@swestash/agent-lens 0.9.3 → 0.9.5

package/dist/agent-lens.js

@@ -2424,7 +2424,7 @@ function parseStored(json, where) {
 }
 
 // ../ingest/dist/classify.js
-var CLASSIFIER_VERSION = 2;
+var CLASSIFIER_VERSION = 3;
 var CATEGORIES = ["bugfix", "refactor", "docs", "ops", "review", "feature", "chore"];
 var BANDS = [
   { max: 22, band: "trivial" },
@@ -2467,14 +2467,23 @@ function band(score) {
   return "xl";
 }
 var clamp01 = (x) => x < 0 ? 0 : x > 1 ? 1 : x;
+var WORD_RE = /* @__PURE__ */ new Map();
+function wordRe(phrase) {
+  let re = WORD_RE.get(phrase);
+  if (!re) {
+    const escaped = phrase.trim().replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    re = new RegExp(`\\b${escaped}\\b`, "g");
+    WORD_RE.set(phrase, re);
+  }
+  return re;
+}
 function hits(text, words) {
   let n = 0;
   for (const w of words) {
-    let i = text.indexOf(w);
-    while (i !== -1) {
+    const re = wordRe(w);
+    re.lastIndex = 0;
+    while (re.exec(text) !== null)
       n++;
-      i = text.indexOf(w, i + w.length);
-    }
   }
   return n;
 }
@@ -2496,9 +2505,9 @@ function scoreCategories(s, text, files) {
   scores.bugfix += hits(t, ["bug", "fix", "broken", "crash", "regression", "traceback", "stack trace", "failing", "error", "exception", "not working"]) * 1;
   scores.refactor += hits(t, ["refactor", "clean up", "cleanup", "rename", "extract", "simplify", "dead code", "tidy", "reorganize", "restructure"]) * 1;
   scores.docs += hits(t, ["readme", "document", "documentation", "changelog", "docstring", "comment", "write docs", "usage guide"]) * 1;
-  scores.ops += hits(t, ["deploy", "docker", "pipeline", "ci/cd", "ci ", "systemd", "infra", "kubernetes", "terraform", "release", "rollback", "container"]) * 1;
+  scores.ops += hits(t, ["deploy", "docker", "pipeline", "ci/cd", "ci", "systemd", "infra", "kubernetes", "terraform", "release", "rollback", "container"]) * 1;
   scores.review += hits(t, ["review", "audit", "inspect", "look over", "feedback on"]) * 1;
-  scores.feature += hits(t, ["add ", "implement", "build ", "create ", "feature", "support for", "new feature"]) * 0.8;
+  scores.feature += hits(t, ["add", "implement", "build", "create", "feature", "support for", "new feature"]) * 0.8;
   const docFiles = s.loc.files > 0 ? countMatch(files, DOC_EXT) : 0;
   const opsFiles = s.loc.files > 0 ? countMatch(files, OPS_FILE) : 0;
   if (s.loc.files > 0) {
@@ -4305,6 +4314,9 @@ function tableExists(db, name) {
 function queryAll(db, sql, ...params) {
   return db.prepare(sql).all(...params);
 }
+function queryGet(db, sql, ...params) {
+  return db.prepare(sql).get(...params);
+}
 function pushDateRange(clauses, params, col, from, to) {
   if (from) {
     clauses.push(`date(${col}) >= date(?)`);
@@ -4325,6 +4337,16 @@ function orderBy(columns, sort, fallback, dir) {
   const col = sort !== void 0 && Object.hasOwn(columns, sort) ? columns[sort] : columns[fallback];
   return `${col} ${dir === "asc" ? "ASC" : "DESC"}`;
 }
+function pageLimit(raw, fallback, max) {
+  const n = Math.floor(Number(raw));
+  if (!Number.isFinite(n) || n < 1)
+    return Math.min(fallback, max);
+  return Math.min(n, max);
+}
+function pageOffset(raw) {
+  const n = Math.floor(Number(raw));
+  return Number.isFinite(n) && n > 0 ? n : 0;
+}
 function pushGrouped(map, key, value) {
   const list = map.get(key);
   if (list)
@@ -4400,22 +4422,17 @@ function extractParts(rawJson) {
   return { text: text || null, thinking: thinking || null };
 }
 function listSources(db) {
-  return db.prepare(
-    // Count MAIN sessions only (is_sidechain = 0): the dropdown filters the session list, which
-    // defaults to main-only, so a source's count must match what you'd see — not be inflated by the
-    // many subagent sidechains each task spawns.
-    `SELECT s.id, s.label, s.agent_id, s.config_dir,
-              (SELECT COUNT(*) FROM sessions x WHERE x.source_id = s.id AND x.is_sidechain = 0) AS session_count
-       FROM sources s ORDER BY s.label`
-  ).all();
+  return queryAll(db, `SELECT s.id, s.label,
+            (SELECT COUNT(*) FROM sessions x WHERE x.source_id = s.id AND x.is_sidechain = 0) AS session_count
+     FROM sources s ORDER BY s.label`);
 }
 function listProjects(db) {
-  return db.prepare(`SELECT p.id, p.path,
-              (SELECT COUNT(*) FROM sessions x WHERE x.project_id = p.id AND x.is_sidechain = 0) AS session_count
-       FROM projects p ORDER BY session_count DESC, p.path`).all();
+  return queryAll(db, `SELECT p.id, p.path,
+            (SELECT COUNT(*) FROM sessions x WHERE x.project_id = p.id AND x.is_sidechain = 0) AS session_count
+     FROM projects p ORDER BY session_count DESC, p.path`);
 }
 function listModels(db) {
-  return db.prepare(`SELECT DISTINCT model FROM token_usage WHERE model IS NOT NULL ORDER BY model`).all().map((r) => r.model);
+  return queryAll(db, `SELECT DISTINCT model FROM token_usage WHERE model IS NOT NULL ORDER BY model`).map((r) => r.model);
 }
 function toFtsQuery(raw) {
   return raw.trim().split(/\s+/).filter(Boolean).map((t) => `"${t.replace(/"/g, '""')}"`).join(" ");
@@ -4452,8 +4469,8 @@ function listSessions(db, f) {
     params.push(toFtsQuery(f.q), like, like, like);
   }
   const whereSql = where.length ? `WHERE ${where.join(" AND ")}` : "";
-  const total = db.prepare(`SELECT COUNT(*) n FROM sessions s ${whereSql}`).get(...params).n;
-  const baseSelect = `SELECT s.id, s.ai_title, s.slug, s.source_id, s.is_sidechain, s.started_at, s.ended_at,
+  const total = queryGet(db, `SELECT COUNT(*) n FROM sessions s ${whereSql}`, ...params).n;
+  const baseSelect = `SELECT s.id, s.ai_title, s.slug, s.source_id, s.is_sidechain, s.started_at,
               s.duration_ms, s.event_count, s.turn_count, p.path AS project_path,
               (SELECT GROUP_CONCAT(DISTINCT model) FROM token_usage t WHERE t.session_id = s.id) AS models,
               (SELECT COUNT(*) FROM tool_calls tc WHERE tc.session_id = s.id) AS tool_call_count,
@@ -4472,10 +4489,9 @@ function listSessions(db, f) {
   };
   const sortKey = f.sort ?? "started";
   const JS_SORT = /* @__PURE__ */ new Set(["tokens", "cost", "errors", "security"]);
-  let rows;
+  let sessions;
   if (JS_SORT.has(sortKey)) {
-    const all = db.prepare(baseSelect).all(...params);
-    attachSessionCost(db, all);
+    const all = attachSessionCost(db, queryAll(db, baseSelect, ...params));
     const sign = f.dir === "asc" ? 1 : -1;
     const metric = (r) => {
       switch (sortKey) {
@@ -4496,12 +4512,11 @@ function listSessions(db, f) {
       const c = (metric(a) - metric(b)) * sign;
       return c !== 0 ? c : String(a.id).localeCompare(String(b.id));
     });
-    rows = all.slice(f.offset, f.offset + f.limit);
+    sessions = all.slice(f.offset, f.offset + f.limit);
   } else {
-    rows = db.prepare(`${baseSelect} ORDER BY ${orderBy(NATIVE_ORDER, sortKey, "started", f.dir)}, s.id ASC LIMIT ? OFFSET ?`).all(...params, f.limit, f.offset);
-    attachSessionCost(db, rows);
+    sessions = attachSessionCost(db, queryAll(db, `${baseSelect} ORDER BY ${orderBy(NATIVE_ORDER, sortKey, "started", f.dir)}, s.id ASC LIMIT ? OFFSET ?`, ...params, f.limit, f.offset));
   }
-  return { total, sessions: rows };
+  return { total, sessions };
 }
 function attachSessionCost(db, rows) {
   const usageBySession = /* @__PURE__ */ new Map();
@@ -4517,21 +4532,18 @@ function attachSessionCost(db, rows) {
       usageBySession.set(u.session_id, list);
     }
   }
-  for (const r of rows) {
+  return rows.map(({ ai_title, slug, ...r }) => {
     const u = usageBySession.get(r.id) ?? [];
     const split = splitOf(u);
-    r.tokens = tokensOf(split);
-    r.token_split = split;
-    r.cost = costOf(u);
-    r.title = r.ai_title || r.slug || null;
-  }
+    return { ...r, tokens: tokensOf(split), token_split: split, cost: costOf(u), title: ai_title || slug || null };
+  });
 }
 function loadToolCalls(db, id) {
-  const toolRows = db.prepare(`SELECT id, event_uuid, tool_name, skill_name, skill_id, agent_type, spawned_session_id,
-              workflow_run_id, workflow_name, status, error_type,
-              total_duration_ms, total_tokens, input_json, result_summary,
-              (SELECT COUNT(*) FROM sessions s WHERE s.workflow_run_id = tool_calls.workflow_run_id) AS workflow_agent_count
-       FROM tool_calls WHERE session_id = ?`).all(id);
+  const toolRows = queryAll(db, `SELECT id, event_uuid, tool_name, skill_name, skill_id, agent_type, spawned_session_id,
+            workflow_run_id, workflow_name, status, error_type,
+            total_duration_ms, input_json, result_summary,
+            (SELECT COUNT(*) FROM sessions s WHERE s.workflow_run_id = tool_calls.workflow_run_id) AS workflow_agent_count
+     FROM tool_calls WHERE session_id = ?`, id);
   if (tableExists(db, "tool_results")) {
     const getFull = db.prepare("SELECT text, bytes FROM tool_results WHERE session_id = ? AND name = ?");
     for (const t of toolRows) {
@@ -4549,8 +4561,8 @@ function loadFindings(db, id, toolRows) {
   if (!tableExists(db, "findings"))
     return [];
   const sessionFindings = [];
-  const findingRows = db.prepare(`SELECT id, tool_call_id, event_uuid, turn_id, rule_id, category, framework_ref, severity, title, evidence, signals_json
-       FROM findings WHERE session_id = ?`).all(id);
+  const findingRows = queryAll(db, `SELECT id, tool_call_id, event_uuid, turn_id, rule_id, category, framework_ref, severity, title, evidence, signals_json
+     FROM findings WHERE session_id = ?`, id);
   const byToolCall = /* @__PURE__ */ new Map();
   for (const fr of findingRows) {
     const f = {
@@ -4564,6 +4576,7 @@ function loadFindings(db, id, toolRows) {
       severity: fr.severity,
       title: fr.title,
       evidence: fr.evidence,
+      // Asserted, not validated: safeJson returns unknown and this is the assertion (ADR-026).
       signals: safeJson(fr.signals_json)
     };
     sessionFindings.push(f);
@@ -4571,13 +4584,16 @@ function loadFindings(db, id, toolRows) {
       pushGrouped(byToolCall, fr.tool_call_id, f);
   }
   for (const t of toolRows)
-    t.findings = byToolCall.get(t.id) ?? [];
+    t.findings = t.id ? byToolCall.get(t.id) ?? [] : [];
   sessionFindings.sort((a, b) => severityRank(b.severity) - severityRank(a.severity));
   return sessionFindings;
 }
+function toResponseToolCall({ event_uuid: _e, error_type: _t, ...call }) {
+  return call;
+}
 function loadEvents(db, id, toolRows) {
-  const eventRows = db.prepare(`SELECT uuid, type, role, timestamp, model, is_sidechain, turn_id, raw_json
-       FROM events WHERE session_id = ? ORDER BY timestamp, seq`).all(id);
+  const eventRows = queryAll(db, `SELECT uuid, type, role, timestamp, model, is_sidechain, turn_id, raw_json
+     FROM events WHERE session_id = ? ORDER BY timestamp, seq`, id);
   const toolsByEvent = /* @__PURE__ */ new Map();
   for (const t of toolRows) {
     if (!t.event_uuid)
@@ -4596,13 +4612,13 @@ function loadEvents(db, id, toolRows) {
       turn_id: e.turn_id,
       text,
       thinking,
-      toolCalls: toolsByEvent.get(e.uuid) ?? []
+      toolCalls: (toolsByEvent.get(e.uuid) ?? []).map(toResponseToolCall)
     };
   });
 }
 function loadClassification(db, id) {
-  const cls = db.prepare(`SELECT category, complexity_score, complexity_band, signals_json, classifier_version
-       FROM classifications WHERE scope = 'session' AND target_id = ?`).get(id);
+  const cls = queryGet(db, `SELECT category, complexity_score, complexity_band, signals_json, classifier_version
+     FROM classifications WHERE scope = 'session' AND target_id = ?`, id);
   if (!cls)
     return null;
   let signals = null;
@@ -4621,66 +4637,67 @@ function loadClassification(db, id) {
 function loadParent(db, session) {
   if (!session.parent_session_id)
     return null;
-  const p = db.prepare(`SELECT ps.id, ps.ai_title, ps.slug, t.seq AS turn_seq
-       FROM sessions ps LEFT JOIN turns t ON t.id = ?
-       WHERE ps.id = ?`).get(session.parent_turn_id, session.parent_session_id);
+  const p = queryGet(db, `SELECT ps.id, ps.ai_title, ps.slug, t.seq AS turn_seq
+     FROM sessions ps LEFT JOIN turns t ON t.id = ?
+     WHERE ps.id = ?`, session.parent_turn_id, session.parent_session_id);
   return p ? { id: p.id, title: p.ai_title || p.slug || null, turn_seq: p.turn_seq ?? null } : null;
 }
 function loadChildren(db, id) {
   const hasMeta = tableExists(db, "session_meta");
-  const children = db.prepare(`SELECT s.id, s.ai_title, s.slug, s.turn_count, s.started_at, s.workflow_run_id,
-              (SELECT GROUP_CONCAT(DISTINCT model) FROM token_usage t WHERE t.session_id = s.id) AS models
-              ${metaProjection(hasMeta)}
-       FROM sessions s ${metaJoin(hasMeta)}
-       WHERE s.parent_session_id = ? ORDER BY s.started_at`).all(id);
-  for (const ch of children) {
-    ch.title = ch.ai_title || ch.slug || null;
+  const children = queryAll(db, `SELECT s.id, s.ai_title, s.slug, s.turn_count, s.started_at, s.workflow_run_id,
+            (SELECT GROUP_CONCAT(DISTINCT model) FROM token_usage t WHERE t.session_id = s.id) AS models
+            ${metaProjection(hasMeta)}
+     FROM sessions s ${metaJoin(hasMeta)}
+     WHERE s.parent_session_id = ? ORDER BY s.started_at`, id);
+  return children.map(({ ai_title, slug, ...ch }) => {
     const u = sessionUsage(db, ch.id);
-    ch.tokens = tokensOf(splitOf(u));
-    ch.cost = costOf(u);
-  }
-  return children;
+    return { ...ch, title: ai_title || slug || null, tokens: tokensOf(splitOf(u)), cost: costOf(u) };
+  });
 }
 function loadWorkflowRuns(db, id) {
   const hasWR = tableExists(db, "workflow_results");
-  return db.prepare(`SELECT tc.workflow_run_id AS run_id, tc.workflow_name AS name, t.seq AS turn_seq,
-              (SELECT COUNT(*) FROM sessions s WHERE s.workflow_run_id = tc.workflow_run_id) AS agent_count
-              ${hasWR ? ", (SELECT status FROM workflow_results wr WHERE wr.run_id = tc.workflow_run_id) AS status" : ", NULL AS status"}
-       FROM tool_calls tc LEFT JOIN turns t ON t.id = tc.turn_id
-       WHERE tc.session_id = ? AND tc.workflow_run_id IS NOT NULL
-       ORDER BY t.seq`).all(id);
+  return queryAll(db, `SELECT tc.workflow_run_id AS run_id, tc.workflow_name AS name, t.seq AS turn_seq,
+            (SELECT COUNT(*) FROM sessions s WHERE s.workflow_run_id = tc.workflow_run_id) AS agent_count
+            ${hasWR ? ", (SELECT status FROM workflow_results wr WHERE wr.run_id = tc.workflow_run_id) AS status" : ", NULL AS status"}
+     FROM tool_calls tc LEFT JOIN turns t ON t.id = tc.turn_id
+     WHERE tc.session_id = ? AND tc.workflow_run_id IS NOT NULL
+     ORDER BY t.seq`, id);
 }
 function loadFileChanges(db, id) {
   if (!tableExists(db, "file_changes"))
     return [];
-  return db.prepare(`SELECT fc.id, fc.tool_call_id, fc.turn_id, fc.event_uuid, fc.file_path, fc.tool_name,
-              fc.lines_added, fc.lines_removed, fc.timestamp
-       FROM file_changes fc WHERE fc.session_id = ? ORDER BY fc.timestamp`).all(id);
+  return queryAll(db, `SELECT fc.id, fc.tool_call_id, fc.turn_id, fc.event_uuid, fc.file_path, fc.tool_name,
+            fc.lines_added, fc.lines_removed, fc.timestamp
+     FROM file_changes fc WHERE fc.session_id = ? ORDER BY fc.timestamp`, id);
 }
-function attachSessionTotals(db, session, id, toolRows) {
+function withSessionTotals(db, session, id, toolRows) {
   const usage = sessionUsage(db, id);
   const split = splitOf(usage);
-  session.tokens = tokensOf(split);
-  session.token_split = split;
-  session.cost = costOf(usage);
-  session.title = session.ai_title || session.slug || null;
-  session.tool_call_count = toolRows.length;
-  session.tool_error_count = toolRows.filter((t) => t.status === "error").length;
-  session.tool_rejection_count = toolRows.filter((t) => t.status === "error" && t.error_type && errorKind(t.error_type) === "rejection").length;
-  session.tool_failure_count = session.tool_error_count - session.tool_rejection_count;
+  const tool_error_count = toolRows.filter((t) => t.status === "error").length;
+  const tool_rejection_count = toolRows.filter((t) => t.status === "error" && t.error_type && errorKind(t.error_type) === "rejection").length;
+  return {
+    ...session,
+    tokens: tokensOf(split),
+    token_split: split,
+    cost: costOf(usage),
+    title: session.ai_title || session.slug || null,
+    tool_call_count: toolRows.length,
+    tool_error_count,
+    tool_rejection_count,
+    tool_failure_count: tool_error_count - tool_rejection_count
+  };
 }
 function getSession(db, id) {
-  const session = db.prepare(`SELECT s.*, p.path AS project_path FROM sessions s
-       LEFT JOIN projects p ON p.id = s.project_id WHERE s.id = ?`).get(id);
+  const session = queryGet(db, `SELECT s.*, p.path AS project_path FROM sessions s
+     LEFT JOIN projects p ON p.id = s.project_id WHERE s.id = ?`, id);
   if (!session)
     return null;
-  const turns = db.prepare("SELECT * FROM turns WHERE session_id = ? ORDER BY seq").all(id);
+  const turns = queryAll(db, "SELECT * FROM turns WHERE session_id = ? ORDER BY seq", id);
   const toolRows = loadToolCalls(db, id);
   const findings = loadFindings(db, id, toolRows);
   const events = loadEvents(db, id, toolRows);
-  attachSessionTotals(db, session, id, toolRows);
   return {
-    session,
+    session: withSessionTotals(db, session, id, toolRows),
     turns,
     events,
     classification: loadClassification(db, id),
@@ -4705,27 +4722,26 @@ function safeJson(s) {
 }
 function loadAgents(db, runId) {
   const hasMeta = tableExists(db, "session_meta");
-  const agents = db.prepare(`SELECT s.id, s.ai_title, s.slug, s.turn_count, s.started_at, s.ended_at, s.duration_ms,
-              (SELECT GROUP_CONCAT(DISTINCT model) FROM token_usage t WHERE t.session_id = s.id) AS models
-              ${metaProjection(hasMeta)}
-       FROM sessions s ${metaJoin(hasMeta)}
-       WHERE s.workflow_run_id = ? ORDER BY s.started_at`).all(runId);
+  const agentRows = queryAll(db, `SELECT s.id, s.ai_title, s.slug, s.turn_count, s.started_at, s.ended_at, s.duration_ms,
+            (SELECT GROUP_CONCAT(DISTINCT model) FROM token_usage t WHERE t.session_id = s.id) AS models
+            ${metaProjection(hasMeta)}
+     FROM sessions s ${metaJoin(hasMeta)}
+     WHERE s.workflow_run_id = ? ORDER BY s.started_at`, runId);
   let total_tokens = 0;
   let total_cost = 0;
   let started_at = null;
   let ended_at = null;
-  for (const a of agents) {
-    a.title = a.ai_title || a.slug || null;
-    const u = sessionUsage(db, a.id);
-    a.tokens = tokensOf(splitOf(u));
-    a.cost = costOf(u);
+  const agents = agentRows.map(({ ai_title, slug, ...r }) => {
+    const u = sessionUsage(db, r.id);
+    const a = { ...r, title: ai_title || slug || null, tokens: tokensOf(splitOf(u)), cost: costOf(u) };
     total_tokens += a.tokens;
     total_cost += a.cost;
     if (a.started_at && (!started_at || a.started_at < started_at))
       started_at = a.started_at;
     if (a.ended_at && (!ended_at || a.ended_at > ended_at))
       ended_at = a.ended_at;
-  }
+    return a;
+  });
   const duration_ms = started_at && ended_at ? new Date(ended_at).getTime() - new Date(started_at).getTime() : null;
   return {
     agents,
@@ -4735,9 +4751,9 @@ function loadAgents(db, runId) {
 function parseCompletion(db, wf) {
   if (!wf.tool_use_id || !wf.parent_session_id)
     return null;
-  const ev = db.prepare(`SELECT raw_json FROM events
-       WHERE session_id = ? AND text LIKE '%<task-notification>%' AND text LIKE ?
-       ORDER BY timestamp DESC LIMIT 1`).get(wf.parent_session_id, `%${wf.tool_use_id}%`);
+  const ev = queryGet(db, `SELECT raw_json FROM events
+     WHERE session_id = ? AND text LIKE '%<task-notification>%' AND text LIKE ?
+     ORDER BY timestamp DESC LIMIT 1`, wf.parent_session_id, `%${wf.tool_use_id}%`);
   if (!ev)
     return null;
   const { text } = extractParts(ev.raw_json);
@@ -4745,9 +4761,9 @@ function parseCompletion(db, wf) {
   return { status: xmlTag(t, "status"), summary: xmlTag(t, "summary"), result: xmlTag(t, "result"), failures: xmlTag(t, "failures") };
 }
 function loadRunSidecar(db, runId, completion) {
-  const wr = tableExists(db, "workflow_results") ? db.prepare(`SELECT status, summary, default_model, result_json, phases_json, logs_json, progress_json,
-                  agent_count, total_tokens, total_tool_calls, duration_ms, started_at, ended_at
-           FROM workflow_results WHERE run_id = ?`).get(runId) : null;
+  const wr = tableExists(db, "workflow_results") ? queryGet(db, `SELECT status, summary, default_model, result_json, phases_json, logs_json, progress_json,
+                agent_count, total_tokens, total_tool_calls, duration_ms, started_at, ended_at
+         FROM workflow_results WHERE run_id = ?`, runId) ?? null : null;
   if (!wr)
     return { wr: null, run: null, completion };
   const run = {
@@ -4760,6 +4776,8 @@ function loadRunSidecar(db, runId, completion) {
     duration_ms: wr.duration_ms ?? null,
     started_at: wr.started_at ?? null,
     ended_at: wr.ended_at ?? null,
+    // The three JSON blobs are asserted, not validated (ADR-026): safeJson yields null for malformed
+    // stored text, and these casts are what claims the shape of everything else.
     phases: safeJson(wr.phases_json),
     logs: safeJson(wr.logs_json),
     // The per-phase/per-agent event timeline (workflowProgress) — lets the page render a phase graph
@@ -4777,16 +4795,16 @@ function loadRunSidecar(db, runId, completion) {
   return { wr, run, completion };
 }
 function getWorkflow(db, runId) {
-  const wf = db.prepare(`SELECT tc.id AS tool_use_id, tc.workflow_run_id AS run_id, tc.workflow_name AS name, tc.status, tc.result_summary,
-              tc.input_json AS input_json,
-              tc.session_id AS parent_session_id, t.seq AS turn_seq,
-              ps.ai_title AS parent_ai_title, ps.slug AS parent_slug
-       FROM tool_calls tc
-       LEFT JOIN turns t ON t.id = tc.turn_id
-       LEFT JOIN sessions ps ON ps.id = tc.session_id
-       WHERE tc.workflow_run_id = ? AND tc.tool_name = 'Workflow'
-       ORDER BY t.seq
-       LIMIT 1`).get(runId);
+  const wf = queryGet(db, `SELECT tc.id AS tool_use_id, tc.workflow_run_id AS run_id, tc.workflow_name AS name, tc.status, tc.result_summary,
+            tc.input_json AS input_json,
+            tc.session_id AS parent_session_id, t.seq AS turn_seq,
+            ps.ai_title AS parent_ai_title, ps.slug AS parent_slug
+     FROM tool_calls tc
+     LEFT JOIN turns t ON t.id = tc.turn_id
+     LEFT JOIN sessions ps ON ps.id = tc.session_id
+     WHERE tc.workflow_run_id = ? AND tc.tool_name = 'Workflow'
+     ORDER BY t.seq
+     LIMIT 1`, runId);
   if (!wf)
     return null;
   const { agents, stats } = loadAgents(db, runId);
@@ -4816,20 +4834,18 @@ function listSkills(db, f = {}) {
     where.push("s.source_id = ?"), params.push(f.source);
   if (f.project)
     where.push("s.project_id = ?"), params.push(f.project);
-  const rows = db.prepare(`SELECT tc.skill_name AS name,
-              COUNT(*) AS call_count,
-              COUNT(DISTINCT tc.skill_id) AS version_count,
-              MAX(e.timestamp) AS last_fired,
-              GROUP_CONCAT(DISTINCT s.source_id) AS sources
-       FROM tool_calls tc
-       JOIN sessions s ON s.id = tc.session_id
-       LEFT JOIN events e ON e.uuid = tc.event_uuid
-       WHERE ${where.join(" AND ")}
-       GROUP BY tc.skill_name
-       ORDER BY call_count DESC, name`).all(...params);
-  for (const r of rows)
-    r.sources = r.sources ? String(r.sources).split(",").filter(Boolean) : [];
-  return rows;
+  const rows = queryAll(db, `SELECT tc.skill_name AS name,
+            COUNT(*) AS call_count,
+            COUNT(DISTINCT tc.skill_id) AS version_count,
+            MAX(e.timestamp) AS last_fired,
+            GROUP_CONCAT(DISTINCT s.source_id) AS sources
+     FROM tool_calls tc
+     JOIN sessions s ON s.id = tc.session_id
+     LEFT JOIN events e ON e.uuid = tc.event_uuid
+     WHERE ${where.join(" AND ")}
+     GROUP BY tc.skill_name
+     ORDER BY call_count DESC, name`, ...params);
+  return rows.map((r) => ({ ...r, sources: r.sources ? String(r.sources).split(",").filter(Boolean) : [] }));
 }
 function listFiles(db, f = {}) {
   if (!tableExists(db, "file_changes"))
@@ -4852,7 +4868,7 @@ function listFiles(db, f = {}) {
        MAX(fc.timestamp) AS last_ts
      FROM file_changes fc${whereSql}
      GROUP BY fc.project_id, fc.file_path`;
-  const total = db.prepare(`SELECT COUNT(*) n FROM (${grouped})`).get(...params).n;
+  const total = queryGet(db, `SELECT COUNT(*) n FROM (${grouped})`, ...params).n;
   const ORDER = {
     last_ts: "last_ts",
     first_ts: "first_ts",
@@ -4862,9 +4878,9 @@ function listFiles(db, f = {}) {
   };
   const limit = Math.min(f.limit ?? 50, 200);
   const offset = f.offset ?? 0;
-  const files = db.prepare(`SELECT g.*, p.path AS project_path FROM (${grouped}) g
-       LEFT JOIN projects p ON p.id = g.project_id
-       ORDER BY ${orderBy(ORDER, f.sort, "last_ts", f.dir)}, g.file_path ASC LIMIT ? OFFSET ?`).all(...params, limit, offset);
+  const files = queryAll(db, `SELECT g.*, p.path AS project_path FROM (${grouped}) g
+     LEFT JOIN projects p ON p.id = g.project_id
+     ORDER BY ${orderBy(ORDER, f.sort, "last_ts", f.dir)}, g.file_path ASC LIMIT ? OFFSET ?`, ...params, limit, offset);
   return { total, files };
 }
 function getFileTimeline(db, filePath, projectId2) {
@@ -4874,15 +4890,15 @@ function getFileTimeline(db, filePath, projectId2) {
   let scope = "fc.file_path = ?";
   if (projectId2)
     scope += " AND fc.project_id = ?", params.push(projectId2);
-  const rows = db.prepare(`SELECT fc.id, fc.session_id, fc.turn_id, fc.event_uuid, fc.tool_name, fc.lines_added,
-              fc.lines_removed, fc.timestamp, fc.project_id,
-              s.ai_title, s.slug, s.source_id, s.started_at, t.seq AS turn_seq, t.prompt_preview,
-              p.path AS project_path
-       FROM file_changes fc
-       JOIN sessions s ON s.id = fc.session_id
-       LEFT JOIN turns t ON t.id = fc.turn_id
-       LEFT JOIN projects p ON p.id = fc.project_id
-       WHERE ${scope} ORDER BY fc.timestamp`).all(...params);
+  const rows = queryAll(db, `SELECT fc.id, fc.session_id, fc.turn_id, fc.event_uuid, fc.tool_name, fc.lines_added,
+            fc.lines_removed, fc.timestamp, fc.project_id,
+            s.ai_title, s.slug, s.source_id, s.started_at, t.seq AS turn_seq, t.prompt_preview,
+            p.path AS project_path
+     FROM file_changes fc
+     JOIN sessions s ON s.id = fc.session_id
+     LEFT JOIN turns t ON t.id = fc.turn_id
+     LEFT JOIN projects p ON p.id = fc.project_id
+     WHERE ${scope} ORDER BY fc.timestamp`, ...params);
   if (!rows.length)
     return null;
   const cat = tableExists(db, "classifications") ? db.prepare("SELECT category FROM classifications WHERE scope = 'session' AND target_id = ?") : null;
@@ -4931,22 +4947,21 @@ function getFileTimeline(db, filePath, projectId2) {
   };
 }
 function getSkill(db, name) {
-  const versions = db.prepare(`SELECT sk.id, sk.base_dir, sk.summary, sk.body, sk.body_bytes, sk.first_seen, sk.last_seen,
-              (SELECT COUNT(*) FROM tool_calls tc WHERE tc.skill_id = sk.id) AS call_count
-       FROM skills sk WHERE sk.name = ? ORDER BY sk.last_seen DESC, sk.id`).all(name);
-  const sessions = db.prepare(`SELECT s.id, s.ai_title, s.slug, s.source_id, s.started_at, p.path AS project_path,
-              tc.skill_id AS version_id, MIN(e.timestamp) AS fired_at, COUNT(*) AS fire_count
-       FROM tool_calls tc
-       JOIN sessions s ON s.id = tc.session_id
-       LEFT JOIN projects p ON p.id = s.project_id
-       LEFT JOIN events e ON e.uuid = tc.event_uuid
-       WHERE tc.tool_name = 'Skill' AND tc.skill_name = ?
-       GROUP BY s.id, tc.skill_id
-       ORDER BY fired_at DESC`).all(name);
-  if (!versions.length && !sessions.length)
+  const versions = queryAll(db, `SELECT sk.id, sk.base_dir, sk.summary, sk.body, sk.body_bytes, sk.first_seen, sk.last_seen,
+            (SELECT COUNT(*) FROM tool_calls tc WHERE tc.skill_id = sk.id) AS call_count
+     FROM skills sk WHERE sk.name = ? ORDER BY sk.last_seen DESC, sk.id`, name);
+  const sessionRows = queryAll(db, `SELECT s.id, s.ai_title, s.slug, s.source_id, s.started_at, p.path AS project_path,
+            tc.skill_id AS version_id, MIN(e.timestamp) AS fired_at, COUNT(*) AS fire_count
+     FROM tool_calls tc
+     JOIN sessions s ON s.id = tc.session_id
+     LEFT JOIN projects p ON p.id = s.project_id
+     LEFT JOIN events e ON e.uuid = tc.event_uuid
+     WHERE tc.tool_name = 'Skill' AND tc.skill_name = ?
+     GROUP BY s.id, tc.skill_id
+     ORDER BY fired_at DESC`, name);
+  if (!versions.length && !sessionRows.length)
     return null;
-  for (const s of sessions)
-    s.title = s.ai_title || s.slug || null;
+  const sessions = sessionRows.map(({ ai_title, slug, ...s }) => ({ ...s, title: ai_title || slug || null }));
   const call_count = sessions.reduce((a, s) => a + s.fire_count, 0);
   return { name, versions, sessions, call_count };
 }
@@ -4998,7 +5013,7 @@ function listFindings(db, f) {
   const whereSql = where.length ? `WHERE ${where.join(" AND ")}` : "";
   const dismissJoin = attached ? "LEFT JOIN triage.dismissed_findings d ON d.finding_id = f.id" : "";
   const triageCols = attached ? `, (d.finding_id IS NOT NULL) AS dismissed, d.note AS dismiss_note, d.dismissed_at, ${MUTED_SQL} AS muted` : `, 0 AS dismissed, NULL AS dismiss_note, NULL AS dismissed_at, 0 AS muted`;
-  const total = db.prepare(`SELECT COUNT(*) n FROM findings f JOIN sessions s ON s.id = f.session_id ${dismissJoin} ${whereSql}`).get(...w.params).n;
+  const total = queryGet(db, `SELECT COUNT(*) n FROM findings f JOIN sessions s ON s.id = f.session_id ${dismissJoin} ${whereSql}`, ...w.params).n;
   const ORDER = {
     severity: SEVERITY_RANK_SQL,
     session: "f.session_id",
@@ -5006,18 +5021,18 @@ function listFindings(db, f) {
     category: "f.category",
     time: "s.started_at"
   };
-  const findings = db.prepare(`SELECT f.id, f.session_id, f.tool_call_id, f.event_uuid, f.turn_id, f.rule_id, f.category,
-              f.framework_ref, f.severity, f.title, f.evidence, tc.tool_name,
-              COALESCE(s.ai_title, s.slug) AS session_title, s.source_id, s.is_sidechain,
-              s.started_at, p.path AS project_path, s.project_id ${triageCols}
-       FROM findings f
-       JOIN sessions s ON s.id = f.session_id
-       LEFT JOIN projects p ON p.id = s.project_id
-       LEFT JOIN tool_calls tc ON tc.id = f.tool_call_id
-       ${dismissJoin}
-       ${whereSql}
-       ORDER BY ${orderBy(ORDER, f.sort, "severity", f.dir)}, ${SEVERITY_RANK_SQL} DESC, f.id ASC
-       LIMIT ? OFFSET ?`).all(...w.params, f.limit, f.offset);
+  const findings = queryAll(db, `SELECT f.id, f.session_id, f.tool_call_id, f.event_uuid, f.turn_id, f.rule_id, f.category,
+            f.framework_ref, f.severity, f.title, f.evidence, tc.tool_name,
+            COALESCE(s.ai_title, s.slug) AS session_title, s.source_id, s.is_sidechain,
+            s.started_at, p.path AS project_path, s.project_id ${triageCols}
+     FROM findings f
+     JOIN sessions s ON s.id = f.session_id
+     LEFT JOIN projects p ON p.id = s.project_id
+     LEFT JOIN tool_calls tc ON tc.id = f.tool_call_id
+     ${dismissJoin}
+     ${whereSql}
+     ORDER BY ${orderBy(ORDER, f.sort, "severity", f.dir)}, ${SEVERITY_RANK_SQL} DESC, f.id ASC
+     LIMIT ? OFFSET ?`, ...w.params, f.limit, f.offset);
   return { total, findings };
 }
 function securitySummary(db) {
@@ -5029,15 +5044,15 @@ function securitySummary(db) {
   const dismissJoin = attached ? "LEFT JOIN triage.dismissed_findings d ON d.finding_id = f.id" : "";
   const base = `FROM findings f JOIN sessions s ON s.id = f.session_id ${dismissJoin}`;
   const openWhere = attached ? `WHERE d.finding_id IS NULL AND NOT ${MUTED_SQL}` : "";
-  const scalar = (sql) => db.prepare(sql).get().n;
+  const scalar = (sql) => queryGet(db, sql).n;
   const total = scalar(`SELECT COUNT(*) n ${base} ${openWhere}`);
   const sessions_flagged = scalar(`SELECT COUNT(DISTINCT f.session_id) n ${base} ${openWhere}`);
   const dismissed = attached ? scalar(`SELECT COUNT(*) n FROM findings f LEFT JOIN triage.dismissed_findings d ON d.finding_id = f.id WHERE d.finding_id IS NOT NULL`) : 0;
   const muted = attached ? scalar(`SELECT COUNT(*) n ${base} WHERE d.finding_id IS NULL AND ${MUTED_SQL}`) : 0;
-  const by_severity = db.prepare(`SELECT f.severity AS severity, COUNT(*) n ${base} ${openWhere} GROUP BY f.severity ORDER BY ${SEVERITY_RANK_SQL} DESC`).all();
-  const by_category = db.prepare(`SELECT f.category AS category, COUNT(*) n ${base} ${openWhere} GROUP BY f.category ORDER BY n DESC`).all();
-  const by_rule = db.prepare(`SELECT f.rule_id AS rule_id, f.category AS category, f.title AS title, COUNT(*) n, MAX(${SEVERITY_RANK_SQL}) AS rank
-       ${base} ${openWhere} GROUP BY f.rule_id ORDER BY rank DESC, n DESC`).all();
+  const by_severity = queryAll(db, `SELECT f.severity AS severity, COUNT(*) n ${base} ${openWhere} GROUP BY f.severity ORDER BY ${SEVERITY_RANK_SQL} DESC`);
+  const by_category = queryAll(db, `SELECT f.category AS category, COUNT(*) n ${base} ${openWhere} GROUP BY f.category ORDER BY n DESC`);
+  const by_rule = queryAll(db, `SELECT f.rule_id AS rule_id, f.category AS category, f.title AS title, COUNT(*) n, MAX(${SEVERITY_RANK_SQL}) AS rank
+     ${base} ${openWhere} GROUP BY f.rule_id ORDER BY rank DESC, n DESC`);
   return { total, sessions_flagged, dismissed, muted, by_severity, by_category, by_rule, categories };
 }
 
@@ -5071,7 +5086,11 @@ function renderSessionExport(db, id, level) {
   }));
   const { markdown } = exportMarkdown({ id: s.id, title: s.title, source: s.source_id, project: s.project_path, model: null, started_at: s.started_at, ended_at: s.ended_at }, events, { level });
   const suffix = level === "off" ? "" : ".redacted";
-  return { markdown, filename: `session-${id.slice(0, 8)}${suffix}.md` };
+  return { markdown, filename: `session-${filenameSafe(id.slice(0, 8))}${suffix}.md` };
+}
+function filenameSafe(s) {
+  const cleaned = s.replace(/[^A-Za-z0-9._-]/g, "_");
+  return cleaned === "" ? "session" : cleaned;
 }
 
 // ../server/dist/dashboard.js
@@ -5090,6 +5109,12 @@ function addUsage(acc, r) {
   acc.cache_creation += r.cw ?? 0;
   acc.cache_read += r.cr ?? 0;
 }
+var usageForCost = (u) => ({
+  input_tokens: u.i ?? 0,
+  output_tokens: u.o ?? 0,
+  cache_creation_input_tokens: u.cw ?? 0,
+  cache_read_input_tokens: u.cr ?? 0
+});
 function pct(sorted, p) {
   if (sorted.length === 0)
     return 0;
@@ -5109,11 +5134,11 @@ function workflowAgg(db, f) {
   if (!tableExists(db, "workflow_results"))
     return empty;
   const ww = workflowWhere(f);
-  const rows = db.prepare(`SELECT COALESCE(status, '(unknown)') status, COUNT(*) n,
-              SUM(COALESCE(total_tokens, 0)) tokens,
-              SUM(COALESCE(duration_ms, 0)) dur,
-              SUM(CASE WHEN duration_ms IS NOT NULL THEN 1 ELSE 0 END) dur_n
-       FROM workflow_results ${ww.sql} GROUP BY status ORDER BY n DESC`).all(...ww.params);
+  const rows = queryAll(db, `SELECT COALESCE(status, '(unknown)') status, COUNT(*) n,
+            SUM(COALESCE(total_tokens, 0)) tokens,
+            SUM(COALESCE(duration_ms, 0)) dur,
+            SUM(CASE WHEN duration_ms IS NOT NULL THEN 1 ELSE 0 END) dur_n
+     FROM workflow_results ${ww.sql} GROUP BY status ORDER BY n DESC`, ...ww.params);
   let total = 0, completed = 0, failed = 0, tokens = 0, durSum = 0, durN = 0;
   const by_status = rows.map((r) => {
     total += r.n;
@@ -5139,32 +5164,32 @@ function workflowAgg(db, f) {
 }
 function dashboardOverview(db, f) {
   const w = sessionWhere(f);
-  const counts = db.prepare(`SELECT
-         COUNT(*) sessions,
-         SUM(CASE WHEN is_sidechain=0 THEN 1 ELSE 0 END) main,
-         SUM(CASE WHEN is_sidechain=1 THEN 1 ELSE 0 END) subagent,
-         SUM(turn_count) turns,
-         COUNT(DISTINCT project_id) projects
-       FROM sessions s ${w.sql}`).get(...w.params);
-  const toolCount = db.prepare(`SELECT COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id ${w.sql}`).get(...w.params).n;
-  const usage = db.prepare(`SELECT t.model model, SUM(t.input_tokens) i, SUM(t.output_tokens) o,
-              SUM(t.cache_creation_input_tokens) cw, SUM(t.cache_read_input_tokens) cr
-       FROM token_usage t JOIN sessions s ON s.id = t.session_id ${w.sql}
-       GROUP BY t.model`).all(...w.params);
+  const counts = queryGet(db, `SELECT
+       COUNT(*) sessions,
+       SUM(CASE WHEN is_sidechain=0 THEN 1 ELSE 0 END) main,
+       SUM(CASE WHEN is_sidechain=1 THEN 1 ELSE 0 END) subagent,
+       SUM(turn_count) turns,
+       COUNT(DISTINCT project_id) projects
+     FROM sessions s ${w.sql}`, ...w.params);
+  const toolCount = queryGet(db, `SELECT COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id ${w.sql}`, ...w.params).n;
+  const usage = queryAll(db, `SELECT t.model model, SUM(t.input_tokens) i, SUM(t.output_tokens) o,
+            SUM(t.cache_creation_input_tokens) cw, SUM(t.cache_read_input_tokens) cr
+     FROM token_usage t JOIN sessions s ON s.id = t.session_id ${w.sql}
+     GROUP BY t.model`, ...w.params);
   const tokens = zeroSplit();
   let cost = 0;
   const unpriced = [];
   for (const u of usage) {
     addUsage(tokens, u);
-    cost += costForUsage(u.model, { input_tokens: u.i, output_tokens: u.o, cache_creation_input_tokens: u.cw, cache_read_input_tokens: u.cr });
+    cost += costForUsage(u.model, usageForCost(u));
     if (u.model && !rateForModel(u.model) && (u.i || u.o || u.cw || u.cr))
       unpriced.push(u.model);
   }
   const totalTokens = tokens.input + tokens.output + tokens.cache_creation + tokens.cache_read;
-  const durs = db.prepare(`SELECT tn.duration_ms d FROM turns tn JOIN sessions s ON s.id = tn.session_id
-         ${w.sql ? w.sql + " AND" : "WHERE"} tn.duration_ms IS NOT NULL ORDER BY tn.duration_ms`).all(...w.params).map((r) => r.d);
-  const sessDurs = db.prepare(`SELECT s.duration_ms d FROM sessions s
-         ${w.sql ? w.sql + " AND" : "WHERE"} s.is_sidechain = 0 AND s.duration_ms IS NOT NULL ORDER BY s.duration_ms`).all(...w.params).map((r) => r.d);
+  const durs = queryAll(db, `SELECT tn.duration_ms d FROM turns tn JOIN sessions s ON s.id = tn.session_id
+     ${w.sql ? w.sql + " AND" : "WHERE"} tn.duration_ms IS NOT NULL ORDER BY tn.duration_ms`, ...w.params).map((r) => r.d);
+  const sessDurs = queryAll(db, `SELECT s.duration_ms d FROM sessions s
+     ${w.sql ? w.sql + " AND" : "WHERE"} s.is_sidechain = 0 AND s.duration_ms IS NOT NULL ORDER BY s.duration_ms`, ...w.params).map((r) => r.d);
   return {
     range: { from: f.from ?? null, to: f.to ?? null, source: f.source ?? null },
     sessions: counts.sessions ?? 0,
@@ -5186,7 +5211,7 @@ function dashboardOverview(db, f) {
 }
 function chooseBucket(db, f) {
   const w = sessionWhere(f);
-  const r = db.prepare(`SELECT MIN(started_at) mn, MAX(started_at) mx FROM sessions s ${w.sql}`).get(...w.params);
+  const r = queryGet(db, `SELECT MIN(started_at) mn, MAX(started_at) mx FROM sessions s ${w.sql}`, ...w.params);
   if (!r?.mn || !r?.mx)
     return "day";
   const spanDays = (Date.parse(r.mx) - Date.parse(r.mn)) / 864e5;
@@ -5214,26 +5239,26 @@ function dashboardTimeseries(db, f, bucketParam) {
     }
     return r;
   };
-  for (const u of db.prepare(`SELECT ${expr} b, t.model model, SUM(t.input_tokens) i, SUM(t.output_tokens) o,
-              SUM(t.cache_creation_input_tokens) cw, SUM(t.cache_read_input_tokens) cr
-       FROM token_usage t JOIN sessions s ON s.id = t.session_id
-       ${w.sql} GROUP BY b, t.model`).all(...w.params)) {
+  for (const u of queryAll(db, `SELECT ${expr} b, t.model model, SUM(t.input_tokens) i, SUM(t.output_tokens) o,
+            SUM(t.cache_creation_input_tokens) cw, SUM(t.cache_read_input_tokens) cr
+     FROM token_usage t JOIN sessions s ON s.id = t.session_id
+     ${w.sql} GROUP BY b, t.model`, ...w.params)) {
     if (!u.b)
       continue;
     const r = get(u.b);
     addUsage(r, u);
-    r.cost += costForUsage(u.model, { input_tokens: u.i, output_tokens: u.o, cache_creation_input_tokens: u.cw, cache_read_input_tokens: u.cr });
+    r.cost += costForUsage(u.model, usageForCost(u));
   }
-  for (const s of db.prepare(`SELECT ${expr} b, COUNT(*) n FROM sessions s ${w.sql} GROUP BY b`).all(...w.params)) {
+  for (const s of queryAll(db, `SELECT ${expr} b, COUNT(*) n FROM sessions s ${w.sql} GROUP BY b`, ...w.params)) {
     if (s.b)
       get(s.b).sessions = s.n;
   }
-  for (const t of db.prepare(`SELECT ${expr} b, COUNT(*) n FROM turns tn JOIN sessions s ON s.id = tn.session_id ${w.sql} GROUP BY b`).all(...w.params)) {
+  for (const t of queryAll(db, `SELECT ${expr} b, COUNT(*) n FROM turns tn JOIN sessions s ON s.id = tn.session_id ${w.sql} GROUP BY b`, ...w.params)) {
     if (t.b)
       get(t.b).turns = t.n;
   }
-  for (const e of db.prepare(`SELECT ${expr} b, tc.error_type et, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${w.sql ? w.sql + " AND" : "WHERE"} tc.status = 'error' GROUP BY b, tc.error_type`).all(...w.params)) {
+  for (const e of queryAll(db, `SELECT ${expr} b, tc.error_type et, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
+     ${w.sql ? w.sql + " AND" : "WHERE"} tc.status = 'error' GROUP BY b, tc.error_type`, ...w.params)) {
     if (!e.b)
       continue;
     const r = get(e.b);
@@ -5249,53 +5274,60 @@ function dashboardTimeseries(db, f, bucketParam) {
 }
 var andWhere = (w) => w.sql ? w.sql + " AND" : "WHERE";
 function modelBreakdown(db, w) {
-  const modelRows = db.prepare(`SELECT t.model model, SUM(t.input_tokens) i, SUM(t.output_tokens) o,
-              SUM(t.cache_creation_input_tokens) cw, SUM(t.cache_read_input_tokens) cr,
-              COUNT(DISTINCT t.session_id) sessions
-       FROM token_usage t JOIN sessions s ON s.id = t.session_id ${w.sql}
-       GROUP BY t.model ORDER BY (SUM(t.input_tokens)+SUM(t.output_tokens)+SUM(t.cache_creation_input_tokens)+SUM(t.cache_read_input_tokens)) DESC`).all(...w.params);
+  const modelRows = queryAll(
+    db,
+    // COALESCE the bucket label, exactly as by_source does for a null source_id: token_usage.model is
+    // nullable and this GROUP BY — unlike the model FILTER list — does not exclude nulls, so a
+    // null-model bucket reaches the chart. It used to render as a nameless bar.
+    `SELECT COALESCE(t.model, '(unknown)') model, SUM(t.input_tokens) i, SUM(t.output_tokens) o,
+            SUM(t.cache_creation_input_tokens) cw, SUM(t.cache_read_input_tokens) cr,
+            COUNT(DISTINCT t.session_id) sessions
+     FROM token_usage t JOIN sessions s ON s.id = t.session_id ${w.sql}
+     GROUP BY t.model ORDER BY (SUM(t.input_tokens)+SUM(t.output_tokens)+SUM(t.cache_creation_input_tokens)+SUM(t.cache_read_input_tokens)) DESC`,
+    ...w.params
+  );
   return modelRows.map((u) => ({
     model: u.model,
     tokens: { input: u.i ?? 0, output: u.o ?? 0, cache_creation: u.cw ?? 0, cache_read: u.cr ?? 0 },
     total_tokens: (u.i ?? 0) + (u.o ?? 0) + (u.cw ?? 0) + (u.cr ?? 0),
-    cost: Number(costForUsage(u.model, { input_tokens: u.i, output_tokens: u.o, cache_creation_input_tokens: u.cw, cache_read_input_tokens: u.cr }).toFixed(4)),
+    cost: Number(costForUsage(u.model, usageForCost(u)).toFixed(4)),
     sessions: u.sessions ?? 0,
     priced: !!rateForModel(u.model)
   }));
 }
 function sourceBreakdown(db, w) {
-  return db.prepare(`SELECT COALESCE(s.source_id, '(none)') source, COUNT(*) sessions, SUM(s.turn_count) turns
-       FROM sessions s ${w.sql} GROUP BY s.source_id ORDER BY sessions DESC`).all(...w.params);
+  return queryAll(db, `SELECT COALESCE(s.source_id, '(none)') source, COUNT(*) sessions, SUM(s.turn_count) turns
+     FROM sessions s ${w.sql} GROUP BY s.source_id ORDER BY sessions DESC`, ...w.params);
 }
 function classificationBreakdowns(db, w) {
   const mainW = { sql: w.sql ? w.sql + " AND s.is_sidechain = 0" : "WHERE s.is_sidechain = 0", params: w.params };
-  const byCategory = db.prepare(`SELECT c.category, COUNT(*) n FROM classifications c JOIN sessions s ON s.id = c.target_id
-       ${mainW.sql} GROUP BY c.category ORDER BY n DESC`).all(...mainW.params);
-  const byComplexity = db.prepare(`SELECT c.complexity_band band, COUNT(*) n FROM classifications c JOIN sessions s ON s.id = c.target_id
-       ${mainW.sql} GROUP BY c.complexity_band ORDER BY n DESC`).all(...mainW.params);
+  const byCategory = queryAll(db, `SELECT c.category, COUNT(*) n FROM classifications c JOIN sessions s ON s.id = c.target_id
+     ${mainW.sql} GROUP BY c.category ORDER BY n DESC`, ...mainW.params);
+  const byComplexity = queryAll(db, `SELECT c.complexity_band band, COUNT(*) n FROM classifications c JOIN sessions s ON s.id = c.target_id
+     ${mainW.sql} GROUP BY c.complexity_band ORDER BY n DESC`, ...mainW.params);
   return { byCategory, byComplexity };
 }
 function toolBreakdown(db, w) {
-  return db.prepare(`SELECT tc.tool_name name, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${w.sql} GROUP BY tc.tool_name ORDER BY n DESC LIMIT 20`).all(...w.params);
+  return queryAll(db, `SELECT tc.tool_name name, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
+     ${w.sql} GROUP BY tc.tool_name ORDER BY n DESC LIMIT 20`, ...w.params);
 }
 function skillBreakdowns(db, w) {
-  const skills = db.prepare(`SELECT tc.skill_name name, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${andWhere(w)} tc.skill_name IS NOT NULL GROUP BY tc.skill_name ORDER BY n DESC LIMIT 20`).all(...w.params);
-  const skillVersions = db.prepare(`SELECT tc.skill_name name, sk.id version_id, sk.summary, sk.last_seen, COUNT(*) n
-       FROM tool_calls tc
-       JOIN skills sk ON sk.id = tc.skill_id
-       JOIN sessions s ON s.id = tc.session_id
-       ${andWhere(w)} tc.skill_id IS NOT NULL
-       GROUP BY tc.skill_name, sk.id ORDER BY name, n DESC`).all(...w.params);
+  const skills = queryAll(db, `SELECT tc.skill_name name, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
+     ${andWhere(w)} tc.skill_name IS NOT NULL GROUP BY tc.skill_name ORDER BY n DESC LIMIT 20`, ...w.params);
+  const skillVersions = queryAll(db, `SELECT tc.skill_name name, sk.id version_id, sk.summary, sk.last_seen, COUNT(*) n
+     FROM tool_calls tc
+     JOIN skills sk ON sk.id = tc.skill_id
+     JOIN sessions s ON s.id = tc.session_id
+     ${andWhere(w)} tc.skill_id IS NOT NULL
+     GROUP BY tc.skill_name, sk.id ORDER BY name, n DESC`, ...w.params);
   return { skills, skillVersions };
 }
 function subagentFanoutBreakdown(db, w) {
-  const subagentByType = db.prepare(`SELECT tc.agent_type type, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${andWhere(w)} tc.agent_type IS NOT NULL GROUP BY tc.agent_type ORDER BY n DESC`).all(...w.params);
-  const perSession = db.prepare(`SELECT COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${andWhere(w)} s.is_sidechain = 0 AND tc.tool_name IN ('Agent','Task')
-       GROUP BY tc.session_id`).all(...w.params);
+  const subagentByType = queryAll(db, `SELECT tc.agent_type type, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
+     ${andWhere(w)} tc.agent_type IS NOT NULL GROUP BY tc.agent_type ORDER BY n DESC`, ...w.params);
+  const perSession = queryAll(db, `SELECT COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
+     ${andWhere(w)} s.is_sidechain = 0 AND tc.tool_name IN ('Agent','Task')
+     GROUP BY tc.session_id`, ...w.params);
   const counts = perSession.map((r) => r.n);
   return {
     by_type: subagentByType,
@@ -5306,8 +5338,8 @@ function subagentFanoutBreakdown(db, w) {
   };
 }
 function errorTypeBreakdown(db, w) {
-  const errorRows = db.prepare(`SELECT COALESCE(tc.error_type, 'other') type, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${andWhere(w)} tc.status = 'error' GROUP BY tc.error_type ORDER BY n DESC`).all(...w.params);
+  const errorRows = queryAll(db, `SELECT COALESCE(tc.error_type, 'other') type, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
+     ${andWhere(w)} tc.status = 'error' GROUP BY tc.error_type ORDER BY n DESC`, ...w.params);
   let failures = 0;
   let rejections = 0;
   const byType = errorRows.map((r) => {
@@ -5568,8 +5600,8 @@ async function createApp(db, opts = {}) {
       errorType: q.error_type ? q.error_type.split(",").filter(Boolean) : void 0,
       sort: ["started", "title", "turns", "tokens", "cost", "duration", "errors", "security"].find((s) => s === q.sort),
       dir: q.dir === "asc" ? "asc" : q.dir === "desc" ? "desc" : void 0,
-      limit: Math.min(Number(q.limit) || 50, 200),
-      offset: Number(q.offset) || 0
+      limit: pageLimit(q.limit, 50, 200),
+      offset: pageOffset(q.offset)
     });
   });
   app.get("/api/sessions/:id", async (req, reply) => {
@@ -5604,8 +5636,8 @@ async function createApp(db, opts = {}) {
       ...findingFilters(q),
       sort: ["severity", "session", "rule", "category", "time"].find((s) => s === q.sort),
       dir: q.dir === "asc" ? "asc" : q.dir === "desc" ? "desc" : void 0,
-      limit: Math.min(Number(q.limit) || 50, 5e3),
-      offset: Number(q.offset) || 0
+      limit: pageLimit(q.limit, 50, 5e3),
+      offset: pageOffset(q.offset)
     });
   });
   app.get("/api/security/mutes", async () => triageDb ? listMutes(triageDb) : []);
@@ -5678,8 +5710,8 @@ async function createApp(db, opts = {}) {
       project: q.project,
       sort,
       dir: q.dir === "asc" ? "asc" : "desc",
-      limit: Math.min(Number(q.limit) || 50, 200),
-      offset: Number(q.offset) || 0
+      limit: pageLimit(q.limit, 50, 200),
+      offset: pageOffset(q.offset)
     });
   });
   app.get("/api/file", async (req, reply) => {