memhouse 0.20.1 → 0.20.3

package/editors/normalise/fsx.js

@@ -0,0 +1,99 @@
+'use strict';
+// The normalisers' file reads, with one rule: a path that is not there (ENOENT, ENOTDIR) is an
+// answer (no store, no session, no file), and any other error is an error. A read that took every
+// error for "not there" turned a permission denial (macOS privacy on ~/Library, a mode change, an
+// unreadable mount) into an editor with no sessions and no word of why.
+//
+// Each helper returns its absent answer (null, or false) only for absence, and throws anything else
+// as an FsError: the path, the operation, and the errno as `code`. normalise-run.js reports it by
+// editor, and `memhouse status` and `doctor` show it with hintOf's advice.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ABSENT = new Set(['ENOENT', 'ENOTDIR']);
+/** True for the errors that mean the path is not there. */
+const absent = (e) => !!e && ABSENT.has(e.code);
+
+class FsError extends Error {
+  constructor(op, p, e) {
+    const code = (e && e.code) || 'EIO';
+    super(`cannot ${op} ${p} (${code})`);
+    this.name = 'FsError';
+    this.code = code;
+    this.path = p;
+  }
+}
+const fail = (op, p, e) => (e instanceof FsError ? e : new FsError(op, p, e));
+
+/** A folder's entries, or null when the folder is not there. */
+function readdir(dir, opts) {
+  try { return fs.readdirSync(dir, opts); } catch (e) { if (absent(e)) return null; throw fail('read the folder', dir, e); }
+}
+/** fs.Stats, or null when the path is not there. */
+function stat(p) {
+  try { return fs.statSync(p); } catch (e) { if (absent(e)) return null; throw fail('stat', p, e); }
+}
+/** fs.Stats of the link itself (a symlink is not followed), or null when the path is not there. */
+function lstat(p) {
+  try { return fs.lstatSync(p); } catch (e) { if (absent(e)) return null; throw fail('stat', p, e); }
+}
+const isFile = (p) => { const s = stat(p); return !!s && s.isFile(); };
+const isDir = (p) => { const s = stat(p); return !!s && s.isDirectory(); };
+/** The file's text (UTF-8), or null when it is not there. */
+function readText(p) {
+  try { return fs.readFileSync(p, 'utf-8'); } catch (e) { if (absent(e)) return null; throw fail('read', p, e); }
+}
+/** The file's bytes, or null when it is not there. */
+function readBytes(p) {
+  try { return fs.readFileSync(p); } catch (e) { if (absent(e)) return null; throw fail('read', p, e); }
+}
+/** The resolved path, or null when it is not there. */
+function realpath(p) {
+  try { return fs.realpathSync.native(p); } catch (e) { if (absent(e)) return null; throw fail('resolve', p, e); }
+}
+/** A file descriptor open for reading, or null when the file is not there. */
+function openRead(p) {
+  try { return fs.openSync(p, 'r'); } catch (e) { if (absent(e)) return null; throw fail('open', p, e); }
+}
+/** True when the file opens for reading, false when it is not there; anything else throws. */
+function probe(p) {
+  const fd = openRead(p);
+  if (fd === null) return false;
+  fs.closeSync(fd);
+  return true;
+}
+
+/**
+ * One entry's read inside a store that read (a session's file or folder in a readable root): a refusal
+ * skips that entry alone, recorded in `errors` as { session_id, code, path, error } (the session's id,
+ * or the entry's name when the id is inside the file), and the store's other entries are listed.
+ * One stuck file must not stop an editor's new sessions from being captured. Returns `skipped` then.
+ * Not there is fn's own absent answer, and any other error propagates.
+ */
+function entry(errors, id, fn, skipped) {
+  try { return fn(); } catch (e) {
+    if (!(e instanceof FsError)) throw e;
+    errors.push({ session_id: String(id), code: e.code, path: e.path, error: e.message });
+    return skipped;
+  }
+}
+/** A list's entries, carrying the entries it skipped as `errors` (normalise-run reports them). */
+const listed = (out, errors) => (errors.length ? Object.assign(out, { errors }) : out);
+
+/**
+ * The advice for an error a read met, or ''. On macOS, a denial under ~/Library is almost always the
+ * privacy setting: the app that runs memhouse (the terminal, or the service's node) needs Full Disk
+ * Access to read another app's folder there.
+ */
+function hintOf(err, { platform = process.platform, home = os.homedir() } = {}) {
+  const code = err && err.code;
+  if (code !== 'EACCES' && code !== 'EPERM') return '';
+  const p = String((err && err.path) || '');
+  if (platform === 'darwin' && p && path.resolve(p).startsWith(path.join(home, 'Library') + path.sep)) {
+    return 'macOS privacy: give the app that runs memhouse Full Disk Access (System Settings > Privacy & Security > Full Disk Access), then restart it';
+  }
+  return 'memhouse cannot read it: check the permissions of the path and its folders';
+}
+
+module.exports = { absent, FsError, readdir, stat, lstat, isFile, isDir, readText, readBytes, realpath, openRead, probe, entry, listed, hintOf };

package/editors/normalise/gemini-cli.js

@@ -69,6 +69,7 @@
 //   `authType`, sits in files this module never opens.
 
 const fs = require('fs');
+const fsx = require('./fsx');
 const path = require('path');
 const crypto = require('crypto');
 const { dataFolder, defaultFolder, resolveNative } = require('../harness-paths');
@@ -89,8 +90,8 @@ function storeRootDefault() {
   return defaultFolder(HARNESS);
 }
 
-const readdir = (d) => { try { return fs.readdirSync(d, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0)); } catch { return []; } };
-const readText = (f) => { try { return fs.readFileSync(f, 'utf-8'); } catch { return null; } };
+const readdir = (d) => (fsx.readdir(d, { withFileTypes: true }) || []).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+const readText = (f) => fsx.readText(f);
 const isObj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
 const str = (v) => (typeof v === 'string' ? v : '');
 const ms = (iso) => { const t = Date.parse(iso); return Number.isFinite(t) ? t : null; };
@@ -159,8 +160,8 @@ function topLevelStrings(text, keys) {
 
 /** A file's first bytes: HEAD_CHUNK, or (untilNewline) its first line, null while it has none. */
 function readPrefix(file, untilNewline) {
-  let fd;
-  try { fd = fs.openSync(file, 'r'); } catch { return null; }
+  const fd = fsx.openRead(file);
+  if (fd === null) return null;
   try {
     let buf = Buffer.alloc(0);
     let size = HEAD_CHUNK;
@@ -175,7 +176,7 @@ function readPrefix(file, untilNewline) {
       if (n < size || buf.length >= HEAD_MAX) return null;   // no complete first line (still being written), or no header
       size = Math.min(size * 2, HEAD_MAX - buf.length);
     }
-  } catch { return null; } finally { try { fs.closeSync(fd); } catch { /* closed */ } }
+  } catch (e) { throw new fsx.FsError('read', file, e); } finally { try { fs.closeSync(fd); } catch { /* closed */ } }
 }
 
 /**
@@ -203,7 +204,7 @@ function readHeader(file, format) {
  */
 function list(storeRoot) {
   const root = path.resolve(storeRoot == null ? defaultFolder(HARNESS) : storeRoot);
-  if (!fs.existsSync(root)) return [];
+  if (!fsx.stat(root)) return [];
   // The default store's harness_path is harness-paths' data folder (GEMINI_CLI_HOME included), so the
   // bridge→normaliser switch dedupes; an explicit root is its own resolved path.
   const harnessPath = storeRoot == null ? dataFolder(HARNESS) : resolveNative(root);
@@ -211,8 +212,9 @@ function list(storeRoot) {
   const projectOf = (slug) => {
     if (!bySlug) {
       bySlug = new Map();
+      const text = fsx.readText(path.join(root, 'projects.json'));
       try {
-        const pj = JSON.parse(fs.readFileSync(path.join(root, 'projects.json'), 'utf-8'));
+        const pj = text === null ? null : JSON.parse(text);
         for (const [dir, sl] of Object.entries((pj && pj.projects) || {}).sort()) if (typeof sl === 'string' && !bySlug.has(sl)) bySlug.set(sl, dir);
       } catch { /* no index */ }
     }
@@ -224,30 +226,38 @@ function list(storeRoot) {
     const head = readHeader(file, format);
     if (!head || !head.sessionId) return;
     let size = 0;
-    try { size = fs.statSync(file).size; } catch { return; }
+    const st = fsx.stat(file);
+    if (!st) return;
+    size = st.size;
     const e = { harness: HARNESS, harness_path: harnessPath, session_id: head.sessionId, file, format, kind: head.kind, parent, slug, cwd, size };
     const prev = found.get(e.session_id);
     const better = !prev || (e.format === 'jsonl' && prev.format !== 'jsonl')
       || (e.format === prev.format && (e.size > prev.size || (e.size === prev.size && e.file < prev.file)));
     if (better) found.set(e.session_id, e);
   };
+  const errors = [];
   for (const s of readdir(path.join(root, 'tmp'))) {
     if (!s.isDirectory()) continue;
     const slugDir = path.join(root, 'tmp', s.name);
     const chats = path.join(slugDir, 'chats');
-    const names = readdir(chats);
+    // A project folder that could not be read: its chats are skipped, reported (fsx.entry).
+    const names = fsx.entry(errors, s.name, () => readdir(chats), []);
     if (!names.length) continue;
-    const cwd = (readText(path.join(slugDir, '.project_root')) || '').trim() || projectOf(s.name);
+    const root0 = fsx.entry(errors, s.name, () => readText(path.join(slugDir, '.project_root')), false);
+    if (root0 === false) continue;
+    const cwd = (root0 || '').trim() || projectOf(s.name);
     for (const f of names) {
       const full = path.join(chats, f.name);
       const m = /^session-.+\.(jsonl|json)$/.exec(f.name);
-      if (m && f.isFile()) { consider(full, m[1], s.name, cwd, ''); continue; }
+      if (m && f.isFile()) { fsx.entry(errors, f.name, () => consider(full, m[1], s.name, cwd, '')); continue; }
       if (!f.isDirectory()) continue;
       // A sub-agent directory, named for the main session's (sanitised) id.
-      for (const c of readdir(full)) if (c.isFile() && /\.jsonl$/.test(c.name)) consider(path.join(full, c.name), 'jsonl', s.name, cwd, f.name);
+      for (const c of fsx.entry(errors, f.name, () => readdir(full), [])) {
+        if (c.isFile() && /\.jsonl$/.test(c.name)) fsx.entry(errors, c.name, () => consider(path.join(full, c.name), 'jsonl', s.name, cwd, f.name));
+      }
     }
   }
-  return [...found.values()].map(({ size, ...e }) => e);
+  return fsx.listed([...found.values()].map(({ size, ...e }) => e), errors);
 }
 
 /** Complete lines only (a partial last line is held back); malformed lines are skipped. */

package/editors/normalise/opencode.js

@@ -51,6 +51,7 @@
 //   part, session_message, session_input and event are read.
 
 const fs = require('fs');
+const fsx = require('./fsx');
 const path = require('path');
 const crypto = require('crypto');
 const { fileURLToPath } = require('url');
@@ -71,8 +72,8 @@ function storeRootDefault(env = process.env) {
   return harnessPaths.dataFolder(HARNESS, { env });
 }
 
-function isFile(p) { try { return fs.statSync(p).isFile(); } catch { return false; } }
-function readdir(dir) { try { return fs.readdirSync(dir).sort(); } catch { return []; } }
+function isFile(p) { return fsx.isFile(p); }
+function readdir(dir) { return (fsx.readdir(dir) || []).sort(); }
 
 /**
  * The session DBs of one data folder: OPENCODE_DB when set (absolute, or relative to the folder;
@@ -171,7 +172,7 @@ function keyColumns(sc) {
  */
 function list(storeRoot = storeRootDefault(), { env = process.env } = {}) {
   storeRoot = path.resolve(storeRoot);
-  try { if (!fs.statSync(storeRoot).isDirectory()) return []; } catch { return []; }
+  if (!fsx.isDir(storeRoot)) return [];
   const spills = path.join(harnessPaths.resolveNative(storeRoot), 'tool-output');
   const out = [];
   for (const { file, harness_path } of dbFiles(storeRoot, env)) {
@@ -264,12 +265,12 @@ function spilled(spillDir, p) {
   const ref = path.basename(String(p || ''));
   if (!SPILL.test(ref)) return null;
   if (!spillDir) return { ref, sha: null, len: null };
-  try {
-    const file = path.join(spillDir, ref);
-    if (!fs.lstatSync(file).isFile()) return { ref, sha: null, len: null };
-    const buf = fs.readFileSync(file);
-    return { ref, sha: sha256(buf), len: buf.length };
-  } catch { return { ref, sha: null, len: null }; }
+  const file = path.join(spillDir, ref);
+  const st = fsx.lstat(file);   // a link is never followed
+  if (!st || !st.isFile()) return { ref, sha: null, len: null };
+  const buf = fsx.readBytes(file);
+  if (!buf) return { ref, sha: null, len: null };
+  return { ref, sha: sha256(buf), len: buf.length };
 }
 
 /** A non-file URL cut to scheme://host (its path and query may carry a token), else one marker. */

package/editors/normalise/vscode.js

@@ -39,6 +39,7 @@
 // - redaction by field path: `selectedModel.metadata.auth`, wherever a `selectedModel` sits.
 
 const fs = require('fs');
+const fsx = require('./fsx');
 const path = require('path');
 const { fileURLToPath } = require('url');
 
@@ -64,7 +65,9 @@ function storeRootDefault() {
 /** A workspace's folder from workspaceStorage/<ws>/workspace.json: a path for file URIs, else the URI. */
 function workspaceFolder(wsDir) {
   let j;
-  try { j = JSON.parse(fs.readFileSync(path.join(wsDir, 'workspace.json'), 'utf-8')); } catch { return ''; }
+  const text = fsx.readText(path.join(wsDir, 'workspace.json'));
+  if (text === null) return '';
+  try { j = JSON.parse(text); } catch { return ''; }
   const uri = typeof j.folder === 'string' ? j.folder : (typeof j.workspace === 'string' ? j.workspace : '');
   if (!uri.startsWith('file:')) return uri;
   try { return fileURLToPath(uri); } catch { return decodeURIComponent(uri.replace(/^file:\/\//, '')); }
@@ -78,30 +81,32 @@ function workspaceFolder(wsDir) {
  * while the file stays the same (the mtime only picks between two files).
  */
 function list(storeRoot = storeRootDefault()) {
-  let harnessPath;
-  try { harnessPath = fs.realpathSync.native(storeRoot); } catch { return []; }
+  const harnessPath = fsx.realpath(storeRoot);
+  if (!harnessPath) return [];
   const client = CLIENTS[path.basename(harnessPath)] || 'vscode';
   const user = path.join(harnessPath, 'User');
   const wsRoot = path.join(user, 'workspaceStorage');
   const dirs = [];
-  let wss = [];
-  try { wss = fs.readdirSync(wsRoot).sort(); } catch { wss = []; }
+  const wss = (fsx.readdir(wsRoot) || []).sort();
   for (const ws of wss) dirs.push({ dir: path.join(wsRoot, ws, 'chatSessions'), wsDir: path.join(wsRoot, ws), workspace: ws });
   dirs.push({ dir: path.join(user, 'globalStorage', 'emptyWindowChatSessions'), wsDir: null, workspace: '' });
 
   const bySid = new Map();
+  const errors = [];   // a workspace or chat file that could not be read: skipped, reported (fsx.entry)
   for (const d of dirs) {
-    let names;
-    try { names = fs.readdirSync(d.dir).sort(); } catch { continue; }
+    const where = d.workspace || 'emptyWindowChatSessions';
+    const names = fsx.entry(errors, where, () => fsx.readdir(d.dir), null);
+    if (!names) continue;
+    names.sort();
     let cwd = null;
     for (const name of names) {
       const m = /^(.+)\.(jsonl|json)$/.exec(name);
       if (!m) continue;
       const file = path.join(d.dir, name);
-      let st;
-      try { st = fs.statSync(file); } catch { continue; }
-      if (!st.isFile()) continue;
-      if (cwd === null) cwd = d.wsDir ? workspaceFolder(d.wsDir) : '';
+      const st = fsx.entry(errors, m[1], () => fsx.stat(file), null);
+      if (!st || !st.isFile()) continue;
+      if (cwd === null) cwd = d.wsDir ? fsx.entry(errors, where, () => workspaceFolder(d.wsDir), null) : '';
+      if (cwd === null) break;   // its workspace.json refused: the workspace's chats are skipped, reported
       const e = {
         harness: HARNESS, session_id: m[1], file, format: m[2], workspace: d.workspace, cwd, client, harness_path: harnessPath, mtime: st.mtimeMs,
       };
@@ -110,7 +115,7 @@ function list(storeRoot = storeRootDefault()) {
       if (better) bySid.set(e.session_id, e);
     }
   }
-  return [...bySid.values()].map(({ mtime, ...e }) => e);
+  return fsx.listed([...bySid.values()].map(({ mtime, ...e }) => e), errors);
 }
 
 /** Change-log lines: complete lines only (a partial last line is held back), malformed ones skipped. */
@@ -437,7 +442,8 @@ function load(session) {
   if (Array.isArray(session.ops)) return replay(session.ops.map((o) => (typeof o === 'string' ? JSON.parse(o) : JSON.parse(JSON.stringify(o)))));
   let text = typeof session.text === 'string' ? session.text : null;
   if (text == null) {
-    try { text = fs.readFileSync(session.file, 'utf-8'); } catch { return snap(null); }
+    text = fsx.readText(session.file);
+    if (text === null) return snap(null);
   }
   const json = session.format === 'json' || (session.file && /\.json$/.test(session.file));
   if (json) { try { return snap(JSON.parse(text)); } catch { return snap(null); } }

package/editors/normalise/zed.js

@@ -79,6 +79,7 @@
 //   signatures, the git snapshot (its remote URL) and sandbox grants are never emitted.
 
 const fs = require('fs');
+const fsx = require('./fsx');
 const path = require('path');
 const crypto = require('crypto');
 const zlib = require('zlib');
@@ -154,23 +155,28 @@ function openThreads(file) {
 }
 
 /** session_id → true for the threads any channel's sidebar marks archived (a flag, no time). */
-function readArchived(storeRoot) {
+function readArchived(storeRoot, errors) {
   const out = new Map();
   let channels = [];
-  try { channels = fs.readdirSync(path.join(storeRoot, 'db')).sort(); } catch { return out; }
+  const names = fsx.readdir(path.join(storeRoot, 'db'));
+  if (!names) return out;
+  channels = names.sort();
+  // A channel's workspace DB that could not be read: its archive flags are skipped, reported (fsx.entry).
   for (const ch of channels) {
     const file = path.join(storeRoot, 'db', ch, 'db.sqlite');
-    try { if (!fs.statSync(file).isFile()) continue; } catch { continue; }
-    let db = null;
-    try {
-      db = openReadOnly(file);
-      const cols = columnsOf(db, 'sidebar_threads');
-      if (!cols.has('session_id') || !cols.has('archived')) continue;
-      for (const r of db.prepare('SELECT session_id, archived FROM sidebar_threads WHERE session_id IS NOT NULL').all()) {
-        const sid = String(textOf(r.session_id));
-        if (sid && Number(r.archived) === 1) out.set(sid, true);
-      }
-    } finally { if (db) try { db.close(); } catch { /* closed */ } }
+    fsx.entry(errors, path.join('db', ch), () => {
+      if (!fsx.isFile(file)) return;
+      let db = null;
+      try {
+        db = openReadOnly(file);
+        const cols = columnsOf(db, 'sidebar_threads');
+        if (!cols.has('session_id') || !cols.has('archived')) return;
+        for (const r of db.prepare('SELECT session_id, archived FROM sidebar_threads WHERE session_id IS NOT NULL').all()) {
+          const sid = String(textOf(r.session_id));
+          if (sid && Number(r.archived) === 1) out.set(sid, true);
+        }
+      } finally { if (db) try { db.close(); } catch { /* closed */ } }
+    });
   }
   return out;
 }
@@ -186,7 +192,7 @@ function readArchived(storeRoot) {
  */
 function list(storeRoot = storeRootDefault()) {
   const file = dbPathOf(storeRoot);
-  try { if (!fs.statSync(file).isFile()) return []; } catch { return []; }
+  if (!fsx.isFile(file)) return [];
   const harnessPath = harnessPaths.resolveNative(storeRoot);
   const db = openThreads(file);
   let rows = [];
@@ -196,9 +202,10 @@ function list(storeRoot = storeRootDefault()) {
     rows = db.prepare(`SELECT id, ${cols.has('updated_at') ? 'updated_at' : "'' AS updated_at"} FROM threads ORDER BY id`).all()
       .map((r) => ({ id: String(textOf(r.id)), updated_at: r.updated_at == null ? '' : String(textOf(r.updated_at)) }));
   } finally { db.close(); }
-  const archived = readArchived(storeRoot);
+  const errors = [];
+  const archived = readArchived(storeRoot, errors);
   const rel = path.relative(storeRoot, file);
-  return rows.map((r) => ({ harness: HARNESS, harness_path: harnessPath, session_id: r.id, db_rel: rel, updated_at: r.updated_at, archived: archived.get(r.id) === true }));
+  return fsx.listed(rows.map((r) => ({ harness: HARNESS, harness_path: harnessPath, session_id: r.id, db_rel: rel, updated_at: r.updated_at, archived: archived.get(r.id) === true })), errors);
 }
 
 /** One thread's row and blob, read together so they are of the same save. */

package/editors/sqlite.js

@@ -21,6 +21,7 @@
 const fs = require('fs');
 const path = require('path');
 const { pathToFileURL } = require('url');
+const fsx = require('./normalise/fsx');
 
 let DatabaseSync = null;
 
@@ -48,21 +49,30 @@ function openReadOnly(file) {
   // torn — measured: 3,525 "malformed" and 304 corrupt reads in 10,625 against a live writer, none
   // with the plain open, which in rollback mode creates no file. The header says which (byte 18:
   // 1 rollback, 2 WAL).
-  if (!fs.existsSync(file)) throw new Error(`unable to open database file: ${file}`);
-  if (!fs.existsSync(`${file}-wal`) && isWalHeader(file)) return new DatabaseSync(`${pathToFileURL(path.resolve(file)).href}?immutable=1`, { readOnly: true });
+  //
+  // The file is probed first, by the normalisers' rule (normalise/fsx.js): not there throws with code
+  // ENOENT (a caller's "no store"); any other error, a permission denial or macOS privacy, throws
+  // with its own errno and path, never as SQLite's "unable to open" that a caller could take for
+  // absence. A SQLite error on a file the probe could read is SQLite's, and stays an error.
+  const head = headerOf(file);
+  if (head === null) throw Object.assign(new Error(`unable to open database file: ${file}`), { code: 'ENOENT', path: file });
+  if (!fsx.stat(`${file}-wal`) && isWal(head)) return new DatabaseSync(`${pathToFileURL(path.resolve(file)).href}?immutable=1`, { readOnly: true });
   return new DatabaseSync(file, { readOnly: true });
 }
 
-/** True when the file's SQLite header says WAL mode (file format write version, byte 18, is 2). */
-function isWalHeader(file) {
-  let fd;
+/** The file's first 20 bytes, or null when it is not there; any other error throws (fsx.FsError). */
+function headerOf(file) {
+  const fd = fsx.openRead(file);
+  if (fd === null) return null;
   try {
-    fd = fs.openSync(file, 'r');
     const b = Buffer.alloc(20);
-    return fs.readSync(fd, b, 0, 20, 0) === 20 && b.toString('latin1', 0, 15) === 'SQLite format 3' && b[18] === 2;
-  } catch { return false; } finally { if (fd !== undefined) fs.closeSync(fd); }
+    return b.subarray(0, fs.readSync(fd, b, 0, 20, 0));
+  } catch (e) { throw new fsx.FsError('read', file, e); } finally { fs.closeSync(fd); }
 }
 
+/** True when a SQLite header says WAL mode (file format write version, byte 18, is 2). */
+const isWal = (b) => b.length === 20 && b.toString('latin1', 0, 15) === 'SQLite format 3' && b[18] === 2;
+
 /**
  * A column's value as text, whether SQLite handed back TEXT or BLOB.
  *

package/memhouse/house/q-cli.js

@@ -741,6 +741,19 @@ function hasFormat(sql) {
   return /\bFORMAT\s+[A-Za-z0-9_]+\s*$/i.test(s);
 }
 
+/**
+ * What `memhouse room-sql` sends: the statement as written, and the output format as the
+ * default_format setting. A FORMAT appended to the statement fails where the statement takes
+ * none (ClickHouse 25.11 parses no FORMAT after a bare SHOW ROW POLICIES); a setting applies to
+ * every statement, and a FORMAT the statement names itself still wins. --json picks the format,
+ * so a statement that names one is refused there.
+ */
+function roomSqlRequest(sql, { json = false } = {}) {
+  const body = String(sql).trim().replace(/;\s*$/, '');
+  if (json && hasFormat(body)) throw new QueryInputError('--json picks the format itself — drop the FORMAT clause');
+  return { body, settings: { default_format: json ? 'JSONEachRow' : 'PrettyCompact' } };
+}
+
 /** Refuse what is not a read before it leaves the machine (the server's readonly=2 refuses it too). */
 function assertRead(sql) {
   const s = String(sql).replace(/--[^\n]*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '').trim();
@@ -858,6 +871,6 @@ module.exports = {
   renderSchemaBlocks,
   NAMES, ALIASES, FILTER_FLAGS, QueryInputError,
   schemaOf, httpTransport, fmtTop, fmtInner, parseWhen, filtersFrom, parseRef, parseQ, runQ, renderQ, allQFlags, canonicalName,
-  resolveRef, hitSpec, lookupSpec, withIso, rewriteRooms, hasFormat, assertRead, statsV3, renderStats, statusV3, statusSpec, machinesFolded,
+  resolveRef, hitSpec, lookupSpec, withIso, rewriteRooms, hasFormat, roomSqlRequest, assertRead, statsV3, renderStats, statusV3, statusSpec, machinesFolded,
   sessionsQueryV3, resumeSpec, table,
 };

package/memhouse/house/records-to-profile.js

@@ -9,6 +9,12 @@
 // record without content_sha and cmp_sha) on every row; on a part row, the sha of the part object
 // as it sits in its message's parts, with message_content_sha the message's. A message's header
 // row (part_id '', kind 'none') carries the message's sha in both.
+//
+// native and units (harness-sessions-sql v1.1, sessions-model §2.7): a record's `native` as
+// canonical JSON text, its `units` as (source_key, generation, unit_key) tuples. A part row carries
+// its message's (message_native, message_units) and its own part_native. A record without them
+// (an adapter older than sessions-model v1.4) leaves the columns out, so the server's defaults
+// ('' and []) stand and a row mapped before them keeps its digest.
 
 const crypto = require('crypto');
 
@@ -30,6 +36,10 @@ const str = (v) => (v == null ? '' : String(v));
 const nb = (v) => (typeof v === 'boolean' ? v : null);
 const nn = (v) => (Number.isFinite(Number(v)) && v !== null && v !== '' ? Number(v) : null);
 const tsOrNull = (v) => (v && Number.isFinite(Date.parse(v)) ? v : null);
+/** A record's native as its column holds it: canonical JSON, or undefined (the column's default) when absent. */
+const nativeText = (v) => (v != null && typeof v === 'object' ? jcs(v) : undefined);
+/** A record's units as named tuples, or undefined (the column's default) when the record states none. */
+const unitsOf = (v) => (Array.isArray(v) ? v.map(([sourceKey, generation, unitKey]) => ({ source_key: str(sourceKey), generation: Number(generation) || 0, unit_key: str(unitKey) })) : undefined);
 
 /** The part columns of one part. */
 function partColumns(p) {
@@ -39,7 +49,7 @@ function partColumns(p) {
     call_id: '', tool_name: '', args: '', server: '', is_error: null, result_status: '', output: '', output_ref: '', output_ref_sha256: '', output_ref_bytes: null,
     output_len: null, truncated: null, exit_code: null, media_type: '', inline_b64: '', ref: '', bytes_len: null, opaque: null, signature_len: null,
     replaces_form: '', replaces_value: '', error_kind: '', error_message: '', http_status: null, level: '', native_type: '',
-    part_source: str(p.source), part_state: str(p.state),
+    part_source: str(p.source), part_state: str(p.state), part_native: nativeText(p.native),
   };
   switch (p.kind) {
     case 'text': case 'notice': case 'summary': case 'reasoning':
@@ -99,7 +109,8 @@ function profileRows(records, key, { firstSeen = () => '1970-01-01T00:00:00.000Z
       source: str(m.source), to_user: nb(m.to_user), to_model: nb(m.to_model), status: str(m.status), state: str(m.state), on_active_branch: nb(m.on_active_branch),
       ts, requested_model: str(m.requested_model), served_model: str(m.served_model), effort: str(m.effort), response_id: str(m.response_id),
       message_aliases: Array.isArray(m.aliases) ? m.aliases.map((a) => ({ id: str(a.id), kind: str(a.kind) })) : [],
-      cmp_sha: str(m.cmp_sha), message_content_sha: msgSha, first_seen: firstSeen(str(m.message_id)),
+      cmp_sha: str(m.cmp_sha), message_content_sha: msgSha, message_native: nativeText(m.native), message_units: unitsOf(m.units),
+      first_seen: firstSeen(str(m.message_id)),
     };
     const ps = Array.isArray(m.parts) ? m.parts : [];
     ps.forEach((p, i) => {
@@ -159,7 +170,7 @@ function profileRows(records, key, { firstSeen = () => '1970-01-01T00:00:00.000Z
     mode: str(s.mode), kind: str(s.kind), reuse: str(s.reuse), ts_source: str(s.ts_source),
     aliases: Array.isArray(s.aliases) ? s.aliases.map((a) => ({ id: str(a.id), kind: str(a.kind) })) : [],
     fingerprint: s.fingerprint && Array.isArray(s.fingerprint.cmp_shas) ? s.fingerprint.cmp_shas.map(String) : [],
-    setup: s.setup == null ? null : jcs(s.setup), content_sha: recordSha(s),
+    setup: s.setup == null ? null : jcs(s.setup), native: nativeText(s.native), units: unitsOf(s.units), content_sha: recordSha(s),
   } : null;
   return { parts, usage, links, lifecycle, session, calls: [...calls.values()].filter((c) => c.call_id && c.tool_name !== undefined) };
 }

package/memhouse/house/schema-profile-views.sql.tpl

@@ -0,0 +1,53 @@
+-- memhouse's reading views over one member's profile tables: harness-sessions-sql v1.1 §6
+-- (schema/clickhouse-views.sql), each reading the member's own {db}.{m}_* tables. Rendered by
+-- schema-profile.js with {db} and {m}, after the tables (schema-profile.sql.tpl). Views are not
+-- tables: they are never in the column heal or the key check.
+--   * CREATE OR REPLACE, so a house created before a definition changed gets the new one at its
+--     next ensure (install, update, migrate).
+--   * SQL SECURITY INVOKER: a read runs with the reader's own grants and row policies (share.js),
+--     never the creator's, so a view shows a reader no row the tables would not.
+--   * {m}_session_turns_view, not {m}_session_turns: a table name ending in _turns reads as a 0.18
+--     member's turns room (share.js memberCollisions).
+
+-- §6, session_turns (plan): one row per turn of one session. A turn starts at a message a person
+-- sent in the main conversation (role 'user', source 'user', agent_id '') and runs to the next
+-- one; messages before the first prompt are turn 0. The session key is the view's parameters, so
+-- the filter on the sort-key prefix comes before FINAL:
+--   SELECT * FROM {db}.{m}_session_turns_view(host = '…', harness = '…', harness_path = '…',
+--                                              session_id = '…', incarnation = '')
+CREATE OR REPLACE VIEW {db}.{m}_session_turns_view SQL SECURITY INVOKER AS
+WITH
+  parts AS (
+    SELECT * FROM {db}.{m}_session_parts FINAL
+    WHERE host = {host:String} AND harness = {harness:String}
+      AND harness_path = {harness_path:String}
+      AND session_id = {session_id:String} AND incarnation = {incarnation:String}
+      AND is_deleted = 0 AND removed = 0
+      AND state = 'current' AND part_state IN ('', 'current')
+      AND ifNull(on_active_branch, true)
+  ),
+  messages AS (
+    SELECT message_id,
+           min(order_key) AS order_key,
+           toUInt32(any(role) = 'user' AND any(source) = 'user' AND any(agent_id) = '') AS is_prompt
+    FROM parts
+    GROUP BY message_id
+  ),
+  numbered AS (
+    SELECT message_id, is_prompt,
+           sum(is_prompt) OVER (ORDER BY order_key, message_id
+                                ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW) AS turn
+    FROM messages
+  )
+SELECT n.turn                                                AS turn,
+       anyIf(p.message_id, n.is_prompt = 1)                  AS prompt_message_id,
+       min(p.ts)                                             AS started_at,
+       max(p.ts)                                             AS ended_at,
+       uniqExact(p.message_id)                               AS messages,
+       countIf(p.kind = 'tool_call')                         AS tool_calls,
+       countIf(p.kind = 'tool_result' AND ifNull(p.is_error, false)) AS tool_errors,
+       arraySort(groupUniqArrayIf(p.served_model, p.served_model != '')) AS served_models
+FROM parts AS p
+INNER JOIN numbered AS n USING (message_id)
+GROUP BY n.turn
+ORDER BY n.turn;