memhouse 0.3.2 → 0.4.3

package/mem-house/service.js

@@ -0,0 +1,400 @@
+// OS service integration — survive a reboot.
+//
+// `memhouse start` detaches the shipper and dashboard with pidfiles. They outlive the
+// shell, but nothing brings them back after a restart, so a machine that reboots stops
+// shipping until someone notices. This installs a real user-level service instead:
+// systemd --user on Linux, launchd LaunchAgent on macOS.
+//
+// User-level deliberately, not system-level: the shipper reads the invoking user's own
+// session stores (~/.claude, ~/.codex, editor SQLite files) and ships under their own
+// credential. A root service would read the wrong home and stamp the wrong user_id.
+//
+// The whole environment is INLINED into the unit on both platforms, and both files are
+// written 0600. systemd could read the env file directly, but ~/.memhouse/env is written
+// in shell quoting so it can be `source`d, and systemd does not understand the `'\''`
+// escape a password with a quote in it produces — it would start the shipper with a
+// subtly different credential. One env representation, decoded once, per platform.
+//
+// Linux caveat: a systemd --user unit stops at logout unless lingering is enabled
+// (`loginctl enable-linger <user>`). We detect and say so rather than silently
+// installing something that dies on logout.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+const envfile = require('./envfile');
+
+const LABEL = 'memhouse-shipper';
+// Units this build never writes, but earlier ones did. A machine that ran the solo tier
+// still has these enabled and possibly executing a script that no longer exists, so
+// uninstall has to reap them or it reports success over a live service. Cleanup outlives
+// the feature; nothing here ever installs them.
+const LEGACY_UNITS = [
+  { unit: 'memhouse-solo.service', label: 'com.memhouse.solo', file: 'memhouse-solo.service', plist: 'com.memhouse.solo.plist' },
+];
+// Environment an ADAPTER reads to find its sessions, as opposed to the connection
+// settings that live in the env file. Keep this in step with `editors/` — today
+// `editors/codex.js` is the only adapter with an override.
+const ADAPTER_ENV = ['CODEX_HOME'];
+
+function platform() {
+  if (process.platform === 'darwin') return 'launchd';
+  if (process.platform === 'linux') return 'systemd';
+  return null;
+}
+
+function unitPaths() {
+  const home = os.homedir();
+  return {
+    systemd: path.join(home, '.config', 'systemd', 'user', `${LABEL}.service`),
+    launchd: path.join(home, 'Library', 'LaunchAgents', 'com.memhouse.shipper.plist'),
+  };
+}
+
+function xml(s) {
+  return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+function envLines(env) {
+  return Object.entries(env).map(([k, v]) => `Environment=${k}=${envfile.quoteSystemd(v)}`).join('\n');
+}
+
+// systemd splits ExecStart on whitespace, so an unquoted path containing a space becomes
+// several arguments and the unit cannot start — `ExecStart=/tmp/a b/node …` resolves the
+// executable as `/tmp/a`. Node itself lives under a space-bearing path often enough
+// (`~/Library/Application Support/...`, `C:\Program Files` equivalents under WSL, any
+// checkout in a folder with a space) that this is not exotic. Double quotes with C escapes
+// are systemd's own syntax, the same rule `Environment=` uses.
+function execToken(s) {
+  return /[\s"'\\]/.test(String(s)) ? envfile.quoteSystemd(s) : String(s);
+}
+
+function systemdUnit({ node, script, args, env, logDir, logName, description }) {
+  return `[Unit]
+Description=${description}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+${envLines(env)}
+ExecStart=${[node, script, ...args].map(execToken).join(' ')}
+Restart=on-failure
+RestartSec=30
+StandardOutput=append:${path.join(logDir, logName)}
+StandardError=append:${path.join(logDir, logName)}
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+function launchdPlist({ node, script, args, env, logDir, logName, label }) {
+  const envEntries = Object.entries(env)
+    .map(([k, v]) => `    <key>${xml(k)}</key>\n    <string>${xml(v)}</string>`)
+    .join('\n');
+  const argEntries = [node, script, ...args]
+    .map((a) => `    <string>${xml(a)}</string>`).join('\n');
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${xml(label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${argEntries}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+${envEntries}
+  </dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key>
+  <dict><key>SuccessfulExit</key><false/></dict>
+  <key>StandardOutPath</key><string>${xml(path.join(logDir, logName))}</string>
+  <key>StandardErrorPath</key><string>${xml(path.join(logDir, logName))}</string>
+</dict>
+</plist>
+`;
+}
+
+function parseEnvFile(file) {
+  try { return envfile.parse(fs.readFileSync(file, 'utf-8')); } catch { return {}; }
+}
+
+function lingerEnabled() {
+  try {
+    const r = spawnSync('loginctl', ['show-user', os.userInfo().username, '--property=Linger'], { encoding: 'utf-8' });
+    return /Linger=yes/.test(r.stdout || '');
+  } catch { return false; }
+}
+
+/**
+ * Everything install would fail on, asked before the caller stops anything.
+ *
+ * `service install` takes over from the detached shipper by killing it first. If the
+ * install then fails — no user manager on Linux, `launchctl bootstrap` refusing on macOS,
+ * a credential with a newline in it — the machine is left with no shipper at all. So the
+ * answerable questions are asked first.
+ */
+function preflight({ envFile }) {
+  const kind = platform();
+  if (!kind) return { ok: false, msg: `no service integration for platform '${process.platform}'` };
+  try { envfile.assertSingleLine(parseEnvFile(envFile)); } catch (e) { return { ok: false, msg: e.message }; }
+  if (kind === 'systemd') {
+    const r = spawnSync('systemctl', ['--user', 'show-environment'], { encoding: 'utf-8' });
+    if (r.error) return { ok: false, msg: 'systemctl is not on PATH — no systemd user manager to install into' };
+    if (r.status !== 0) {
+      return { ok: false, msg: 'cannot reach the systemd user manager '
+        + `(${((r.stderr || '').trim().split('\n')[0]) || `exit ${r.status}`}). Is XDG_RUNTIME_DIR set for this session?` };
+    }
+  } else {
+    const r = spawnSync('launchctl', ['print', `gui/${process.getuid()}`], { encoding: 'utf-8' });
+    if (r.error) return { ok: false, msg: 'launchctl is not on PATH — no launchd session to install into' };
+    // A non-zero status is a refusal too, and the systemd branch already treats it as
+    // one. Over SSH there is often no accessible GUI domain, so `bootstrap` would fail —
+    // after the caller had already stopped the shipper and the shim it was replacing.
+    if (r.status !== 0) {
+      return { ok: false, msg: `no accessible launchd GUI domain for uid ${process.getuid()} `
+        + `(${((r.stderr || '').trim().split('\n')[0]) || `exit ${r.status}`}). `
+        + 'A LaunchAgent needs a logged-in session; over SSH there may not be one.' };
+    }
+  }
+  return { ok: true, kind };
+}
+
+/** Install the shipper as a user service. */
+function install({ shipJs, envFile, logDir, interval = 300, home = null }) {
+  const kind = platform();
+  if (!kind) return { ok: false, msg: `no service integration for platform '${process.platform}'` };
+  const p = unitPaths()[kind];
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.mkdirSync(logDir, { recursive: true });
+  const node = process.execPath;
+
+  // The whole persisted config, so the house a unit points at travels with it: an install
+  // whose service forgot the layout switch would come back after a reboot writing to the
+  // another member's rooms — which either fails on permissions or, if it can read them,
+  // quietly ships into the wrong place.
+  const env = parseEnvFile(envFile);
+  // MEMHOUSE_HOME is not in the env file — it is where the env file itself lives — and a
+  // service installed under a custom home must keep using it, or it reads a different
+  // config after a reboot than the one just written.
+  if (home) env.MEMHOUSE_HOME = home;
+  // Adapter location overrides travel too. A detached shipper inherits them from the
+  // invoking shell through childEnv(); a service inherits nothing, so an override that
+  // was working before `service install` silently stops applying — the adapter falls back
+  // to its default path and just stops finding sessions, with no error anywhere.
+  for (const k of ADAPTER_ENV) if (process.env[k]) env[k] = process.env[k];
+  try { envfile.assertSingleLine(env); } catch (e) { return { ok: false, msg: e.message }; }
+
+  if (kind === 'systemd') {
+    fs.writeFileSync(p, systemdUnit({
+      node, script: shipJs, args: ['--loop', String(interval)], env, logDir, logName: 'shipper.log',
+      description: 'memhouse shipper — parse local agent sessions and ship to the house',
+    }), { mode: 0o600 });
+    execFileSync('systemctl', ['--user', 'daemon-reload']);
+    // `enable --now` STARTS a unit; it does not restart one that is already running, and
+    // a running unit keeps the environment it was started with. Re-installing after
+    // changing the connection, the interval, CODEX_HOME or the tier would then report
+    // success while the service went on shipping with the old settings until a reboot.
+    // So: enable, then restart — which starts a stopped unit and replaces a running one.
+    for (const unit of [`${LABEL}.service`]) {
+      execFileSync('systemctl', ['--user', 'enable', unit]);
+      execFileSync('systemctl', ['--user', 'restart', unit]);
+    }
+    const warn = lingerEnabled() ? null
+      : `systemd --user services stop at logout. Run: loginctl enable-linger ${os.userInfo().username}`;
+    return { ok: true, kind, path: p, warn };
+  }
+
+  // launchd. The plist inlines the credential, so it must not be world-readable.
+  fs.writeFileSync(p, launchdPlist({
+    node, script: shipJs, args: ['--loop', String(interval)], env, logDir,
+    logName: 'shipper.log', label: 'com.memhouse.shipper',
+  }), { mode: 0o600 });
+  // bootout is asynchronous: it returns before launchd has finished tearing the job down,
+  // and a bootstrap issued in that window fails with `Service is being removed` (EBUSY,
+  // 36). Reinstalling over a RUNNING service is exactly when that happens, which is the
+  // common case — `service install` after a redeploy. Wait for the label to actually go.
+  spawnSync('launchctl', ['bootout', `gui/${process.getuid()}/com.memhouse.shipper`]); // ignore if absent
+  for (let i = 0; i < 50; i++) {
+    const q = spawnSync('launchctl', ['print', `gui/${process.getuid()}/com.memhouse.shipper`], { encoding: 'utf-8' });
+    if (q.status !== 0) break; // gone
+    spawnSync('sleep', ['0.1']);
+  }
+  const r = spawnSync('launchctl', ['bootstrap', `gui/${process.getuid()}`, p], { encoding: 'utf-8' });
+  if (r.status !== 0) return { ok: false, msg: (r.stderr || '').trim() || 'launchctl bootstrap failed', path: p };
+  return { ok: true, kind, path: p, warn: null };
+}
+
+/**
+ * Remove the units — but only after they are actually stopped.
+ *
+ * Deleting a unit file does not stop a loaded service. If `disable --now` fails (a
+ * lingering user service running under a manager this shell cannot reach, say), removing
+ * the file leaves a shipper running with the credential inlined in a file the caller is
+ * about to delete, while every command reports the install gone. So: verify stopped, and
+ * refuse rather than report a success that is not one.
+ */
+function uninstall() {
+  const kind = platform();
+  if (!kind) return { ok: false, msg: `no service integration for platform '${process.platform}'` };
+  const p = unitPaths()[kind];
+  const stillRunning = [];
+  const indeterminate = [];
+
+  const home = os.homedir();
+  const legacy = LEGACY_UNITS.map((l) => (kind === 'systemd'
+    ? [l.unit, path.join(home, '.config', 'systemd', 'user', l.file), l.label]
+    : [l.label, path.join(home, 'Library', 'LaunchAgents', l.plist), l.label]));
+  const units = [
+    ...(kind === 'systemd'
+      ? [[`${LABEL}.service`, p, 'com.memhouse.shipper']]
+      : [['com.memhouse.shipper', p, 'com.memhouse.shipper']]),
+    ...legacy,
+  ];
+
+  for (const [unit, file, label] of units) {
+    if (!fs.existsSync(file)) continue;
+    if (kind === 'systemd') spawnSync('systemctl', ['--user', 'disable', '--now', unit], { encoding: 'utf-8' });
+    else spawnSync('launchctl', ['bootout', `gui/${process.getuid()}/${label}`], { encoding: 'utf-8' });
+    // The command's own status is not the question — `disable` can report success while
+    // the unit stays active, and `bootout` returns non-zero for an already-absent job.
+    // Ask what state it is in now, and treat "cannot tell" as its own answer: deleting
+    // the unit on an unknown state is how a live shipper keeps running with a credential
+    // in a file everyone believes is gone.
+    const state = runState(kind, unit, label);
+    if (state === 'running') { stillRunning.push(unit); continue; }
+    if (state === 'unknown') { indeterminate.push(unit); continue; }
+    fs.unlinkSync(file);
+  }
+  if (kind === 'systemd') spawnSync('systemctl', ['--user', 'daemon-reload']);
+
+  if (stillRunning.length) {
+    return {
+      ok: false,
+      kind,
+      path: p,
+      msg: `${stillRunning.join(', ')} is still running after stop — unit file kept. `
+        + `Stop it yourself (systemctl --user stop ${stillRunning[0]}), then re-run.`,
+    };
+  }
+  if (indeterminate.length) {
+    return {
+      ok: false,
+      kind,
+      path: p,
+      msg: `cannot determine whether ${indeterminate.join(', ')} stopped — no usable `
+        + `${kind === 'systemd' ? 'systemctl' : 'launchctl'} on this host, so the unit file is kept. `
+        + 'Confirm it is stopped, remove the unit yourself, then re-run.',
+    };
+  }
+  return { ok: true, kind, path: p };
+}
+
+// Three states, not two. A missing service manager is a normal state and not a crash —
+// `spawnSync` on an absent binary returns { error, stdout: null }, and dereferencing that
+// took down `uninstall`, `status` and `doctor` on any Linux host without systemctl. But
+// collapsing that into "not running" is its own bug: teardown would then treat "cannot
+// tell" as "confirmed stopped" and delete the unit and the credential out from under a
+// shipper that is still going. Display may round `unknown` down; teardown must not.
+function runState(kind, unit, label) {
+  if (kind === 'systemd') {
+    const r = spawnSync('systemctl', ['--user', 'is-active', unit], { encoding: 'utf-8' });
+    if (r.error) return 'unknown';               // no systemctl on PATH
+    const out = (r.stdout || '').trim();
+    if (out === 'active') return 'running';
+    // `is-active` answers inactive/failed/activating on a manager it can reach. Anything
+    // else — empty output, a connection error on stderr — means it could not tell us.
+    // `deactivating` is a unit still shutting down, not one that has stopped. Calling it
+    // stopped let uninstall delete a credential-bearing unit whose process was still
+    // alive. Both transitional states count as running, so teardown keeps the file and
+    // refuses until systemd reports a terminal state.
+    if (['activating', 'deactivating'].includes(out)) return 'running';
+    if (['inactive', 'failed'].includes(out)) return 'stopped';
+    return 'unknown';
+  }
+  const r = spawnSync('launchctl', ['print', `gui/${process.getuid()}/${label}`], { encoding: 'utf-8' });
+  if (r.error) return 'unknown';                 // no launchctl
+  if (r.status === 0) return /state = running|state = waiting/.test(r.stdout || '') ? 'running' : 'stopped';
+  // Non-zero has two very different meanings. "Could not find service" is launchd
+  // telling us the job is gone — a real `stopped`. "Could not find domain" is launchd
+  // telling us it cannot look, which happens over SSH with no GUI session, and treating
+  // that as stopped let `uninstall` delete a plist while its shipper kept running with
+  // the inlined credential.
+  const out = `${r.stderr || ''}${r.stdout || ''}`;
+  if (/could not find service|no such process|not find the specified service/i.test(out)) return 'stopped';
+  return 'unknown';
+}
+
+function isRunning(kind, unit, label) {
+  return runState(kind, unit, label) === 'running';
+}
+
+/**
+ * What the INSTALLED unit actually points at, read from the unit file rather than from
+ * the current config — the two drift the moment anything is redeployed, and callers
+ * asking "does this service care about the house I am removing?" need the unit's answer.
+ *
+ * Returns { installed, url, db } — null/false when undeterminable.
+ */
+function installedConfig() {
+  const kind = platform();
+  if (!kind) return { installed: false, url: null, db: null };
+  const p = unitPaths()[kind];
+  if (!fs.existsSync(p)) return { installed: false, url: null, db: null };
+  let text = '';
+  try { text = fs.readFileSync(p, 'utf-8'); } catch { return { installed: true, url: null, db: null }; }
+  const env = {};
+  if (kind === 'systemd') {
+    for (const m of text.matchAll(/^Environment=([A-Z0-9_]+)=(.*)$/gm)) {
+      let v = m[2].trim();
+      if (v.startsWith('"') && v.endsWith('"')) v = v.slice(1, -1).replace(/\\(["\\])/g, '$1');
+      env[m[1]] = v;
+    }
+  } else {
+    // <key>NAME</key><newline><string>VALUE</string>
+    for (const m of text.matchAll(/<key>([A-Z0-9_]+)<\/key>\s*<string>([^<]*)<\/string>/g)) {
+      env[m[1]] = m[2].replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>');
+    }
+  }
+  return {
+    installed: true,
+    url: env.MEMHOUSE_URL || null,
+    // The endpoint is not the whole identity. A service on the same URL but a different
+    // DATABASE — or a different room layout — is still shipping somewhere else.
+    db: env.MEMHOUSE_DB || null,
+  };
+}
+
+function status() {
+  const kind = platform();
+  if (!kind) return { kind: null, installed: false, running: false };
+  const p = unitPaths()[kind];
+  const home = os.homedir();
+  // Legacy units are reported separately: `installed` must stay "this build's unit is
+  // here", or every caller that asks it starts meaning something else. But uninstall has
+  // to know, or a machine with ONLY a stale solo unit skips the service step entirely.
+  const legacy = LEGACY_UNITS
+    .map((l) => (kind === 'systemd'
+      ? path.join(home, '.config', 'systemd', 'user', l.file)
+      : path.join(home, 'Library', 'LaunchAgents', l.plist)))
+    .filter((f) => fs.existsSync(f));
+  return {
+    kind,
+    installed: fs.existsSync(p),
+    running: isRunning(kind, `${LABEL}.service`, 'com.memhouse.shipper'),
+    path: p,
+    legacy,
+  };
+}
+
+// The two renderers are exported so the unit gate can check what gets written without
+// installing anything. A malformed plist or unit is only visible at load time otherwise,
+// and "load it and see" is not available on a machine you must not touch.
+module.exports = {
+  install, uninstall, status, platform, preflight, installedConfig, lingerEnabled,
+  _render: { systemdUnit, launchdPlist, unitPaths },
+};

package/mem-house/shipper/ship.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 // mem-house SHIPPER — parse-on-client (bet #1 in ../DESIGN.md). Runs the 17 editor
-// adapters locally and ships TYPED rows into the house (sessions / messages /
-// tool_calls, ../schema.sql). The typed evolution of agency/ingest.js: same host id,
+// adapters locally and ships TYPED rows into THE CALLER'S OWN rooms — sessions_<m> /
+// messages_<m> / tool_calls_<m>, where <m> is `SELECT currentUser()` and never config
+// (../per-member/schema-member.sql.tpl, ../per-member/rooms.js). All of one member's
+// machines land in that member's rooms, told apart by the `host` column; no member
+// writes into another's. The typed evolution of agency/ingest.js: same host id,
 // same ts interpolation, same batching discipline — but rows land in physical
 // columns instead of a raw JSON blob.
 //
@@ -17,11 +20,11 @@
 // CLI:  node ship.js                one incremental pass
 //       node ship.js --loop [sec]   repeat every sec seconds (default 300)
 //       node ship.js --full         ignore the incremental skip (re-ship everything)
-//       node ship.js --ensure-schema  apply ../schema.sql and exit
+//       node ship.js --ensure-schema  create the caller's own rooms and exit
 //       node ship.js --stats        per-source counts from sessions_v and exit
 //
 // Env (DESIGN.md contract): MEMHOUSE_URL / MEMHOUSE_USER / MEMHOUSE_PASSWORD /
-// MEMHOUSE_DB — defaults http://localhost:8123 / memhouse_root / '' / memhouse.
+// MEMHOUSE_DB — defaults http://localhost:8123 / memhouse_root / '' / mem.
 
 const os = require('os');
 const fs = require('fs');
@@ -30,6 +33,7 @@ const crypto = require('crypto');
 const { createClient } = require('@clickhouse/client');
 const { getAllChats, getAdapterErrors, getMessages, resetCaches } = require('../../editors');
 const adapterErrorSink = require('../../editors/adapter-errors');
+const { resolveRooms, READ_SETTINGS } = require('../per-member/rooms');
 
 const BATCH_ROWS = 2000;   // insert batch ceiling (binding)
 const TEXT_MAX = 50000;    // messages.text truncation
@@ -79,7 +83,7 @@ function makeClient() {
     url: process.env.MEMHOUSE_URL || 'http://localhost:8123',
     username: process.env.MEMHOUSE_USER || 'memhouse_root',
     password: process.env.MEMHOUSE_PASSWORD || '',
-    database: process.env.MEMHOUSE_DB || 'memhouse',
+    database: process.env.MEMHOUSE_DB || 'mem',
     request_timeout: 300000, // full re-ships move tens of MB; don't cut inserts short
     clickhouse_settings: {
       // Int64/UInt64 back as JSON numbers — our values (counts, tokens) are < 2^53.
@@ -97,10 +101,21 @@ function makeClient() {
   });
 }
 
-// Apply ../schema.sql statement by statement. Comments are stripped BEFORE the ';'
-// split — schema comments legitimately contain semicolons.
+// Create the CALLER'S OWN rooms, from ../per-member/schema-member.sql.tpl. Comments are
+// stripped BEFORE the ';' split — schema comments legitimately contain semicolons.
+//
+// This is the solo path: on a house you own, `memhouse install` mints your three rooms and
+// you are done. It creates nobody else's — the template is rendered for currentUser(), the
+// same identity the rooms' user_id is stamped with, so a client cannot name its way into
+// someone else's rooms.
+//
+// It does NOT issue grants or create the Merge rooms. A solo owner needs neither. Adding a
+// SECOND member — grants, Merge rooms, sharing — is owner work and lives in
+// ../per-member/provision.js.
 async function ensureSchema(client) {
-  const sql = fs.readFileSync(path.join(__dirname, '..', 'schema.sql'), 'utf-8');
+  const { member } = await resolveRooms(client);
+  const tpl = fs.readFileSync(path.join(__dirname, '..', 'per-member', 'schema-member.sql.tpl'), 'utf-8');
+  const sql = tpl.replaceAll('{{MEMBER}}', member);
   const stripped = sql.split('\n').map((l) => l.replace(/--.*$/, '')).join('\n');
   const stmts = stripped.split(';').map((s) => s.trim()).filter(Boolean);
   for (const q of stmts) {
@@ -121,9 +136,9 @@ async function ensureSchema(client) {
 // NOT message_count — because parsed-message count and bubbleCount are different
 // units in several adapters (claude folds subagents, codex reports 0), and skipping
 // must be decidable WITHOUT calling getMessages on every chat.
-async function loadExisting(client) {
+async function loadExisting(client, rooms) {
   const rs = await client.query({
-    query: 'SELECT session_id, last_updated_at, message_count, extra FROM sessions FINAL WHERE user_id = currentUser()',
+    query: `SELECT session_id, last_updated_at, message_count, extra FROM ${rooms.sessions} FINAL WHERE user_id = currentUser()`,
     format: 'JSONEachRow',
   });
   // Actual message rows per session: an interrupted re-ship (crash between the
@@ -132,7 +147,7 @@ async function loadExisting(client) {
   // must compare the real row count against the recorded message_count, not
   // merely check that some row exists.
   const mr = await client.query({
-    query: 'SELECT session_id, count() AS n FROM messages FINAL WHERE user_id = currentUser() GROUP BY session_id',
+    query: `SELECT session_id, count() AS n FROM ${rooms.messages} FINAL WHERE user_id = currentUser() GROUP BY session_id`,
     format: 'JSONEachRow',
   });
   const msgCounts = new Map();
@@ -269,7 +284,8 @@ async function runShip(client, opts = {}) {
   // only in incremental mode, but re-shipping a KNOWN session must clear its old
   // message/tool rows first (a shrunken re-parse leaves stale higher-seq rows
   // otherwise: ReplacingMergeTree collapses same-key rows only).
-  const existing = await loadExisting(client);
+  const rooms = await resolveRooms(client);
+  const existing = await loadExisting(client, rooms);
   const chats = getAllChats();
 
   // An adapter that cannot load contributes zero sessions, which is indistinguishable
@@ -285,7 +301,7 @@ async function runShip(client, opts = {}) {
   const flush = async (table) => {
     if (!batches[table].length) return;
     await client.insert({
-      table,
+      table: rooms[table],
       values: batches[table],
       format: 'JSONEachRow',
       clickhouse_settings: { async_insert: 0 }, // binding: user_id stamping breaks otherwise
@@ -350,10 +366,17 @@ async function runShip(client, opts = {}) {
       // shorter re-parse can't leave stale seq/idx tails. A crash between the
       // delete and the inserts is repaired by the next pass: the skip predicate
       // refuses to skip a non-empty session whose message rows are missing.
+      // user_id is BOUND, not `= currentUser()`. A DELETE is a mutation, and a mutation
+      // does not necessarily evaluate currentUser() in the caller's context — it matches
+      // nothing at all, so the delete silently removes zero rows and the stale tail this
+      // code exists to clear survives forever. Measured on ClickHouse 25.11 —
+      // the identical predicate with the literal value deleted 2000 rows where
+      // currentUser() deleted 0. The value is the same identity either way: it is read
+      // from the server over this very connection.
       for (const t of ['messages', 'tool_calls']) {
         await client.command({
-          query: `DELETE FROM ${t} WHERE session_id = {id:String} AND user_id = currentUser()`,
-          query_params: { id },
+          query: `DELETE FROM ${rooms[t]} WHERE session_id = {id:String} AND user_id = {uid:String}`,
+          query_params: { id, uid: rooms.user },
           clickhouse_settings: { async_insert: 0 },
         });
       }
@@ -387,18 +410,20 @@ function reportAdapterErrors(warned) {
 }
 
 // Per-source rollup straight from sessions_v (final=1 so ReplacingMergeTree collapses).
+// The rollup resolves like the rooms do — it is a subquery over the caller's own rooms.
 async function printStats(client) {
+  const rooms = await resolveRooms(client);
   const rs = await client.query({
     query: `
       SELECT source,
              count() AS sessions,
              sum(total_msgs) AS messages,
              sum(input_tokens + output_tokens + cache_read_tokens + cache_write_tokens) AS tokens
-      FROM sessions_v
+      FROM ${rooms.sessions_v}
       GROUP BY source
       ORDER BY sessions DESC`,
     format: 'JSONEachRow',
-    clickhouse_settings: { final: 1 },
+    clickhouse_settings: READ_SETTINGS,
   });
   const rows = await rs.json();
   if (!rows.length) { console.log('[mem-house] house is empty'); return; }
@@ -433,19 +458,37 @@ async function main() {
       if (Number.isFinite(n) && n > 0) intervalSec = n;
     }
     let full = argv.includes('--full');
+    // A failed pass does NOT wait the full interval. The common failure at startup is
+    // that the house is not up yet — the container is still booting — and sleeping 300s
+    // there means the first ship is
+    // five minutes late for a condition that clears in under a second. systemd's
+    // After= orders process start, not readiness, and launchd has no ordering at all, so
+    // this is the only place the race can be closed for every path at once.
+    // Backs off to the normal interval so a genuinely unreachable house is not hammered.
+    const RETRY_START_MS = 2000;
+    let retryMs = RETRY_START_MS;
     do {
       const t0 = Date.now();
+      let failed = false;
       try {
         const r = await runShip(client, { full });
         console.log(`[mem-house] shipped ${r.sessions} sessions (${r.skipped} skipped${r.unreadable ? `, ${r.unreadable} unreadable-will-retry` : ''}) → ` +
           `${r.msgRows} msg rows, ${r.toolRows} tool rows in ${((Date.now() - t0) / 1000).toFixed(1)}s`);
       } catch (e) {
+        failed = true;
         console.error(`[mem-house] pass failed: ${e.message}`);
         if (!loop) process.exitCode = 1;
       }
       full = false; // --full applies to the first pass only; loop passes stay incremental
       if (loop) {
-        await new Promise((r) => setTimeout(r, intervalSec * 1000));
+        const waitMs = failed ? Math.min(retryMs, intervalSec * 1000) : intervalSec * 1000;
+        if (failed) {
+          console.error(`[mem-house] retrying in ${Math.round(waitMs / 1000)}s`);
+          retryMs = Math.min(retryMs * 2, intervalSec * 1000);
+        } else {
+          retryMs = RETRY_START_MS;
+        }
+        await new Promise((r) => setTimeout(r, waitMs));
         resetCaches(); // adapters cache chat lists; drop them so new sessions surface
       }
     } while (loop);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "memhouse",
-  "version": "0.3.2",
-  "description": "memhouse — agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store, kernel-agency install, and the agentlytics dashboard",
+  "version": "0.4.3",
+  "description": "memhouse — agent conversation memory across 17 editors: parse-on-client shippers, a typed ClickHouse store with one set of rooms per member, kernel-agency install, and the agentlytics dashboard",
   "main": "bin/memhouse.js",
   "bin": {
     "memhouse": "./bin/memhouse.js",
@@ -37,7 +37,7 @@
     "start": "node bin/memhouse.js",
     "build": "cd ui && npm install && npm run build",
     "dev": "cd ui && npm run dev",
-    "test": "node misc/syntax-check.js",
+    "test": "node misc/syntax-check.js && node misc/unit-test.js",
     "prepack": "cd ui && npm install --no-audit --no-fund && npm run build"
   },
   "keywords": [

package/pricing.js

@@ -53,12 +53,30 @@ function normalizeModelName(name) {
     if (withoutQual !== c && MODEL_PRICING[withoutQual]) return withoutQual;
   }
 
-  // Pass 2: fuzzy startsWith (longest key match wins)
+  // Pass 2: prefix match, longest key wins — but only on a SEGMENT boundary.
+  //
+  // A bare startsWith matches across a version boundary and returns a confident wrong
+  // price rather than null. `gpt-4-mini`.startsWith('gpt-4') is true, so an unpriced
+  // model billed at gpt-4's $30/$60 instead of failing loudly; `gpt-5-6-sol` did exactly
+  // this against `gpt-5` and reported a quarter of its true cost for months. A missing
+  // model at least yields a zero someone might question.
+  //
+  // The rule: the remainder after a matched key must be a DATE OR VERSION STAMP —
+  // digit-only segments. `claude-opus-4-8-20260115` is claude-opus-4-8 on a given day and
+  // costs the same. `gpt-4-mini` is not gpt-4 with a stamp, it is a different model, and
+  // guessing its price from gpt-4 overstates it 40x.
+  //
+  // A word suffix therefore returns null rather than a neighbour's price. That is
+  // deliberate even though null means the model is dropped from cost totals: an absent
+  // number invites the question, a wrong one does not. `doctor` reports what is unpriced
+  // so the gap is visible rather than silent.
+  const stamped = (rest) => rest === '' || /^(-[0-9]+)+$/.test(rest);
   const keys = Object.keys(MODEL_PRICING);
   for (const c of candidates) {
     let best = null;
     for (const key of keys) {
-      if (c.startsWith(key) && (!best || key.length > best.length)) best = key;
+      if (c.startsWith(key) && stamped(c.slice(key.length))
+          && (!best || key.length > best.length)) best = key;
     }
     if (best) return best;
   }