Alerts and Webhook Recipes

Alerts and Webhook Recipes

Alerts turn observed conditions into reviewable events. Webhooks deliver those alerts to another system. Build them in that order: signal first, routing second.

Alert rule types

CCAM supports event-pattern, inactivity, status-duration, and token-threshold rules. Choose the rule that expresses the operational question directly.

Goal	Rule shape	Common pitfall
Detect a known failure signature	Event pattern	Pattern too broad and noisy
Find silent active work	Inactivity	Threshold shorter than normal long tools
Escalate a prolonged state	Status duration	Treating ordinary waiting as failure
Warn on unusually large usage	Token threshold	Ignoring model/project scope

Build safely

1. Observe normal behavior over a representative period.
2. Create one disabled or narrowly scoped rule.
3. Review historical matches if available.
4. Enable and watch its cooldown behavior.
5. Add a webhook target and send a synthetic test.
6. Confirm the delivered payload points to actionable context.

Useful commands:

npx ccam rules
npx ccam alerts --unacked
npx ccam alert-rules create --help
npx ccam webhooks providers
npx ccam webhooks test <webhook-id>
npx ccam webhooks deliveries <webhook-id>

Writes require explicit confirmation. Supply rule or webhook configuration from a permission-restricted file rather than a shell argument when it includes secrets.

Delivery hygiene

• Give every target an owner and purpose.
• Scope targets to relevant rules when possible.
• Use provider-native signing/secrets if supported.
• Never expect CCAM to return stored webhook secrets.
• Review delivery history before retrying manually.
• Rate-limit downstream automation and make it idempotent.

Recommended first alerts

Start with a sustained ingestion/remote-source symptom and one high-but-realistic usage threshold. Avoid starting with dozens of event patterns. A small alert set with clear response instructions is more valuable than exhaustive noise.

Recipe: Send Alerts to Your Team.