@aitne/daemon 0.1.7 → 0.1.8

package/dist/api/routes/dashboard/conversations.js

@@ -0,0 +1,309 @@
+import { existsSync } from "node:fs";
+import { getSessionWorkdirPath } from "../../../core/workdir.js";
+import { DASHBOARD_CHAT_SCOPE, DOCS_QA_SCOPE } from "../../../messaging/constants.js";
+import { deleteAllChatSidebarSessions, deleteChatSession, } from "../../../core/dashboard-session-cleanup.js";
+export function registerConversationsRoutes(app, deps) {
+    const { db, config } = deps;
+    // ── Events/Logs API ──
+    /** GET /events — paginated event/action log */
+    app.get("/events", (c) => {
+        const page = Math.max(1, Number(c.req.query("page") ?? "1"));
+        const limit = Math.min(Number(c.req.query("limit") ?? "50"), 100);
+        const offset = (page - 1) * limit;
+        const type = c.req.query("type");
+        const result = c.req.query("result");
+        const days = c.req.query("days"); // "1" (today), "7", "30"
+        let whereClause = "WHERE 1=1";
+        const params = [];
+        if (type) {
+            whereClause += " AND action_type = ?";
+            params.push(type);
+        }
+        if (result) {
+            whereClause += " AND result = ?";
+            params.push(result);
+        }
+        if (days) {
+            const d = Number(days);
+            if (d > 0 && d <= 365) {
+                // datetime(started_at) normalizes mixed ISO-8601 / SQL formats — the
+                // delegated_proxy.invoke writer historically inserted ISO-with-T-and-Z
+                // strings, which sort lexicographically above same-day SQL strings.
+                whereClause += " AND datetime(started_at) > datetime('now', '-' || ? || ' days')";
+                params.push(d);
+            }
+        }
+        const total = db
+            .prepare(`SELECT COUNT(*) as cnt FROM agent_actions ${whereClause}`)
+            .get(...params);
+        params.push(limit, offset);
+        const rows = db
+            .prepare(`SELECT id, event_id, action_type, trigger, model_used, model_usage_json, cost_usd,
+                tokens_input, tokens_output,
+                cache_creation_tokens, cache_read_tokens,
+                duration_ms, num_turns,
+                result, detail, started_at, completed_at, error
+         FROM agent_actions ${whereClause}
+         ORDER BY datetime(started_at) DESC, id DESC
+         LIMIT ? OFFSET ?`)
+            .all(...params);
+        return c.json({
+            events: rows,
+            pagination: {
+                page,
+                limit,
+                total: total.cnt,
+                totalPages: Math.ceil(total.cnt / limit),
+            },
+        });
+    });
+    // ── Conversations API ──
+    /** GET /conversations — paginated conversation sessions */
+    app.get("/conversations", (c) => {
+        const page = Number(c.req.query("page") ?? "1");
+        const limit = Math.min(Number(c.req.query("limit") ?? "20"), 50);
+        const offset = (page - 1) * limit;
+        const platform = c.req.query("platform");
+        const status = c.req.query("status");
+        const scope = c.req.query("scope");
+        const scopes = scope
+            ?.split(",")
+            .map((value) => value.trim())
+            .filter((value) => value.length > 0);
+        let whereClause = "WHERE 1=1";
+        const params = [];
+        if (platform) {
+            whereClause += " AND platform = ?";
+            params.push(platform);
+        }
+        if (status) {
+            whereClause += " AND status = ?";
+            params.push(status);
+        }
+        if (scopes && scopes.length > 0) {
+            if (scopes.length === 1) {
+                whereClause += " AND scope = ?";
+                params.push(scopes[0]);
+            }
+            else {
+                whereClause += ` AND scope IN (${scopes.map(() => "?").join(", ")})`;
+                params.push(...scopes);
+            }
+        }
+        else {
+            // Default view excludes docs_qa: QA transcripts are short lookups
+            // and would drown out chat in /activity. Operators opt in with the
+            // explicit `?scope=docs_qa` filter chip.
+            whereClause += " AND scope != ?";
+            params.push(DOCS_QA_SCOPE);
+        }
+        const total = db
+            .prepare(`SELECT COUNT(*) as cnt FROM conversation_sessions ${whereClause}`)
+            .get(...params);
+        params.push(limit, offset);
+        const rows = db
+            .prepare(`SELECT id, platform, channel_id, thread_id, scope, model, status,
+                message_count, started_at, last_message_at, is_dm, backend_session_id
+         FROM conversation_sessions ${whereClause}
+         ORDER BY last_message_at DESC
+         LIMIT ? OFFSET ?`)
+            .all(...params);
+        const sourcePlatformsStmt = db.prepare(`SELECT DISTINCT platform
+         FROM messages
+        WHERE session_id = ?
+        ORDER BY CASE platform
+          WHEN 'dashboard' THEN 0
+          WHEN 'whatsapp' THEN 1
+          WHEN 'telegram' THEN 2
+          WHEN 'slack' THEN 3
+          WHEN 'discord' THEN 4
+          ELSE 99
+        END, platform`);
+        const conversations = rows.map((row) => {
+            const sourcePlatforms = sourcePlatformsStmt.all(row.id).map((platformRow) => platformRow.platform);
+            const normalizedSourcePlatforms = sourcePlatforms.length > 0
+                ? sourcePlatforms
+                : row.platform !== "owner"
+                    ? [row.platform]
+                    : [];
+            const browserOnly = normalizedSourcePlatforms.length > 0
+                && normalizedSourcePlatforms.every((platform) => platform === "dashboard");
+            return {
+                id: row.id,
+                platform: row.platform,
+                channel_id: row.channel_id,
+                thread_id: row.thread_id,
+                model: row.model,
+                status: row.status,
+                message_count: row.message_count,
+                started_at: row.started_at,
+                last_message_at: row.last_message_at,
+                summary: null,
+                source_platforms: normalizedSourcePlatforms,
+                read_only_from_dashboard: normalizedSourcePlatforms.length === 0 ||
+                    normalizedSourcePlatforms.some((platform) => platform !== "dashboard"),
+                // A session is continuable when the dispatcher can actually
+                // execute against it — not when its stored SDK session id is
+                // non-null. `continueDashboardSession` legitimately writes
+                // `backend_session_id = NULL` on the `shouldInvalidateSdkSession`
+                // path, and the dispatcher falls back to fresh-execute + history
+                // injection for NULL backends. The real gates are: scope,
+                // browser-only provenance, and the workdir surviving on disk.
+                continue_available: row.scope === DASHBOARD_CHAT_SCOPE
+                    && browserOnly
+                    && existsSync(getSessionWorkdirPath(config.dataDir, row.id)),
+            };
+        });
+        return c.json({
+            conversations,
+            pagination: {
+                page,
+                limit,
+                total: total.cnt,
+                totalPages: Math.ceil(total.cnt / limit),
+            },
+        });
+    });
+    /**
+     * DELETE /conversations — bulk-delete every non-active sidebar session.
+     * Scope is hard-coded to `dashboard_chat` + `owner_dm` (what the chat
+     * sidebar shows); the live active session is filtered out so deleting
+     * "all past sessions" never kills the current chat.
+     */
+    app.delete("/conversations", (c) => {
+        const result = deleteAllChatSidebarSessions({ db, dataDir: config.dataDir });
+        return c.json({ status: "deleted", deleted: result.deleted });
+    });
+    /** DELETE /conversations/:id — delete one non-active sidebar session. */
+    app.delete("/conversations/:id", (c) => {
+        const sessionId = Number(c.req.param("id"));
+        if (!Number.isFinite(sessionId) || sessionId <= 0) {
+            return c.json({ error: "invalid_session_id" }, 400);
+        }
+        const result = deleteChatSession({
+            db,
+            dataDir: config.dataDir,
+            sessionId,
+        });
+        if (!result.ok) {
+            return c.json({ error: "delete_failed", message: result.message }, result.status);
+        }
+        return c.json({ status: "deleted", deleted: result.deleted });
+    });
+    /** GET /conversations/:id/messages — messages for a specific conversation */
+    app.get("/conversations/:id/messages", (c) => {
+        const sessionId = Number(c.req.param("id"));
+        const limit = Math.min(Number(c.req.query("limit") ?? "50"), 200);
+        const before = c.req.query("before"); // cursor-based pagination
+        let whereClause = "WHERE session_id = ?";
+        const params = [sessionId];
+        if (before) {
+            whereClause += " AND id < ?";
+            params.push(Number(before));
+        }
+        params.push(limit);
+        const rows = db
+            .prepare(`SELECT id, role, content, platform, sender_id, timestamp
+         FROM messages ${whereClause}
+         ORDER BY id DESC
+         LIMIT ?`)
+            .all(...params);
+        // Chat-attachments Phase 1 — inline attachment refs per message so
+        // the dashboard transcript can render thumbnails/download chips
+        // alongside past messages without an extra round-trip per row.
+        // Skipped when the chat_attachments table doesn't exist (older DB
+        // snapshots / tests that don't run migrations).
+        const hasAttachments = (() => {
+            try {
+                const row = db
+                    .prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name='chat_attachments'`)
+                    .get();
+                return row !== undefined;
+            }
+            catch {
+                return false;
+            }
+        })();
+        const attachmentsByMessage = new Map();
+        if (hasAttachments && rows.length > 0) {
+            const ids = rows.map((r) => r.id);
+            const placeholders = ids.map(() => "?").join(",");
+            const attachmentRows = db
+                .prepare(`SELECT message_id, id, direction, original_filename, mime_type, size_bytes, caption
+           FROM chat_attachments
+           WHERE message_id IN (${placeholders})
+           ORDER BY created_at ASC`)
+                .all(...ids);
+            for (const a of attachmentRows) {
+                let bucket = attachmentsByMessage.get(a.message_id);
+                if (!bucket) {
+                    bucket = [];
+                    attachmentsByMessage.set(a.message_id, bucket);
+                }
+                bucket.push({
+                    id: a.id,
+                    direction: a.direction,
+                    originalFilename: a.original_filename,
+                    mimeType: a.mime_type,
+                    sizeBytes: a.size_bytes,
+                    caption: a.caption,
+                });
+            }
+        }
+        const enriched = rows.map((row) => {
+            const attachments = attachmentsByMessage.get(row.id);
+            return attachments && attachments.length > 0
+                ? { ...row, attachments }
+                : row;
+        });
+        return c.json({
+            messages: enriched.reverse(), // Return in chronological order
+            hasMore: rows.length === limit,
+        });
+    });
+    // ── Search API ──
+    /** GET /search?q= — full-text search via FTS5 */
+    app.get("/search", (c) => {
+        const q = c.req.query("q");
+        if (!q || q.length < 2)
+            return c.json({ error: "query too short" }, 400);
+        if (q.length > 200)
+            return c.json({ error: "query too long" }, 400);
+        const limit = Math.min(Number(c.req.query("limit") ?? "20"), 50);
+        // Sanitize: wrap each word in double-quotes to disable FTS5 operators (NEAR, NOT, OR, etc.)
+        const safeQuery = q
+            .replace(/[^\w\s\u3000-\u9FFF\uF900-\uFAFF]/g, " ") // strip punctuation except CJK
+            .split(/\s+/)
+            .filter(Boolean)
+            .map((w) => `"${w}"`)
+            .join(" ");
+        if (!safeQuery)
+            return c.json({ actions: [], messages: [] });
+        let actions = [];
+        let messages = [];
+        try {
+            actions = db
+                .prepare(`SELECT a.id, a.action_type, a.started_at,
+                  highlight(fts_actions, 1, '<mark>', '</mark>') as snippet
+           FROM fts_actions JOIN agent_actions a ON a.id = fts_actions.rowid
+           WHERE fts_actions MATCH ? ORDER BY rank LIMIT ?`)
+                .all(safeQuery, limit);
+        }
+        catch {
+            // FTS table may not exist yet
+        }
+        try {
+            messages = db
+                .prepare(`SELECT m.id, m.role, m.timestamp, m.session_id,
+                  highlight(fts_messages, 0, '<mark>', '</mark>') as snippet
+           FROM fts_messages JOIN messages m ON m.id = fts_messages.rowid
+           WHERE fts_messages MATCH ? ORDER BY rank LIMIT ?`)
+                .all(safeQuery, limit);
+        }
+        catch {
+            // FTS table may not exist yet
+        }
+        return c.json({ actions, messages });
+    });
+}
+//# sourceMappingURL=conversations.js.map

package/dist/api/routes/dashboard/conversations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversations.js","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/conversations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,4CAA4C,CAAC;AAEpD,MAAM,UAAU,2BAA2B,CAAC,GAAS,EAAE,IAAqB;IAC1E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE5B,wBAAwB;IAExB,+CAA+C;IAC/C,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB;QAE3D,IAAI,WAAW,GAAG,WAAW,CAAC;QAC9B,MAAM,MAAM,GAAc,EAAE,CAAC;QAE7B,IAAI,IAAI,EAAE,CAAC;YACT,WAAW,IAAI,sBAAsB,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,IAAI,iBAAiB,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;gBACtB,qEAAqE;gBACrE,uEAAuE;gBACvE,oEAAoE;gBACpE,WAAW,IAAI,kEAAkE,CAAC;gBAClF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,EAAE;aACb,OAAO,CACN,6CAA6C,WAAW,EAAE,CAC3D;aACA,GAAG,CAAC,GAAG,MAAM,CAAoB,CAAC;QAErC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;;;;;8BAKsB,WAAW;;0BAEf,CACnB;aACA,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAElB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,IAAI;gBACJ,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,GAAG;gBAChB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;aACzC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAE1B,2DAA2D;IAC3D,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK;YAClB,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvC,IAAI,WAAW,GAAG,WAAW,CAAC;QAC9B,MAAM,MAAM,GAAc,EAAE,CAAC;QAE7B,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,IAAI,mBAAmB,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,IAAI,iBAAiB,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,WAAW,IAAI,gBAAgB,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,WAAW,IAAI,kBAAkB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,mEAAmE;YACnE,yCAAyC;YACzC,WAAW,IAAI,iBAAiB,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,KAAK,GAAG,EAAE;aACb,OAAO,CACN,qDAAqD,WAAW,EAAE,CACnE;aACA,GAAG,CAAC,GAAG,MAAM,CAAoB,CAAC;QAErC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;;sCAE8B,WAAW;;0BAEvB,CACnB;aACA,GAAG,CAAC,GAAG,MAAM,CAaZ,CAAC;QAEL,MAAM,mBAAmB,GAAG,EAAE,CAAC,OAAO,CACpC;;;;;;;;;;sBAUgB,CACjB,CAAC;QAEF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACrC,MAAM,eAAe,GACnB,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,yBAAyB,GAC7B,eAAe,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO;oBACxB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAChB,CAAC,CAAC,EAAE,CAAC;YACX,MAAM,WAAW,GACf,yBAAyB,CAAC,MAAM,GAAG,CAAC;mBACjC,yBAAyB,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;YAE7E,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,yBAAyB;gBAC3C,wBAAwB,EACtB,yBAAyB,CAAC,MAAM,KAAK,CAAC;oBACtC,yBAAyB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,WAAW,CAAC;gBACxE,4DAA4D;gBAC5D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,kEAAkE;gBAClE,iEAAiE;gBACjE,0DAA0D;gBAC1D,8DAA8D;gBAC9D,kBAAkB,EAChB,GAAG,CAAC,KAAK,KAAK,oBAAoB;uBAC/B,WAAW;uBACX,UAAU,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAC/D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,aAAa;YACb,UAAU,EAAE;gBACV,IAAI;gBACJ,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,GAAG;gBAChB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;aACzC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,4BAA4B,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,EAAE;YACF,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,0BAA0B;QAEhE,IAAI,WAAW,GAAG,sBAAsB,CAAC;QACzC,MAAM,MAAM,GAAc,CAAC,SAAS,CAAC,CAAC;QAEtC,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,IAAI,aAAa,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;yBACiB,WAAW;;iBAEnB,CACV;aACA,GAAG,CAAC,GAAG,MAAM,CAOZ,CAAC;QAEL,mEAAmE;QACnE,gEAAgE;QAChE,+DAA+D;QAC/D,kEAAkE;QAClE,gDAAgD;QAChD,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE;qBACX,OAAO,CACN,+EAA+E,CAChF;qBACA,GAAG,EAAE,CAAC;gBACT,OAAO,GAAG,KAAK,SAAS,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAUjC,CAAC;QACJ,IAAI,cAAc,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,cAAc,GAAG,EAAE;iBACtB,OAAO,CACN;;kCAEwB,YAAY;mCACX,CAC1B;iBACA,GAAG,CAAC,GAAG,GAAG,CAQT,CAAC;YACL,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;gBAC/B,IAAI,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACpD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,GAAG,EAAE,CAAC;oBACZ,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBACjD,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,gBAAgB,EAAE,CAAC,CAAC,iBAAiB;oBACrC,QAAQ,EAAE,CAAC,CAAC,SAAS;oBACrB,SAAS,EAAE,CAAC,CAAC,UAAU;oBACvB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAChC,MAAM,WAAW,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrD,OAAO,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAC1C,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE;gBACzB,CAAC,CAAC,GAAG,CAAC;QACV,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,gCAAgC;YAC9D,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,KAAK;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,mBAAmB;IAEnB,iDAAiD;IACjD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEjE,4FAA4F;QAC5F,MAAM,SAAS,GAAG,CAAC;aAChB,OAAO,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAE,+BAA+B;aACnF,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;aACpB,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAE7D,IAAI,OAAO,GAAc,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAc,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,OAAO,GAAG,EAAE;iBACT,OAAO,CACN;;;2DAGiD,CAClD;iBACA,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;QAED,IAAI,CAAC;YACH,QAAQ,GAAG,EAAE;iBACV,OAAO,CACN;;;4DAGkD,CACnD;iBACA,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes/dashboard/cost-approvals.d.ts

@@ -0,0 +1,29 @@
+import type { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+/**
+ * Aggregate raw `byModelRows` into the `{ model, total_cost, session_count }`
+ * shape the dashboard expects, attributing cost to the actually-billed model
+ * from `model_usage_json` rather than the requested `model_used`. When a row
+ * has no usage breakdown we fall back to `model_used`. A row that touches
+ * multiple billed models contributes its split cost to each bucket and is
+ * counted once toward each model's `session_count`.
+ *
+ * Cost reconciliation: the SDK's `r.modelUsage[*].costUSD` covers LLM
+ * inference only — server-side tools (web_search, code_execution) appear in
+ * `r.total_cost_usd` (= row.cost_usd) but not in any per-model entry. If
+ * `Σ per-model cost < row.cost_usd`, the residual is credited to
+ * `model_used` (the requested model) so per-model totals add up to the
+ * dashboard's overall cost. Without this, a chart row's "billed total"
+ * silently drops tool-use spend.
+ */
+export declare function aggregateByBilledModel(rows: ReadonlyArray<{
+    model_used: string | null;
+    model_usage_json: string | null;
+    cost_usd: number;
+}>): Array<{
+    model: string;
+    total_cost: number;
+    session_count: number;
+}>;
+export declare function registerCostApprovalsRoutes(app: Hono, deps: ApiDependencies): void;
+//# sourceMappingURL=cost-approvals.d.ts.map

package/dist/api/routes/dashboard/cost-approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-approvals.d.ts","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/cost-approvals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiEvD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,GACD,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAsErE;AAmBD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAoIlF"}

package/dist/api/routes/dashboard/cost-approvals.js

@@ -0,0 +1,259 @@
+import { getAgentDayBoundsUtc, getAgentDaySqlShiftModifier } from "@aitne/shared";
+/**
+ * Pre-defined static cost queries — no string interpolation of user input.
+ * `byModel` is computed in JS via `aggregateByBilledModel` because the SDK
+ * can route a request for one model to a sibling (e.g. opus-4-7 →
+ * opus-4-6[1m]); SQL `GROUP BY model_used` would lump cost under the
+ * requested model and produce a chart that disagrees with the per-row
+ * billed-model badge on the same page.
+ *
+ * `byPeriod` buckets by *agent day* via `date(started_at, ?)` where `?` is
+ * the timezone+dayBoundary shift modifier. Without the shift, a single
+ * agent day (e.g. 04:00 JST → 04:00 JST next day) gets split across two
+ * UTC calendar dates so the chart shows two half-height bars summing to
+ * the same Today-card total — the bug reported in the original screenshot
+ * where Today=$6.30 rendered as two flat ~$3.15 buckets.
+ */
+const COST_QUERIES = {
+    daily: {
+        byPeriod: `SELECT date(started_at, ?) as period,
+            SUM(cost_usd) as total_cost, COUNT(*) as session_count,
+            SUM(tokens_input) as total_input_tokens, SUM(tokens_output) as total_output_tokens
+     FROM agent_actions WHERE started_at > datetime('now', '-30 days') AND cost_usd IS NOT NULL
+     GROUP BY date(started_at, ?) ORDER BY period DESC`,
+        byModelRows: `SELECT model_used, model_usage_json, cost_usd
+     FROM agent_actions
+     WHERE started_at > datetime('now', '-30 days')
+       AND cost_usd IS NOT NULL
+       AND (model_used IS NOT NULL OR model_usage_json IS NOT NULL)`,
+        byEventType: `SELECT action_type as event_type, SUM(cost_usd) as total_cost, COUNT(*) as session_count
+     FROM agent_actions WHERE started_at > datetime('now', '-30 days') AND cost_usd IS NOT NULL
+     GROUP BY action_type ORDER BY total_cost DESC`,
+    },
+    weekly: {
+        byPeriod: `SELECT strftime('%Y-W%W', started_at, ?) as period,
+            SUM(cost_usd) as total_cost, COUNT(*) as session_count,
+            SUM(tokens_input) as total_input_tokens, SUM(tokens_output) as total_output_tokens
+     FROM agent_actions WHERE started_at > datetime('now', '-90 days') AND cost_usd IS NOT NULL
+     GROUP BY strftime('%Y-W%W', started_at, ?) ORDER BY period DESC`,
+        byModelRows: `SELECT model_used, model_usage_json, cost_usd
+     FROM agent_actions
+     WHERE started_at > datetime('now', '-90 days')
+       AND cost_usd IS NOT NULL
+       AND (model_used IS NOT NULL OR model_usage_json IS NOT NULL)`,
+        byEventType: `SELECT action_type as event_type, SUM(cost_usd) as total_cost, COUNT(*) as session_count
+     FROM agent_actions WHERE started_at > datetime('now', '-90 days') AND cost_usd IS NOT NULL
+     GROUP BY action_type ORDER BY total_cost DESC`,
+    },
+    monthly: {
+        byPeriod: `SELECT strftime('%Y-%m', started_at, ?) as period,
+            SUM(cost_usd) as total_cost, COUNT(*) as session_count,
+            SUM(tokens_input) as total_input_tokens, SUM(tokens_output) as total_output_tokens
+     FROM agent_actions WHERE started_at > datetime('now', '-365 days') AND cost_usd IS NOT NULL
+     GROUP BY strftime('%Y-%m', started_at, ?) ORDER BY period DESC`,
+        byModelRows: `SELECT model_used, model_usage_json, cost_usd
+     FROM agent_actions
+     WHERE started_at > datetime('now', '-365 days')
+       AND cost_usd IS NOT NULL
+       AND (model_used IS NOT NULL OR model_usage_json IS NOT NULL)`,
+        byEventType: `SELECT action_type as event_type, SUM(cost_usd) as total_cost, COUNT(*) as session_count
+     FROM agent_actions WHERE started_at > datetime('now', '-365 days') AND cost_usd IS NOT NULL
+     GROUP BY action_type ORDER BY total_cost DESC`,
+    },
+};
+/**
+ * Aggregate raw `byModelRows` into the `{ model, total_cost, session_count }`
+ * shape the dashboard expects, attributing cost to the actually-billed model
+ * from `model_usage_json` rather than the requested `model_used`. When a row
+ * has no usage breakdown we fall back to `model_used`. A row that touches
+ * multiple billed models contributes its split cost to each bucket and is
+ * counted once toward each model's `session_count`.
+ *
+ * Cost reconciliation: the SDK's `r.modelUsage[*].costUSD` covers LLM
+ * inference only — server-side tools (web_search, code_execution) appear in
+ * `r.total_cost_usd` (= row.cost_usd) but not in any per-model entry. If
+ * `Σ per-model cost < row.cost_usd`, the residual is credited to
+ * `model_used` (the requested model) so per-model totals add up to the
+ * dashboard's overall cost. Without this, a chart row's "billed total"
+ * silently drops tool-use spend.
+ */
+export function aggregateByBilledModel(rows) {
+    const map = new Map();
+    // Per-row scratch; a single row counts toward `session_count` exactly once
+    // per model it touched, even when residual handling credits the same model
+    // twice (once from per-model breakdown, once from tool-use residual).
+    const addCost = (model, cost) => {
+        const bucket = map.get(model) ?? { total_cost: 0, session_count: 0 };
+        bucket.total_cost += cost;
+        map.set(model, bucket);
+    };
+    const incSession = (rowSeen, model) => {
+        if (rowSeen.has(model))
+            return;
+        rowSeen.add(model);
+        const bucket = map.get(model) ?? { total_cost: 0, session_count: 0 };
+        bucket.session_count += 1;
+        map.set(model, bucket);
+    };
+    // 0.0001¢ — below this, treat the residual as float-arithmetic noise and
+    // skip the bookkeeping. Real tool-use costs are always orders of magnitude
+    // above this.
+    const RESIDUAL_EPSILON_USD = 0.000001;
+    for (const row of rows) {
+        const seenForRow = new Set();
+        let parsed = null;
+        if (row.model_usage_json) {
+            try {
+                parsed = JSON.parse(row.model_usage_json);
+            }
+            catch {
+                parsed = null;
+            }
+        }
+        let perModelTotal = 0;
+        let touchedAny = false;
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            for (const [modelId, entry] of Object.entries(parsed)) {
+                if (!entry || typeof entry !== "object")
+                    continue;
+                const v = entry;
+                const cost = typeof v.costUsd === "number" ? v.costUsd : 0;
+                addCost(modelId, cost);
+                incSession(seenForRow, modelId);
+                perModelTotal += cost;
+                touchedAny = true;
+            }
+        }
+        if (!touchedAny) {
+            if (row.model_used) {
+                addCost(row.model_used, row.cost_usd);
+                incSession(seenForRow, row.model_used);
+            }
+            continue;
+        }
+        // Residual handles server-side tool cost (web_search, code execution)
+        // that the SDK adds to total_cost_usd but not to any per-model bucket.
+        const residual = row.cost_usd - perModelTotal;
+        if (residual > RESIDUAL_EPSILON_USD && row.model_used) {
+            addCost(row.model_used, residual);
+            incSession(seenForRow, row.model_used);
+        }
+    }
+    return [...map.entries()]
+        .map(([model, v]) => ({ model, ...v }))
+        .sort((a, b) => b.total_cost - a.total_cost);
+}
+// `bucketExpr` takes a single shift-modifier parameter (e.g. "+300 minutes")
+// so each query binds it explicitly — see COST_QUERIES for the rationale.
+const COST_PERIOD_SPECS = {
+    daily: {
+        bucketExpr: "date(started_at, ?)",
+        sinceExpr: "-30 days",
+    },
+    weekly: {
+        bucketExpr: "strftime('%Y-W%W', started_at, ?)",
+        sinceExpr: "-90 days",
+    },
+    monthly: {
+        bucketExpr: "strftime('%Y-%m', started_at, ?)",
+        sinceExpr: "-365 days",
+    },
+};
+export function registerCostApprovalsRoutes(app, deps) {
+    const { db, config } = deps;
+    const agentActionColumns = new Set(db.pragma("table_info(agent_actions)").map((column) => column.name));
+    const backendExpr = agentActionColumns.has("backend")
+        ? "COALESCE(backend, 'claude')"
+        : "'claude'";
+    // ── Cost API ──
+    /** GET /cost — cost analytics */
+    app.get("/cost", (c) => {
+        const period = c.req.query("period") ?? "daily"; // daily, weekly, monthly
+        const periodKey = period in COST_QUERIES
+            ? period
+            : "daily";
+        const queries = COST_QUERIES[periodKey];
+        const spec = COST_PERIOD_SPECS[periodKey];
+        const shift = getAgentDaySqlShiftModifier(config.timezone, config.dayBoundaryHour);
+        const byPeriod = db.prepare(queries.byPeriod).all(shift, shift);
+        const byModelRaw = db.prepare(queries.byModelRows).all();
+        const byModel = aggregateByBilledModel(byModelRaw);
+        const byEventType = db.prepare(queries.byEventType).all();
+        const byBackend = db
+            .prepare(`SELECT ${backendExpr} as backend,
+                SUM(cost_usd) as total_cost,
+                COUNT(*) as session_count
+           FROM agent_actions
+          WHERE started_at > datetime('now', ?)
+            AND cost_usd IS NOT NULL
+          GROUP BY 1
+          ORDER BY total_cost DESC`)
+            .all(spec.sinceExpr);
+        const byBackendPeriod = db
+            .prepare(`SELECT ${spec.bucketExpr} as period,
+                ${backendExpr} as backend,
+                SUM(cost_usd) as total_cost,
+                COUNT(*) as session_count
+           FROM agent_actions
+          WHERE started_at > datetime('now', ?)
+            AND cost_usd IS NOT NULL
+          GROUP BY 1, 2
+          ORDER BY period DESC, backend ASC`)
+            .all(shift, spec.sinceExpr);
+        // Today's total (timezone-aware agent day, executed sessions only).
+        // datetime(started_at) normalizes mixed ISO-8601 / SQL formats — same
+        // rationale as the /events ORDER BY fix above.
+        const bounds = getAgentDayBoundsUtc(config.timezone, config.dayBoundaryHour);
+        const today = db
+            .prepare(`SELECT COALESCE(SUM(cost_usd), 0) as cost,
+                COUNT(*) as sessions
+         FROM agent_actions
+         WHERE datetime(started_at) >= ? AND datetime(started_at) < ?
+           AND cost_usd IS NOT NULL`)
+            .get(bounds.start, bounds.end);
+        return c.json({
+            period,
+            today: { costUsd: today.cost, sessions: today.sessions },
+            byPeriod,
+            byModel,
+            byEventType,
+            byBackend,
+            byBackendPeriod,
+        });
+    });
+    // ── Approvals API ──
+    /** GET /approvals — list pending approval requests */
+    app.get("/approvals", (c) => {
+        const rows = db
+            .prepare(`SELECT id, scheduled_for, task_type, task_description,
+                task_context, model, status, created_at
+         FROM agent_schedule
+         WHERE status = 'pending' AND task_type = 'approval'
+         ORDER BY created_at DESC`)
+            .all();
+        return c.json({ approvals: rows });
+    });
+    /** POST /approvals/:id/approve — approve a pending request */
+    app.post("/approvals/:id/approve", (c) => {
+        const id = Number(c.req.param("id"));
+        const result = db
+            .prepare("UPDATE agent_schedule SET status = 'pending', task_type = 'approved_task' WHERE id = ? AND status = 'pending' AND task_type = 'approval'")
+            .run(id);
+        if (result.changes === 0) {
+            return c.json({ error: "approval not found or already processed" }, 404);
+        }
+        return c.json({ status: "approved", id });
+    });
+    /** POST /approvals/:id/deny — deny a pending request */
+    app.post("/approvals/:id/deny", (c) => {
+        const id = Number(c.req.param("id"));
+        const result = db
+            .prepare("UPDATE agent_schedule SET status = 'skipped' WHERE id = ? AND status = 'pending' AND task_type = 'approval'")
+            .run(id);
+        if (result.changes === 0) {
+            return c.json({ error: "approval not found or already processed" }, 404);
+        }
+        return c.json({ status: "denied", id });
+    });
+}
+//# sourceMappingURL=cost-approvals.js.map

package/dist/api/routes/dashboard/cost-approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-approvals.js","sourceRoot":"","sources":["../../../../src/api/routes/dashboard/cost-approvals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAGlF;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAG;IACnB,KAAK,EAAE;QACL,QAAQ,EAAE;;;;uDAIyC;QACnD,WAAW,EAAE;;;;oEAImD;QAChE,WAAW,EAAE;;mDAEkC;KAChD;IACD,MAAM,EAAE;QACN,QAAQ,EAAE;;;;qEAIuD;QACjE,WAAW,EAAE;;;;oEAImD;QAChE,WAAW,EAAE;;mDAEkC;KAChD;IACD,OAAO,EAAE;QACP,QAAQ,EAAE;;;;oEAIsD;QAChE,WAAW,EAAE;;;;oEAImD;QAChE,WAAW,EAAE;;mDAEkC;KAChD;CACO,CAAC;AAEX;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAIE;IAEF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyD,CAAC;IAE7E,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,OAAoB,EAAE,KAAa,EAAE,EAAE;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,cAAc;IACd,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAEtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,IAAI,MAAM,GAAY,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QAED,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBAClD,MAAM,CAAC,GAAG,KAAgC,CAAC;gBAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACvB,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBAChC,aAAa,IAAI,IAAI,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACtC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC;YACD,SAAS;QACX,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC;QAC9C,IAAI,QAAQ,GAAG,oBAAoB,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAClC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SACtC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG;IACxB,KAAK,EAAE;QACL,UAAU,EAAE,qBAAqB;QACjC,SAAS,EAAE,UAAU;KACtB;IACD,MAAM,EAAE;QACN,UAAU,EAAE,mCAAmC;QAC/C,SAAS,EAAE,UAAU;KACtB;IACD,OAAO,EAAE;QACP,UAAU,EAAE,kCAAkC;QAC9C,SAAS,EAAE,WAAW;KACvB;CACO,CAAC;AAEX,MAAM,UAAU,2BAA2B,CAAC,GAAS,EAAE,IAAqB;IAC1E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAC/B,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAwB,CAAC,GAAG,CAChE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CACxB,CACF,CAAC;IACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,UAAU,CAAC;IAEf,iBAAiB;IAEjB,iCAAiC;IACjC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,yBAAyB;QAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,YAAY;YACtC,CAAC,CAAE,MAAoC;YACvC,CAAC,CAAC,OAAO,CAAC;QACZ,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE1C,MAAM,KAAK,GAAG,2BAA2B,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,EAIpD,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,EAAE;aACjB,OAAO,CACN,UAAU,WAAW;;;;;;;mCAOM,CAC5B;aACA,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,eAAe,GAAG,EAAE;aACvB,OAAO,CACN,UAAU,IAAI,CAAC,UAAU;kBACf,WAAW;;;;;;;4CAOe,CACrC;aACA,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAE9B,oEAAoE;QACpE,sEAAsE;QACtE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,EAAE;aACb,OAAO,CACN;;;;oCAI4B,CAC7B;aACA,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAuC,CAAC;QAEvE,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YACxD,QAAQ;YACR,OAAO;YACP,WAAW;YACX,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sBAAsB;IAEtB,sDAAsD;IACtD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;;;;kCAI0B,CAC3B;aACA,GAAG,EAAE,CAAC;QAET,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,EAAE;aACd,OAAO,CACN,0IAA0I,CAC3I;aACA,GAAG,CAAC,EAAE,CAAC,CAAC;QAEX,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,EAAE;aACd,OAAO,CACN,6GAA6G,CAC9G;aACA,GAAG,CAAC,EAAE,CAAC,CAAC;QAEX,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/routes/dashboard/index.d.ts

@@ -0,0 +1,27 @@
+import { Hono } from "hono";
+import type { ApiDependencies } from "../../server.js";
+/**
+ * Dashboard API routes — REST endpoints for the Dashboard UI.
+ *
+ * Provides:
+ * - Config management (GET/PATCH /api/config)
+ * - Event/action logs (GET /api/events)
+ * - Conversation history (GET /api/conversations)
+ * - Cost analytics (GET /api/cost)
+ * - Approval queue (GET/POST /api/approvals)
+ *
+ * Split into sibling sub-files behind a single `Hono` app — see
+ * docs/design/appendices/api-route-decomposition.md PR 2 for the layout.
+ * Sub-file registration order is a topical regroup, not a byte-identical
+ * replay of the pre-split source: `/notifications`, `/dashboard/{next-check,
+ * dm-freshness}`, and `/config/reset-safety` move into their topical sibling
+ * (notifications.ts / config.ts) and therefore land earlier than they did
+ * in the monolithic file. The split is safe because the affected paths
+ * are unique strings (no params, no wildcards), so Hono match precedence
+ * is unaffected by their reordering. The only ordering invariants that
+ * still matter — `/conversations/:id` before `/conversations/:id/messages`,
+ * `/snapshots/content/:id` before `/snapshots/*` — are honored inside the
+ * `conversations.ts` and `snapshots.ts` sub-files respectively.
+ */
+export declare function createDashboardRoutes(deps: ApiDependencies): Hono;
+//# sourceMappingURL=index.d.ts.map