memhouse 0.8.0 → 0.11.0

package/editors/antigravity.js

@@ -2,16 +2,7 @@ const { execSync, execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-// Required lazily. A top-level require makes this native module a load-time dependency
-// of the whole adapter set: editors/index.js imports every adapter, so one missing
-// binding threw before any adapter ran and `discover` reported ZERO editors — losing the
-// eleven that need no native code at all. The adapterErrors path exists to degrade one
-// adapter at a time, and a top-level throw walks straight past it.
-let Database = null;
-function openDb(...a) {
-  if (!Database) Database = require('better-sqlite3');
-  return new Database(...a);
-}
+const { openReadOnly, textOf } = require('./sqlite');
 const { getAppDataPath } = require('./base');
 const adapterErrors = require('./adapter-errors');
 
@@ -244,13 +235,14 @@ function readGlobalStateValue(key) {
 
   let db = null;
   try {
-    db = openDb(ANTIGRAVITY_GLOBAL_STORAGE_DB, { readonly: true, fileMustExist: true });
+    // fileMustExist is gone with better-sqlite3, not lost: node:sqlite refuses to
+    // create a database it is opening read-only, and the existsSync above still stands.
+    db = openReadOnly(ANTIGRAVITY_GLOBAL_STORAGE_DB);
     const row = db.prepare('SELECT value FROM ItemTable WHERE key = ?').get(key);
     if (!row) return null;
-    const v = row.value;
-    if (typeof v === 'string') return v;
-    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.from(v).toString('utf-8');
-    return v == null ? null : String(v);
+    // ItemTable.value is declared BLOB and usually holds TEXT — textOf covers both,
+    // including the Uint8Array node:sqlite returns for the byte case.
+    return row.value == null ? null : textOf(row.value);
   } catch (e) {
     // Only the offline half of getChats() reads this store; live cascades come over
     // RPC. So a failure here costs some sessions, not all of them.

package/editors/cursor.js

@@ -1,13 +1,4 @@
-// Required lazily. A top-level require makes this native module a load-time dependency
-// of the whole adapter set: editors/index.js imports every adapter, so one missing
-// binding threw before any adapter ran and `discover` reported ZERO editors — losing the
-// eleven that need no native code at all. The adapterErrors path exists to degrade one
-// adapter at a time, and a top-level throw walks straight past it.
-let Database = null;
-function openDb(...a) {
-  if (!Database) Database = require('better-sqlite3');
-  return new Database(...a);
-}
+const { openReadOnly, textOf, bytesOf } = require('./sqlite');
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
@@ -52,16 +43,16 @@ function hexToString(hex) {
 function readStoreMeta(db) {
   const row = db.prepare('SELECT value FROM meta WHERE key = ?').get('0');
   if (!row) return null;
-  const hex = typeof row.value === 'string' ? row.value : Buffer.from(row.value).toString('hex');
+  const hex = typeof row.value === 'string' ? row.value : bytesOf(row.value).toString('hex');
   try {
     return JSON.parse(hexToString(hex));
   } catch {
-    try { return JSON.parse(row.value); } catch { return null; }
+    try { return JSON.parse(textOf(row.value)); } catch { return null; }
   }
 }
 
 function parseTreeBlob(data) {
-  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const buf = bytesOf(data);
   const messageRefs = [];
   const childRefs = [];
   let offset = 0;
@@ -114,7 +105,10 @@ function collectStoreMessages(db, rootBlobId) {
     if (!row) return;
     const data = row.data;
     try {
-      const json = typeof data === 'string' ? JSON.parse(data) : JSON.parse(data.toString('utf-8'));
+      // textOf, not data.toString(): a message blob arrives as a Uint8Array, whose own
+      // toString() renders the bytes as "123,45,…" and would send every message in the
+      // tree down the tree-blob path below.
+      const json = JSON.parse(textOf(data));
       if (json && json.role) { allMessages.push(normalizeStoreMessage(json)); return; }
     } catch { /* tree blob */ }
     const { messageRefs, childRefs } = parseTreeBlob(data);
@@ -156,11 +150,11 @@ function getWorkspaceMap() {
 
 function getComposerHeaders(stateDbPath) {
   try {
-    const db = openDb(stateDbPath, { readonly: true });
+    const db = openReadOnly(stateDbPath);
     const row = db.prepare("SELECT value FROM ItemTable WHERE key = 'composer.composerData'").get();
     db.close();
     if (!row) return [];
-    const data = JSON.parse(row.value);
+    const data = JSON.parse(textOf(row.value));
     return (data.allComposers || []).map((c) => ({
       composerId: c.composerId,
       name: c.name || null,
@@ -183,7 +177,7 @@ function getModelPreference(globalDb) {
   try {
     const row = globalDb.prepare("SELECT value FROM ItemTable WHERE key = 'cursor/lastSingleModelPreference'").get();
     if (!row) return null;
-    const pref = JSON.parse(row.value);
+    const pref = JSON.parse(textOf(row.value));
     return pref.composer || pref.agent || null;
   } catch { return null; }
 }
@@ -197,7 +191,7 @@ function getComposerBubbles(globalDb, composerId) {
   const bubbles = [];
   for (const row of rows) {
     try {
-      const obj = JSON.parse(row.value);
+      const obj = JSON.parse(textOf(row.value));
       bubbles.push(obj);
     } catch (e) {
       // Historically treated as "binary blob, skip", but a row that will not decode
@@ -286,7 +280,7 @@ function getChats() {
   // Source 1: ~/.cursor/chats store.db
   for (const { workspace, chatId, dbPath } of getAgentStoreChats()) {
     try {
-      const db = openDb(dbPath, { readonly: true });
+      const db = openReadOnly(dbPath);
       const meta = readStoreMeta(db);
       db.close();
       if (meta) {
@@ -325,7 +319,7 @@ function getChats() {
 
   // Source 2: workspaceStorage composers
   let globalDb = null;
-  try { globalDb = openDb(GLOBAL_STORAGE_DB, { readonly: true }); }
+  try { globalDb = openReadOnly(GLOBAL_STORAGE_DB); }
   catch (e) {
     // Absent is normal — Cursor may simply not be installed. Unreadable is not.
     if (fs.existsSync(GLOBAL_STORAGE_DB)) adapterErrors.record('cursor', e, GLOBAL_STORAGE_DB);
@@ -378,7 +372,7 @@ function getChats() {
 
 function getMessages(chat) {
   if (chat._type === 'agent-store') {
-    const db = openDb(chat._dbPath, { readonly: true });
+    const db = openReadOnly(chat._dbPath);
     const msgs = collectStoreMessages(db, chat._rootBlobId);
     db.close();
     // Use lastUsedModel as fallback for assistant messages without model info
@@ -391,7 +385,7 @@ function getMessages(chat) {
   }
 
   let globalDb;
-  try { globalDb = openDb(GLOBAL_STORAGE_DB, { readonly: true }); }
+  try { globalDb = openReadOnly(GLOBAL_STORAGE_DB); }
   catch (e) {
     // Returning [] unreported would let a re-ship overwrite this session's stored
     // transcript with nothing.
@@ -416,10 +410,10 @@ function getMessages(chat) {
 
 function getCursorAccessToken() {
   try {
-    const db = openDb(GLOBAL_STORAGE_DB, { readonly: true });
+    const db = openReadOnly(GLOBAL_STORAGE_DB);
     const row = db.prepare("SELECT value FROM ItemTable WHERE key = 'cursorAuth/accessToken'").get();
     db.close();
-    return row ? row.value : null;
+    return row ? textOf(row.value) : null;
   } catch { return null; }
 }
 

package/editors/goose.js

@@ -2,6 +2,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 
+const { openReadOnly, textOf } = require('./sqlite');
 const adapterErrors = require('./adapter-errors');
 
 const GOOSE_DIR = path.join(os.homedir(), '.local', 'share', 'goose', 'sessions');
@@ -9,30 +10,17 @@ const DB_PATH = path.join(GOOSE_DIR, 'sessions.db');
 const CONFIG_PATH = path.join(os.homedir(), '.config', 'goose', 'config.yaml');
 
 // ============================================================
-// Query SQLite via better-sqlite3 (cross-platform)
+// Query SQLite via node:sqlite (cross-platform, part of Node itself)
 // ============================================================
 
-let Database;
-function getDatabase() {
-  if (!Database) {
-    try {
-      Database = require('better-sqlite3');
-    } catch {
-      // better-sqlite3 not available
-    }
-  }
-  return Database;
-}
-
+// This used to swallow "SQLite is unavailable" as a case of its own, because
+// better-sqlite3's binding could genuinely be absent. It cannot be now — so an open
+// that fails is an open that failed, and the one catch below reports it like any other
+// unreadable store.
 function queryDb(sql) {
   if (!fs.existsSync(DB_PATH)) return [];
-  const Db = getDatabase();
-  if (!Db) {
-    adapterErrors.record('goose', new Error('better-sqlite3 unavailable'), DB_PATH);
-    return [];
-  }
   try {
-    const db = new Db(DB_PATH, { readonly: true });
+    const db = openReadOnly(DB_PATH);
     const rows = db.prepare(sql).all();
     db.close();
     return rows;
@@ -201,7 +189,7 @@ function getMessagesFromDb(chat) {
     // A row we cannot decode drops a message from the transcript. Silently, that is
     // a truncation that looks complete, and a re-ship would replace the stored
     // transcript with it. Report so the shipper withholds and retries instead.
-    try { parts = JSON.parse(row.content_json); }
+    try { parts = JSON.parse(textOf(row.content_json)); }
     catch (e) { adapterErrors.record('goose', e, `session ${chat.composerId}`); continue; }
     if (!Array.isArray(parts)) {
       adapterErrors.record('goose', new Error('message content_json is not an array'), `session ${chat.composerId}`);
@@ -314,7 +302,7 @@ function getMessagesFromJsonl(chat) {
 function extractSessionModel(row) {
   if (row.model_config_json) {
     try {
-      const cfg = JSON.parse(row.model_config_json);
+      const cfg = JSON.parse(textOf(row.model_config_json));
       if (cfg.model) return cfg.model;
       if (cfg.model_id) return cfg.model_id;
     } catch {}

package/editors/index.js

@@ -26,58 +26,19 @@ for (const editor of editors) {
 
 // Per-adapter failures from the last getAllChats() pass. An adapter that throws is
 // skipped so one broken editor cannot take down a scan, but the failure is recorded
-// here rather than discarded: a missing better-sqlite3 native binding and an editor
-// the user simply does not have both produce zero sessions, and only this tells them
-// apart. See getAdapterErrors().
-let adapterErrors = [];
-
-// better-sqlite3 ships a prebuilt binary via an install script. npm >= 12 blocks
-// install scripts by default, so a plain `npm i -g memhouse` leaves no binding and
-// every SQLite-backed adapter reads zero sessions.
-const MISSING_BINDING = /Could not locate the bindings file|Cannot find module 'better-sqlite3'/;
-
-// Adapters that read sessions out of a SQLite store, so a dead binding costs
-// sessions. Membership is narrower than `grep -l better-sqlite3 editors/*.js`:
-// windsurf/devin also requires better-sqlite3, but only in getDevinApiKey() for
-// usage — its getChats() is pure language-server RPC, so its sessions survive a
-// broken binding and listing it here would raise a false alarm. antigravity is
-// listed because its *offline* chats come from SQLite, though its live cascades,
-// like devin's, come over RPC — a failure there is partial.
-// Held as module references, not strings, so the reported name always matches the
-// adapter's own `name`.
-const SQLITE_BACKED = [antigravity, cursor, goose, opencode, zed].map((m) => m.name);
-
-// Construct an in-memory database. Loading the module is not enough — better-sqlite3
-// resolves the native binding lazily, on first open.
+// here rather than discarded: an unreadable store and an editor the user simply does
+// not have both produce zero sessions, and only this tells them apart. See
+// getAdapterErrors().
 //
-// This only answers "can SQLite work at all". It deliberately cannot tell whether a
-// given editor's real store is readable: permissions, locking, corruption, and
-// SQLCipher all pass this probe and fail later. Those are reported by the adapters
-// themselves through adapter-errors.
-function probeSqlite() {
-  try {
-    const Database = require('better-sqlite3');
-    const db = new Database(':memory:');
-    db.close();
-    return { available: true };
-  } catch (e) {
-    const message = ((e && e.message) || String(e)).split('\n')[0];
-    return { available: false, message, missingBinding: MISSING_BINDING.test(message) };
-  }
-}
-
-// Cache only success. A failed probe must be retried: a long-running shipper daemon
-// that warned about a missing binding should notice once the user installs it,
-// rather than repeating the warning for the life of the process.
-let sqliteProbe = null;
-function sqliteStatus() {
-  if (sqliteProbe === null) {
-    const result = probeSqlite();
-    if (result.available) sqliteProbe = result;
-    return result;
-  }
-  return sqliteProbe;
-}
+// There used to be a second, coarser class beside those: better-sqlite3's native
+// binding could be missing outright, taking all five SQLite-backed adapters down at
+// once for a reason none of them could see, so a separate probe ran an in-memory open
+// and reported the verdict against every one of them. SQLite is `node:sqlite` now — it
+// arrives with Node and cannot go missing — so that probe, its MISSING_BINDING regex,
+// and the `missingBinding` flag they put on every error are gone. What remains is the
+// per-store reporting the adapters do themselves: permissions, locking, corruption and
+// schema drift are all still real and all still land here, one line per adapter.
+let adapterErrors = [];
 
 /**
  * Get all chats from all editor adapters, sorted by most recent first.
@@ -92,11 +53,7 @@ function getAllChats() {
       chats.push(...editorChats);
     } catch (e) {
       const message = (e && e.message) || String(e);
-      adapterErrors.push({
-        source: editor.name,
-        message: message.split('\n')[0],
-        missingBinding: MISSING_BINDING.test(message),
-      });
+      adapterErrors.push({ source: editor.name, message: message.split('\n')[0] });
     }
   }
 
@@ -110,27 +67,19 @@ function getAllChats() {
 }
 
 /**
- * Adapters that could not report their sessions: [{ source, message, missingBinding }].
+ * Adapters that could not report their sessions: [{ source, message, detail? }].
  * Empty when every adapter ran clean.
  *
  * Two sources, because there are two ways an adapter goes quiet. One throws out of
- * getChats() and is recorded during the pass. The other is a dead SQLite binding,
- * which throws nowhere at all — the adapters catch it internally — so it is probed
- * for directly and reported against every SQLite-backed adapter at once.
+ * getChats() and is recorded during the pass. The other catches its own failure — a
+ * locked state.vscdb, a thread blob that will not decompress, a schema the parser does
+ * not know — and reports it through the adapter-errors sink so the shipper knows not to
+ * overwrite a good stored transcript with a partial read.
  */
 function getAdapterErrors() {
   const errors = adapterErrors.slice();
   for (const e of adapterErrorSink.recorded()) {
-    errors.push({ source: e.source, message: e.message, detail: e.detail, missingBinding: MISSING_BINDING.test(e.message) });
-  }
-  const sqlite = sqliteStatus();
-  if (!sqlite.available) {
-    const already = new Set(errors.map((e) => e.source));
-    for (const source of SQLITE_BACKED) {
-      if (!already.has(source)) {
-        errors.push({ source, message: sqlite.message, missingBinding: sqlite.missingBinding });
-      }
-    }
+    errors.push({ source: e.source, message: e.message, detail: e.detail });
   }
   // One line per adapter, not one per failed query — a broken store is usually hit
   // many times in a single scan.

package/editors/opencode.js

@@ -1,16 +1,7 @@
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
-// Required lazily. A top-level require makes this native module a load-time dependency
-// of the whole adapter set: editors/index.js imports every adapter, so one missing
-// binding threw before any adapter ran and `discover` reported ZERO editors — losing the
-// eleven that need no native code at all. The adapterErrors path exists to degrade one
-// adapter at a time, and a top-level throw walks straight past it.
-let Database = null;
-function openDb(...a) {
-  if (!Database) Database = require('better-sqlite3');
-  return new Database(...a);
-}
+const { openReadOnly, textOf } = require('./sqlite');
 const adapterErrors = require('./adapter-errors');
 
 // OpenCode stores data in XDG-style paths across all platforms
@@ -31,13 +22,13 @@ function getOpenCodeDbPath() {
 const DB_PATH = getOpenCodeDbPath();
 
 // ============================================================
-// Query SQLite using better-sqlite3
+// Query SQLite using node:sqlite (built into Node — nothing to install)
 // ============================================================
 
 function queryDb(sql) {
   if (!fs.existsSync(DB_PATH)) return [];
   try {
-    const db = openDb(DB_PATH, { readonly: true });
+    const db = openReadOnly(DB_PATH);
     const rows = db.prepare(sql).all();
     db.close();
     return rows;
@@ -94,7 +85,7 @@ function getSqliteSessions() {
 function getSqliteMessages(sessionId) {
   if (!fs.existsSync(DB_PATH)) return [];
   try {
-    const db = openDb(DB_PATH, { readonly: true });
+    const db = openReadOnly(DB_PATH);
     const messages = db.prepare(
       `SELECT m.id as msg_id, m.data as msg_data, m.time_created
        FROM message m WHERE m.session_id = ? ORDER BY m.time_created ASC`
@@ -107,7 +98,7 @@ function getSqliteMessages(sessionId) {
       // yields a TRUNCATED history that looks complete — and a re-ship would replace
       // the full stored transcript with the shortened one. Report it so the shipper
       // refuses to overwrite good data with a partial read.
-      try { msgData = JSON.parse(msg.msg_data); }
+      try { msgData = JSON.parse(textOf(msg.msg_data)); }
       catch (e) { adapterErrors.record('opencode', e, `message ${msg.msg_id}`); continue; }
 
       const role = msgData.role;
@@ -120,7 +111,7 @@ function getSqliteMessages(sessionId) {
       const contentParts = [];
       for (const part of parts) {
         let partData;
-        try { partData = JSON.parse(part.data); }
+        try { partData = JSON.parse(textOf(part.data)); }
         catch (e) { adapterErrors.record('opencode', e, `part of message ${msg.msg_id}`); continue; }
         const type = partData.type;
 

package/editors/sqlite.js

@@ -0,0 +1,74 @@
+// SQLite for the five adapters that read an editor's store directly — cursor, zed,
+// opencode, goose, antigravity — plus windsurf's Devin API-key lookup.
+//
+// This was `better-sqlite3`, a native module whose prebuilt binary arrives through an
+// npm install script — and npm >= 12 blocks install scripts by default, so a plain
+// `npm i -g memhouse` left no binding at all. Those five adapters then read ZERO
+// sessions and looked exactly like editors the pilot does not have. The fix was a flag
+// (`--allow-scripts=better-sqlite3`) that had to be typed on every install and every
+// upgrade, was never remembered by npm, and produced no error when omitted.
+//
+// `node:sqlite` is part of Node itself — stable in 24, no build step, no binary to
+// misplace, nothing to allow. The whole "adapter silently skipped for a missing native
+// binding" failure class is gone, and install is one command with no flags.
+//
+// Still required lazily, but for a different reason than before. On a Node older than
+// the engines floor `require('node:sqlite')` throws, and editors/index.js imports every
+// adapter at load time — a top-level require here would take the eleven adapters that
+// need no SQLite at all down with the five that do, and `discover` would report zero
+// editors. Lazy, that throw lands inside each adapter's own try/catch and is reported
+// through adapter-errors like any other unreadable store.
+let DatabaseSync = null;
+
+/**
+ * Open an editor's store read-only.
+ *
+ * Every call site in this repo is a read, so there is no write mode to get wrong.
+ * better-sqlite3 spelled the option `readonly` and needed `fileMustExist` beside it to
+ * stop a typo'd path from quietly creating an empty database; node:sqlite spells it
+ * `readOnly` and refuses on its own — measured, a missing file throws ERR_SQLITE_ERROR
+ * "unable to open database file" rather than creating one. Callers that check
+ * fs.existsSync() first keep working unchanged; callers that do not still cannot
+ * conjure a store that is not there.
+ */
+function openReadOnly(file) {
+  if (!DatabaseSync) ({ DatabaseSync } = require('node:sqlite'));
+  return new DatabaseSync(file, { readOnly: true });
+}
+
+/**
+ * A column's value as text, whether SQLite handed back TEXT or BLOB.
+ *
+ * SQLite types values, not columns, and these stores are not consistent about it: the
+ * VS Code family declares `ItemTable.value` as BLOB but stores strings in it, while
+ * Cursor's agent store keeps real bytes in the same shape of table. better-sqlite3
+ * returned a Buffer for the byte case and every `JSON.parse(row.value)` in these
+ * adapters worked by accident, because Buffer.toString() decodes utf-8.
+ *
+ * node:sqlite returns a plain Uint8Array, whose toString() renders "40,181,47,253,…" —
+ * a comma-joined list of byte values. That is not utf-8, not JSON, and not empty, so it
+ * does not fail loudly; it fails four frames deeper as a parse error against a store
+ * that is perfectly healthy. Every read that may be either type goes through here.
+ */
+function textOf(v) {
+  if (v == null) return v;
+  if (typeof v === 'string') return v;
+  if (v instanceof Uint8Array) return Buffer.from(v.buffer, v.byteOffset, v.byteLength).toString('utf-8');
+  return String(v);
+}
+
+/**
+ * A column's value as a Buffer, for readers that slice it, hex-encode it, or hand it to
+ * zlib. Buffer IS a Uint8Array, so this is a no-op on anything better-sqlite3 would have
+ * returned — it exists so the byte-walking code below never has to ask which it got.
+ */
+function bytesOf(v) {
+  if (v == null) return v;
+  if (Buffer.isBuffer(v)) return v;
+  if (typeof v === 'string') return Buffer.from(v, 'utf-8');
+  // A view over the same memory, not a copy — these blobs run to megabytes and every
+  // consumer here only reads.
+  return Buffer.from(v.buffer, v.byteOffset, v.byteLength);
+}
+
+module.exports = { openReadOnly, textOf, bytesOf };

package/editors/windsurf.js

@@ -484,13 +484,13 @@ function getDevinApiKey(appNames) {
           dbPath = path.join(HOME, '.config', appName, 'User', 'globalStorage', 'state.vscdb');
       }
       if (!fs.existsSync(dbPath)) continue;
-      const Database = require('better-sqlite3');
-      const db = new Database(dbPath, { readonly: true });
+      const { openReadOnly, textOf } = require('./sqlite');
+      const db = openReadOnly(dbPath);
       try {
         for (const key of keys) {
           const row = db.prepare('SELECT value FROM ItemTable WHERE key = ?').get(key);
           if (!row) continue;
-          const parsed = JSON.parse(row.value);
+          const parsed = JSON.parse(textOf(row.value));
           if (parsed.apiKey) return parsed.apiKey;
         }
       } finally {

package/editors/zed.js

@@ -2,16 +2,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 
-// Required lazily. A top-level require makes this native module a load-time dependency
-// of the whole adapter set: editors/index.js imports every adapter, so one missing
-// binding threw before any adapter ran and `discover` reported ZERO editors — losing the
-// eleven that need no native code at all. The adapterErrors path exists to degrade one
-// adapter at a time, and a top-level throw walks straight past it.
-let Database = null;
-function openDb(...a) {
-  if (!Database) Database = require('better-sqlite3');
-  return new Database(...a);
-}
+const { openReadOnly, bytesOf } = require('./sqlite');
 const adapterErrors = require('./adapter-errors');
 
 // Zed stores data in different locations depending on the platform
@@ -72,13 +63,13 @@ function decompressZstd(buf) {
 }
 
 // ============================================================
-// Query SQLite using better-sqlite3 (cross-platform)
+// Query SQLite using node:sqlite (cross-platform, no native dependency)
 // ============================================================
 
 function queryDb(sql) {
   if (!fs.existsSync(THREADS_DB)) return [];
   try {
-    const db = openDb(THREADS_DB, { readonly: true });
+    const db = openReadOnly(THREADS_DB);
     const rows = db.prepare(sql).all();
     db.close();
     return rows;
@@ -100,7 +91,7 @@ function getThreadColumns() {
   if (threadColumns) return threadColumns;
   if (!fs.existsSync(THREADS_DB)) return new Set();
   try {
-    const db = openDb(THREADS_DB, { readonly: true });
+    const db = openReadOnly(THREADS_DB);
     const cols = db.prepare('PRAGMA table_info(threads)').all().map((r) => r.name);
     db.close();
     // PRAGMA on a missing or renamed table SUCCEEDS with zero rows rather than
@@ -131,10 +122,14 @@ function resetCache() {
 function queryBlob(id) {
   if (!fs.existsSync(THREADS_DB)) return null;
   try {
-    const db = openDb(THREADS_DB, { readonly: true });
+    const db = openReadOnly(THREADS_DB);
     const row = db.prepare('SELECT data FROM threads WHERE id = ?').get(id);
     db.close();
-    return row ? row.data : null;
+    // As a Buffer, not the raw Uint8Array node:sqlite hands back. Both callers below
+    // treat it as one: the uncompressed path calls .toString('utf-8') on it, which on a
+    // bare Uint8Array yields "40,181,47,…" — the byte VALUES, comma-joined — and the
+    // thread would then fail JSON.parse as if it were corrupt.
+    return row ? bytesOf(row.data) : null;
   } catch (e) {
     // This is the message-blob read. A silent null here becomes a zero-message
     // session, which overwrites the stored transcript on re-ship.

package/memhouse/COMPETITION.md

@@ -141,11 +141,15 @@ memory. None ingest agent sessions.
   into *installed skills*. Our skills must be chosen. One independent analysis of 270
   real sessions found **only 4.8% involved an explicit history query** — a pull-only
   model gets invoked rarely.
-- **Install weight — we are the heaviest in the category.** AgentsView, deja-vu and
-  ctx are single dependency-free binaries via Homebrew, Docker, `go install` or curl.
-  We are Node, need `--allow-scripts=better-sqlite3` (five adapters silently read
-  nothing without it), and additionally need a ClickHouse to point at. Our README
-  spends paragraphs on `EACCES`/`sudo` triage. That is a real adoption tax.
+- **Install weight — still the heaviest in the category, but half the tax is paid.**
+  AgentsView, deja-vu and ctx are single dependency-free binaries via Homebrew, Docker,
+  `go install` or curl. We are Node and need a ClickHouse to point at.
+  **Resolved 2026-08-16:** the native-dependency half is gone. `better-sqlite3` was
+  replaced by `node:sqlite`, so `npm i -g memhouse` with no flags is now a complete,
+  fully working install — no `--allow-scripts`, no build step, and no five-adapters-
+  silently-read-nothing failure mode. What remains of the tax is the runtime (Node,
+  not a static binary), the ClickHouse dependency, and the `EACCES`/`sudo` prefix
+  triage, which was never about the flag and is not fixable from our side.
 - **Semantic search.** AgentsView (opt-in index), claude-mem (Chroma),
   claude-history (local embedding model). We are FTS-only. Contested rather than
   settled — deja-vu made the same choice and was criticised for it on HN.

package/memhouse/DESIGN.md

@@ -64,9 +64,10 @@ them free and further along; **bet 3 is the one nobody else attempts.**
    Physical typed columns (what memory-house derives in views) + `tool_calls`
    (memory-house has no tool table) + one `extra JSON` escape hatch per room so
    unnormalized adapter fields are never lost. `ReplacingMergeTree(ingested_at)`;
-   `messages` keyed `(session_id, user_id, origin, seq)` so a re-ship of a
-   grown/changed session replaces stale rows (latest-wins) and two housemates' rows
-   never collapse into one. FTS text indexes built in (CH ≥ 26.2).
+   `messages` keyed `(session_id, user_id, origin, epoch, seq)` so a re-ship of a
+   grown session replaces stale rows (latest-wins), two housemates' rows never
+   collapse into one, and a re-parse that SHRANK or was rewritten lands under a new
+   epoch instead of over what it replaces. FTS text indexes built in (CH ≥ 26.2).
 3. **Kernel-installable agency.** Joining any ClickHouse — a kernel's included — is a
    database plus a credential: `CREATE USER`, `GRANT ALL ON <house>.* `, done. The
    shipper is the resident that lands with it and creates its own rooms. Identity is
@@ -116,15 +117,39 @@ Config file: `~/.memhouse/config.json` (`hiddenProjects`, future prefs).
 - Incremental shipping: read existing `(session_id, last_updated_at, message_count)`
   (FINAL) and skip chats that haven't grown/changed; a full re-ship must remain
   safe (ReplacingMergeTree collapses).
-- Re-shipping a known session **deletes its message/tool rows first**: `ReplacingMergeTree`
-  collapses same-key rows but cannot remove a row the new parse no longer produces, so a
-  shrunken re-parse would leave a stale `seq` tail forever.
-- **A mutation predicate must bind the user, never call `currentUser()`.** A mutation does
-  not evaluate it in the caller's context: measured on ClickHouse 25.11 and chdb, the same
-  `DELETE` matched 0 rows with `user_id = currentUser()` and 2000 with the value bound —
-  silently, both times. Read the identity once (`SELECT currentUser()`) and pass it as a
-  query parameter. This applies to `DELETE`/`ALTER … UPDATE`, not to `SELECT`, where
-  `currentUser()` behaves as expected.
+- **The shipper is insert-only, and nothing may reintroduce a destructive verb.**
+  `ReplacingMergeTree` collapses same-key rows but cannot remove a row the new parse no
+  longer produces, so a shrunken re-parse leaves a stale `seq` tail. The shipper used to
+  clear the session's rows first; that destroyed content held nowhere else, because
+  Claude Code compacts transcripts and deletes them after `cleanupPeriodDays` (30 by
+  default), and a shorter re-parse cannot be told apart from a fixed adapter bug. Instead
+  `decideEpoch` bumps the session's `epoch` when the new parse is shorter than the stored
+  one, or diverges from it at an overlapping `seq` (compared on the stored `line_hash`),
+  and writes underneath the old parse rather than over it.
+- **memhouse is an accumulator, not a mirror.** Absence of a session on disk is never a
+  signal: retention cleanup, a manual delete, a second laptop, an unmounted folder, a
+  locked SQLite file and a thrown adapter all produce the identical observation. A
+  session that disappears is never cleared and never re-inserted. **No `sync` and no
+  `prune` feature may be built here** — either would destroy the archive by design.
+- Reads see one parse per session. `roomNames()` resolves `messages`/`tool_calls` to a
+  current-epoch subquery and the bare tables only as `*_raw`, so retention cannot silently
+  inflate a rollup, and a read path written by someone who has never heard of epochs is
+  still correct. Measured cost of the filter: **+10 ms** across the dashboard's queries on
+  a real 66k-message house (all of them under 200 ms), and **+13–37 ms** on a synthetic
+  1M-message / 20k-session one. The single shape that grows is a one-session read
+  (5 ms → 18 ms at 1M rows): the `IN` aggregates the whole room regardless of the outer
+  session filter. If that ever matters, the answer is a small materialized current-epoch
+  table maintained by the shipper — never a filter each caller has to remember.
+- **A mutation predicate must bind the user, never call `currentUser()`.** No mutation
+  survives in the shipper, but the finding outlives it — `migrate-rooms` and `reset` still
+  run statements where it applies. A mutation does not evaluate `currentUser()` in the
+  caller's context: measured on ClickHouse 25.11 and chdb, the same `DELETE` matched 0
+  rows with `user_id = currentUser()` and 2000 with the value bound — silently, both
+  times. Read the identity once (`SELECT currentUser()`) and pass it as a query parameter.
+  The same trap bites the other way in a rebuild: `user_id` is `MATERIALIZED
+  currentUser()`, so an `INSERT SELECT` that does not carry it explicitly (under
+  `insert_allow_materialized_columns=1`) restamps every copied row with whoever ran the
+  migration.
 - Costs are computed in the server from `pricing.js` (repo root) over per-model
   token sums; `<synthetic>` and empty models excluded from model lists.