Feature: Advanced Query Explorer for Events, Agents, and Sessions

[hoangsonww]

Problem

Power users need more than fixed filters; they need expressive querying across session/agent/event dimensions to answer custom questions quickly.

Proposal

Add an Advanced Query Explorer with a safe query DSL and visual results.

Scope

• Query builder UI (fields, operators, time ranges, group by)
• Saved queries with tags and sharing
• Result views: table, time-series, aggregation cards
• Export query results (CSV/JSON)

Query Examples

• Events where tool_name = Bash and status became error
• Sessions with > N subagents and duration > X minutes
• Agents with repeated reconnect patterns

Technical Notes

• Implement validated DSL -> SQL translation with strict allowlist
• Add query execution limits/timeouts to protect server
• Index recommendations surfaced from slow query telemetry

Acceptance Criteria

• Users can build and run custom queries without SQL access
• Query validation prevents unsafe operations
• Saved queries persist and can be rerun/editable
• Results support sorting, pagination, and export
• Slow query warnings include optimization hints