douglance/devsql/devsql-querying

DevSQL Querying Skill

Use DevSQL Code Mode to query Claude Code and Codex CLI history, shell history, macOS Unified Logs, Git commits, and source code.

Primary interface

Prefer the connected DevSQL Code Mode server. Use codemode_search to discover typed devsql.* methods, then codemode_execute to compose them in JavaScript. Inspect query executions with codemode_execution. Devsql observes existing history; it does not create tasks or require progress reports.

Use the direct commands below only when Code Mode is unavailable or when writing a shell script.

When to Use

• User asks "How many Claude sessions did I have this week?"
• User wants to "Find my longest debugging sessions"
• User asks "Which prompts led to the most commits?"
• User wants productivity analytics or session insights
• User asks about correlating Claude/Codex usage with Git history
• User wants to search for symbols, functions, or classes in the codebase
• User asks "What's in this file?" or needs file context
• User wants to understand what changed between commits
• User asks about imports, dependencies, or impact of a file
• User wants to diagnose recent macOS application or subsystem behavior
• User asks what a Grok Bot said or decided (use devsql grok search, not recall/gather)

Prerequisites

Ensure devsql is installed:

brew install douglance/tap/devsql

Agent Tool Commands

For structured queries, prefer these subcommands (they return JSON):

All commands accept --repo / -r and --data-dir / -d options.

Available Tables

The lists below are a guide. For the exact columns, run devsql schema (every table) or devsql schema <table>; a query naming a column that does not exist fails with the table's real columns and the closest match.

Claude/Codex Tables

Shell Tables

transcripts covers ~/.claude/projects/<slug>/**/*.jsonl (top-level sessions plus subagent transcripts) and the legacy ~/.claude/transcripts/*.jsonl. sessions has one aggregated row per session file; _project / project is the project slug directory (e.g. -Users-you-Developer-app), NULL for legacy files. _agent_id is set only on subagent rows.

Git Tables

Also loaded when a query reads them: commit_parents, tags, refs, stashes, reflog, blame, config, remotes, submodules, status, worktrees, hooks, notes. A commit's hash is commits.id (short_id for 7 characters); line counts live in diffs and diff_files, not commits.

macOS Unified Log

Pass log_last, log_start/log_end, log_predicate, log_archive, log_level, log_max_rows, and log_timeout to devsql.query. Prefer a narrow time window plus process or subsystem filters. Defaults are 15 minutes, standard level, 50,000 rows, and 30 seconds. The provider streams with bounded memory, pushes safe filters into macOS log show, and returns partial rows with a warning when a timeout or configured row cap is reached.

Grok Bot Tables

Grok Bots are global: they have no cwd and no repo, so --repo does not scope them. They are deliberately absent from recall, gather, and command_events — treat them as an explicit search target.

Two caveats worth knowing when interpreting results:

• Local replicas are truncated windows. entry_count below newest_entry_id

means history exists on the gateway that is not indexed yet; run devsql grok sync --bot <name> --full to backfill. Inside a Grok Bot sandbox this does not apply: devsql reads each bot's store.db directly and offline.

• provenance says where a row came from: local_replica, store_db,

gateway, or both (seen from more than one).

• roster_present = 0 marks a bot deleted in the Grok UI whose history devsql

still holds.

Code Tables (Source Analysis)

\* imports requires the tree-sitter-ast build feature; without it a query on imports fails with that message. Without the feature, symbols uses regex-based extraction.

Supported languages for symbol extraction: Rust, TypeScript, JavaScript, Python, Go.

Symbol kinds: fn (Rust), function (TypeScript/JavaScript/Python), struct, enum, trait, type, const, static, mod, macro, class, interface (varies by language).

Approach

1. Understand what the user wants to analyze
2. Choose the right tool:

• For structured queries about symbols/files/history → use a subcommand
• For cross-table analytics or custom joins → compose a SQL query

1. Execute with: devsql "<query>" or devsql <subcommand> <args>
2. Present results with insights

Note: history.timestamp is in milliseconds. Use datetime(timestamp/1000, 'unixepoch') to convert.

Example Queries

-- Recent application errors (pass log_last: "10m", log_level: "info")
SELECT timestamp, process, subsystem, category, message
FROM macos_logs
WHERE process = 'ExampleApp' AND message LIKE '%error%'
ORDER BY timestamp DESC
LIMIT 100;
 
-- Recent prompts
SELECT display as prompt, project
FROM history ORDER BY timestamp DESC LIMIT 10;
 
-- Prompts this week
SELECT COUNT(*) as prompts
FROM history
WHERE datetime(timestamp/1000, 'unixepoch') > date('now', '-7 days');
 
-- Correlate prompts with commits
SELECT
  date(c.authored_at) as day,
  COUNT(DISTINCT h.timestamp) as prompts,
  COUNT(DISTINCT c.id) as commits
FROM commits c
LEFT JOIN history h
  ON date(c.authored_at) = date(datetime(h.timestamp/1000, 'unixepoch'))
GROUP BY day
ORDER BY day DESC
LIMIT 14;
 
-- Which prompts led to commits?
SELECT h.display as prompt, COUNT(c.id) as commits_after
FROM history h
JOIN commits c ON date(datetime(h.timestamp/1000, 'unixepoch')) = date(c.authored_at)
GROUP BY h.display
ORDER BY commits_after DESC
LIMIT 10;
 
-- Tool usage
SELECT tool_name, COUNT(*) as uses
FROM transcripts
WHERE type = 'tool_use'
GROUP BY tool_name
ORDER BY uses DESC;
 
-- Find all public Rust functions (Rust emits kind='fn'; JS/TS use 'function')
SELECT name, file_path, line_start, signature
FROM symbols
WHERE kind = 'fn' AND visibility = 'pub'
ORDER BY file_path, line_start;
 
-- Top sessions by cache-read tokens
SELECT title, project, total_cache_read_input_tokens, last_timestamp
FROM sessions
ORDER BY total_cache_read_input_tokens DESC
LIMIT 10;
 
-- Daily output tokens by model (flattened usage columns)
SELECT DATE(timestamp) as day, model, SUM(usage_output_tokens) as output_tokens
FROM transcripts
WHERE type = 'assistant' AND usage_output_tokens IS NOT NULL
GROUP BY day, model
ORDER BY day DESC;
 
-- Codebase overview by language
SELECT language, COUNT(*) as files, SUM(line_count) as total_lines
FROM source_files
GROUP BY language
ORDER BY total_lines DESC;
 
-- Files with the most symbols
SELECT s.file_path, f.language, COUNT(*) as symbol_count
FROM symbols s
JOIN source_files f ON s.file_path = f.path
GROUP BY s.file_path
ORDER BY symbol_count DESC
LIMIT 10;
 
-- Most changed files correlated with symbol count
SELECT df.path, COUNT(DISTINCT df.commit_id) as commits,
  SUM(df.insertions) as total_adds,
  (SELECT COUNT(*) FROM symbols s WHERE s.file_path = df.path) as symbols
FROM diff_files df
GROUP BY df.path
ORDER BY commits DESC
LIMIT 10;

Find what a Grok Bot said about a topic

devsql grok search "release" --bot Terri --limit 10

SELECT bot_name, substr(timestamp, 1, 10) AS day, role, substr(text, 1, 120) AS excerpt
FROM grok_messages
WHERE text LIKE '%deploy%'
ORDER BY timestamp_ms DESC
LIMIT 20;

See which bots need a gateway backfill

SELECT name, entry_count, newest_entry_id, gateway_complete
FROM grok_bots
WHERE roster_present = 1
ORDER BY entry_count;

Output Formats

• Default: formatted table
• CSV: devsql -f csv "<query>"
• JSON: devsql -f json "<query>"