mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
v0.16.0: fastapi-guard HTTP security layer — calibrated + scanner honeytrap (#290)
* [fastapi-guard] Phase 1a: gated config flags for the HTTP security layer Adds the ROBOCO_GUARD_* settings (all default-off / secure-default) for the upcoming fastapi-guard 7.2.0 hardening — guard_enabled (master switch), guard_fail_secure (fail-closed default; NAS overrides to false), guard_telemetry_enabled + guard_agent_api_key + guard_project_id (guard-agent telemetry, opt-in), guard_emergency + guard_emergency_whitelist (lockdown kill switch). Inert until consumed: nothing reads them yet, so the request path is unchanged. Foundation for v0.16.0. * [fastapi-guard] Phase 1b: security foundation module + gated wiring Add fastapi-guard 7.2.0 + guard-core 3.3.0 (bare, unpinned) and roboco/security.py: - build_security_config() from settings — behind-nginx real-IP (trusted_proxies + trust_x_forwarded_proto), HSTS/CSP headers, threat-ban + 404-sweep rules, redis-backed state, exclude_paths (/ws + health + docs), env-driven enforce_https, fail_secure (secure default), emergency lockdown, guard-agent telemetry (opt-in), passive-mode calibration switch. - guard_deco singleton (SecurityDecorator) for per-route decorators (Phase 2+). - Three custom content validators guard's WAF can't cover: prompt-injection / role-override, secret-exfil / credential-in-body, internal-SSRF. - apply_guard(app) + guarded_lifespan() wired into create_app AFTER settings. guard_passive_mode config flag added. Entirely gated by ROBOCO_GUARD_ENABLED (default off): create_app mounts nothing and returns the unchanged app when off (verified). make quality GREEN (cov 95.32%, pip-audit clean, import-linter 2/0). 12 new unit tests. * [fastapi-guard] Phase 2: critical-path decorators Apply guard decorators to the highest-value endpoints (metadata-only; enforced only when the middleware is mounted, so no-op while ROBOCO_GUARD_ENABLED is off): - provider keys (ollama/grok/self-hosted writes): strict rate_limit + max_request_size + block_clouds (no datacenter IP should touch secret writes). - settings write + release approve/reject (CEO-gated): strict rate_limit. - intake chat (prompter start/messages/events): rate_limit + max_request_size + custom_validation(prompt_injection_validator) — the prompt-facing free-text ingress gets the injection/role-override/secret-exfil content scan. make quality GREEN (cov 95.32%, contracts 2/0). App builds with guard off, decorators inert (verified). * [fastapi-guard] Phase 3: wide decorator coverage across ingress + sensitive routes Targeted-wide application (metadata-only; no-op until ROBOCO_GUARD_ENABLED). The global SecurityMiddleware already rate-limits + WAF-scans every request, so this adds the custom content validators on free-text ingress + tight limits on sensitive ops (not blanket per-route rate_limit on reads): - agent gateway do verbs (note/say/commit/dm/pitch/progress/draft_playbook/...): rate_limit + max_request_size + custom_validation(secret_exfil or prompt_injection). - a2a message/send + chat writes: rate_limit + size + prompt_injection. - optimal/RAG (kb/search, rag/query, mentor/ask, errors/decisions/standards/ learnings): prompt_injection on searches, secret_exfil on record writes; docs index → internal_ssrf. - tasks: create/update → prompt_injection; QA/doc/PM transitions → secret_exfil; CEO-gated verbs → tight rate_limit. - secretary chat → prompt_injection; research → internal_ssrf; orchestrator spawn/mutations → rate_limit; git ops + flow verbs → tight rate_limit. Pure GET/reads left to the global middleware. Applied via a Sonnet workflow, then verified: app builds with guard off (decorators inert), make quality GREEN (cov 95.37%, contracts 2/0). Decoy/honeypot-path surface deferred (needs verified guard ban-API integration — not rushed). * [fastapi-guard] Phase 5: arm the NAS composes in passive/log-only mode Arm ROBOCO_GUARD_ENABLED=true + ROBOCO_GUARD_PASSIVE_MODE=true + ROBOCO_GUARD_FAIL_SECURE=false on the two NAS composes (docker-compose.yaml + .yml). Passive = guard mounts and logs what it WOULD block but blocks nothing, so the next NAS deploy calibrates against real traffic; flip PASSIVE_MODE off after the false-positive review to enforce. fail_secure=false keeps a guard-internal error from 500ing the personal deploy. The registry (user-facing) compose is deliberately left unarmed so its published default stays conservative. Phase 4 (passive calibration) is the operational step this enables. * feat(security): Phase 3b — full-arsenal per-route guard enrichment Stack the applicable guard decorators per surface instead of the minimal rate_limit/max_request_size/custom_validation triad: content_type_filter on every JSON-body write, honeypot_detection form-traps on human-facing POSTs, block_clouds on key-writes + CEO release ops, behavior_analysis runaway-rate rules on the agent flow/do verbs, suspicious_detection + usage_monitor on the sensitive surfaces. Nine distinct decorators now applied thoughtfully per endpoint. All metadata-only — no-op while ROBOCO_GUARD_ENABLED is off. * fix(a2a): permit PR reviewer to deliver gate verdicts to the owning PM can_a2a_direct had no pr_reviewer rule, so a reviewer (team=board, or a cell team) fell through to the cell-member path and was cross-cell-denied when the in-path gate delivered a pr_fail change-request to main-pm (or a cross-cell cell-pm): "Cannot A2A main-pm ... Ask None to coordinate with None". The delivery is best-effort, so pr_fail still transitioned but the verdict never reached the owning PM — the blind-re-submit signal-gap the pr_fail fix closes. Add an explicit pr_reviewer handler: it may A2A only cell_pm / main_pm (its sole comms surface — everything else it posts on the PR itself), with a matching route hint. The cell reviewers kept same-team access by coincidence; this scopes every reviewer to PM-only, the correct model, with no other A2A caller affected. Refresh uv.lock to the current resolution. * feat(models): adopt Claude Sonnet 5 as the sonnet tier Point the 'sonnet' alias at claude-sonnet-5 (MODEL_MAP) and give pr_reviewer its own opus tier in ROLE_MODEL_MAP — it was falling through to the sonnet default, and the role gates untrusted external/fork PRs plus root→master, which warrants opus. Price claude-sonnet-5 at the promotional 33% off Sonnet 4.6 ($2.01 / $10.05, cache 0.201 / 0.5025) through 2026-08-31 via a dedicated pricing fragment that beats the bare 'sonnet' alias; revert to full rate when the promo ends. Bare 'sonnet' stays full-rate as a conservative fallback (prod prices the resolved claude-sonnet-5 id from the transcript). Update the model docs and the billing / usage / manifest / spawn tests. * feat(security): calibrate the guard WAF for RoboCo traffic + document the layer The first end-to-end run of the fastapi-guard layer showed active enforcement would block ~50% of legitimate agent traffic — RoboCo request bodies are code, SQL, diffs, file paths, HTML, and URLs, which the stock signature WAF reads as attacks. build_security_config now excludes RoboCo's free-text top-level body fields (derived from the real request models, including the free-form container fields whose nested prose is stringified and scanned) from WAF scanning, dropping the active-mode false-positive rate to zero while keeping the WAF on every non-excluded (id/enum/slug/branch) field and leaving the prompt-injection / secret-exfil / internal-SSRF validators — which run independently of the exclusion — fully in force. enable_penetration_detection is made explicit. Only excluded_detection_body_fields is reliable on guard 7.2.1: the per-route categories knob is bypassed for JSON bodies, and the body scanner excludes top-level keys only (scanning str(value) of every non-excluded field), so free-form container fields must be excluded wholesale. Adds tests/unit/test_security_middleware.py — the first end-to-end exercise of the middleware (mounts it, drives guard's lifespan, fires real requests): proves passive mode is log-only, active mode does not false-positive on realistic agent payloads, threats are still blocked inside excluded fields, and the WAF still fires on non-excluded fields. Docs: CHANGELOG (Unreleased); a user-facing Optional-subsystems page + nav + env reference for the HTTP security layer; the agent-facing RAG corpus (what it is + why a request could be blocked); and the roboco mapping (api-core-websocket / deployment-tooling / _complete_map). * feat(security): Surface N — scanner honeytrap (guard /api auto-ban + nginx edge-drop) Turns scanner probes against the scanner, in two layers matched to where traffic lands. Behind nginx only /api, /ws, /health, /ready reach the orchestrator, so guard can only see (and ban) scanner probes on those paths; the classic root probes (/.env, /wp-login.php, /phpmyadmin, /.git/config) hit the panel. So: - build_security_config's threat_ban_config gains recon / sensitive_file / cms_probing categories. A scanner probing those fingerprints on an /api path is detected on the URL-path scan; repeated probes from one IP trip an adaptive per-IP auto-ban (redis-backed, 24h). Only bans in active mode (passive logs the recon hit) and needs redis (the 24h ban exceeds the in-memory cap). The spec's decoy-route file is redundant — the WAF url-path scan bans regardless of a registered route — so it is intentionally omitted. - docker/nginx.conf drops the classic root scanner paths at the edge with 444 (connection closed, no response) before they reach the panel, anchored to known scanner fingerprints so /.well-known and every real panel/API route are untouched. Always on, independent of ROBOCO_GUARD_ENABLED. Tests: 2 unit (the exclusion set + the scanner-ban categories are present) and 2 integration (a decoy path is blocked in active mode, passes in passive). The nginx regex was validated against 15 scanner + 19 legit paths (0 false positives). Docs: CHANGELOG, the HTTP-security page, the roboco mapping, and the agent-facing RAG corpus. * Token optimization — per-role observability, compute policy, spawn preflight (#291) * test(models): lock the sonnet→claude-sonnet-5 MODEL_MAP invariant * feat(usage): surface cache tokens + cache_hit_rate in usage breakdowns * feat(usage): add per-role usage breakdown endpoint * feat(usage): add spawn-waste signal (per-role unproductive rate + respawn strikes) * feat(panel): surface per-role cost/cache + spawn-waste on the metrics page * feat(routing): Phase 2 per-role compute policy — qa→haiku, main_pm→sonnet, per-role effort env mechanism (default-inert) * feat(orchestrator): Phase 3 flag-gated spawn preflight — refuse non-gateway delivery roles (respawn-forever guard) * chore(compose): arm ROBOCO_SPAWN_PREFLIGHT_ENABLED on the NAS composes * docs: per-role usage observability, per-role compute policy, and spawn preflight --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com> * fix(panel): pin outputFileTracingRoot so the standalone build isn't broken by stray lockfiles * feat(routing): populate ROLE_EFFORT_MAP + wire the verified --effort flag (cell_pm/board/auditor to medium) * feat(gateway): omit empty context_briefing sections (Phase 4 payload compaction) * refactor(orchestrator): extract spawn chokepoint guards to restore xenon rank B on spawn_agent --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>
This commit is contained in:
Renzo F
@@ -1,10 +1,18 @@
|
||||
import type { NextConfig } from "next";
|
||||
import path from "path";
|
||||
|
||||
// const BACKEND_URL = process.env.BACKEND_URL || "http://localhost:8000";
|
||||
|
||||
const nextConfig: NextConfig = {
|
||||
output: "standalone",
|
||||
|
||||
// Pin the file-tracing root to this directory so `output: "standalone"` is
|
||||
// deterministic regardless of stray lockfiles higher up the tree (e.g. a
|
||||
// ~/package-lock.json). Without it Next can infer the wrong workspace root
|
||||
// from a sibling lockfile and nest the standalone output, so `server.js`
|
||||
// never lands at `.next/standalone/server.js` and `node server.js` fails.
|
||||
outputFileTracingRoot: path.join(__dirname),
|
||||
|
||||
// // Proxy API calls to the backend to avoid CORS issues
|
||||
// async rewrites() {
|
||||
// return [
|
||||
|
||||
@@ -10,8 +10,10 @@ import {
|
||||
useAgentUsage,
|
||||
useTeamUsage,
|
||||
useModelUsage,
|
||||
useRoleUsage,
|
||||
useUsageProjection,
|
||||
useCacheEfficiency,
|
||||
useSpawnWaste,
|
||||
useUsageSessions,
|
||||
} from "@/hooks/use-usage";
|
||||
import { TaskStatus, Team } from "@/types";
|
||||
@@ -46,6 +48,8 @@ import {
|
||||
import type {
|
||||
UsageProjection as UP,
|
||||
CacheEfficiencyResponse as CER,
|
||||
RoleUsageRow,
|
||||
SpawnWasteResponse,
|
||||
} from "@/types";
|
||||
|
||||
// ─── Humanized number formatting ─────────────────────────────────────────────
|
||||
@@ -395,6 +399,8 @@ function TokenUsageCostsSection() {
|
||||
const { data: projection, isLoading: loadingProj } = useUsageProjection();
|
||||
const { data: cacheStats, isLoading: loadingCache } =
|
||||
useCacheEfficiency("24h");
|
||||
const { data: roleUsage, isLoading: loadingRoles } = useRoleUsage("24h");
|
||||
const { data: waste, isLoading: loadingWaste } = useSpawnWaste("24h");
|
||||
|
||||
const trendUp = (summary?.trend_pct ?? 0) >= 0;
|
||||
|
||||
@@ -474,7 +480,13 @@ function TokenUsageCostsSection() {
|
||||
<CacheEfficiencyCard cacheStats={cacheStats} isLoading={loadingCache} />
|
||||
</div>
|
||||
|
||||
{/* Row 5 — Sessions table */}
|
||||
{/* Row 5 — Per-role cost/cache + spawn waste */}
|
||||
<div className="grid gap-4 lg:grid-cols-2 xl:grid-cols-2 2xl:grid-cols-2">
|
||||
<RoleUsageTable data={roleUsage} isLoading={loadingRoles} />
|
||||
<SpawnWasteCard data={waste} isLoading={loadingWaste} />
|
||||
</div>
|
||||
|
||||
{/* Row 6 — Sessions table */}
|
||||
<SessionsTable data={sessions} isLoading={loadingSessions} />
|
||||
</div>
|
||||
);
|
||||
@@ -601,6 +613,119 @@ function CacheEfficiencyCard({
|
||||
);
|
||||
}
|
||||
|
||||
interface RoleUsageTableProps {
|
||||
data: RoleUsageRow[] | undefined;
|
||||
isLoading: boolean;
|
||||
}
|
||||
|
||||
function RoleUsageTable({ data, isLoading }: RoleUsageTableProps) {
|
||||
return (
|
||||
<Card>
|
||||
<CardHeader className="pb-2">
|
||||
<CardTitle className="text-base flex items-center gap-2">
|
||||
<Users className="h-4 w-4 text-blue-500" />
|
||||
Cost & Cache by Role
|
||||
</CardTitle>
|
||||
</CardHeader>
|
||||
<CardContent>
|
||||
{isLoading ? (
|
||||
<Skeleton className="h-40 w-full" />
|
||||
) : !data || data.length === 0 ? (
|
||||
<p className="text-sm text-muted-foreground">
|
||||
No usage recorded yet.
|
||||
</p>
|
||||
) : (
|
||||
<table className="w-full text-sm">
|
||||
<thead>
|
||||
<tr className="text-left text-xs text-muted-foreground">
|
||||
<th className="pb-1 font-medium">Role</th>
|
||||
<th className="pb-1 font-medium text-right">Cost</th>
|
||||
<th className="pb-1 font-medium text-right">Cache hit</th>
|
||||
<th className="pb-1 font-medium text-right">%</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{data.map((r) => (
|
||||
<tr key={r.role} className="border-t">
|
||||
<td className="py-1 font-mono text-xs">{r.role}</td>
|
||||
<td className="py-1 text-right">${r.cost_usd.toFixed(4)}</td>
|
||||
<td className="py-1 text-right">
|
||||
{(r.cache_hit_rate * 100).toFixed(1)}%
|
||||
</td>
|
||||
<td className="py-1 text-right text-muted-foreground">
|
||||
{r.pct_of_total.toFixed(1)}%
|
||||
</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
)}
|
||||
</CardContent>
|
||||
</Card>
|
||||
);
|
||||
}
|
||||
|
||||
interface SpawnWasteCardProps {
|
||||
data: SpawnWasteResponse | undefined;
|
||||
isLoading: boolean;
|
||||
}
|
||||
|
||||
function SpawnWasteCard({ data, isLoading }: SpawnWasteCardProps) {
|
||||
return (
|
||||
<Card>
|
||||
<CardHeader className="pb-2">
|
||||
<CardTitle className="text-base flex items-center gap-2">
|
||||
<AlertTriangle className="h-4 w-4 text-orange-500" />
|
||||
Spawn Waste
|
||||
</CardTitle>
|
||||
</CardHeader>
|
||||
<CardContent>
|
||||
{isLoading ? (
|
||||
<Skeleton className="h-40 w-full" />
|
||||
) : !data ? (
|
||||
<p className="text-sm text-muted-foreground">No spawn data yet.</p>
|
||||
) : (
|
||||
<div className="space-y-2">
|
||||
<div>
|
||||
<div className="text-3xl font-bold">
|
||||
{data.unproductive_pct.toFixed(1)}%
|
||||
</div>
|
||||
<p className="text-xs text-muted-foreground mt-1">
|
||||
{data.unproductive_spawns} of {data.total_spawns} spawns
|
||||
produced no output
|
||||
</p>
|
||||
</div>
|
||||
{data.by_role.length > 0 && (
|
||||
<table className="w-full text-xs">
|
||||
<tbody>
|
||||
{data.by_role.map((r) => (
|
||||
<tr key={r.role} className="border-t">
|
||||
<td className="py-1 font-mono">{r.role}</td>
|
||||
<td className="py-1 text-right text-muted-foreground">
|
||||
{r.unproductive}/{r.spawns}
|
||||
</td>
|
||||
<td className="py-1 text-right">
|
||||
{r.unproductive_pct.toFixed(0)}%
|
||||
</td>
|
||||
</tr>
|
||||
))}
|
||||
</tbody>
|
||||
</table>
|
||||
)}
|
||||
{data.respawn_strikes.length > 0 && (
|
||||
<p className="text-xs text-muted-foreground">
|
||||
{data.respawn_strikes.length} wedged task
|
||||
{data.respawn_strikes.length === 1 ? "" : "s"} with open respawn
|
||||
strikes
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
)}
|
||||
</CardContent>
|
||||
</Card>
|
||||
);
|
||||
}
|
||||
|
||||
// ─── Tab types ────────────────────────────────────────────────────────────────
|
||||
|
||||
type MetricsTab = "performance" | "token-usage" | "delivery" | "scorecards";
|
||||
|
||||
@@ -8,9 +8,11 @@ import type {
|
||||
AgentUsageRow,
|
||||
TeamUsageRow,
|
||||
ModelUsageSlice,
|
||||
RoleUsageRow,
|
||||
UsageTimePoint,
|
||||
UsageProjection,
|
||||
CacheEfficiencyResponse,
|
||||
SpawnWasteResponse,
|
||||
UsageSession,
|
||||
} from "@/types";
|
||||
|
||||
@@ -30,9 +32,13 @@ export const usageKeys = {
|
||||
[...usageKeys.all, "by-team", period] as const,
|
||||
modelUsage: (period: UsagePeriod) =>
|
||||
[...usageKeys.all, "by-model", period] as const,
|
||||
roleUsage: (period: UsagePeriod) =>
|
||||
[...usageKeys.all, "by-role", period] as const,
|
||||
projection: () => [...usageKeys.all, "projection"] as const,
|
||||
cacheEfficiency: (period: UsagePeriod) =>
|
||||
[...usageKeys.all, "cache-efficiency", period] as const,
|
||||
spawnWaste: (period: UsagePeriod) =>
|
||||
[...usageKeys.all, "spawn-waste", period] as const,
|
||||
sessions: (limit: number) => [...usageKeys.all, "sessions", limit] as const,
|
||||
};
|
||||
|
||||
@@ -85,6 +91,15 @@ export function useModelUsage(period: UsagePeriod = "24h") {
|
||||
});
|
||||
}
|
||||
|
||||
/** Per-role usage rows (cost + cache hit rate) */
|
||||
export function useRoleUsage(period: UsagePeriod = "24h") {
|
||||
return useQuery<RoleUsageRow[]>({
|
||||
queryKey: usageKeys.roleUsage(period),
|
||||
queryFn: () => usageApi.getRoleUsage(period),
|
||||
refetchInterval: 60_000,
|
||||
});
|
||||
}
|
||||
|
||||
/** Monthly cost projection based on 7-day rolling average */
|
||||
export function useUsageProjection() {
|
||||
return useQuery<UsageProjection>({
|
||||
@@ -103,6 +118,15 @@ export function useCacheEfficiency(period: UsagePeriod = "24h") {
|
||||
});
|
||||
}
|
||||
|
||||
/** Spawn-churn signal (per-role unproductive rate + respawn strikes) */
|
||||
export function useSpawnWaste(period: UsagePeriod = "24h") {
|
||||
return useQuery<SpawnWasteResponse>({
|
||||
queryKey: usageKeys.spawnWaste(period),
|
||||
queryFn: () => usageApi.getSpawnWaste(period),
|
||||
refetchInterval: 60_000,
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Recent inference sessions — mock-mode only.
|
||||
*
|
||||
|
||||
@@ -5,9 +5,11 @@ import type {
|
||||
AgentUsageRow,
|
||||
TeamUsageRow,
|
||||
ModelUsageSlice,
|
||||
RoleUsageRow,
|
||||
UsageTimePoint,
|
||||
UsageProjection,
|
||||
CacheEfficiencyResponse,
|
||||
SpawnWasteResponse,
|
||||
UsageSession,
|
||||
} from "@/types";
|
||||
|
||||
@@ -153,6 +155,72 @@ function mockCacheEfficiency(
|
||||
};
|
||||
}
|
||||
|
||||
function mockRoleUsage(period: UsagePeriod = "24h"): RoleUsageRow[] {
|
||||
const scale = period === "30d" ? 30 : period === "7d" ? 7 : 1;
|
||||
const roles = [
|
||||
{ role: "developer", share: 0.375 },
|
||||
{ role: "main_pm", share: 0.301 },
|
||||
{ role: "cell_pm", share: 0.176 },
|
||||
{ role: "pr_reviewer", share: 0.058 },
|
||||
{ role: "qa", share: 0.056 },
|
||||
{ role: "documenter", share: 0.034 },
|
||||
];
|
||||
const base = 124_800 * scale;
|
||||
return roles.map((r) => {
|
||||
const ti = Math.round(base * r.share * 0.05);
|
||||
const to_ = Math.round(base * r.share * 0.03);
|
||||
const cr = Math.round(base * r.share * 0.8);
|
||||
const cw = Math.round(base * r.share * 0.12);
|
||||
const total = ti + to_ + cr + cw;
|
||||
return {
|
||||
role: r.role,
|
||||
tokens_input: ti,
|
||||
tokens_output: to_,
|
||||
tokens_cache_read: cr,
|
||||
tokens_cache_write: cw,
|
||||
cache_hit_rate: parseFloat((cr / (ti + cr)).toFixed(4)),
|
||||
total_tokens: total,
|
||||
cost_usd: parseFloat((total * 0.00002).toFixed(6)),
|
||||
pct_of_total: parseFloat((r.share * 100).toFixed(1)),
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
function mockSpawnWaste(period: UsagePeriod = "24h"): SpawnWasteResponse {
|
||||
const scale = period === "30d" ? 30 : period === "7d" ? 7 : 1;
|
||||
const by_role = [
|
||||
{ role: "developer", spawns: 51 * scale, unproductive: 42 * scale },
|
||||
{ role: "cell_pm", spawns: 34 * scale, unproductive: 18 * scale },
|
||||
{ role: "main_pm", spawns: 20 * scale, unproductive: 9 * scale },
|
||||
{ role: "qa", spawns: 18 * scale, unproductive: 14 * scale },
|
||||
].map((r) => ({
|
||||
...r,
|
||||
unproductive_pct: parseFloat(
|
||||
((r.unproductive / r.spawns) * 100).toFixed(1),
|
||||
),
|
||||
}));
|
||||
const total_spawns = by_role.reduce((s, r) => s + r.spawns, 0);
|
||||
const unproductive_spawns = by_role.reduce((s, r) => s + r.unproductive, 0);
|
||||
return {
|
||||
total_spawns,
|
||||
unproductive_spawns,
|
||||
unproductive_pct: parseFloat(
|
||||
((unproductive_spawns / total_spawns) * 100).toFixed(1),
|
||||
),
|
||||
by_role,
|
||||
respawn_strikes: [
|
||||
{
|
||||
agent_slug: "be-dev-1",
|
||||
task_id: "11111111-1111-1111-1111-111111111111",
|
||||
count: 4,
|
||||
last_status: "in_progress",
|
||||
notified: true,
|
||||
},
|
||||
],
|
||||
period,
|
||||
};
|
||||
}
|
||||
|
||||
function mockSessions(): UsageSession[] {
|
||||
const models = ["claude-opus-4", "claude-sonnet-4", "claude-haiku-4"];
|
||||
const agentSlugs = ["be-dev-1", "be-dev-2", "fe-dev-1", "fe-qa", "main-pm"];
|
||||
@@ -246,6 +314,28 @@ export const usageApi = {
|
||||
return data;
|
||||
},
|
||||
|
||||
/** Per-role usage rows (with cache hit rate) — GET /usage/by-role?period= */
|
||||
getRoleUsage: async (
|
||||
period: UsagePeriod = "24h",
|
||||
): Promise<RoleUsageRow[]> => {
|
||||
if (isMockMode()) return mockRoleUsage(period);
|
||||
const { data } = await api.get<RoleUsageRow[]>("/usage/by-role", {
|
||||
params: { period },
|
||||
});
|
||||
return data;
|
||||
},
|
||||
|
||||
/** Spawn-churn signal — GET /usage/spawn-waste?period= */
|
||||
getSpawnWaste: async (
|
||||
period: UsagePeriod = "24h",
|
||||
): Promise<SpawnWasteResponse> => {
|
||||
if (isMockMode()) return mockSpawnWaste(period);
|
||||
const { data } = await api.get<SpawnWasteResponse>("/usage/spawn-waste", {
|
||||
params: { period },
|
||||
});
|
||||
return data;
|
||||
},
|
||||
|
||||
/** Monthly cost projection — GET /usage/projection */
|
||||
getUsageProjection: async (): Promise<UsageProjection> => {
|
||||
if (isMockMode()) return mockProjection();
|
||||
|
||||
@@ -1361,6 +1361,46 @@ export interface CacheEfficiencyResponse {
|
||||
period: string;
|
||||
}
|
||||
|
||||
/** Per-role usage row (with cache hit rate) — GET /usage/by-role?period=24h|7d|30d */
|
||||
export interface RoleUsageRow {
|
||||
role: string;
|
||||
tokens_input: number;
|
||||
tokens_output: number;
|
||||
tokens_cache_read: number;
|
||||
tokens_cache_write: number;
|
||||
cache_hit_rate: number;
|
||||
total_tokens: number;
|
||||
cost_usd: number;
|
||||
pct_of_total: number;
|
||||
}
|
||||
|
||||
/** One per-role row in the spawn-waste signal */
|
||||
export interface RoleWasteRow {
|
||||
role: string;
|
||||
spawns: number;
|
||||
unproductive: number;
|
||||
unproductive_pct: number;
|
||||
}
|
||||
|
||||
/** One wedged agent/task pair the circuit breaker is counting */
|
||||
export interface RespawnStrikeRow {
|
||||
agent_slug: string;
|
||||
task_id: string;
|
||||
count: number;
|
||||
last_status: string | null;
|
||||
notified: boolean;
|
||||
}
|
||||
|
||||
/** Spawn-churn signal — GET /usage/spawn-waste?period=24h|7d|30d */
|
||||
export interface SpawnWasteResponse {
|
||||
total_spawns: number;
|
||||
unproductive_spawns: number;
|
||||
unproductive_pct: number;
|
||||
by_role: RoleWasteRow[];
|
||||
respawn_strikes: RespawnStrikeRow[];
|
||||
period: string;
|
||||
}
|
||||
|
||||
/** Individual inference session for the sessions table (mock-mode only — no real backend endpoint) */
|
||||
export interface UsageSession {
|
||||
id: string;
|
||||
|
||||
Reference in New Issue
Block a user