memhouse 0.3.0 → 0.3.2

package/editors/opencode.js

@@ -2,6 +2,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const Database = require('better-sqlite3');
+const adapterErrors = require('./adapter-errors');
 
 // OpenCode stores data in XDG-style paths across all platforms
 function getOpenCodeStoragePath() {
@@ -31,7 +32,10 @@ function queryDb(sql) {
     const rows = db.prepare(sql).all();
     db.close();
     return rows;
-  } catch {
+  } catch (e) {
+    // The store exists but could not be read. Returning [] keeps one bad database
+    // from killing the scan, but staying quiet would hide missing sessions.
+    adapterErrors.record('opencode', e, DB_PATH);
     return [];
   }
 }
@@ -90,7 +94,12 @@ function getSqliteMessages(sessionId) {
     const result = [];
     for (const msg of messages) {
       let msgData;
-      try { msgData = JSON.parse(msg.msg_data); } catch { continue; }
+      // A record we cannot decode is dropped from the transcript. Silently, that
+      // yields a TRUNCATED history that looks complete — and a re-ship would replace
+      // the full stored transcript with the shortened one. Report it so the shipper
+      // refuses to overwrite good data with a partial read.
+      try { msgData = JSON.parse(msg.msg_data); }
+      catch (e) { adapterErrors.record('opencode', e, `message ${msg.msg_id}`); continue; }
 
       const role = msgData.role;
       if (!role) continue;
@@ -102,7 +111,8 @@ function getSqliteMessages(sessionId) {
       const contentParts = [];
       for (const part of parts) {
         let partData;
-        try { partData = JSON.parse(part.data); } catch { continue; }
+        try { partData = JSON.parse(part.data); }
+        catch (e) { adapterErrors.record('opencode', e, `part of message ${msg.msg_id}`); continue; }
         const type = partData.type;
 
         if (type === 'text' && partData.text) {
@@ -143,7 +153,10 @@ function getSqliteMessages(sessionId) {
 
     db.close();
     return result;
-  } catch {
+  } catch (e) {
+    // Message reads must report too, not just the session scan: an empty transcript
+    // is written over the stored one on re-ship.
+    adapterErrors.record('opencode', e, DB_PATH);
     return [];
   }
 }
@@ -167,26 +180,41 @@ function getAllSessions() {
     if (!fs.statSync(projectDir).isDirectory()) continue;
 
     let files;
-    try { files = fs.readdirSync(projectDir).filter(f => f.startsWith('ses_') && f.endsWith('.json')); } catch { continue; }
+    // Discovery-time drop: the project directory is there but will not enumerate, so
+    // every session under it vanishes before anything downstream can miss it.
+    try { files = fs.readdirSync(projectDir).filter(f => f.startsWith('ses_') && f.endsWith('.json')); }
+    catch (e) { adapterErrors.record('opencode', e, projectDir); continue; }
 
     for (const file of files) {
       const filePath = path.join(projectDir, file);
       const data = readJson(filePath);
       if (data && data.id) {
         sessions.push({ ...data, _filePath: filePath });
+      } else {
+        // The file was listed, so it exists. Failing to decode it drops the session
+        // from discovery entirely — it reaches neither doctor nor the shipper, and
+        // nothing downstream can miss what it never saw.
+        adapterErrors.record('opencode', new Error('unreadable session metadata file'), filePath);
       }
     }
   }
   return sessions;
 }
 
+// Returns the message count, or null when it could not be determined. Null and 0
+// are NOT interchangeable: bubbleCount feeds the shipper's skip predicate, and a
+// zero standing in for "unknown" makes `prev.bc >= 0` trivially true, so the session
+// is skipped before anything can read it — stale forever, on every incremental pass.
 function getMessageCount(sessionId) {
   const sessionMsgDir = path.join(MESSAGE_DIR, sessionId);
   if (!fs.existsSync(sessionMsgDir)) return 0;
 
   try {
     return fs.readdirSync(sessionMsgDir).filter(f => f.startsWith('msg_') && f.endsWith('.json')).length;
-  } catch { return 0; }
+  } catch (e) {
+    adapterErrors.record('opencode', e, sessionMsgDir);
+    return null;
+  }
 }
 
 function getMessagesForSession(sessionId) {
@@ -194,13 +222,22 @@ function getMessagesForSession(sessionId) {
   if (!fs.existsSync(sessionMsgDir)) return [];
 
   let files;
-  try { files = fs.readdirSync(sessionMsgDir).filter(f => f.startsWith('msg_') && f.endsWith('.json')); } catch { return []; }
+  try { files = fs.readdirSync(sessionMsgDir).filter(f => f.startsWith('msg_') && f.endsWith('.json')); }
+  catch (e) {
+    // The directory exists (checked above) but is unreadable — report it, or the
+    // empty result overwrites the stored transcript on re-ship.
+    adapterErrors.record('opencode', e, sessionMsgDir);
+    return [];
+  }
 
   const rawMsgs = [];
   for (const file of files) {
     const msgPath = path.join(sessionMsgDir, file);
     const msg = readJson(msgPath);
-    if (!msg || !msg.id) continue;
+    // The file was listed, so it exists; failing to decode it drops a message from
+    // the transcript and would let a re-ship overwrite the stored copy with less.
+    if (!msg) { adapterErrors.record('opencode', new Error('unreadable message file'), msgPath); continue; }
+    if (!msg.id) continue;
     rawMsgs.push(msg);
   }
 
@@ -216,10 +253,17 @@ function getMessagesForSession(sessionId) {
       try {
         const partFiles = fs.readdirSync(msgPartDir).filter(f => f.startsWith('prt_') && f.endsWith('.json'));
         for (const partFile of partFiles) {
-          const part = readJson(path.join(msgPartDir, partFile));
+          const partPath = path.join(msgPartDir, partFile);
+          const part = readJson(partPath);
           if (part) parts.push(part);
+          else adapterErrors.record('opencode', new Error('unreadable part file'), partPath);
         }
-      } catch { /* skip */ }
+      } catch (e) {
+        // The directory exists (checked above) but cannot be enumerated, so none of
+        // the per-file records above ran and the message collapses to a bare [role]
+        // placeholder. Unreported, that truncation would overwrite stored content.
+        adapterErrors.record('opencode', e, msgPartDir);
+      }
     }
 
     // Build content from parts
@@ -285,6 +329,7 @@ function getChats() {
   const fileSessions = getAllSessions();
   for (const s of fileSessions) {
     seen.add(s.id);
+    const msgCount = getMessageCount(s.id);
     chats.push({
       source: 'opencode',
       composerId: s.id,
@@ -294,7 +339,8 @@ function getChats() {
       mode: s.mode || 'opencode',
       folder: s.directory || null,
       encrypted: false,
-      bubbleCount: getMessageCount(s.id),
+      bubbleCount: msgCount ?? 0,
+      _countUnknown: msgCount === null,
       _agent: s.agent,
       _model: s.modelID,
       _provider: s.providerID,
@@ -332,10 +378,22 @@ function cleanTitle(title) {
 }
 
 function getMessages(chat) {
-  // Prefer file-based messages; fall back to SQLite
+  // Prefer file-based messages; fall back to SQLite.
+  //
+  // Failures on the file path are only failures of the READ if the fallback also
+  // comes up empty. An unreadable message directory for a session that opencode.db
+  // still holds in full is not a reason to withhold the session — and leaving those
+  // entries in the sink would make the shipper do exactly that, forever. So they are
+  // retracted once SQLite produces a transcript. Scoped to the file attempt, so any
+  // truncation the SQLite reader reports about itself survives.
+  const beforeFile = adapterErrors.mark();
   const fileMessages = getMessagesForSession(chat.composerId);
+  const afterFile = adapterErrors.mark();
   if (fileMessages.length > 0) return fileMessages;
-  return getSqliteMessages(chat.composerId);
+
+  const sqliteMessages = getSqliteMessages(chat.composerId);
+  if (sqliteMessages.length > 0) adapterErrors.dropRange(beforeFile, afterFile);
+  return sqliteMessages;
 }
 
 const labels = { 'opencode': 'OpenCode' };

package/editors/zed.js

@@ -3,6 +3,7 @@ const fs = require('fs');
 const os = require('os');
 
 const Database = require('better-sqlite3');
+const adapterErrors = require('./adapter-errors');
 
 // Zed stores data in different locations depending on the platform
 // - Windows: %LOCALAPPDATA%\Zed (not Roaming)
@@ -73,11 +74,51 @@ function queryDb(sql) {
     db.close();
     return rows;
   } catch (e) {
-    // Silently fail if database is locked or inaccessible
+    // Locked, inaccessible, or corrupt. Keep the scan alive but say so — silence
+    // here reads as "the user does not use Zed".
+    adapterErrors.record('zed', e, THREADS_DB);
     return [];
   }
 }
 
+// Zed's `threads` schema varies by version: `worktree_branch` exists in some builds
+// and not others, and older builds lack `created_at`. Naming a column that is not
+// there fails the WHOLE query with "no such column", which cost every Zed thread on
+// this machine — silently, until the adapter started reporting. So ask the table what
+// it has rather than assuming. Cached: the schema cannot change while we scan.
+let threadColumns = null;
+function getThreadColumns() {
+  if (threadColumns) return threadColumns;
+  if (!fs.existsSync(THREADS_DB)) return new Set();
+  try {
+    const db = new Database(THREADS_DB, { readonly: true });
+    const cols = db.prepare('PRAGMA table_info(threads)').all().map((r) => r.name);
+    db.close();
+    // PRAGMA on a missing or renamed table SUCCEEDS with zero rows rather than
+    // throwing. Left unreported, that would cache an empty set, return no sessions,
+    // and look exactly like an unused Zed install — the same silent whole-adapter
+    // drop this function exists to end. Do not cache it either: the next scan should
+    // look again rather than inherit the verdict.
+    if (cols.length === 0) {
+      adapterErrors.record('zed', new Error('threads table missing or unreadable — incompatible Zed schema'), THREADS_DB);
+      return new Set();
+    }
+    threadColumns = new Set(cols);
+    return threadColumns;
+  } catch (e) {
+    adapterErrors.record('zed', e, THREADS_DB);
+    return new Set();
+  }
+}
+
+// index.js calls this between passes of a long-running `ship --loop`. Without it the
+// column set would be fixed for the life of the process, so a Zed upgrade mid-run
+// would keep querying a column that no longer exists — or keep ignoring one newly
+// added — until someone restarted the shipper.
+function resetCache() {
+  threadColumns = null;
+}
+
 function queryBlob(id) {
   if (!fs.existsSync(THREADS_DB)) return null;
   try {
@@ -85,7 +126,10 @@ function queryBlob(id) {
     const row = db.prepare('SELECT data FROM threads WHERE id = ?').get(id);
     db.close();
     return row ? row.data : null;
-  } catch {
+  } catch (e) {
+    // This is the message-blob read. A silent null here becomes a zero-message
+    // session, which overwrites the stored transcript on re-ship.
+    adapterErrors.record('zed', e, THREADS_DB);
     return null;
   }
 }
@@ -97,22 +141,33 @@ function queryBlob(id) {
 const name = 'zed';
 
 function getChats() {
-  const rows = queryDb(
-    'SELECT id, summary, updated_at, data_type, length(data) as data_size, parent_id, worktree_branch FROM threads ORDER BY updated_at DESC'
-  );
+  const cols = getThreadColumns();
+  if (cols.size === 0) return [];
+
+  // Only these are relied on. Anything else is taken when the build provides it.
+  const select = ['id', 'summary', 'updated_at', 'data_type', 'length(data) as data_size', 'parent_id'];
+  const hasBranch = cols.has('worktree_branch');
+  const hasCreated = cols.has('created_at');
+  if (hasBranch) select.push('worktree_branch');
+  if (hasCreated) select.push('created_at');
+
+  const rows = queryDb(`SELECT ${select.join(', ')} FROM threads ORDER BY updated_at DESC`);
 
   return rows.map(row => ({
     source: 'zed',
     composerId: row.id,
     name: row.summary || null,
-    createdAt: row.updated_at ? new Date(row.updated_at).getTime() : null,
+    // created_at when the build has it. Falling back to updated_at is not a
+    // creation time — it just keeps the field non-null on builds that lack it.
+    createdAt: (hasCreated && row.created_at) ? new Date(row.created_at).getTime()
+      : (row.updated_at ? new Date(row.updated_at).getTime() : null),
     lastUpdatedAt: row.updated_at ? new Date(row.updated_at).getTime() : null,
     mode: 'thread',
     folder: null,
     encrypted: false,
     bubbleCount: 0,
     _dataType: row.data_type,
-    _gitBranch: row.worktree_branch,
+    _gitBranch: hasBranch ? row.worktree_branch : null,
   }));
 }
 
@@ -129,12 +184,22 @@ function getMessages(chat) {
       json = blob.toString('utf-8');
     }
   } catch (e) {
-    // Decompression failed - zstd CLI not available
+    // Decompression failed — usually no zstd CLI and no native zstd in this Node.
+    // The thread exists and has content we cannot read, so this must be reported:
+    // silently returning [] would overwrite its stored transcript on re-ship.
+    adapterErrors.record('zed', e, THREADS_DB);
     return [];
   }
 
   let data;
-  try { data = JSON.parse(json); } catch { return []; }
+  try { data = JSON.parse(json); }
+  catch (e) {
+    // Decompressed but undecodable — malformed, or a thread schema this parser does
+    // not know. The thread has content, so returning [] unreported would let a
+    // re-ship replace the stored transcript with nothing.
+    adapterErrors.record('zed', e, THREADS_DB);
+    return [];
+  }
 
   const model = data.model?.model || null;
   const messages = [];
@@ -210,4 +275,4 @@ function getMCPServers() {
   return results;
 }
 
-module.exports = { name, labels, getChats, getMessages, getMCPServers };
+module.exports = { name, labels, getChats, getMessages, getMCPServers, resetCache };

package/mem-house/delivery/AGENT-INSTALL.md

@@ -1,21 +1,48 @@
 # mem-house — agent install
 
 Imperative steps for an AI coding agent installing mem-house on a machine. Execute
-in order; every command is copy-pasteable. Prereqs: Node >= 20.19, a reachable
+in order; every command is copy-pasteable. Prereqs: Node >= 20.19 and a reachable
 ClickHouse >= 26.2 (local server, Cloud, or a kernel house — see
-`kernel-install.md` for the kernel path), and this repo checked out.
+`kernel-install.md` for the kernel path). No checkout required — memhouse is on npm.
 
 ## 1. Install
 
 ```bash
-cd <repo>            # the memhouse checkout
-npm install --no-audit --no-fund
+npm install -g memhouse --allow-scripts=better-sqlite3
 ```
 
+`--allow-scripts=better-sqlite3` is required, not cosmetic. Five adapters (cursor,
+goose, opencode, zed, antigravity) read SQLite session stores, and npm 12 blocks
+the install script that builds the native binding. Without it those five silently
+return zero sessions and you ship a partial history. Verify with step 4 —
+`memhouse discover` names any adapter it had to skip.
+
+On `EACCES`, decide by **who owns the prefix root**. Not the path — Homebrew's
+prefix is `/usr/local` on Intel and `/opt/homebrew` on Apple Silicon and is
+user-owned in both. Not the failing file either — an earlier `sudo npm` leaves
+root-owned files inside a prefix that is still the user's, and judging by those
+misreads it as system-managed.
+
+```bash
+ls -ld "$(npm prefix -g)"     # the prefix ROOT decides
+```
+
+Prefix root owned by `root` → a system-managed Node; re-run as
+`sudo npm install -g memhouse --allow-scripts=better-sqlite3`.
+
+Prefix root owned by the current user → the prefix is theirs (Homebrew, fnm, nvm,
+volta), so the root-owned file npm tripped on is a stray from an earlier `sudo npm`
+and another `sudo` adds more. Repair that path instead:
+`sudo chown -R "$(id -u):$(id -g)" <path npm named>` (same for `~/.npm`).
+
+From a checkout instead (contributors): `npm install --no-audit --no-fund` in the
+repo root — its `allowScripts` field already covers the binding — then substitute
+`node bin/memhouse.js` for `memhouse` below.
+
 ## 2. Configure the connection
 
-Write `~/.memhouse/env` (the installer can do this interactively — `bash
-mem-house/delivery/install.sh` — or write it yourself):
+Write `~/.memhouse/env` (or run `memhouse install --yes --url … --user … --password
+… --db …`, which writes it for you):
 
 ```bash
 mkdir -p ~/.memhouse
@@ -31,9 +58,7 @@ chmod 600 ~/.memhouse/env
 ## 3. Create the schema and run the first ship
 
 ```bash
-set -a; source ~/.memhouse/env; set +a
-node mem-house/shipper/ship.js --ensure-schema
-node mem-house/shipper/ship.js            # first full parse-on-client ship
+memhouse install --yes     # applies the schema, then runs the first full ship
 ```
 
 Expected output shape: `[mem-house] shipped N sessions (0 skipped) → M msg rows, T
@@ -42,34 +67,39 @@ tool rows in Xs` with N in the hundreds on a machine with real agent usage.
 ## 4. Verify
 
 ```bash
-node mem-house/shipper/ship.js --stats
+memhouse discover     # which adapters were read, and which were SKIPPED
+memhouse stats        # per-source counts now in the house
 ```
 
-Expect one row per source (claude-code, codex, gemini-cli, …) with non-zero
-sessions/messages. Or verify by SQL:
+Read `discover` first. It prints one line per editor it found sessions for, and
+warns by name about any adapter it had to skip — that warning is the only signal
+that step 1's `--allow-scripts` flag was missed and five editors are dark.
+
+`stats` should show one row per source (claude-code, codex, gemini-cli, …) with
+non-zero sessions/messages. Or verify by SQL:
 
 ```bash
 curl -s -u "$MEMHOUSE_USER:$MEMHOUSE_PASSWORD" "$MEMHOUSE_URL/?database=$MEMHOUSE_DB" \
   --data-binary "SELECT source, count() FROM sessions_v GROUP BY source SETTINGS final=1 FORMAT PrettyCompact"
 ```
 
-## 5. Start the dashboard (optional)
+## 5. Start the dashboard and the shipper loop
 
 ```bash
-cd ui && npm install && npm run build && cd ..   # first time only (builds public/)
-node mem-house/server/server.js                  # → http://localhost:4640
+memhouse start        # both as background daemons; UI is prebuilt in the package
+memhouse status       # daemons, connection, counts, freshness (--json for agents)
 ```
 
-## 6. Keep it fresh
+The dashboard comes up on http://localhost:4640. `start` also runs the incremental
+re-ship loop, so this replaces any separate cron. `memhouse stop` ends both.
 
-Re-ship on a schedule (incremental — cheap):
+## 6. Install the skills (optional, for Claude Code)
 
 ```bash
-node mem-house/shipper/ship.js --loop 300 &
+memhouse plugins install claude
 ```
 
-## 7. Install the skills (optional, for Claude Code)
-
-Copy `mem-house/delivery/skills/*` into the target agent's skills directory
-(e.g. `$CLAUDE_CONFIG_DIR/skills/`), or install `mem-house/delivery/plugin/` as a
-Claude Code plugin. The skills read the connection from `~/.memhouse/env`.
+Installs the `memhouse-search` / `memhouse-sessions` / `memhouse-sql` skills into
+the agent's skills directory; they read the connection from `~/.memhouse/env`.
+`memhouse plugins list` shows what is installed, `memhouse plugins remove claude`
+undoes it.

package/mem-house/delivery/kernel-install.md

@@ -23,17 +23,24 @@ the executor (running as the ego, the `kernel` user) creates database `memhouse`
 (`realm_user` profile), and owner grants. It returns a one-time **credential** —
 rotate on first connect (`issue-credential{user:'memhouse_root'}`).
 
-## 2. Owner sets up the house (from this repo)
+## 2. Owner sets up the house
 
 ```bash
-export MEMHOUSE_URL=https://<kernel-host>:8443
-export MEMHOUSE_USER=memhouse_root
-export MEMHOUSE_PASSWORD=<credential-from-provision>
-export MEMHOUSE_DB=memhouse
-node mem-house/shipper/ship.js --ensure-schema
-node mem-house/shipper/ship.js          # first ship; then --loop 300 to keep fresh
+npm install -g memhouse --allow-scripts=better-sqlite3
+memhouse install --yes \
+  --url https://<kernel-host>:8443 \
+  --user memhouse_root \
+  --password <credential-from-provision> \
+  --db memhouse
 ```
 
+That writes `~/.memhouse/env`, applies the schema, and runs the first ship.
+`memhouse start` then keeps it fresh on a 300s loop.
+
+Keep `--allow-scripts=better-sqlite3`: without it npm 12 leaves `better-sqlite3`
+with no native binding and the five SQLite-backed adapters ship nothing, silently.
+`memhouse discover` names any adapter it had to skip.
+
 The kernel never runs or reads any of this — it is content-blind; the shipper is
 the agency's own resident, a deterministic `worker` on a loop (no LLM, not an
 injection surface). It is the only thing here that writes without being asked.
@@ -69,7 +76,7 @@ Pick one; do not mix on the same role.
 ## 5. Verify
 
 ```bash
-node mem-house/shipper/ship.js --stats      # per-source counts as the owner
+memhouse stats                              # per-source counts as the owner
 # as a member (own-only): counts reflect only that member's rows
 curl -s -u "alice:<pw>" "$MEMHOUSE_URL/?database=memhouse" \
   --data-binary "SELECT count() FROM sessions_v SETTINGS final=1"

package/mem-house/shipper/ship.js

@@ -28,7 +28,8 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { createClient } = require('@clickhouse/client');
-const { getAllChats, getMessages, resetCaches } = require('../../editors');
+const { getAllChats, getAdapterErrors, getMessages, resetCaches } = require('../../editors');
+const adapterErrorSink = require('../../editors/adapter-errors');
 
 const BATCH_ROWS = 2000;   // insert batch ceiling (binding)
 const TEXT_MAX = 50000;    // messages.text truncation
@@ -158,7 +159,15 @@ const TOOL_CALL_RE = /\[tool-call: ([^(\]]+)/g;
 // absorbs the incremental skip for stable-empty chats).
 function rowsForChat(chat, host) {
   let messages;
-  try { messages = getMessages(chat) || []; } catch { return null; }
+  try { messages = getMessages(chat) || []; }
+  catch (e) {
+    // Some readers throw instead of reporting through adapter-errors — Cursor's
+    // agent-store path on a bad blobs table, for one. Converting that to a bare
+    // `unreadable` count would leave the end-of-pass report with nothing to print,
+    // so operators would see a number rising every pass and no cause anywhere.
+    adapterErrorSink.record(chat.source, e, chat.composerId);
+    return null;
+  }
 
   const source = chat.source;
   // Canonical globally-unique session id: '<source>:<adapter-local id>'.
@@ -263,6 +272,15 @@ async function runShip(client, opts = {}) {
   const existing = await loadExisting(client);
   const chats = getAllChats();
 
+  // An adapter that cannot load contributes zero sessions, which is indistinguishable
+  // from an editor the user does not have — so the shipper would silently ship a
+  // partial history forever. Say so on every pass.
+  // Reported once here for what the scan already knows (a dead binding is visible
+  // before any work happens, and this pass may take minutes), and again after the
+  // loop for failures that only surface while reading messages.
+  const warned = new Set();
+  reportAdapterErrors(warned);
+
   const batches = { sessions: [], messages: [], tool_calls: [] };
   const flush = async (table) => {
     if (!batches[table].length) return;
@@ -300,11 +318,33 @@ async function runShip(client, opts = {}) {
       // row count == recorded message_count) so an interrupted re-ship — even one
       // that died mid-flush leaving a partial transcript — repairs itself on the
       // next pass instead of being skipped forever.
-      if (notNewer && prev.bc >= (chat.bubbleCount || 0) && prev.intact) { skipped++; continue; }
+      // _countUnknown means the adapter could not determine this chat's message
+      // count, so bubbleCount is a placeholder rather than a measurement. Skipping on
+      // it would compare against a number that means nothing — `prev.bc >= 0` is
+      // trivially true — and the session would stay stale forever. Re-read instead.
+      if (notNewer && !chat._countUnknown && prev.bc >= (chat.bubbleCount || 0) && prev.intact) { skipped++; continue; }
     }
 
+    // rowsForChat returns null only when getMessages() *throws*. An adapter that
+    // swallows its own failure returns [] instead, which would look like a session
+    // that genuinely has no messages — and for a known session the re-ship below
+    // deletes the old transcript before inserting that emptiness. So treat a
+    // failure recorded while reading THIS chat as unreadable too: write nothing,
+    // delete nothing, retry next pass.
+    const errsBefore = adapterErrorSink.recorded().length;
     const rows = rowsForChat(chat, host);
-    if (!rows) { unreadable++; continue; } // write nothing → retried next pass
+    const failedHere = adapterErrorSink.recorded().slice(errsBefore).some((e) => e.source === chat.source);
+    // Write nothing on a failed read, whether or not the session is already stored.
+    //
+    // Shipping a partial first read looks tempting — nothing is there to destroy —
+    // but it is a trap: message_count would be written from the partial rows, so
+    // prev.intact becomes true, prev.bc already matches the source, the timestamp is
+    // unchanged, and the skip predicate above then withholds the session forever.
+    // The truncation would become permanent AND the warning would stop, because the
+    // adapter is never asked to read it again. Withholding keeps the session out of
+    // the skip predicate entirely, so every pass retries it and re-reports it until
+    // the underlying store is readable.
+    if (!rows || failedHere) { unreadable++; continue; }
     if (prev) {
       // Known session being re-shipped: clear its old rows BEFORE inserting so a
       // shorter re-parse can't leave stale seq/idx tails. A crash between the
@@ -324,9 +364,28 @@ async function runShip(client, opts = {}) {
     for (const r of rows.toolRows) { await push('tool_calls', r); toolRows++; }
   }
   for (const table of Object.keys(batches)) await flush(table);
+  // Anything that only failed while reading messages — the sink is reset by the
+  // next getAllChats(), so unreported here means never reported at all.
+  reportAdapterErrors(warned);
   return { sessions, skipped, msgRows, toolRows, unreadable };
 }
 
+// Warn once per adapter per pass. `warned` carries across the two call sites so a
+// dead binding is not reported twice in the same run.
+function reportAdapterErrors(warned) {
+  const errors = getAdapterErrors().filter((e) => !warned.has(e.source));
+  if (!errors.length) return;
+  for (const e of errors) warned.add(e.source);
+  const noBinding = errors.filter((e) => e.missingBinding).map((e) => e.source);
+  if (noBinding.length) {
+    console.log(`[mem-house] WARNING: ${noBinding.length} adapter(s) skipped, sessions NOT shipped — better-sqlite3 has no native binding: ${noBinding.join(', ')}`);
+    console.log('[mem-house]          fix: npm install -g memhouse --allow-scripts=better-sqlite3');
+  }
+  for (const e of errors.filter((x) => !x.missingBinding)) {
+    console.log(`[mem-house] WARNING: ${e.source} skipped — ${e.message}`);
+  }
+}
+
 // Per-source rollup straight from sessions_v (final=1 so ReplacingMergeTree collapses).
 async function printStats(client) {
   const rs = await client.query({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "memhouse",
-  "version": "0.3.0",
-  "description": "memhouse \u2014 agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store, kernel-agency install, and the agentlytics dashboard",
+  "version": "0.3.2",
+  "description": "memhouse — agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {
     "memhouse": "./bin/memhouse.js",
@@ -56,6 +56,9 @@
   "engines": {
     "node": ">=20.19.0"
   },
+  "allowScripts": {
+    "better-sqlite3": true
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/agent-realm/memhouse"