aiden-runtime 4.8.0 → 4.9.0

package/dist/core/v4/daemon/runs/stuckAttemptWatchdog.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Shiva Deore (Taracod).
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ *
+ * Aiden — local-first agent.
+ */
+/**
+ * core/v4/daemon/runs/stuckAttemptWatchdog.ts — v4.9.0 Slice 8.
+ *
+ * Sweeps `run_attempts` (and `spans`) that are stuck `running` from
+ * a previous incarnation past `STUCK_THRESHOLD_MS`. Marks them
+ * `crashed` so post-mortem queries get one consistent shape rather
+ * than mixing "in-flight" with "abandoned".
+ *
+ * Wired as a `setInterval` ticker from bootstrap. Cadence default 5
+ * min, configurable via `AIDEN_STUCK_ATTEMPT_CHECK_MS`. Threshold 30
+ * min default, configurable via `AIDEN_STUCK_ATTEMPT_THRESHOLD_MS`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sweepStuckAttempts = sweepStuckAttempts;
+const DEFAULT_THRESHOLD_MS = 30 * 60 * 1000;
+/**
+ * Run a single sweep pass. Returns the count + ids of rows touched.
+ * Idempotent — calling twice in a row sweeps zero on the second call.
+ */
+function sweepStuckAttempts(db, opts) {
+    const now = (opts.now ?? Date.now)();
+    const thresholdMs = opts.thresholdMs ?? DEFAULT_THRESHOLD_MS;
+    const cutoffIso = new Date(now - thresholdMs).toISOString();
+    const endedAtIso = new Date(now).toISOString();
+    // ── attempts ────────────────────────────────────────────────────────────
+    const attemptRows = db.prepare(`SELECT attempt_id FROM run_attempts
+      WHERE status = 'running'
+        AND incarnation_id != ?
+        AND started_at < ?`).all(opts.currentIncarnationId, cutoffIso);
+    const attemptIds = attemptRows.map((r) => r.attempt_id);
+    if (attemptIds.length > 0) {
+        db.prepare(`UPDATE run_attempts
+          SET status        = 'crashed',
+              ended_at      = COALESCE(ended_at, ?),
+              finish_reason = COALESCE(finish_reason, 'stuck_attempt_swept')
+        WHERE status = 'running'
+          AND incarnation_id != ?
+          AND started_at < ?`).run(endedAtIso, opts.currentIncarnationId, cutoffIso);
+    }
+    // ── spans ──────────────────────────────────────────────────────────────
+    // Open spans (status NULL = in-flight) from a non-current incarnation.
+    // We don't apply the threshold here — any open span owned by a dead
+    // incarnation is by definition stuck; the parent process is gone.
+    const spanRows = db.prepare(`SELECT span_id FROM spans
+      WHERE status IS NULL
+        AND ended_at IS NULL
+        AND incarnation_id != ?`).all(opts.currentIncarnationId);
+    const spanIds = spanRows.map((r) => r.span_id);
+    if (spanIds.length > 0) {
+        db.prepare(`UPDATE spans
+          SET status        = 'cancelled',
+              ended_at      = COALESCE(ended_at, ?),
+              error_class   = COALESCE(error_class, 'OrphanedSpan'),
+              error_message = COALESCE(error_message, 'incarnation died with span open')
+        WHERE status IS NULL
+          AND ended_at IS NULL
+          AND incarnation_id != ?`).run(endedAtIso, opts.currentIncarnationId);
+    }
+    return {
+        reclaimedAttempts: attemptIds.length,
+        reclaimedSpans: spanIds.length,
+        attemptIds,
+        spanIds,
+    };
+}

package/dist/core/v4/daemon/spans/spanHelpers.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Shiva Deore (Taracod).
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ *
+ * Aiden — local-first agent.
+ */
+/**
+ * core/v4/daemon/spans/spanHelpers.ts — v4.9.0 Slice 5.
+ *
+ * `withSpan` is the ergonomic primitive every Slice 6+ caller will use
+ * to instrument a unit of work: tool dispatch, hook firing, LLM call,
+ * subagent fanout, etc. Each call:
+ *
+ *   1. Forks a child `ExecutionContext` via `childSpan(parent)` so the
+ *      new `span_id` is set and `parent_span_id` chains to the parent.
+ *   2. Opens a row in `spans` via `openSpan(db, ...)`.
+ *   3. Calls `fn(childCtx)` inside a `runWithContext(childCtx, ...)`
+ *      frame so any nested `withSpan` or `requireContext()` reaches
+ *      the new ambient context.
+ *   4. On success: closes the span with `status='ok'`.
+ *   5. On thrown error: closes with `status='error'` + `error_class` +
+ *      `error_message`, then rethrows so the caller's catch chain
+ *      still runs.
+ *
+ * If the caller has no ambient context, `withSpan` falls back to
+ * "no-op the span" — logs a warning via the supplied logger callback
+ * but still runs `fn` with whatever ctx (or undefined) the caller had.
+ * This matches the project rule "no instrumentation primitive throws
+ * because context is missing" — Slice 5 must not turn a missing-context
+ * scenario into a 500.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shortInputFingerprint = shortInputFingerprint;
+exports.withSpan = withSpan;
+exports.withToolSpan = withToolSpan;
+exports.withLlmSpan = withLlmSpan;
+exports.runHookWithSpan = runHookWithSpan;
+const node_crypto_1 = require("node:crypto");
+const identity_1 = require("../../identity");
+const spanStore_1 = require("./spanStore");
+/** Stable input fingerprint — sha256 hex, first 16 chars. */
+function shortInputFingerprint(args) {
+    const canon = canonicaliseForHash(args);
+    return (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(canon)).digest('hex').slice(0, 16);
+}
+function canonicaliseForHash(v) {
+    if (v === null || v === undefined)
+        return null;
+    if (Array.isArray(v))
+        return v.map(canonicaliseForHash);
+    if (typeof v === 'object') {
+        const out = {};
+        for (const k of Object.keys(v).sort()) {
+            out[k] = canonicaliseForHash(v[k]);
+        }
+        return out;
+    }
+    return v;
+}
+// v4.9.0 Slice 8 — map SpanKind → EnforcementKind so the enforcement
+// layer's per-kind config buckets line up with the span taxonomy.
+function spanKindToEnforcementKind(k) {
+    switch (k) {
+        case 'llm': return 'llm';
+        case 'tool': return 'tool';
+        case 'hook': return 'hook';
+        case 'memory': return 'memory_write';
+        case 'http': return 'http_outbound';
+        case 'subprocess': return 'subprocess';
+        case 'subagent':
+        case 'other':
+        default: return 'tool';
+    }
+}
+/**
+ * Run `fn` inside an instrumented child span. See file header for the
+ * detailed semantics; the short version is: opens a span, runs the fn
+ * with that ctx installed, closes the span, rethrows on error.
+ */
+async function withSpan(db, opts, fn) {
+    const parent = (0, identity_1.currentContext)();
+    if (!parent) {
+        // v4.9.0 Slice 8 — enforcement (counter + strict-throw) is
+        // additive to the original warn contract. Pass `warn: undefined`
+        // so the enforcement layer doesn't double-log; spanHelpers owns
+        // the opts.warn invocation below.
+        (0, identity_1.reportMissingContext)(spanKindToEnforcementKind(opts.kind), `${opts.kind}/${opts.name}`);
+        if (opts.warn) {
+            try {
+                opts.warn(`[span] withSpan(${opts.kind}/${opts.name}) — no ambient context, dropping span`);
+            }
+            catch { /* logger may not be wired yet — ignore */ }
+        }
+        // Build a minimal stand-in ctx so the inner fn still gets a value
+        // shaped like ExecutionContext (callers may read `.runId` etc.).
+        return fn({
+            daemonId: '',
+            incarnationId: '',
+            runId: '',
+            traceId: '',
+            spanId: '',
+            source: 'unknown',
+            attempt: 0,
+        });
+    }
+    const child = (0, identity_1.childSpan)(parent);
+    (0, spanStore_1.openSpan)(db, {
+        ctx: child,
+        kind: opts.kind,
+        name: opts.name,
+        attrs: opts.attrs,
+        runId: opts.runId,
+        attemptId: opts.attemptId,
+    });
+    try {
+        const out = await (0, identity_1.runWithContext)(child, () => fn(child));
+        (0, spanStore_1.closeSpan)(db, { spanId: child.spanId, status: 'ok' });
+        return out;
+    }
+    catch (err) {
+        const eClass = err instanceof Error ? err.name : 'NonError';
+        const eMsg = err instanceof Error ? err.message : String(err);
+        (0, spanStore_1.closeSpan)(db, {
+            spanId: child.spanId,
+            status: 'error',
+            errorClass: eClass,
+            errorMessage: eMsg,
+        });
+        throw err;
+    }
+}
+/**
+ * Wrap a tool execution. The span carries `kind:'tool'`, `name:<toolName>`,
+ * and attrs `{ input_fingerprint, side_effect_class, attempt_number }`.
+ * If no ambient ExecutionContext is active, this no-ops the span
+ * (project rule: instrumentation primitives never throw because
+ * context is missing) and still runs `fn`.
+ */
+async function withToolSpan(db, opts, fn) {
+    return withSpan(db, {
+        kind: 'tool',
+        name: opts.toolName,
+        attrs: {
+            input_fingerprint: opts.inputFingerprint,
+            side_effect_class: opts.sideEffectClass,
+            attempt_number: opts.attemptNumber ?? 1,
+        },
+        runId: opts.runId,
+        attemptId: opts.attemptId,
+        warn: opts.warn,
+    }, fn);
+}
+/**
+ * Wrap an LLM provider call. The span carries `kind:'llm'`,
+ * `name:<model>`. Tokens / finish-reason / cost are unknown at
+ * open-time, so the `fn` receives a `patchAttrs(attrs)` callback to
+ * back-fill them after the response lands. The patch is applied via
+ * `closeSpan({attrsPatch})` on the success path.
+ */
+async function withLlmSpan(db, opts, fn) {
+    const parent = (0, identity_1.currentContext)();
+    if (!parent) {
+        // v4.9.0 Slice 8 — enforcement (counter + strict-throw).
+        (0, identity_1.reportMissingContext)('llm', `llm/${opts.model}`);
+        if (opts.warn) {
+            try {
+                opts.warn(`[span] withLlmSpan(${opts.model}) — no ambient context, dropping span`);
+            }
+            catch { /* noop */ }
+        }
+        // Stand-in ctx, no-op patch.
+        return fn({ daemonId: '', incarnationId: '', runId: '', traceId: '', spanId: '',
+            source: 'unknown', attempt: 0 }, () => { });
+    }
+    const child = (0, identity_1.childSpan)(parent);
+    const initialAttrs = {
+        model: opts.model,
+        provider: opts.provider,
+    };
+    (0, spanStore_1.openSpan)(db, {
+        ctx: child,
+        kind: 'llm',
+        name: opts.model,
+        attrs: initialAttrs,
+        runId: opts.runId,
+        attemptId: opts.attemptId,
+    });
+    let patched = null;
+    const patchAttrs = (attrs) => {
+        patched = { ...(patched ?? {}), ...attrs };
+    };
+    try {
+        const out = await (0, identity_1.runWithContext)(child, () => fn(child, patchAttrs));
+        (0, spanStore_1.closeSpan)(db, {
+            spanId: child.spanId,
+            status: 'ok',
+            attrsPatch: patched ?? undefined,
+        });
+        return out;
+    }
+    catch (err) {
+        const eClass = err instanceof Error ? err.name : 'NonError';
+        const eMsg = err instanceof Error ? err.message : String(err);
+        (0, spanStore_1.closeSpan)(db, {
+            spanId: child.spanId,
+            status: 'error',
+            errorClass: eClass,
+            errorMessage: eMsg,
+            attrsPatch: patched ?? undefined,
+        });
+        throw err;
+    }
+}
+/**
+ * Wrap a hook execution with a 5s timeout (configurable). The hook
+ * system isn't wired yet (Slice 9 work), but this helper is the seam
+ * Slice 9 will call from. Returns `null` on timeout, error, or
+ * missing-context degraded path so callers can safely continue.
+ */
+async function runHookWithSpan(db, opts, fn) {
+    const timeoutMs = opts.timeoutMs ?? 5000;
+    const parent = (0, identity_1.currentContext)();
+    if (!parent) {
+        // v4.9.0 Slice 8 — enforcement (counter + strict-throw).
+        (0, identity_1.reportMissingContext)('hook', `hook/${opts.hookName}`);
+        if (opts.warn) {
+            try {
+                opts.warn(`[span] runHookWithSpan(${opts.hookName}) — no ambient context, dropping span`);
+            }
+            catch { /* noop */ }
+        }
+        try {
+            return await fn({ daemonId: '', incarnationId: '', runId: '', traceId: '', spanId: '', source: 'unknown', attempt: 0 });
+        }
+        catch {
+            return null;
+        }
+    }
+    const child = (0, identity_1.childSpan)(parent);
+    (0, spanStore_1.openSpan)(db, { ctx: child, kind: 'hook', name: opts.hookName });
+    let timer = null;
+    try {
+        const timeoutPromise = new Promise((_resolve, reject) => {
+            timer = setTimeout(() => reject(new HookTimeoutError(opts.hookName, timeoutMs)), timeoutMs);
+        });
+        const work = (0, identity_1.runWithContext)(child, () => fn(child));
+        const out = await Promise.race([work, timeoutPromise]);
+        if (timer)
+            clearTimeout(timer);
+        (0, spanStore_1.closeSpan)(db, { spanId: child.spanId, status: 'ok' });
+        return out;
+    }
+    catch (err) {
+        if (timer)
+            clearTimeout(timer);
+        const isTimeout = err instanceof HookTimeoutError;
+        (0, spanStore_1.closeSpan)(db, {
+            spanId: child.spanId,
+            status: 'error',
+            errorClass: isTimeout ? 'HookTimeout' : (err instanceof Error ? err.name : 'NonError'),
+            errorMessage: err instanceof Error ? err.message : String(err),
+        });
+        return null;
+    }
+}
+class HookTimeoutError extends Error {
+    constructor(hookName, ms) {
+        super(`hook '${hookName}' timed out after ${ms}ms`);
+        this.name = 'HookTimeout';
+    }
+}

package/dist/core/v4/daemon/spans/spanStore.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Shiva Deore (Taracod).
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ *
+ * Aiden — local-first agent.
+ */
+/**
+ * core/v4/daemon/spans/spanStore.ts — v4.9.0 Slice 5.
+ *
+ * Persists the span tree used by `withSpan(...)` and `aiden doctor`-style
+ * trace inspection. Spans flow from ExecutionContext (Slice 4) — the
+ * caller supplies `trace_id`, `span_id`, `parent_span_id`, `run_id?`,
+ * `attempt_id?`, `incarnation_id` via the context object. Slice 5 lands
+ * schema + writers; the tool-dispatcher + hook integration is Slice 6+.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openSpan = openSpan;
+exports.closeSpan = closeSpan;
+exports.getSpan = getSpan;
+exports.getTraceTree = getTraceTree;
+function safeStringify(v) {
+    if (!v || Object.keys(v).length === 0)
+        return null;
+    try {
+        return JSON.stringify(v);
+    }
+    catch {
+        return null;
+    }
+}
+function safeParse(s) {
+    if (!s)
+        return {};
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Insert a new span row in `started` state. The span_id is taken from
+ * `ctx.spanId` (set by `childSpan` upstream); the caller is responsible
+ * for forking the spanId before calling — `withSpan` does this. The
+ * parent_span_id is taken from `ctx.parentSpanId`, also set by
+ * `childSpan`. Returns the span_id for convenience.
+ */
+function openSpan(db, opts) {
+    const startedAt = opts.startedAt ?? new Date().toISOString();
+    db.prepare(`INSERT INTO spans
+       (span_id, trace_id, parent_span_id, run_id, attempt_id,
+        incarnation_id, kind, name, started_at, attrs_json)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(opts.ctx.spanId, opts.ctx.traceId, opts.ctx.parentSpanId ?? null, opts.runId ?? null, opts.attemptId ?? null, opts.ctx.incarnationId, opts.kind, opts.name, startedAt, safeStringify(opts.attrs));
+    return opts.ctx.spanId;
+}
+/**
+ * Close an in-flight span. COALESCE-protected on `ended_at` so a
+ * double-close (e.g. handler + finalizer both fire) keeps the first
+ * timestamp. attrs are shallow-merged into the existing attrs_json.
+ */
+function closeSpan(db, opts) {
+    const endedAt = opts.endedAt ?? new Date().toISOString();
+    // Shallow-merge attrs by reading + replacing if a patch is supplied.
+    if (opts.attrsPatch) {
+        const cur = db.prepare(`SELECT attrs_json FROM spans WHERE span_id = ?`)
+            .get(opts.spanId);
+        const merged = { ...safeParse(cur?.attrs_json ?? null), ...opts.attrsPatch };
+        db.prepare(`UPDATE spans
+          SET status        = COALESCE(status, ?),
+              ended_at      = COALESCE(ended_at, ?),
+              error_class   = COALESCE(error_class, ?),
+              error_message = COALESCE(error_message, ?),
+              attrs_json    = ?
+        WHERE span_id = ?`).run(opts.status, endedAt, opts.errorClass ?? null, opts.errorMessage ?? null, safeStringify(merged), opts.spanId);
+        return;
+    }
+    db.prepare(`UPDATE spans
+        SET status        = COALESCE(status, ?),
+            ended_at      = COALESCE(ended_at, ?),
+            error_class   = COALESCE(error_class, ?),
+            error_message = COALESCE(error_message, ?)
+      WHERE span_id = ?`).run(opts.status, endedAt, opts.errorClass ?? null, opts.errorMessage ?? null, opts.spanId);
+}
+/** Single-span lookup. */
+function getSpan(db, spanId) {
+    const r = db.prepare(`SELECT * FROM spans WHERE span_id = ?`)
+        .get(spanId);
+    return r ?? null;
+}
+/**
+ * Build the span tree for a trace. Returns the root(s) sorted by
+ * started_at, each with `children` recursively populated. A trace may
+ * have multiple roots if disconnected spans share the same trace_id
+ * (e.g. a fan-out scenario); usually it's one root.
+ */
+function getTraceTree(db, traceId) {
+    const rows = db.prepare(`SELECT * FROM spans WHERE trace_id = ? ORDER BY started_at ASC`).all(traceId);
+    const nodes = new Map();
+    for (const r of rows) {
+        nodes.set(r.span_id, { ...r, children: [] });
+    }
+    const roots = [];
+    for (const node of nodes.values()) {
+        if (node.parent_span_id && nodes.has(node.parent_span_id)) {
+            nodes.get(node.parent_span_id).children.push(node);
+        }
+        else {
+            roots.push(node);
+        }
+    }
+    return roots;
+}

package/dist/core/v4/daemon/triggerBus.js

@@ -73,25 +73,56 @@ function createTriggerBus(opts) {
         insert(ev) {
             const now = Date.now();
             const payloadJson = JSON.stringify(ev.payload ?? {});
-            const result = db
-                .prepare(`INSERT OR IGNORE INTO trigger_events
-             (source, source_key, idempotency_key, payload_json,
-              status, attempts, created_at, updated_at)
-           VALUES (?, ?, ?, ?, 'pending', 0, ?, ?)`)
-                .run(ev.source, ev.sourceKey, ev.idempotencyKey ?? null, payloadJson, now, now);
-            if (result.changes > 0) {
-                return { id: Number(result.lastInsertRowid), inserted: true };
-            }
-            // Dedup hit — return the existing id.
-            const existing = db
-                .prepare('SELECT id FROM trigger_events WHERE source = ? AND idempotency_key = ?')
-                .get(ev.source, ev.idempotencyKey ?? null);
-            if (!existing) {
-                // Defensive — shouldn't happen unless idempotency_key was null,
-                // in which case INSERT OR IGNORE wouldn't have skipped.
-                throw new Error('triggerBus.insert: INSERT OR IGNORE produced no row but no existing match found');
-            }
-            return { id: existing.id, inserted: false };
+            // v4.9.0 Slice 5 — wrap insert + idempotency write in a single
+            // transaction so a crash between them can't leave a stranded
+            // trigger_events row without an idempotency anchor.
+            let outcome = null;
+            const tx = db.transaction(() => {
+                const result = db
+                    .prepare(`INSERT OR IGNORE INTO trigger_events
+               (source, source_key, idempotency_key, payload_json,
+                status, attempts, created_at, updated_at)
+             VALUES (?, ?, ?, ?, 'pending', 0, ?, ?)`)
+                    .run(ev.source, ev.sourceKey, ev.idempotencyKey ?? null, payloadJson, now, now);
+                if (result.changes > 0) {
+                    const newId = Number(result.lastInsertRowid);
+                    // Slice 5 — anchor the run-idempotency row keyed on
+                    // (`trigger:<source>`, `<sourceKey>::<idempotencyKey>`). We
+                    // skip if idempotencyKey is null (nothing to dedupe against).
+                    if (opts.enableRunIdempotency && ev.idempotencyKey) {
+                        const ns = `trigger:${ev.source}`;
+                        const key = `${ev.sourceKey}::${ev.idempotencyKey}`;
+                        const fp = ev.idempotencyKey;
+                        db.prepare(`INSERT OR IGNORE INTO run_idempotency_keys
+                 (namespace, key, fingerprint, trigger_event_id,
+                  status, created_at)
+               VALUES (?, ?, ?, ?, 'accepted', ?)`).run(ns, key, fp, newId, new Date(now).toISOString());
+                    }
+                    outcome = { id: newId, inserted: true };
+                    return;
+                }
+                // Dedup hit — return the existing id.
+                const existing = db
+                    .prepare('SELECT id FROM trigger_events WHERE source = ? AND idempotency_key = ?')
+                    .get(ev.source, ev.idempotencyKey ?? null);
+                if (!existing) {
+                    throw new Error('triggerBus.insert: INSERT OR IGNORE produced no row but no existing match found');
+                }
+                if (opts.enableRunIdempotency && ev.idempotencyKey && opts.onIdempotencyConflict) {
+                    // Slice 5 — surface the dedup-as-duplicate event for visibility.
+                    try {
+                        opts.onIdempotencyConflict({
+                            source: ev.source,
+                            sourceKey: ev.sourceKey,
+                            key: `${ev.sourceKey}::${ev.idempotencyKey}`,
+                        });
+                    }
+                    catch { /* notification must never throw */ }
+                }
+                outcome = { id: existing.id, inserted: false };
+            });
+            tx();
+            return outcome;
         },
         claim(opts2 = { ownerId: '' }) {
             const leaseMs = opts2.leaseMs ?? exports.DEFAULT_CLAIM_LEASE_MS;

package/dist/core/v4/hooks/auditQuery.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryHookExecutions = queryHookExecutions;
+exports.failureRates = failureRates;
+exports.countByStatus = countByStatus;
+function queryHookExecutions(db, q = {}) {
+    const where = [];
+    const params = [];
+    if (q.hookId) {
+        where.push('e.hook_id = ?');
+        params.push(q.hookId);
+    }
+    if (q.event) {
+        where.push('e.event = ?');
+        params.push(q.event);
+    }
+    if (q.status) {
+        where.push('e.status = ?');
+        params.push(q.status);
+    }
+    if (q.since) {
+        where.push('e.started_at >= ?');
+        params.push(q.since);
+    }
+    const limit = Math.min(Math.max(q.limit ?? 50, 1), 1000);
+    const sql = `
+    SELECT e.hook_execution_id, e.hook_id, h.name AS hook_name,
+           e.subscription_id, e.event, e.status, e.decision,
+           e.elapsed_ms, e.exit_code, e.error_kind, e.error_message,
+           e.started_at, e.finished_at, e.run_id, e.trace_id
+      FROM hook_executions e
+      LEFT JOIN hooks h ON h.hook_id = e.hook_id
+     ${where.length ? 'WHERE ' + where.join(' AND ') : ''}
+     ORDER BY e.started_at DESC
+     LIMIT ?`;
+    params.push(limit);
+    return db.prepare(sql).all(...params);
+}
+function failureRates(db, lookbackN = 100) {
+    // Per-hook: count last N executions and how many were non-ok.
+    const ids = db.prepare(`SELECT hook_id, name FROM hooks`).all();
+    const rows = [];
+    for (const h of ids) {
+        const recent = db.prepare(`SELECT status FROM hook_executions WHERE hook_id = ?
+         ORDER BY started_at DESC LIMIT ?`).all(h.hook_id, lookbackN);
+        if (recent.length === 0)
+            continue;
+        const failures = recent.filter((r) => r.status !== 'ok').length;
+        rows.push({
+            hook_id: h.hook_id,
+            hook_name: h.name,
+            total: recent.length,
+            failures,
+            failureRate: failures / recent.length,
+        });
+    }
+    return rows;
+}
+/** Count rows matching a status set over the recent window. */
+function countByStatus(db, sinceIso) {
+    const rows = db.prepare(`SELECT status, COUNT(*) AS n FROM hook_executions
+       WHERE started_at >= ? GROUP BY status`).all(sinceIso);
+    const out = {};
+    for (const r of rows)
+        out[r.status] = r.n;
+    return out;
+}