memhouse 0.7.1 → 0.9.0

package/editors/cursor.js

@@ -1,13 +1,4 @@
-// Required lazily. A top-level require makes this native module a load-time dependency
-// of the whole adapter set: editors/index.js imports every adapter, so one missing
-// binding threw before any adapter ran and `discover` reported ZERO editors — losing the
-// eleven that need no native code at all. The adapterErrors path exists to degrade one
-// adapter at a time, and a top-level throw walks straight past it.
-let Database = null;
-function openDb(...a) {
-  if (!Database) Database = require('better-sqlite3');
-  return new Database(...a);
-}
+const { openReadOnly, textOf, bytesOf } = require('./sqlite');
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
@@ -52,16 +43,16 @@ function hexToString(hex) {
 function readStoreMeta(db) {
   const row = db.prepare('SELECT value FROM meta WHERE key = ?').get('0');
   if (!row) return null;
-  const hex = typeof row.value === 'string' ? row.value : Buffer.from(row.value).toString('hex');
+  const hex = typeof row.value === 'string' ? row.value : bytesOf(row.value).toString('hex');
   try {
     return JSON.parse(hexToString(hex));
   } catch {
-    try { return JSON.parse(row.value); } catch { return null; }
+    try { return JSON.parse(textOf(row.value)); } catch { return null; }
   }
 }
 
 function parseTreeBlob(data) {
-  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const buf = bytesOf(data);
   const messageRefs = [];
   const childRefs = [];
   let offset = 0;
@@ -114,7 +105,10 @@ function collectStoreMessages(db, rootBlobId) {
     if (!row) return;
     const data = row.data;
     try {
-      const json = typeof data === 'string' ? JSON.parse(data) : JSON.parse(data.toString('utf-8'));
+      // textOf, not data.toString(): a message blob arrives as a Uint8Array, whose own
+      // toString() renders the bytes as "123,45,…" and would send every message in the
+      // tree down the tree-blob path below.
+      const json = JSON.parse(textOf(data));
       if (json && json.role) { allMessages.push(normalizeStoreMessage(json)); return; }
     } catch { /* tree blob */ }
     const { messageRefs, childRefs } = parseTreeBlob(data);
@@ -156,11 +150,11 @@ function getWorkspaceMap() {
 
 function getComposerHeaders(stateDbPath) {
   try {
-    const db = openDb(stateDbPath, { readonly: true });
+    const db = openReadOnly(stateDbPath);
     const row = db.prepare("SELECT value FROM ItemTable WHERE key = 'composer.composerData'").get();
     db.close();
     if (!row) return [];
-    const data = JSON.parse(row.value);
+    const data = JSON.parse(textOf(row.value));
     return (data.allComposers || []).map((c) => ({
       composerId: c.composerId,
       name: c.name || null,
@@ -183,7 +177,7 @@ function getModelPreference(globalDb) {
   try {
     const row = globalDb.prepare("SELECT value FROM ItemTable WHERE key = 'cursor/lastSingleModelPreference'").get();
     if (!row) return null;
-    const pref = JSON.parse(row.value);
+    const pref = JSON.parse(textOf(row.value));
     return pref.composer || pref.agent || null;
   } catch { return null; }
 }
@@ -197,7 +191,7 @@ function getComposerBubbles(globalDb, composerId) {
   const bubbles = [];
   for (const row of rows) {
     try {
-      const obj = JSON.parse(row.value);
+      const obj = JSON.parse(textOf(row.value));
       bubbles.push(obj);
     } catch (e) {
       // Historically treated as "binary blob, skip", but a row that will not decode
@@ -286,7 +280,7 @@ function getChats() {
   // Source 1: ~/.cursor/chats store.db
   for (const { workspace, chatId, dbPath } of getAgentStoreChats()) {
     try {
-      const db = openDb(dbPath, { readonly: true });
+      const db = openReadOnly(dbPath);
       const meta = readStoreMeta(db);
       db.close();
       if (meta) {
@@ -325,7 +319,7 @@ function getChats() {
 
   // Source 2: workspaceStorage composers
   let globalDb = null;
-  try { globalDb = openDb(GLOBAL_STORAGE_DB, { readonly: true }); }
+  try { globalDb = openReadOnly(GLOBAL_STORAGE_DB); }
   catch (e) {
     // Absent is normal — Cursor may simply not be installed. Unreadable is not.
     if (fs.existsSync(GLOBAL_STORAGE_DB)) adapterErrors.record('cursor', e, GLOBAL_STORAGE_DB);
@@ -378,7 +372,7 @@ function getChats() {
 
 function getMessages(chat) {
   if (chat._type === 'agent-store') {
-    const db = openDb(chat._dbPath, { readonly: true });
+    const db = openReadOnly(chat._dbPath);
     const msgs = collectStoreMessages(db, chat._rootBlobId);
     db.close();
     // Use lastUsedModel as fallback for assistant messages without model info
@@ -391,7 +385,7 @@ function getMessages(chat) {
   }
 
   let globalDb;
-  try { globalDb = openDb(GLOBAL_STORAGE_DB, { readonly: true }); }
+  try { globalDb = openReadOnly(GLOBAL_STORAGE_DB); }
   catch (e) {
     // Returning [] unreported would let a re-ship overwrite this session's stored
     // transcript with nothing.
@@ -416,10 +410,10 @@ function getMessages(chat) {
 
 function getCursorAccessToken() {
   try {
-    const db = openDb(GLOBAL_STORAGE_DB, { readonly: true });
+    const db = openReadOnly(GLOBAL_STORAGE_DB);
     const row = db.prepare("SELECT value FROM ItemTable WHERE key = 'cursorAuth/accessToken'").get();
     db.close();
-    return row ? row.value : null;
+    return row ? textOf(row.value) : null;
   } catch { return null; }
 }
 

package/editors/goose.js

@@ -2,6 +2,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 
+const { openReadOnly, textOf } = require('./sqlite');
 const adapterErrors = require('./adapter-errors');
 
 const GOOSE_DIR = path.join(os.homedir(), '.local', 'share', 'goose', 'sessions');
@@ -9,30 +10,17 @@ const DB_PATH = path.join(GOOSE_DIR, 'sessions.db');
 const CONFIG_PATH = path.join(os.homedir(), '.config', 'goose', 'config.yaml');
 
 // ============================================================
-// Query SQLite via better-sqlite3 (cross-platform)
+// Query SQLite via node:sqlite (cross-platform, part of Node itself)
 // ============================================================
 
-let Database;
-function getDatabase() {
-  if (!Database) {
-    try {
-      Database = require('better-sqlite3');
-    } catch {
-      // better-sqlite3 not available
-    }
-  }
-  return Database;
-}
-
+// This used to swallow "SQLite is unavailable" as a case of its own, because
+// better-sqlite3's binding could genuinely be absent. It cannot be now — so an open
+// that fails is an open that failed, and the one catch below reports it like any other
+// unreadable store.
 function queryDb(sql) {
   if (!fs.existsSync(DB_PATH)) return [];
-  const Db = getDatabase();
-  if (!Db) {
-    adapterErrors.record('goose', new Error('better-sqlite3 unavailable'), DB_PATH);
-    return [];
-  }
   try {
-    const db = new Db(DB_PATH, { readonly: true });
+    const db = openReadOnly(DB_PATH);
     const rows = db.prepare(sql).all();
     db.close();
     return rows;
@@ -201,7 +189,7 @@ function getMessagesFromDb(chat) {
     // A row we cannot decode drops a message from the transcript. Silently, that is
     // a truncation that looks complete, and a re-ship would replace the stored
     // transcript with it. Report so the shipper withholds and retries instead.
-    try { parts = JSON.parse(row.content_json); }
+    try { parts = JSON.parse(textOf(row.content_json)); }
     catch (e) { adapterErrors.record('goose', e, `session ${chat.composerId}`); continue; }
     if (!Array.isArray(parts)) {
       adapterErrors.record('goose', new Error('message content_json is not an array'), `session ${chat.composerId}`);
@@ -314,7 +302,7 @@ function getMessagesFromJsonl(chat) {
 function extractSessionModel(row) {
   if (row.model_config_json) {
     try {
-      const cfg = JSON.parse(row.model_config_json);
+      const cfg = JSON.parse(textOf(row.model_config_json));
       if (cfg.model) return cfg.model;
       if (cfg.model_id) return cfg.model_id;
     } catch {}

package/editors/index.js

@@ -26,58 +26,19 @@ for (const editor of editors) {
 
 // Per-adapter failures from the last getAllChats() pass. An adapter that throws is
 // skipped so one broken editor cannot take down a scan, but the failure is recorded
-// here rather than discarded: a missing better-sqlite3 native binding and an editor
-// the user simply does not have both produce zero sessions, and only this tells them
-// apart. See getAdapterErrors().
-let adapterErrors = [];
-
-// better-sqlite3 ships a prebuilt binary via an install script. npm >= 12 blocks
-// install scripts by default, so a plain `npm i -g memhouse` leaves no binding and
-// every SQLite-backed adapter reads zero sessions.
-const MISSING_BINDING = /Could not locate the bindings file|Cannot find module 'better-sqlite3'/;
-
-// Adapters that read sessions out of a SQLite store, so a dead binding costs
-// sessions. Membership is narrower than `grep -l better-sqlite3 editors/*.js`:
-// windsurf/devin also requires better-sqlite3, but only in getDevinApiKey() for
-// usage — its getChats() is pure language-server RPC, so its sessions survive a
-// broken binding and listing it here would raise a false alarm. antigravity is
-// listed because its *offline* chats come from SQLite, though its live cascades,
-// like devin's, come over RPC — a failure there is partial.
-// Held as module references, not strings, so the reported name always matches the
-// adapter's own `name`.
-const SQLITE_BACKED = [antigravity, cursor, goose, opencode, zed].map((m) => m.name);
-
-// Construct an in-memory database. Loading the module is not enough — better-sqlite3
-// resolves the native binding lazily, on first open.
+// here rather than discarded: an unreadable store and an editor the user simply does
+// not have both produce zero sessions, and only this tells them apart. See
+// getAdapterErrors().
 //
-// This only answers "can SQLite work at all". It deliberately cannot tell whether a
-// given editor's real store is readable: permissions, locking, corruption, and
-// SQLCipher all pass this probe and fail later. Those are reported by the adapters
-// themselves through adapter-errors.
-function probeSqlite() {
-  try {
-    const Database = require('better-sqlite3');
-    const db = new Database(':memory:');
-    db.close();
-    return { available: true };
-  } catch (e) {
-    const message = ((e && e.message) || String(e)).split('\n')[0];
-    return { available: false, message, missingBinding: MISSING_BINDING.test(message) };
-  }
-}
-
-// Cache only success. A failed probe must be retried: a long-running shipper daemon
-// that warned about a missing binding should notice once the user installs it,
-// rather than repeating the warning for the life of the process.
-let sqliteProbe = null;
-function sqliteStatus() {
-  if (sqliteProbe === null) {
-    const result = probeSqlite();
-    if (result.available) sqliteProbe = result;
-    return result;
-  }
-  return sqliteProbe;
-}
+// There used to be a second, coarser class beside those: better-sqlite3's native
+// binding could be missing outright, taking all five SQLite-backed adapters down at
+// once for a reason none of them could see, so a separate probe ran an in-memory open
+// and reported the verdict against every one of them. SQLite is `node:sqlite` now — it
+// arrives with Node and cannot go missing — so that probe, its MISSING_BINDING regex,
+// and the `missingBinding` flag they put on every error are gone. What remains is the
+// per-store reporting the adapters do themselves: permissions, locking, corruption and
+// schema drift are all still real and all still land here, one line per adapter.
+let adapterErrors = [];
 
 /**
  * Get all chats from all editor adapters, sorted by most recent first.
@@ -92,11 +53,7 @@ function getAllChats() {
       chats.push(...editorChats);
     } catch (e) {
       const message = (e && e.message) || String(e);
-      adapterErrors.push({
-        source: editor.name,
-        message: message.split('\n')[0],
-        missingBinding: MISSING_BINDING.test(message),
-      });
+      adapterErrors.push({ source: editor.name, message: message.split('\n')[0] });
     }
   }
 
@@ -110,27 +67,19 @@ function getAllChats() {
 }
 
 /**
- * Adapters that could not report their sessions: [{ source, message, missingBinding }].
+ * Adapters that could not report their sessions: [{ source, message, detail? }].
  * Empty when every adapter ran clean.
  *
  * Two sources, because there are two ways an adapter goes quiet. One throws out of
- * getChats() and is recorded during the pass. The other is a dead SQLite binding,
- * which throws nowhere at all — the adapters catch it internally — so it is probed
- * for directly and reported against every SQLite-backed adapter at once.
+ * getChats() and is recorded during the pass. The other catches its own failure — a
+ * locked state.vscdb, a thread blob that will not decompress, a schema the parser does
+ * not know — and reports it through the adapter-errors sink so the shipper knows not to
+ * overwrite a good stored transcript with a partial read.
  */
 function getAdapterErrors() {
   const errors = adapterErrors.slice();
   for (const e of adapterErrorSink.recorded()) {
-    errors.push({ source: e.source, message: e.message, detail: e.detail, missingBinding: MISSING_BINDING.test(e.message) });
-  }
-  const sqlite = sqliteStatus();
-  if (!sqlite.available) {
-    const already = new Set(errors.map((e) => e.source));
-    for (const source of SQLITE_BACKED) {
-      if (!already.has(source)) {
-        errors.push({ source, message: sqlite.message, missingBinding: sqlite.missingBinding });
-      }
-    }
+    errors.push({ source: e.source, message: e.message, detail: e.detail });
   }
   // One line per adapter, not one per failed query — a broken store is usually hit
   // many times in a single scan.

package/editors/opencode.js

@@ -1,16 +1,7 @@
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
-// Required lazily. A top-level require makes this native module a load-time dependency
-// of the whole adapter set: editors/index.js imports every adapter, so one missing
-// binding threw before any adapter ran and `discover` reported ZERO editors — losing the
-// eleven that need no native code at all. The adapterErrors path exists to degrade one
-// adapter at a time, and a top-level throw walks straight past it.
-let Database = null;
-function openDb(...a) {
-  if (!Database) Database = require('better-sqlite3');
-  return new Database(...a);
-}
+const { openReadOnly, textOf } = require('./sqlite');
 const adapterErrors = require('./adapter-errors');
 
 // OpenCode stores data in XDG-style paths across all platforms
@@ -31,13 +22,13 @@ function getOpenCodeDbPath() {
 const DB_PATH = getOpenCodeDbPath();
 
 // ============================================================
-// Query SQLite using better-sqlite3
+// Query SQLite using node:sqlite (built into Node — nothing to install)
 // ============================================================
 
 function queryDb(sql) {
   if (!fs.existsSync(DB_PATH)) return [];
   try {
-    const db = openDb(DB_PATH, { readonly: true });
+    const db = openReadOnly(DB_PATH);
     const rows = db.prepare(sql).all();
     db.close();
     return rows;
@@ -94,7 +85,7 @@ function getSqliteSessions() {
 function getSqliteMessages(sessionId) {
   if (!fs.existsSync(DB_PATH)) return [];
   try {
-    const db = openDb(DB_PATH, { readonly: true });
+    const db = openReadOnly(DB_PATH);
     const messages = db.prepare(
       `SELECT m.id as msg_id, m.data as msg_data, m.time_created
        FROM message m WHERE m.session_id = ? ORDER BY m.time_created ASC`
@@ -107,7 +98,7 @@ function getSqliteMessages(sessionId) {
       // yields a TRUNCATED history that looks complete — and a re-ship would replace
       // the full stored transcript with the shortened one. Report it so the shipper
       // refuses to overwrite good data with a partial read.
-      try { msgData = JSON.parse(msg.msg_data); }
+      try { msgData = JSON.parse(textOf(msg.msg_data)); }
       catch (e) { adapterErrors.record('opencode', e, `message ${msg.msg_id}`); continue; }
 
       const role = msgData.role;
@@ -120,7 +111,7 @@ function getSqliteMessages(sessionId) {
       const contentParts = [];
       for (const part of parts) {
         let partData;
-        try { partData = JSON.parse(part.data); }
+        try { partData = JSON.parse(textOf(part.data)); }
         catch (e) { adapterErrors.record('opencode', e, `part of message ${msg.msg_id}`); continue; }
         const type = partData.type;
 

package/editors/sqlite.js

@@ -0,0 +1,74 @@
+// SQLite for the five adapters that read an editor's store directly — cursor, zed,
+// opencode, goose, antigravity — plus windsurf's Devin API-key lookup.
+//
+// This was `better-sqlite3`, a native module whose prebuilt binary arrives through an
+// npm install script — and npm >= 12 blocks install scripts by default, so a plain
+// `npm i -g memhouse` left no binding at all. Those five adapters then read ZERO
+// sessions and looked exactly like editors the pilot does not have. The fix was a flag
+// (`--allow-scripts=better-sqlite3`) that had to be typed on every install and every
+// upgrade, was never remembered by npm, and produced no error when omitted.
+//
+// `node:sqlite` is part of Node itself — stable in 24, no build step, no binary to
+// misplace, nothing to allow. The whole "adapter silently skipped for a missing native
+// binding" failure class is gone, and install is one command with no flags.
+//
+// Still required lazily, but for a different reason than before. On a Node older than
+// the engines floor `require('node:sqlite')` throws, and editors/index.js imports every
+// adapter at load time — a top-level require here would take the eleven adapters that
+// need no SQLite at all down with the five that do, and `discover` would report zero
+// editors. Lazy, that throw lands inside each adapter's own try/catch and is reported
+// through adapter-errors like any other unreadable store.
+let DatabaseSync = null;
+
+/**
+ * Open an editor's store read-only.
+ *
+ * Every call site in this repo is a read, so there is no write mode to get wrong.
+ * better-sqlite3 spelled the option `readonly` and needed `fileMustExist` beside it to
+ * stop a typo'd path from quietly creating an empty database; node:sqlite spells it
+ * `readOnly` and refuses on its own — measured, a missing file throws ERR_SQLITE_ERROR
+ * "unable to open database file" rather than creating one. Callers that check
+ * fs.existsSync() first keep working unchanged; callers that do not still cannot
+ * conjure a store that is not there.
+ */
+function openReadOnly(file) {
+  if (!DatabaseSync) ({ DatabaseSync } = require('node:sqlite'));
+  return new DatabaseSync(file, { readOnly: true });
+}
+
+/**
+ * A column's value as text, whether SQLite handed back TEXT or BLOB.
+ *
+ * SQLite types values, not columns, and these stores are not consistent about it: the
+ * VS Code family declares `ItemTable.value` as BLOB but stores strings in it, while
+ * Cursor's agent store keeps real bytes in the same shape of table. better-sqlite3
+ * returned a Buffer for the byte case and every `JSON.parse(row.value)` in these
+ * adapters worked by accident, because Buffer.toString() decodes utf-8.
+ *
+ * node:sqlite returns a plain Uint8Array, whose toString() renders "40,181,47,253,…" —
+ * a comma-joined list of byte values. That is not utf-8, not JSON, and not empty, so it
+ * does not fail loudly; it fails four frames deeper as a parse error against a store
+ * that is perfectly healthy. Every read that may be either type goes through here.
+ */
+function textOf(v) {
+  if (v == null) return v;
+  if (typeof v === 'string') return v;
+  if (v instanceof Uint8Array) return Buffer.from(v.buffer, v.byteOffset, v.byteLength).toString('utf-8');
+  return String(v);
+}
+
+/**
+ * A column's value as a Buffer, for readers that slice it, hex-encode it, or hand it to
+ * zlib. Buffer IS a Uint8Array, so this is a no-op on anything better-sqlite3 would have
+ * returned — it exists so the byte-walking code below never has to ask which it got.
+ */
+function bytesOf(v) {
+  if (v == null) return v;
+  if (Buffer.isBuffer(v)) return v;
+  if (typeof v === 'string') return Buffer.from(v, 'utf-8');
+  // A view over the same memory, not a copy — these blobs run to megabytes and every
+  // consumer here only reads.
+  return Buffer.from(v.buffer, v.byteOffset, v.byteLength);
+}
+
+module.exports = { openReadOnly, textOf, bytesOf };

package/editors/windsurf.js

@@ -484,13 +484,13 @@ function getDevinApiKey(appNames) {
           dbPath = path.join(HOME, '.config', appName, 'User', 'globalStorage', 'state.vscdb');
       }
       if (!fs.existsSync(dbPath)) continue;
-      const Database = require('better-sqlite3');
-      const db = new Database(dbPath, { readonly: true });
+      const { openReadOnly, textOf } = require('./sqlite');
+      const db = openReadOnly(dbPath);
       try {
         for (const key of keys) {
           const row = db.prepare('SELECT value FROM ItemTable WHERE key = ?').get(key);
           if (!row) continue;
-          const parsed = JSON.parse(row.value);
+          const parsed = JSON.parse(textOf(row.value));
           if (parsed.apiKey) return parsed.apiKey;
         }
       } finally {

package/editors/zed.js

@@ -2,16 +2,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 
-// Required lazily. A top-level require makes this native module a load-time dependency
-// of the whole adapter set: editors/index.js imports every adapter, so one missing
-// binding threw before any adapter ran and `discover` reported ZERO editors — losing the
-// eleven that need no native code at all. The adapterErrors path exists to degrade one
-// adapter at a time, and a top-level throw walks straight past it.
-let Database = null;
-function openDb(...a) {
-  if (!Database) Database = require('better-sqlite3');
-  return new Database(...a);
-}
+const { openReadOnly, bytesOf } = require('./sqlite');
 const adapterErrors = require('./adapter-errors');
 
 // Zed stores data in different locations depending on the platform
@@ -72,13 +63,13 @@ function decompressZstd(buf) {
 }
 
 // ============================================================
-// Query SQLite using better-sqlite3 (cross-platform)
+// Query SQLite using node:sqlite (cross-platform, no native dependency)
 // ============================================================
 
 function queryDb(sql) {
   if (!fs.existsSync(THREADS_DB)) return [];
   try {
-    const db = openDb(THREADS_DB, { readonly: true });
+    const db = openReadOnly(THREADS_DB);
     const rows = db.prepare(sql).all();
     db.close();
     return rows;
@@ -100,7 +91,7 @@ function getThreadColumns() {
   if (threadColumns) return threadColumns;
   if (!fs.existsSync(THREADS_DB)) return new Set();
   try {
-    const db = openDb(THREADS_DB, { readonly: true });
+    const db = openReadOnly(THREADS_DB);
     const cols = db.prepare('PRAGMA table_info(threads)').all().map((r) => r.name);
     db.close();
     // PRAGMA on a missing or renamed table SUCCEEDS with zero rows rather than
@@ -131,10 +122,14 @@ function resetCache() {
 function queryBlob(id) {
   if (!fs.existsSync(THREADS_DB)) return null;
   try {
-    const db = openDb(THREADS_DB, { readonly: true });
+    const db = openReadOnly(THREADS_DB);
     const row = db.prepare('SELECT data FROM threads WHERE id = ?').get(id);
     db.close();
-    return row ? row.data : null;
+    // As a Buffer, not the raw Uint8Array node:sqlite hands back. Both callers below
+    // treat it as one: the uncompressed path calls .toString('utf-8') on it, which on a
+    // bare Uint8Array yields "40,181,47,…" — the byte VALUES, comma-joined — and the
+    // thread would then fail JSON.parse as if it were corrupt.
+    return row ? bytesOf(row.data) : null;
   } catch (e) {
     // This is the message-blob read. A silent null here becomes a zero-message
     // session, which overwrites the stored transcript on re-ship.

package/memhouse/COMPETITION.md

@@ -141,11 +141,15 @@ memory. None ingest agent sessions.
   into *installed skills*. Our skills must be chosen. One independent analysis of 270
   real sessions found **only 4.8% involved an explicit history query** — a pull-only
   model gets invoked rarely.
-- **Install weight — we are the heaviest in the category.** AgentsView, deja-vu and
-  ctx are single dependency-free binaries via Homebrew, Docker, `go install` or curl.
-  We are Node, need `--allow-scripts=better-sqlite3` (five adapters silently read
-  nothing without it), and additionally need a ClickHouse to point at. Our README
-  spends paragraphs on `EACCES`/`sudo` triage. That is a real adoption tax.
+- **Install weight — still the heaviest in the category, but half the tax is paid.**
+  AgentsView, deja-vu and ctx are single dependency-free binaries via Homebrew, Docker,
+  `go install` or curl. We are Node and need a ClickHouse to point at.
+  **Resolved 2026-08-16:** the native-dependency half is gone. `better-sqlite3` was
+  replaced by `node:sqlite`, so `npm i -g memhouse` with no flags is now a complete,
+  fully working install — no `--allow-scripts`, no build step, and no five-adapters-
+  silently-read-nothing failure mode. What remains of the tax is the runtime (Node,
+  not a static binary), the ClickHouse dependency, and the `EACCES`/`sudo` prefix
+  triage, which was never about the flag and is not fixable from our side.
 - **Semantic search.** AgentsView (opt-in index), claude-mem (Chroma),
   claude-history (local embedding model). We are FTS-only. Contested rather than
   settled — deja-vu made the same choice and was criticised for it on HN.

package/memhouse/DESIGN.md

@@ -5,10 +5,12 @@ on your machines — across **all 17 editors** agentlytics supports — parsed l
 shipped to a typed ClickHouse store, shareable with a team, installable on the
 ultimagent kernel as an **agency**, and visible through the agentlytics dashboard.
 
-**One house, a set of rooms per member** — `sessions_<m>`, `messages_<m>`,
-`tool_calls_<m>`. All of one member's machines ship into that member's rooms, told
-apart by the `host` column; no member writes into another's. The shared-table layout
-this once had was removed in 0.4.0; see `per-member/`.
+**A house is a database; its rooms are three shared tables** — `sessions`, `messages`,
+`tool_calls`. Everyone in the house writes into the same tables with their own
+credential; the server-stamped `user_id` says who, the install fingerprint `host` says
+which machine. Sharing IS the house; the boundary between groups is the database. (The
+layout has moved twice: shared-tables-with-row-policies fell in 0.4.0, per-member
+suffixed rooms fell in 0.8.0 — see `house/HOUSE.md` for why.)
 
 **Agency, precisely.** In constellation terms (`../TERMINOLOGY.md`) memhouse is a
 **house** — the `mem` database — **plus a resident**: the shipper. That pairing
@@ -24,23 +26,21 @@ on   = "loop"      # a daemon — not an insert trigger, not a schedule
 ```
 
 The session rollup is a **routine** — house machinery, not a second resident. Since
-0.4.0 it is not even an object: it is SQL text (`per-member/rooms.js`), substituted with
-the caller's own room names and computed during your query, for your query, writing
-nothing. memhouse has **no materialized views at all** — in fact no stored views at all
+0.4.0 it is not even an object: it is SQL text (`house/house.js`), computed during your
+query, for your query, writing nothing. memhouse has **no materialized views at all** — in fact no stored views at all
 — so the shipper is not merely a resident, it is the only candidate in the tree. Strip
 it and every remaining moving part is a routine over rows nobody is writing any more.
 
 Note that `user_id MATERIALIZED currentUser()` is a materialized *column*: it computes
-during your own insert and is part of the table's definition. It is not what isolates
-members — the room they hold no grant on does that — but it records who wrote each row,
-which keeps provenance across a share and keeps the `Merge` rooms meaningful. An identity
-property, not what makes this an agency.
+during your own insert and is part of the table's definition. It is what tells housemates'
+rows apart in the shared tables — provenance, stamped by the server, with async_insert
+pinned so it cannot be skipped. An identity property, not what makes this an agency.
 
 **Positioning:** an alternative agency **competing with memory-house**. It borrows
 memory-house's proven ideas (server-stamped identity, idempotent shipping,
 skills/plugin delivery) and agentlytics' proven assets (adapters, UI, cost engine) —
-but **not** its shared-table-plus-row-policy layout, which 0.4.0 removed in favour of
-one set of rooms per member. If it wins, it can become memory-house v4; until then the
+but **not** its row-policy machinery: memhouse's tables are shared by people who chose
+one house, and the boundary between houses is the database itself. If it wins, it can become memory-house v4; until then the
 two run side by side as separate agencies, each in its own house. Naming: the product is
 **memhouse**; the agency is **`memhouse`** and its house is the **`mem`** database
 (identifiers can't carry a dash; the owner kept the longer name, `memhouse_root`).
@@ -60,20 +60,19 @@ them free and further along; **bet 3 is the one nobody else attempts.**
    write axis this bet is precisely *moving work from routine to resident*:
    memory-house parses when you query, memhouse parses before anyone asks and
    writes the result down.
-2. **Typed common schema** (`per-member/schema-member.sql.tpl`, applied once per
-   member; `schema-merge.sql.tpl` for the team rooms). Physical typed columns (what
-   memory-house derives in views) + `tool_calls_<m>` (memory-house has no tool table)
-   + one `extra JSON` escape hatch per room so unnormalized adapter fields are never
-   lost. `ReplacingMergeTree(ingested_at)`; `messages_<m>` keyed
-   `(session_id, user_id, seq)` so a re-ship of a grown/changed session replaces stale
-   rows (latest-wins). FTS text indexes built in (CH ≥ 26.2).
-3. **Kernel-installable agency.** Same install path proven for agentlytics-agency:
-   `install-agency{memhouse}` → house + `memhouse_root` + credential; members via
-   `register-member` + owner `GRANT` on that member's own rooms. Own-only visibility
-   needs no policy: a member is granted their rooms and nobody else's. The shipper is
-   the resident that lands with it. Identity is `user_id MATERIALIZED currentUser()`
-   (requires `async_insert=0`). Sharing is a further GRANT, issued by the member
-   themselves (grant-option) or the owner.
+2. **Typed common schema** (`house/schema.sql.tpl` — three shared tables per house).
+   Physical typed columns (what memory-house derives in views) + `tool_calls`
+   (memory-house has no tool table) + one `extra JSON` escape hatch per room so
+   unnormalized adapter fields are never lost. `ReplacingMergeTree(ingested_at)`;
+   `messages` keyed `(session_id, user_id, origin, seq)` so a re-ship of a
+   grown/changed session replaces stale rows (latest-wins) and two housemates' rows
+   never collapse into one. FTS text indexes built in (CH ≥ 26.2).
+3. **Kernel-installable agency.** Joining any ClickHouse — a kernel's included — is a
+   database plus a credential: `CREATE USER`, `GRANT ALL ON <house>.* `, done. The
+   shipper is the resident that lands with it and creates its own rooms. Identity is
+   `user_id MATERIALIZED currentUser()` with `async_insert = 0 CONST` pinned on the
+   user; machines are told apart by the `host` fingerprint. The boundary between
+   agencies on one server is the database — a house's ALL reaches nothing outside it.
 4. **Borrowed UI, zero fork.** The React SPA consumes REST JSON, not tables. The
    memhouse server implements the **same `/api/*` contract** as agentlytics'
    `server.js` (same routes, same response shapes) over the memhouse schema, and
@@ -83,9 +82,9 @@ them free and further along; **bet 3 is the one nobody else attempts.**
 
 | Path | What | Notes |
 |---|---|---|
-| `per-member/rooms.js` | room-name resolution + the session rollup | one naming rule for both transports |
-| `per-member/schema-member.sql.tpl` | one member's three rooms (typed) | the owner via `provision.js`, or the member on a house they own |
-| `per-member/schema-merge.sql.tpl` | the three team Merge rooms | owner-managed; reduce to the caller's grants |
+| `house/house.js` | room names + the session rollup + the user pin | one rule for both transports |
+| `house/schema.sql.tpl` | the house's three shared tables (typed) | applied by each member's own shipper |
+| `house/HOUSE.md` | the model, and what it replaced | |
 | `shipper/ship.js` | parse-on-client shipper CLI — the resident (`worker`) | reuses `../../editors`; incremental; idempotent |
 | `server/server.js` | REST API + dashboard | same API contract as agentlytics; serves `../../public` |
 | `delivery/` | delivery kit | installer, skills, plugin, AGENT-INSTALL.md, prompt |