memhouse 0.7.1 → 0.9.0

package/bin/memhouse.js

@@ -23,7 +23,7 @@ const SHIP_JS = path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js');
 const SERVER_JS = path.join(REPO_ROOT, 'memhouse', 'server', 'server.js');
 const DELIVERY = path.join(REPO_ROOT, 'memhouse', 'delivery');
 const PKG = require(path.join(REPO_ROOT, 'package.json'));
-const { roomNames, ROOM_TYPES, mergeRooms, MEMBER_PRIVS, MEMBER_PROFILE, MEMBER_PROFILE_SETTINGS, installCommand } = require(path.join(REPO_ROOT, 'memhouse', 'per-member', 'rooms'));
+const { roomNames, ROOM_TYPES, MEMBER_PIN, installCommand } = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
 const envfile = require(path.join(REPO_ROOT, 'memhouse', 'envfile'));
 
 const HOME_DIR = process.env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse');
@@ -65,7 +65,10 @@ function resolveConfig() {
     url: pick('url', 'MEMHOUSE_URL', 'http://localhost:8123'),
     user: pick('user', 'MEMHOUSE_USER', 'memhouse_root'),
     password: pick('password', 'MEMHOUSE_PASSWORD', ''),
-    db: pick('db', 'MEMHOUSE_DB', 'mem'),
+    // The house defaults to the USER'S OWN NAME (`polat` ships into `polat.messages`),
+    // because a house is a database and the natural first house is your own. Any name
+    // works — user 'alice' with house 'default' is a supported pairing.
+    db: pick('db', 'MEMHOUSE_DB', pick('user', 'MEMHOUSE_USER', 'memhouse_root')),
     port: pick('port', 'MEMHOUSE_PORT', '4640'),
     // Did anything actually SAY which house this is, or are the values above just the
     // defaults? The defaults are not neutral — localhost:8123 as memhouse_root is a real
@@ -353,18 +356,15 @@ Engine: MEMHOUSE_ENGINE pins docker or podman when both are installed and one ca
 `;
 
 // A skipped adapter and an editor the user does not have look identical — both
-// contribute zero sessions. Say which happened, and how to fix the one that is fixable.
+// contribute zero sessions. Say which happened.
+//
+// There was a second branch here for the one cause that hit five adapters at once: a
+// missing better-sqlite3 native binding, fixable only by reinstalling with a flag. With
+// SQLite now inside Node there is nothing to install and nothing to advise — every
+// remaining failure is one adapter's own store, and its own message is the whole story.
 function printAdapterErrors(errors) {
   if (!errors || errors.length === 0) return;
-  const blocked = errors.filter((e) => e.missingBinding);
-  const other = errors.filter((e) => !e.missingBinding);
-  if (blocked.length) {
-    console.log(warn(`${blocked.length} adapter${blocked.length > 1 ? 's' : ''} skipped — better-sqlite3 has no native binding: ${blocked.map((e) => e.source).join(', ')}`));
-    console.log('  their sessions are NOT being shipped. npm >= 12 blocks install scripts by default; rebuild with:');
-    console.log('    ${installCommand()}');
-    console.log('  (from a checkout: npm install --no-audit --no-fund, which package.json already allows)');
-  }
-  for (const e of other) console.log(warn(`${e.source.padEnd(16)} skipped: ${e.message}`));
+  for (const e of errors) console.log(warn(`${e.source.padEnd(16)} skipped: ${e.message}`));
 }
 
 async function cmdDiscover() {
@@ -600,38 +600,20 @@ function generatePassword() {
  * same templates provision.js applies, so the two cannot drift into different houses.
  */
 function memberSql(db, member, password) {
-  const here = path.join(REPO_ROOT, 'memhouse', 'per-member');
-  // The templates are written unqualified because provision.js applies them with the
-  // house already selected. A human pastes this somewhere unknown — clickhouse-client,
-  // the play UI, curl — so every name is qualified here and there is no `USE`.
-  //
-  // `currentDatabase()` in the Merge engine is the trap, and it is silent:
-  // it is evaluated at CREATE time, not at read time, so a block run without the house
-  // selected builds Merge rooms pointing at `default` that return zero rows forever. The
-  // literal name goes in instead.
+  // The template is written unqualified because the shipper applies it with the house
+  // already selected. A human pastes this somewhere unknown — clickhouse-client, the
+  // play UI, curl — so every name is qualified here and there is no `USE`.
   const qualify = (sql) => sql
-    .replace(/CREATE TABLE IF NOT EXISTS (\w+)/g, `CREATE TABLE IF NOT EXISTS ${db}.$1`)
-    .replace(/ AS (\w+)\nENGINE = Merge/g, ` AS ${db}.$1\nENGINE = Merge`)
-    .replace(/Merge\(currentDatabase\(\)/g, `Merge('${db}'`);
-  const rooms = qualify(fs.readFileSync(path.join(here, 'schema-member.sql.tpl'), 'utf-8')
-    .replaceAll('{{MEMBER}}', member));
-  const merge = qualify(fs.readFileSync(path.join(here, 'schema-merge.sql.tpl'), 'utf-8')
-    .replaceAll('{{TEMPLATE_MEMBER}}', member));
-  // The SAME grant set provision.js issues. These two paths build the same house, and when
-  // only one of them was narrowed, `install --print-sql` — the path INSTALL.md calls the
-  // common case — still emitted GRANT ALL, which includes CREATE TABLE on the member's own
-  // room name. A member provisioned that way could drop their room, recreate it as
-  // Merge('<db>','^messages_'), and double every other member's rows in the team room:
-  // exactly the attack the narrowing was for, fully reachable, one release later.
-  const grants = ROOM_TYPES.flatMap((t) => [
-    `GRANT ${MEMBER_PRIVS} ON ${db}.${t}_${member} TO ${member};`,
-    `GRANT SELECT ON ${db}.${t}_${member} TO ${member} WITH GRANT OPTION;`,
-  ]).join('\n');
-  const mergeGrants = Object.values(mergeRooms())
-    .map((n) => `GRANT SELECT ON ${db}.${n} TO ${member};`).join('\n');
+    .replace(/CREATE TABLE IF NOT EXISTS (\w+)/g, `CREATE TABLE IF NOT EXISTS ${db}.$1`);
+  const rooms = qualify(fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl'), 'utf-8'));
   return `-- memhouse: everything '${member}' needs in house '${db}'. Run as a user with
 -- ACCESS MANAGEMENT (a stock 'default' with access_management=1 will do).
 --
+-- A house is a database; its rooms are three shared tables. Everyone granted on the
+-- database writes into the same tables, and every row carries who (user_id, stamped by
+-- the server) and where from (host, the install's fingerprint). Adding a housemate later
+-- is the same two statements: CREATE USER, GRANT ALL ON the house.
+--
 -- Every name is qualified and there is no USE, so this runs anywhere: clickhouse-client,
 -- the play UI, curl, a GUI. Order matters only in that the database comes first.
 --
@@ -655,31 +637,16 @@ CREATE USER IF NOT EXISTS ${member} IDENTIFIED BY '${password.replace(/'/g, "\\'
 
 ${rooms.trim()}
 
--- Exactly what the shipper uses, and nothing that defines an object: no CREATE TABLE, no
--- DROP, no TRUNCATE. A member who owned the room NAME rather than its data could replace
--- it with a Merge over every member's rooms and double their rows in the team room.
--- Only SELECT is re-grantable, so a share can only ever be read-only.
-${grants}
-
--- Team-wide reads. A Merge room reduces to the rooms the CALLER holds grants for, so
--- this narrows rather than denies, and picks up members added later with no DDL.
-${merge.trim()}
-
-${mergeGrants}
-
--- Resource ceilings. Confidentiality isolation is a grant that is absent; this is the
--- availability half, and it did not exist until 0.4.7 — a member could raise
--- max_memory_usage, zero max_execution_time and take a shared server down for everyone.
--- CONST, not MAX: a plain default is advisory, and MAX is not enough either because 0 means
--- UNLIMITED in ClickHouse and 0 satisfies any MAX. Measured — with a MAX ceiling in force,
--- SETTINGS max_memory_usage = 0 was accepted and the ceiling was gone.
--- CREATE ... OR REPLACE, which this used, DETACHES every user already on the profile, so
--- provisioning a second member silently stripped the first member's ceilings. IF NOT
--- EXISTS + ALTER edits the same object in place and keeps every assignment.
-CREATE SETTINGS PROFILE IF NOT EXISTS ${MEMBER_PROFILE};
-ALTER SETTINGS PROFILE ${MEMBER_PROFILE} SETTINGS NONE;
-ALTER SETTINGS PROFILE ${MEMBER_PROFILE} SETTINGS ${MEMBER_PROFILE_SETTINGS};
-ALTER USER ${member} SETTINGS PROFILE '${MEMBER_PROFILE}';
+-- The whole database. ALL on your own house reaches nothing outside it — the database is
+-- the boundary — and it is what lets the shipper create and evolve its own tables.
+GRANT ALL ON ${db}.* TO ${member};
+
+-- Pin async_insert on the user (ADD SETTING merges; a bare SETTINGS clause would replace
+-- the user's whole list). The pin keeps the user_id stamp honest: a MATERIALIZED
+-- currentUser() is computed during the INSERT, and an async flush stores it as the empty
+-- string. CONST refuses the override; a client that never mentions the setting is held
+-- at 0 and its insert lands stamped.
+ALTER USER ${member} ADD SETTING ${MEMBER_PIN};
 `;
 }
 
@@ -707,22 +674,19 @@ async function adminBootstrap(cfg, admin) {
     catch { console.log(bad(`house '${cfg.db}' does not exist and '${admin.user}' cannot create it: ${e.message}`)); return null; }
   }
 
-  // 2. the user. An EXISTING user is refused: adopting one silently hands the second
-  // human the first's identity and rooms, and user_id MATERIALIZED currentUser() would
-  // stamp them identically, so nothing downstream would ever notice.
-  // A member who passes --admin-user gets ACCESS_DENIED here, because no member holds
-  // SELECT ON system.users. That is the isolation working — but the raw 497 names neither
-  // side, while INSTALL.md promises install "refuses, names both sides, and creates
-  // nothing". Say who you are not, and what the owner has to run instead.
+  // 2. the user. A shared house makes an existing user unremarkable — rows are told apart
+  // by the server-stamped user_id, so "the handle is taken" hands nobody anything. What
+  // still matters is proof: connecting AS the member below is what validates whichever
+  // password is in play, existing user or fresh one.
   let exists;
   try {
     exists = (await chRows(adminCfg, `SELECT name FROM system.users WHERE name = '${admin.member}'`, { database: '' })).length > 0;
   } catch (e) {
     if (/Not enough privileges|ACCESS_DENIED|system\.users/i.test(e.message || '')) {
       console.log(bad(`'${admin.user}' is not an admin of this house — it cannot read system.users, so it cannot provision a member`));
-      console.log('  Adding a member is the house owner\'s job. Ask them for:');
-      console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member ${admin.member} --merge`);
-      console.log('  If you already HAVE a member credential on this house, you do not need admin:');
+      console.log('  Joining a house is two statements for whoever owns it:');
+      console.log(`     CREATE USER ${admin.member} IDENTIFIED BY '…';  GRANT ALL ON ${cfg.db}.* TO ${admin.member};`);
+      console.log('  If you already HAVE a credential on this house, you do not need admin:');
       console.log(`     memhouse install --url ${adminCfg.url} --user ${admin.member} --password …`);
       return null;
     }
@@ -730,19 +694,14 @@ async function adminBootstrap(cfg, admin) {
   }
   let password = flags['member-password'] || null;
   if (exists) {
-    if (flags['adopt-user'] !== true) {
-      console.log(bad(`ClickHouse user '${admin.member}' already exists in this house.`));
-      console.log('  Creating rooms for them would hand you their identity — user_id is stamped from');
-      console.log('  currentUser(), so their rows and yours would be indistinguishable.');
-      console.log('  If this is you on a new machine, prove it:');
-      console.log(`     memhouse install --adopt-user --member ${admin.member} --member-password '…' …`);
-      console.log(`  If it is someone else, pick another handle:  --member <name>`);
+    if (!password) {
+      console.log(bad(`ClickHouse user '${admin.member}' already exists — pass --member-password to install as them.`));
+      console.log(`  Or pick another handle:  --member <name>`);
       return null;
     }
-    if (!password) { console.log(bad('--adopt-user requires --member-password — the password is the proof')); return null; }
     try { await ch({ ...cfg, user: admin.member, password }, 'SELECT 1', { database: '' }); }
-    catch { console.log(bad(`--adopt-user: '${admin.member}' did not authenticate with that password`)); return null; }
-    console.log(ok(`adopted existing user '${admin.member}' (password verified)`));
+    catch { console.log(bad(`'${admin.member}' did not authenticate with that password`)); return null; }
+    console.log(ok(`using the existing ClickHouse user '${admin.member}' (password verified)`));
   } else {
     if (!password) {
       password = generatePassword();
@@ -758,33 +717,18 @@ async function adminBootstrap(cfg, admin) {
     createdUser = admin.member;
   }
 
-  // 3. rooms, 4. grants, 5. Merge rooms + their grant — provision.js owns all of it, so
-  // there is one implementation of the grant set rather than two that drift.
-  const provision = path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js');
-  // Tell it who made the user. Without this the child finds a user that exists — because
-  // THIS command created it two lines ago — and says so, producing two consecutive lines
-  // of one command's output that contradict each other:
-  //     ✓ created ClickHouse user 'henry'
-  //     [mem] ClickHouse user 'henry' already exists — provisioning rooms only
-  // and "already exists" is the exact phrase memhouse uses for the identity-takeover
-  // REFUSAL, so a first-time installer reads a success as a warning about someone else.
-  const provisionArgs = [provision, '--member', admin.member, '--merge'];
-  if (createdUser) provisionArgs.push('--user-just-created');
-  const rc = spawnSync(process.execPath, provisionArgs, {
-    stdio: 'inherit',
-    env: { ...process.env, MEM_URL: cfg.url, MEM_USER: admin.user, MEM_PASSWORD: admin.password, MEM_DB: cfg.db },
-  });
-  if (rc.status !== 0) {
-    // "nothing was written" was a lie whenever the CREATE USER above had already run —
-    // and it runs before this. Observed: provision.js died on a missing dependency, this
-    // printed the all-clear, and the next install refused with the identity-takeover
-    // message because the user it said it had not created was there. Say what exists, and
-    // name the two ways forward.
-    console.log(bad('provisioning failed'));
+  // 3. the grant and the pin. GRANT ALL on the house is the whole tenancy model: it
+  // reaches nothing outside the database, and it is what lets the member's own shipper
+  // create and evolve the rooms (--ensure-schema below).
+  try {
+    await q(`GRANT ALL ON ${cfg.db}.* TO ${admin.member}`, { database: '' });
+    await q(`ALTER USER ${admin.member} ADD SETTING ${MEMBER_PIN}`, { database: '' });
+    console.log(ok(`granted the house: ALL ON ${cfg.db}.* to '${admin.member}', async_insert pinned`));
+  } catch (e) {
+    console.log(bad(`could not grant the house to '${admin.member}': ${e.message}`));
     if (createdUser) {
-      console.log(`  ClickHouse user '${createdUser}' WAS created before this failed; its rooms were not.`);
-      console.log('  Nothing was written to disk. To continue once the cause is fixed:');
-      console.log(`     memhouse install --adopt-user --member ${createdUser} --member-password '<the password above>' …`);
+      console.log(`  ClickHouse user '${createdUser}' WAS created before this failed.`);
+      console.log(`  Continue once fixed:  memhouse install --member ${createdUser} --member-password '<the password above>' …`);
       console.log(`  Or undo it as the admin:  DROP USER ${createdUser}`);
     } else {
       console.log('  nothing was written');
@@ -793,11 +737,15 @@ async function adminBootstrap(cfg, admin) {
   }
 
   // The step that makes this trustworthy: stop being admin, and prove the credential we
-  // are about to persist actually reaches the rooms.
+  // are about to persist can build and reach the rooms itself.
   const memberCfg = { ...cfg, user: admin.member, password };
+  if (run(SHIP_JS, ['--ensure-schema'], memberCfg) !== 0) {
+    console.log(bad(`'${admin.member}' could not create the rooms in '${cfg.db}' — nothing written to disk`));
+    return null;
+  }
   try {
-    const seen = await chRows(memberCfg, `SELECT count() AS n FROM system.tables WHERE database = '${cfg.db}' AND name IN ('sessions_${admin.member}','messages_${admin.member}','tool_calls_${admin.member}')`, { database: '' });
-    if (Number(seen[0]?.n) !== 3) { console.log(bad(`'${admin.member}' cannot see all three of their rooms — nothing written`)); return null; }
+    const seen = await chRows(memberCfg, `SELECT count() AS n FROM system.tables WHERE database = '${cfg.db}' AND name IN ('sessions','messages','tool_calls')`, { database: '' });
+    if (Number(seen[0]?.n) !== 3) { console.log(bad(`'${admin.member}' cannot see the three rooms — nothing written`)); return null; }
   } catch (e) { console.log(bad(`'${admin.member}' could not connect after provisioning: ${e.message}`)); return null; }
   console.log(ok(`verified as '${admin.member}' — admin credential discarded, not stored`));
   return memberCfg;
@@ -855,6 +803,16 @@ async function cmdInstall({ interactive }) {
   let cfg = resolveConfig();
   const adminUser = flags['admin-user'];
 
+  // The house name is spliced unquoted into CREATE DATABASE and GRANT ALL ON <db>.* —
+  // validate it HERE, on every install mode, not only where deploy happens to choose it.
+  // Found by the acceptance run, driven end to end: `install --db system` sailed through,
+  // granted a member CHECK/SHOW/SELECT/INSERT/ALTER/DROP/TRUNCATE/… ON system.* and
+  // created sessions/messages/tool_calls INSIDE the server's system database, exit 0.
+  // On a shared or kernel ClickHouse that is a granted-everything-on-system user minted
+  // by a memhouse one-liner.
+  try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(cfg.db, 'house'); }
+  catch (e) { console.log(bad(e.message)); return 1; }
+
   // Option 1 — print the SQL and stop. For the common case: you have admin on this
   // ClickHouse and would rather run four statements yourself than hand a credential to an
   // installer. Nothing is written and nothing is contacted.
@@ -893,7 +851,7 @@ async function cmdInstall({ interactive }) {
   if (keyProblem) {
     console.log(bad(`the rooms are here, but their sorting keys are wrong: ${keyProblem}`));
     console.log('  a ship pass would corrupt them, so `memhouse ship` will refuse.');
-    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}, then: memhouse ship --full`);
+    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl')}, then: memhouse ship --full`);
     console.log('  no config was written — nothing here reads as installed.');
     return 1;
   }
@@ -907,8 +865,8 @@ async function cmdInstall({ interactive }) {
     }
     if (flags['no-ship'] !== true && run(SHIP_JS, [], cfg) !== 0) return 1;
     console.log(ok('installed — next: memhouse start   (dashboard + shipper loop)'));
-    console.log('  admin is needed again only for: a second member, or an ADD COLUMN rollout.');
-    console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member <name> --merge`);
+    console.log('  adding a housemate later is two statements for the admin:');
+    console.log(`     CREATE USER <name> IDENTIFIED BY '…';  GRANT ALL ON ${cfg.db}.* TO <name>;`);
     return 0;
   }
 
@@ -917,7 +875,7 @@ async function cmdInstall({ interactive }) {
   // authenticating as memhouse_root instead: the three flags did nothing, --yes satisfied
   // haveAll so no prompt asked who you were, and resolveConfig's default was used AS A
   // CREDENTIAL. Refuse rather than do something else silently.
-  const adminOnly = ['adopt-user', 'member', 'member-password'].filter((k) => flags[k] !== undefined);
+  const adminOnly = ['member', 'member-password'].filter((k) => flags[k] !== undefined);
   if (!adminUser && adminOnly.length) {
     console.log(bad(`--${adminOnly.join(', --')} ${adminOnly.length > 1 ? 'are' : 'is'} only read with --admin-user`));
     console.log('  Those flags provision a member, which needs house admin. Without them this');
@@ -1030,7 +988,7 @@ async function cmdInstall({ interactive }) {
   if (keyProblem) {
     console.log(bad(`the rooms are here, but their sorting keys are wrong: ${keyProblem}`));
     console.log('  a ship pass would corrupt them, so `memhouse ship` will refuse.');
-    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}, then: memhouse ship --full`);
+    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl')}, then: memhouse ship --full`);
     console.log('  no config was written — nothing here reads as installed.');
     return 1;
   }
@@ -1268,8 +1226,11 @@ async function cmdDoctor() {
   const checks = [];
   const add = (okFlag, label, hint) => checks.push({ ok: okFlag, label, hint });
 
-  const [major, minor] = process.versions.node.split('.').map(Number);
-  add(major > 20 || (major === 20 && minor >= 19), `node ${process.versions.node}`, 'need >= 20.19');
+  // 24 because SQLite comes from `node:sqlite`, which is stable there. It works on 22.13+
+  // but prints an ExperimentalWarning on every command, and 20 is past EOL. Below the
+  // floor, the five SQLite-backed adapters are the part that actually breaks.
+  const [major] = process.versions.node.split('.').map(Number);
+  add(major >= 24, `node ${process.versions.node}`, 'need >= 24 — node:sqlite is stable there; the SQLite-backed adapters need it');
   add(fs.existsSync(ENV_FILE), `config ${ENV_FILE}`, 'run: memhouse install');
   // doctor is exempt from requireConfig — diagnosing an unconfigured machine is its job —
   // but "exempt from refusing" is not "licensed to log in somewhere". With no config it
@@ -1320,7 +1281,7 @@ async function cmdDoctor() {
       add(t === objects.length, t === objects.length
         ? `schema: 3/3 rooms in '${cfg.db}' (${objects.join(', ')})`
         : `schema: ${t}/${objects.length} rooms in '${cfg.db}' — missing ${absent.join(', ')}`,
-        `run: memhouse install, or as the owner: node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member ${rooms.member}`);
+        `run: memhouse install — with ALL on the house, ship --ensure-schema builds them`);
     } catch (e) { add(false, 'schema check', `${e.message} — run: memhouse install`); }
     // Columns, not just rooms. A room with a column missing accepts every insert and
     // discards that field — measured, 85 rows shipped with the value thrown away while
@@ -1328,7 +1289,7 @@ async function cmdDoctor() {
     // counted rooms.
     try {
       const { templateColumns } = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js'));
-      const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl'), 'utf-8');
+      const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl'), 'utf-8');
       const want = templateColumns(tpl);
       // Names AND types AND the MATERIALIZED kind. Comparing names alone left every other
       // kind of drift invisible, with measured consequences: a `UInt64` column narrowed to
@@ -1393,7 +1354,7 @@ async function cmdDoctor() {
         add(false, `sorting keys: only ${checked}/${ROOM_TYPES.length} rooms are MergeTree — the rest have no sorting key at all`,
           'a room was replaced by a Merge/View/Log engine; rebuild it from the schema template as the house owner');
       } else add(wrongKeys.length === 0, `sorting keys${wrongKeys.length ? `: wrong on ${wrongKeys.join(', ')}` : ` carry origin correctly (${checked}/${ROOM_TYPES.length} rooms)`}`,
-        `rebuild those rooms from the schema template, then: memhouse ship --full\n     template: ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}`);
+        `rebuild those rooms from the schema template, then: memhouse ship --full\n     template: ${path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl')}`);
     } catch (e) { add(false, 'sorting keys', e.message); }
     try {
       // countIf, not any(). `any()` returns an arbitrary row's value, so on a house with
@@ -1484,11 +1445,11 @@ async function cmdDoctor() {
     }
     adapterErrors = getAdapterErrors();
     for (const t of thrown) {
-      if (!adapterErrors.some((e) => e.source === t.source)) adapterErrors.push({ ...t, missingBinding: false });
+      if (!adapterErrors.some((e) => e.source === t.source)) adapterErrors.push(t);
     }
-    // Any adapter that could not be read is a failure, whatever the cause — a
-    // locked or corrupt store loses just as many sessions as a missing binding.
-    const blocked = adapterErrors.filter((e) => e.missingBinding).map((e) => e.source);
+    // Any adapter that could not be read is a failure, whatever the cause — a locked or
+    // corrupt store loses sessions just as surely as the missing native binding this
+    // used to have a separate remedy for.
     const failed = adapterErrors.map((e) => e.source);
     add(adapterErrors.length === 0,
       // "visible locally" is what the ADAPTERS see; `stats` reports what the house HOLDS,
@@ -1497,9 +1458,7 @@ async function cmdDoctor() {
       // find the other number elsewhere (161 here, 156 there, on a real machine) gives
       // them no way to tell "correctly skipped" from "silently dropped".
       `adapters: ${seen} sessions visible locally${failed.length ? ` (${failed.length} skipped: ${failed.join(', ')})` : ''} — compare with what the house holds: memhouse stats`,
-      blocked.length ? installCommand()
-        : adapterErrors.length ? adapterErrors.map((e) => `${e.source}: ${e.message}`).join('; ')
-          : undefined);
+      adapterErrors.length ? adapterErrors.map((e) => `${e.source}: ${e.message}`).join('; ') : undefined);
   } catch (e) { add(false, 'adapters', e.message); }
   // Which models in this house have no price. An unpriced model is not an error — a new
   // release always lands before pricing.json catches up — but it IS silent: calculateCost
@@ -1696,12 +1655,12 @@ async function cmdUpdate() {
 
   if (kind === 'npx') {
     console.log(warn('nothing to update — npx resolves the registry on every run'));
-    console.log('  to keep a version around: npm install -g memhouse --allow-scripts=better-sqlite3');
+    console.log('  to keep a version around: npm install -g memhouse');
     return 1;
   }
   if (kind === 'local-dep') {
     console.log(warn('this is a project dependency, not a global install'));
-    console.log(`  upgrade it where it lives: npm install memhouse@latest --allow-scripts=better-sqlite3`);
+    console.log(`  upgrade it where it lives: npm install memhouse@latest`);
     return 1;
   }
 
@@ -1729,10 +1688,11 @@ async function cmdUpdate() {
       }
     }
   } else {
-    // --allow-scripts is not optional and not remembered: npm >= 12 blocks install scripts
-    // by default, so an upgrade without it leaves better-sqlite3 with no binding and the
-    // five SQLite-backed adapters read zero sessions on every pass afterwards.
-    const r = spawnSync('npm', ['install', '-g', 'memhouse@latest', '--allow-scripts=better-sqlite3'], { stdio: 'inherit' });
+    // Plain, with no flag to forget. This carried `--allow-scripts=better-sqlite3` for as
+    // long as SQLite was a native module: npm never remembered it, and an upgrade without
+    // it left the binding unbuilt and the five SQLite-backed adapters reading zero
+    // sessions on every pass afterwards. There is no binding to build now.
+    const r = spawnSync('npm', ['install', '-g', 'memhouse@latest'], { stdio: 'inherit' });
     if (r.status !== 0) {
       console.log(bad('npm install failed — nothing was restarted, the running version is unchanged'));
       console.log('  if it was EACCES: ls -ld "$(npm prefix -g)" — root-owned needs sudo, yours needs a chown');
@@ -1931,8 +1891,8 @@ async function cmdReset() {
   } catch { /* pre-origin house: nothing to protect, ensureSchema will add the column */ }
 
   if (flags.yes !== true) {
-    // Name the rooms. Under the per-member layout this only ever empties the caller's own,
-    // and "ALL rows in 'mem'" would misdescribe that in the alarming direction.
+    // Name the rooms, and the scope honestly: the tables are shared, but reset only ever
+    // deletes rows whose user_id is the CALLER's — a housemate's rows are untouched.
     const scope = allOrigins
       ? `EVERY row, including ${imported} imported one(s) that re-shipping CANNOT restore,`
       : 'the rows the shipper wrote';
@@ -2271,10 +2231,43 @@ async function cmdUninstall() {
           : process.env.MEMHOUSE_PASSWORD ? 'MEMHOUSE_PASSWORD' : null;
       if (initialised && rotateAsk) {
         console.log(bad(`${rotateAsk} cannot change the credential of an existing house — the image only applies it when it initialises the data directory.`));
-        console.log('  to rotate:   ALTER USER memhouse_root IDENTIFIED BY \'…\' inside the house, then: memhouse setup --password …');
+        console.log(`  to rotate:   ALTER USER ${priorCfg.user || 'memhouse_root'} IDENTIFIED BY '…' inside the house, then: memhouse setup --password …`);
         console.log('  to start over (DESTROYS the memory):  memhouse deploy --down');
         process.exitCode = 2; break;
       }
+      // Who owns this house. A local deploy is the pilot's own machine and their own
+      // memory, so the house user is THEM — suggested from the OS username (`polat`, not
+      // `memhouse_root`) — created by the container itself at first init with full
+      // rights. No admin/member split, no provisioning dance: a URI and a credential is
+      // the whole install. The name is fixed at volume init exactly like the password,
+      // so an existing house keeps the user it was born with.
+      const osName = (os.userInfo().username || '').replace(/[^A-Za-z0-9_]/g, '_').replace(/^[0-9_]+/, '');
+      let houseUser;
+      if (initialised) {
+        // The env FILE, not resolveConfig(): flags outrank the file there, so comparing
+        // `--user other` against priorCfg.user compares the flag against itself and the
+        // refusal below can never fire — while the volume stays initialised with the
+        // original name and every later connection fails auth.
+        const storedUser = readEnvFile().MEMHOUSE_USER;
+        // No stored user means the env file is gone or emptied — the stored PASSWORD is
+        // gone with it, so the `initialised && !reusable` refusal below already owns this
+        // case. Refusing `--user` here on a guessed 'memhouse_root' would tell the pilot
+        // their house "was initialised with memhouse_root" on no evidence at all.
+        if (storedUser && flags.user && flags.user !== true && flags.user !== storedUser) {
+          console.log(bad(`--user cannot rename the user of an existing house — the image creates it only when it initialises the data directory.`));
+          console.log(`  this house was initialised with '${storedUser}'. To start over (DESTROYS the memory):  memhouse deploy --down`);
+          process.exitCode = 2; break;
+        }
+        houseUser = storedUser || 'memhouse_root';
+      } else if (flags.user && flags.user !== true) {
+        houseUser = String(flags.user);
+      } else if (flags.yes !== true && process.stdin.isTTY) {
+        houseUser = (await ask(`House user (this becomes your member name)`, osName || 'memhouse_root')).trim() || osName || 'memhouse_root';
+      } else {
+        houseUser = osName || 'memhouse_root';
+      }
+      try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(houseUser, 'house user'); }
+      catch (e) { console.log(bad(`'${houseUser}' cannot be the house user — ${e.message}`)); process.exitCode = 2; break; }
       // An initialised volume with no credential to reuse — env file deleted, emptied, or
       // never written — is the same lockout by another route: a generated password would
       // be ignored by the server and then written over the config as if it worked.
@@ -2301,7 +2294,17 @@ async function cmdUninstall() {
       const tag = flags.tag || process.env.MEMHOUSE_CH_TAG || dep.managedTag() || dep.DEFAULT_TAG;
       // The database is part of the destination, not a detail of it — see the service
       // check below, which must compare it.
-      const targetDb = flags.db || process.env.MEMHOUSE_DB || priorCfg.db || 'mem';
+      // STATED sources only, then the house user. priorCfg.db is unusable here: resolveConfig
+      // computes a DEFAULT for it (the user's name, itself defaulted), so going through it
+      // handed a fresh deploy `memhouse_root` as the house name while the superuser was
+      // 'polat' — the memory would live in a database named after a role account nobody
+      // chose.
+      const targetDb = flags.db || process.env.MEMHOUSE_DB || readEnvFile().MEMHOUSE_DB || houseUser;
+      // Same check install runs, but EARLY — deploy initialises the container volume and
+      // writes the env file before its install step, so a refusal that waits for install
+      // arrives after the damage.
+      try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(targetDb, 'house'); }
+      catch (e) { console.log(bad(e.message)); process.exitCode = 2; break; }
       {
         // A service-managed shipper keeps the environment it was installed with, so ANY
         // switch that repoints the config leaves it shipping somewhere else — not only an
@@ -2355,7 +2358,7 @@ async function cmdUninstall() {
       }
       const pw = reusable || crypto.randomBytes(16).toString('hex');
       if (reusable) console.log(ok('reusing the existing house credential (its data volume is already initialised)'));
-      const r = dep.up({ password: pw, port, tag });
+      const r = dep.up({ password: pw, port, tag, user: houseUser });
       if (!r.ok) { console.log(bad(r.msg)); process.exitCode = 1; break; }
       console.log(ok(`ClickHouse starting via ${r.engine} on ${r.url} (loopback only)`));
 
@@ -2367,7 +2370,10 @@ async function cmdUninstall() {
       // house that eventually came up is unreachable forever. The image applies the
       // password only at first init, so there is no way back from that.
       if (!reusable) {
-        writeEnvFile({ ...priorCfg, url: r.url, user: 'memhouse_root', password: pw });
+        // db INCLUDED: this file is read back by the install below, and writing
+        // priorCfg's computed default here made that install refuse over a mismatch
+        // with a file this same command had just written.
+        writeEnvFile({ ...priorCfg, url: r.url, user: houseUser, password: pw, db: targetDb });
         console.log(ok(`credential saved to ${ENV_FILE} before waiting — the volume is initialised with it`));
       }
 
@@ -2417,10 +2423,10 @@ async function cmdUninstall() {
       // anticipates it) and it is NOT the narrow set INSTALL.md's grant-set argument
       // describes. A user who later adds a second member should know which house they
       // have.
-      console.log(warn(`this house is yours alone: '${'memhouse_root'}' is its superuser, and that is the credential being saved`));
-      console.log('  Adding a second person later? Give them their own member instead:');
-      console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member <name> --merge`);
-      flags.url = r.url; flags.user = 'memhouse_root'; flags.password = pw;
+      console.log(warn(`this house is yours alone: '${houseUser}' is its superuser, and that is the credential being saved`));
+      console.log('  Adding a housemate later is two statements:');
+      console.log(`     CREATE USER <name> IDENTIFIED BY '…';  GRANT ALL ON ${targetDb}.* TO <name>;`);
+      flags.url = r.url; flags.user = houseUser; flags.password = pw;
       flags.db = targetDb;
       flags.yes = true;
       process.exitCode = await cmdInstall({ interactive: false });

package/editors/antigravity.js

@@ -2,16 +2,7 @@ const { execSync, execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-// Required lazily. A top-level require makes this native module a load-time dependency
-// of the whole adapter set: editors/index.js imports every adapter, so one missing
-// binding threw before any adapter ran and `discover` reported ZERO editors — losing the
-// eleven that need no native code at all. The adapterErrors path exists to degrade one
-// adapter at a time, and a top-level throw walks straight past it.
-let Database = null;
-function openDb(...a) {
-  if (!Database) Database = require('better-sqlite3');
-  return new Database(...a);
-}
+const { openReadOnly, textOf } = require('./sqlite');
 const { getAppDataPath } = require('./base');
 const adapterErrors = require('./adapter-errors');
 
@@ -244,13 +235,14 @@ function readGlobalStateValue(key) {
 
   let db = null;
   try {
-    db = openDb(ANTIGRAVITY_GLOBAL_STORAGE_DB, { readonly: true, fileMustExist: true });
+    // fileMustExist is gone with better-sqlite3, not lost: node:sqlite refuses to
+    // create a database it is opening read-only, and the existsSync above still stands.
+    db = openReadOnly(ANTIGRAVITY_GLOBAL_STORAGE_DB);
     const row = db.prepare('SELECT value FROM ItemTable WHERE key = ?').get(key);
     if (!row) return null;
-    const v = row.value;
-    if (typeof v === 'string') return v;
-    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.from(v).toString('utf-8');
-    return v == null ? null : String(v);
+    // ItemTable.value is declared BLOB and usually holds TEXT — textOf covers both,
+    // including the Uint8Array node:sqlite returns for the byte case.
+    return row.value == null ? null : textOf(row.value);
   } catch (e) {
     // Only the offline half of getChats() reads this store; live cascades come over
     // RPC. So a failure here costs some sessions, not all of them.