pg_reports 0.8.0 → 0.8.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 70975bd7aa15cac037bc8ac3f658c7cabe1e7492a3c37a1db588c92bce3d0f3d
-  data.tar.gz: 587f0a5474d427303c483603467155c4e0602ff604d5628c39e45d7137d1354d
+  metadata.gz: 2800846cf0c02bdf3a2605151d0bfe7b7775a1eda3a1a920eed26bc3f731748d
+  data.tar.gz: 6f07d07fcd9e396d6c9dd885f9e9c2e0c9d10595f5b8817eba59a2c8c734981a
 SHA512:
-  metadata.gz: 3174ba9362c38d77da9a41653453de23e6c462fac8be71ceacf82b645fffb68343eb09421df8cfbab9f1100d1ca70fbca6234bc3a4450e83e5be9c35079653da
-  data.tar.gz: 70f91b168cc0890414741f75de6aea545400d738ef2a00e5a664a7555aac9bcfd923ba53ce169ca2ffa610efe9dbd95ff26902c77dcbfcf79b872421cf63e644
+  metadata.gz: 2c5165e3eaff390afb0f9369aa6a9a2351dbe410cf64fd26a5df0be6cd3492513d0510d84758886dfa42d04b378e524d8483490f991ab63f3cef25ed8594b088
+  data.tar.gz: 312d69fcb4a15c0216a1381ec04d9db6bf4811b326b89e70ecd5ce5ed43974eddc38ab6ed3c59e7358eb4ce2e1f0fd7ffc054be0da747f3d903f40b808e205c1

data/CHANGELOG.md

@@ -7,6 +7,49 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.2] - 2026-07-10
+
+### Added
+
+- **SQL Console — free-form SQL editor.** A new **SQL Console** button in the dashboard header opens a large modal with a SQL textarea (⌘/Ctrl+Enter to run) and a results table with row count and execution time. Renamed from the initial "Run Query" label, which read too similarly to the existing **▶ Run Report** button. Unlike *Execute Query* (which only ever runs server-generated, hash-cached queries — see 0.5.1 below), this accepts client-typed SQL directly, so the same SELECT-only/no-semicolon/keyword-denylist validation is applied straight to the submitted text via a new shared `enforce_select_only!` check. Gated by the existing `config.allow_raw_query_execution` flag; new `POST /run_query` endpoint.
+- **Bounded statement timeout for raw query execution.** `Execute Query`, `EXPLAIN ANALYZE`, and `SQL Console` now run inside a transaction with `SET LOCAL statement_timeout`, configurable via `config.raw_query_statement_timeout_ms` (default 5000ms, `PG_REPORTS_RAW_QUERY_STATEMENT_TIMEOUT_MS`, `0` disables). Prevents a runaway or accidentally expensive query from holding a connection open indefinitely; a cancelled query now surfaces a clear "query timed out" error instead of an opaque `PG::QueryCanceled`.
+- **Rate limiting for privileged dashboard endpoints.** `explain_analyze`, `execute_query`, `run_query`, and `create_migration` are now throttled per client IP via `config.raw_query_rate_limit` (default 30 requests, `PG_REPORTS_RAW_QUERY_RATE_LIMIT`) within `config.raw_query_rate_limit_window_seconds` (default 60s, `PG_REPORTS_RAW_QUERY_RATE_LIMIT_WINDOW_SECONDS`). Backed by `Rails.cache`; best-effort (not a hardened distributed limiter) and fails open if the cache is unavailable. Set `raw_query_rate_limit = nil` to disable.
+
+### Changed
+
+- **SQL Query Monitor is no longer shown in standalone mode.** It works by subscribing to `ActiveSupport::Notifications` in a host application's process — standalone mode has no separate host app, so the panel had nothing meaningful to monitor. The dashboard panel is now hidden and the `/query_monitor/*` endpoints return `403 Forbidden` when `PgReports.config.standalone` is true.
+
+## [0.8.1] - 2026-07-03
+
+### Added
+
+- **Standalone mode — run the dashboard without a host Rails app.** A new `pg_reports server` executable (and `rake pg_reports:server` task) boots a minimal Rails application that mounts the engine at `/` and serves it on port **4000**, straight from the gem's root folder. The connection is resolved from `--database-url`, then `DATABASE_URL`, then libpq-style `PG*` env vars; flags cover `--port`, `--host`, `--mount`, and `--server`. All existing multi-database / multi-cluster switching works unchanged, since the connection registry auto-registers the standalone connection as the `:primary` target.
+  - **No new runtime dependencies.** `rack` and `rackup` already ship transitively via `actionpack`/`railties`; the web server (Puma, WEBrick, …) is resolved at run time and is not a hard dependency — the runner uses whichever is installed and prints a clear message if none is.
+  - New `PgReports::Standalone` module encapsulating app construction, connection resolution, and server boot.
+  - `./bin/pg_reports` runs from a checkout without `bundle exec` via a soft bundler shim (activated only when a Gemfile sits next to the executable; skipped for the installed gem).
+  - **[docs/standalone.md](docs/standalone.md).**
+- **Dashboard footer** with links to the project on GitHub and a contact address.
+- **ESC closes any open modal.** A single global handler triggers the modal's own close button, so per-modal cleanup still runs.
+
+### Changed
+
+- **Redesigned the pg_stat_statements status badge.** The header badge now reports four clearly distinguished states with plain-language labels instead of a raw identifier glued to an adjective (`pg_stat_statements готовий`):
+  - 🟢 **Active** — monitoring works.
+  - 🟡 **Preload required** — the extension exists but isn't in `shared_preload_libraries`; clicking the badge opens the setup instructions.
+  - 🟡 **Extension required** — the library is loaded but the extension isn't created; clicking opens a modal with a one-click **Create extension** button.
+  - 🔴 **No connection** — the database itself is unreachable.
+  Warning/error badges are now clickable and self-explanatory. The redundant `?` info button and the header **Create extension** button were removed in favor of the badge-driven modals. Labels no longer use a negative "Not …" framing. Translations updated for `en` / `uk` / `ru`.
+- **pg_stat_statements status detection no longer reads `shared_preload_libraries`.** That setting requires the `pg_read_all_settings` role and is unreadable by a typical monitoring user, which made the "preloaded but extension missing" state unreachable. State is now derived entirely from signals every role can observe: connectivity (`SELECT 1`), extension presence in `pg_extension`, and whether the `pg_stat_statements` view is queryable. `pg_stat_statements_status` gains a `connected:` key, and `PgReports.system.connected?` is a new public helper.
+- **Primary buttons toned down.** `btn-primary` (Start monitoring, Run report, Create extension, …) switched from a solid accent fill to a subtle tinted style, so it reads as the accent action without dominating the page.
+- **Live-metrics "long queries" threshold lowered from 60s to 5s** — the default the top-of-dashboard tile counts against.
+- **Header/layout polish** — the status badge, settings button, and Reset button are unified to the same height; the settings button is now square; the pg_stat_statements category warning banner no longer overhangs its card; and the "scope: host application" note in the query monitor uses a real styled tooltip (hover + keyboard focus) instead of the unreliable native `title`.
+- **README trimmed**: standalone, Telegram, and Grafana/Prometheus details moved to dedicated docs ([docs/standalone.md](docs/standalone.md), [docs/telegram.md](docs/telegram.md), [docs/grafana.md](docs/grafana.md)).
+
+### Fixed
+
+- **Query Monitor no longer records pg_reports' own queries.** Internal queries (live-metrics polling, status checks, database listing) run through `Executor`/`Target` are now tagged with a `"PgReports"` statement name, so `QueryMonitor#should_skip?` filters them by name regardless of backtrace depth. Previously the deep `ActiveSupport::Notifications` stack could push the pg_reports frames past the 30-frame backtrace scan, leaking these queries into the monitor history.
+- **Dashboard requests broke when the engine is mounted at the root path** (e.g. standalone). The client base path resolved to `/`, so `fetch` URLs became `//live_metrics` — a protocol-relative URL the browser sent to a bogus host, breaking live metrics and report runs. The base now strips a trailing slash.
+
 ## [0.8.0] - 2026-05-01
 
 ### Added

data/README.md

@@ -7,10 +7,14 @@
 
 A comprehensive PostgreSQL monitoring and analysis library for Rails applications. Get insights into query performance, index usage, table statistics, connection health, and more — across **every database on the cluster**, switchable from the dashboard with no extra configuration. Includes a beautiful web dashboard, a Grafana / Prometheus exporter, and Telegram delivery.
 
+> [!NOTE]
+> **It now runs standalone, too** — launch the dashboard against any PostgreSQL database without a host Rails app, straight from the gem with a single command (`pg_reports server`). It still needs a Ruby runtime installed. Docker images (no Ruby required) are planned for the near future. See **[Standalone mode →](docs/standalone.md)**.
+
 ![Dashboard Screenshot](docs/dashboard.png)
 
 ## Features
 
+- 🚀 **Standalone or mounted** - Run inside your Rails app, or launch the dashboard on its own with `pg_reports server` (requires Ruby; Docker images coming soon).
 - 🗄️ **Multi-database** - Auto-discovers every database on the cluster and lets you switch from a dropdown in the dashboard. No configuration required.
 - 📊 **Query Analysis** - Identify slow, heavy, and expensive queries using `pg_stat_statements`
 - 📇 **Index Analysis** - Find unused, duplicate, invalid, and missing indexes
@@ -24,7 +28,8 @@ A comprehensive PostgreSQL monitoring and analysis library for Rails application
 - 🔗 **IDE Integration** - Open source locations in VS Code, Cursor, RubyMine, or IntelliJ (with WSL support)
 - 📌 **Comparison Mode** - Save records to compare before/after optimization
 - 📊 **EXPLAIN ANALYZE** - Advanced query plan analyzer with problem detection and recommendations
-- 🔍 **SQL Query Monitoring** - Real-time monitoring of all executed SQL queries with source location tracking
+- 🖥️ **SQL Console** - Free-form SQL editor in a modal, run SELECT queries and view results directly from the dashboard
+- 🔍 **SQL Query Monitoring** - Real-time monitoring of all executed SQL queries with source location tracking (not available in standalone mode)
 - 🔌 **Connection Pool Analytics** - Monitor pool usage, wait times, saturation warnings, and connection churn
 - 🤖 **AI Prompt Export** - Copy a ready-to-paste prompt for Claude Code, Cursor, or Codex with problem context and report data
 - 🗑️ **Migration Generator** - Generate Rails migrations to drop unused indexes
@@ -61,6 +66,18 @@ Visit `http://localhost:3000/pg_reports`.
 
 For query analysis, also enable `pg_stat_statements` — see [setup instructions in docs/configuration.md](docs/configuration.md#pg_stat_statements-setup).
 
+## Standalone (no host app)
+
+You can also run the dashboard on its own, straight from the gem's root folder — no Rails app to mount it in. It serves at `/` on port **4000** and connects via `DATABASE_URL` or libpq env vars:
+
+```bash
+./bin/pg_reports server        # from a checkout; no `bundle exec` needed
+DATABASE_URL=postgres://user:pass@localhost/myapp bundle exec pg_reports server
+./bin/pg_reports server --allow-raw-query-execution   # opt into the Run SQL panel
+```
+
+Settings come from `PG_REPORTS_*` env vars, an auto-detected `./pg_reports.rb` config file (full `PgReports.configure` access), or CLI flags — in that order of precedence. Adds no runtime dependencies to the gem. **[Standalone guide → docs/standalone.md](docs/standalone.md)**
+
 ## Usage
 
 ```ruby
@@ -73,12 +90,9 @@ report = PgReports.expensive_queries
 report.to_text
 report.to_csv
 report.to_a
-
-# Telegram
-PgReports.slow_queries.send_to_telegram
 ```
 
-**[Full list of reports →](docs/reports.md)**
+**[Full list of reports →](docs/reports.md)**  ·  **[Send reports to Telegram →](docs/telegram.md)**
 
 ## Multi-database
 
@@ -100,8 +114,6 @@ PgReports works out of the box once mounted. Common options:
 ```ruby
 # config/initializers/pg_reports.rb
 PgReports.configure do |config|
-  config.telegram_bot_token           = ENV["PG_REPORTS_TELEGRAM_TOKEN"]
-  config.telegram_chat_id             = ENV["PG_REPORTS_TELEGRAM_CHAT_ID"]
   config.slow_query_threshold_ms      = 100
   config.unused_index_threshold_scans = 50
   config.bloat_threshold_percent      = 20
@@ -115,8 +127,8 @@ PgReports.configure do |config|
 end
 ```
 
-**Multi-database, thresholds, query monitor, Grafana, raw query execution, source tracking, locale, Telegram —**
-**[full reference in docs/configuration.md →](docs/configuration.md)**
+**Multi-database, thresholds, query monitor, raw query execution, source tracking, locale —**
+**[full reference in docs/configuration.md →](docs/configuration.md)**  ·  **[Telegram](docs/telegram.md)**  ·  **[Grafana / Prometheus](docs/grafana.md)**
 
 ## Report object
 
@@ -172,6 +184,19 @@ Requires `config.allow_raw_query_execution = true`.
 
 </details>
 
+<details>
+<summary><strong>SQL Console — free-form SQL editor</strong></summary>
+
+Click **SQL Console** in the header to open a large modal with a SQL editor. Type or paste a query, run it (⌘/Ctrl+Enter also works), and see the results in a table with row count and execution time.
+
+Only `SELECT` statements are allowed — the same denylist validation used for the query-hash based **Execute Query** panel (single statement, no `INSERT`/`UPDATE`/`DELETE`/`DROP`/`ALTER`/`CREATE`/`TRUNCATE`/`GRANT`/`REVOKE`) applies here, since this is client-typed SQL rather than a server-generated query. See [Security model](docs/configuration.md#security-model) for the full threat model and residual risks (this is a denylist, not a sandbox).
+
+Every query (here and in Execute Query / EXPLAIN ANALYZE) runs under a bounded `statement_timeout` (`config.raw_query_statement_timeout_ms`, default 5s) and these endpoints are rate-limited per client IP (`config.raw_query_rate_limit`, default 30/min) — see [Raw query execution](docs/configuration.md#raw-query-execution-explain-analyze--execute-query--sql-console).
+
+Requires `config.allow_raw_query_execution = true`.
+
+</details>
+
 <details>
 <summary><strong>SQL Query Monitor — real-time query capture</strong></summary>
 
@@ -194,6 +219,8 @@ end
 
 Use cases: debugging N+1, identifying slow queries during feature development, tracking down unexpected queries, teaching ActiveRecord behavior.
 
+Not available in [standalone mode](docs/standalone.md) — there is no host application process to subscribe to, so the panel and its API are both disabled.
+
 </details>
 
 <details>
@@ -240,66 +267,9 @@ The Export dropdown includes **Copy Prompt** (visible on actionable reports). It
 <details>
 <summary><strong>Grafana / Prometheus exporter</strong></summary>
 
-Expose selected reports at `<mount_point>/metrics` in Prometheus exposition format. The default mount is `/pg_reports`, so the endpoint is typically `/pg_reports/metrics` — but it follows whatever path you used in `mount PgReports::Engine, at: "..."`. Severity (`ok` / `warning` / `critical`) is derived automatically from the thresholds defined in [`Dashboard::ReportsRegistry::REPORT_CONFIG`](lib/pg_reports/dashboard/reports_registry.rb).
-
-```ruby
-PgReports.configure do |config|
-  config.grafana_favorites = [
-    :slow_queries,
-    :unused_indexes,
-    :bloated_tables,
-    :missing_validations,
-    :polymorphic_without_index
-  ]
-  config.grafana_metrics_token = ENV["PG_REPORTS_METRICS_TOKEN"]  # optional bearer token
-  config.grafana_cache_ttl     = 60                                # seconds
-end
-```
-
-Scrape with Prometheus:
-
-```yaml
-scrape_configs:
-  - job_name: pg_reports
-    metrics_path: /pg_reports/metrics    # adjust to your Engine mount point
-    scrape_interval: 60s
-    authorization: { credentials: "${PG_REPORTS_METRICS_TOKEN}" }
-    static_configs:
-      - targets: ["app.internal:3000"]
-```
-
-> [!WARNING]
-> Reports are cached via `Rails.cache` for `grafana_cache_ttl` so frequent scrapes don't hammer the database. Without it, Prometheus' default 15s scrape interval against heavy reports like `missing_validations` will DDoS your own DB. Always set a TTL ≥ scrape interval, and consider a longer per-report TTL for expensive reports.
-
-The exporter also emits a `pg_reports_row` series per report row (each column becomes a Prometheus label), so the auto-generated dashboard can show a **table panel** with the actual rows that need fixing — not just an aggregate count.
-
-Generate a matching Grafana dashboard from the same favorites:
-
-```bash
-bundle exec rake pg_reports:grafana:dashboard
-# writes pg_reports.json in pwd; then Dashboards → Import in Grafana
-```
-
-**[Full Grafana integration guide →](docs/grafana.md)** &nbsp;·&nbsp; **[Local Prometheus + Grafana without Docker →](docs/grafana-local-setup.md)**
-
-</details>
-
-<details>
-<summary><strong>Telegram delivery</strong></summary>
-
-Get a bot token from [@BotFather](https://t.me/BotFather) and your chat ID from [@userinfobot](https://t.me/userinfobot), then:
-
-```ruby
-PgReports.configure do |config|
-  config.telegram_bot_token = "123456:ABC-DEF..."
-  config.telegram_chat_id   = "-1001234567890"
-end
-
-PgReports.slow_queries.send_to_telegram
-PgReports.health_report.send_to_telegram_as_file
-```
+Expose selected reports at `<mount_point>/metrics` in Prometheus exposition format, with severity (`ok` / `warning` / `critical`) derived automatically from each report's thresholds. Reports are cached per a configurable TTL so frequent scrapes don't hammer the database, and a matching Grafana dashboard can be generated from the same favorites (`rake pg_reports:grafana:dashboard`).
 
-Reports under ~50 rows go as a message; larger ones are sent as a file attachment.
+**[Grafana / Prometheus integration guide →](docs/grafana.md)** &nbsp;·&nbsp; **[Local Prometheus + Grafana without Docker →](docs/grafana-local-setup.md)**
 
 </details>
 
@@ -323,8 +293,8 @@ bundle exec rubocop
 
 ## License
 
-MIT. See [LICENSE.txt](LICENSE.txt).
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
 
 ## Acknowledgments
 
-Inspired by [rails-pg-extras](https://github.com/pawurb/rails-pg-extras). UI built with [Claude](https://www.anthropic.com/claude) by Anthropic.
+Inspired by [rails-pg-extras](https://github.com/pawurb/rails-pg-extras) and built with ❤️ for the Rails community.

data/app/controllers/pg_reports/dashboard_controller.rb

@@ -15,6 +15,13 @@ module PgReports
     before_action :set_categories
     before_action :resolve_database_selection
     around_action :within_selected_database
+    before_action :block_query_monitor_in_standalone, only: %i[
+      start_query_monitoring stop_query_monitoring query_monitor_status
+      query_monitor_feed load_query_history download_query_monitor
+    ]
+    before_action :enforce_rate_limit!, only: %i[
+      explain_analyze execute_query run_query create_migration
+    ]
 
     helper_method :category_disabled_reason, :category_disabled?
 
@@ -70,7 +77,7 @@ module PgReports
     end
 
     def live_metrics
-      threshold = params[:long_query_threshold]&.to_i || 60
+      threshold = params[:long_query_threshold]&.to_i || 5
 
       # Check if we have access to required statistics
       begin
@@ -275,8 +282,11 @@ module PgReports
         return
       end
 
-      result = ActiveRecord::Base.connection.execute("EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) #{final_query}")
-      explain_output = result.map { |r| r["QUERY PLAN"] }.join("\n")
+      explain_output = nil
+      with_statement_timeout do
+        result = ActiveRecord::Base.connection.execute("EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT) #{final_query}")
+        explain_output = result.map { |r| r["QUERY PLAN"] }.join("\n")
+      end
 
       # Analyze the EXPLAIN output
       analyzer = ExplainAnalyzer.new(explain_output)
@@ -290,6 +300,8 @@ module PgReports
         problems: analysis[:problems],
         summary: analysis[:summary]
       }
+    rescue ActiveRecord::QueryCanceled
+      render json: {success: false, error: query_timed_out_message}, status: :unprocessable_entity
     rescue => e
       render json: {success: false, error: e.message}, status: :unprocessable_entity
     end
@@ -340,23 +352,95 @@ module PgReports
       # Execute with LIMIT to prevent huge result sets
       limited_query = add_limit_if_missing(final_query, 100)
 
-      start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-      result = ActiveRecord::Base.connection.execute(limited_query)
-      end_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-      execution_time = ((end_time - start_time) * 1000).round(2)
+      rows = columns = nil
+      total_count = 0
+      truncated = false
+      execution_time = nil
+
+      with_statement_timeout do
+        start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        result = ActiveRecord::Base.connection.execute(limited_query)
+        end_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        execution_time = ((end_time - start_time) * 1000).round(2)
+
+        rows = result.to_a
+        columns = rows.first&.keys || []
+        total_count = rows.size
+
+        # Check if we need to get total count
+        if rows.size >= 100
+          count_result = ActiveRecord::Base.connection.execute("SELECT COUNT(*) FROM (#{final_query}) AS count_query")
+          total_count = count_result.first["count"].to_i
+          truncated = total_count > 100
+        end
+      end
+
+      render json: {
+        success: true,
+        columns: columns,
+        rows: rows,
+        count: rows.size,
+        total_count: total_count,
+        truncated: truncated,
+        execution_time: execution_time
+      }
+    rescue ActiveRecord::QueryCanceled
+      render json: {success: false, error: query_timed_out_message}, status: :unprocessable_entity
+    rescue => e
+      render json: {success: false, error: e.message}, status: :unprocessable_entity
+    end
+
+    # POST /run_query
+    # Free-text SQL runner backing the "Run Query" modal. Unlike #execute_query
+    # (which only ever runs queries the server itself generated and cached by
+    # hash — see CHANGELOG 0.5.1), this endpoint accepts client-typed SQL
+    # directly, so it applies the same SELECT-only/denylist validation that
+    # normally happens on cache retrieval directly to the submitted text.
+    def run_query
+      raw_query = params[:query].to_s
 
-      rows = result.to_a
-      columns = rows.first&.keys || []
+      if raw_query.blank?
+        render json: {success: false, error: I18n.t("pg_reports.ui.errors.query_required")}, status: :unprocessable_entity
+        return
+      end
 
-      # Check if we need to get total count
-      total_count = rows.size
-      truncated = false
+      unless PgReports.config.allow_raw_query_execution
+        render json: {
+          success: false,
+          error: I18n.t("pg_reports.ui.errors.query_execution_disabled")
+        }, status: :forbidden
+        return
+      end
+
+      begin
+        enforce_select_only!(raw_query)
+      rescue SecurityError => e
+        render json: {success: false, error: "#{I18n.t("pg_reports.ui.errors.security_violation_prefix")} #{e.message}"}, status: :forbidden
+        return
+      end
 
-      if rows.size >= 100
-        # Check if there are more rows
-        count_result = ActiveRecord::Base.connection.execute("SELECT COUNT(*) FROM (#{final_query}) AS count_query")
-        total_count = count_result.first["count"].to_i
-        truncated = total_count > 100
+      limited_query = add_limit_if_missing(raw_query, 100)
+
+      rows = columns = nil
+      total_count = 0
+      truncated = false
+      execution_time = nil
+
+      with_statement_timeout do
+        start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        result = ActiveRecord::Base.connection.execute(limited_query)
+        end_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        execution_time = ((end_time - start_time) * 1000).round(2)
+
+        rows = result.to_a
+        columns = rows.first&.keys || []
+        total_count = rows.size
+
+        if rows.size >= 100
+          count_result = ActiveRecord::Base.connection.execute("SELECT COUNT(*) FROM (#{raw_query}) AS count_query")
+          total_count = count_result.first["count"].to_i
+          truncated = total_count > 100
+        end
       end
 
       render json: {
@@ -368,6 +452,8 @@ module PgReports
         truncated: truncated,
         execution_time: execution_time
       }
+    rescue ActiveRecord::QueryCanceled
+      render json: {success: false, error: query_timed_out_message}, status: :unprocessable_entity
     rescue => e
       render json: {success: false, error: e.message}, status: :unprocessable_entity
     end
@@ -668,6 +754,17 @@ module PgReports
     def category_disabled_reason(category)
       constraint = Dashboard::ReportsRegistry.target_constraint(category)
       return nil unless constraint == :primary_default_database_only
+
+      # In standalone mode there is no host application, so its ActiveRecord
+      # models don't exist — these reports would inspect nothing. Disable the
+      # whole category with an explanation instead of returning empty results.
+      if PgReports.config.standalone
+        return I18n.t("pg_reports.ui.categories.standalone_no_host_app_reason",
+          default: "🔒 This category isn't available in standalone mode — it " \
+            "inspects the host application's models, and there is no host app " \
+            "when running the dashboard on its own.")
+      end
+
       return nil if on_primary_default_database?
 
       I18n.t("pg_reports.ui.categories.primary_only_reason",
@@ -680,6 +777,51 @@ module PgReports
       category_disabled_reason(category).present?
     end
 
+    # SQL Query Monitor taps ActiveSupport::Notifications in the host
+    # application's process. In standalone mode there is no host app — pg_reports
+    # is the only process running, so there's nothing meaningful to observe.
+    # Blocks the API even if a client calls it directly (the UI panel is also
+    # hidden in standalone, see dashboard/index view).
+    def block_query_monitor_in_standalone
+      return unless PgReports.config.standalone
+
+      render json: {
+        success: false,
+        error: I18n.t("pg_reports.ui.errors.query_monitor_unavailable_standalone")
+      }, status: :forbidden
+    end
+
+    # Soft per-IP throttle for the dashboard's privileged raw-query and
+    # migration endpoints. This is not a hardened distributed rate limiter —
+    # just a best-effort guard against a single client hammering these
+    # expensive/privileged actions, backed by Rails.cache (works with or
+    # without a shared cache backend across processes). Fails open if the
+    # cache is unavailable, consistent with the rest of the dashboard (see
+    # #resolve_database_selection, #retrieve_query_by_hash).
+    def enforce_rate_limit!
+      limit = PgReports.config.raw_query_rate_limit
+      return if limit.nil?
+
+      window = PgReports.config.raw_query_rate_limit_window_seconds
+      key = "pg_reports:rate_limit:#{request.remote_ip}:#{params[:action]}"
+
+      count = begin
+        current = (Rails.cache.read(key) || 0) + 1
+        Rails.cache.write(key, current, expires_in: window)
+        current
+      rescue => e
+        Rails.logger.warn("PgReports: Rate limit cache unavailable: #{e.message}") if defined?(Rails.logger)
+        return
+      end
+
+      return if count <= limit
+
+      render json: {
+        success: false,
+        error: I18n.t("pg_reports.ui.errors.rate_limit_exceeded")
+      }, status: :too_many_requests
+    end
+
     def on_primary_default_database?
       return true if @target_default_database.nil?
 
@@ -768,7 +910,15 @@ module PgReports
         return nil
       end
 
-      # Strict validation: must be a SELECT query only
+      enforce_select_only!(query)
+
+      query
+    end
+
+    # Strict validation: must be a single SELECT statement, no dangerous
+    # keywords. This is a denylist, not a sandbox (see docs/configuration.md)
+    # — shared by #retrieve_query_by_hash and the free-text #run_query action.
+    def enforce_select_only!(query)
       normalized = query.strip.gsub(/\s+/, " ").downcase
 
       # Check for semicolons (prevents multiple statements)
@@ -788,8 +938,24 @@ module PgReports
           raise SecurityError, "Dangerous keyword detected: #{keyword.upcase}"
         end
       end
+    end
 
-      query
+    # Bounds how long a single raw-query execution (Execute Query / EXPLAIN
+    # ANALYZE / SQL Console) can run, so a runaway query can't hang the
+    # connection indefinitely. SET LOCAL only takes effect inside a
+    # transaction and reverts automatically at its end (commit or rollback) —
+    # safe here since every caller only ever runs SELECTs.
+    def with_statement_timeout
+      ActiveRecord::Base.transaction do
+        timeout_ms = PgReports.config.raw_query_statement_timeout_ms.to_i
+        ActiveRecord::Base.connection.execute("SET LOCAL statement_timeout = #{timeout_ms}") if timeout_ms.positive?
+        yield
+      end
+    end
+
+    def query_timed_out_message
+      I18n.t("pg_reports.ui.errors.query_timed_out",
+        ms: PgReports.config.raw_query_statement_timeout_ms.to_i)
     end
 
     def generate_query_monitor_csv(queries)