6 +435,8 @@ app.get('*', (req, res) => {
 });
 
 if (require.main === module) {
+  // Before serving: has the house moved under us? (see queries.adoptMovedHouse)
+  qy.adoptMovedHouse().catch(() => {});
   app.listen(PORT, HOST, () => {
     console.log(`[memhouse] dashboard → http://localhost:${PORT} (house '${qy.config.database}' @ ${qy.config.url.replace(/\/\/.*@/, '//')})`
       + (HOST !== '127.0.0.1' ? ` [bound to ${HOST} — remotely reachable]` : ''));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memhouse",
-  "version": "0.18.5",
+  "version": "0.18.7",
   "description": "memhouse \u2014 agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {