@steadwing/openalerts 0.2.4 → 0.2.5

package/dist/collections/types.d.ts

@@ -0,0 +1,177 @@
+export interface MonitorSession {
+    key: string;
+    agentId: string;
+    platform: string;
+    recipient: string;
+    isGroup: boolean;
+    lastActivityAt: number;
+    status: "idle" | "active" | "thinking";
+    spawnedBy?: string;
+    messageCount?: number;
+    totalCostUsd?: number;
+    totalInputTokens?: number;
+    totalOutputTokens?: number;
+}
+export type MonitorActionType = "start" | "streaming" | "complete" | "aborted" | "error" | "tool_call" | "tool_result";
+export type MonitorActionEventType = "chat" | "agent" | "system";
+export interface MonitorAction {
+    id: string;
+    runId: string;
+    sessionKey: string;
+    seq: number;
+    type: MonitorActionType;
+    eventType: MonitorActionEventType;
+    timestamp: number;
+    content?: string;
+    toolName?: string;
+    toolArgs?: unknown;
+    startedAt?: number;
+    endedAt?: number;
+    duration?: number;
+    inputTokens?: number;
+    outputTokens?: number;
+    stopReason?: string;
+    costUsd?: number;
+    model?: string;
+    provider?: string;
+}
+export type MonitorExecEventType = "started" | "output" | "completed";
+export type MonitorExecProcessStatus = "running" | "completed" | "failed";
+export interface MonitorExecOutputChunk {
+    id: string;
+    stream: "stdout" | "stderr" | string;
+    text: string;
+    timestamp: number;
+}
+export interface MonitorExecEvent {
+    id: string;
+    execId: string;
+    runId: string;
+    pid: number;
+    sessionId?: string;
+    sessionKey?: string;
+    eventType: MonitorExecEventType;
+    command?: string;
+    stream?: "stdout" | "stderr" | string;
+    output?: string;
+    startedAt?: number;
+    durationMs?: number;
+    exitCode?: number;
+    status?: string;
+    timestamp: number;
+}
+export interface MonitorExecProcess {
+    id: string;
+    runId: string;
+    pid: number;
+    command: string;
+    sessionId?: string;
+    sessionKey?: string;
+    status: MonitorExecProcessStatus;
+    startedAt: number;
+    completedAt?: number;
+    durationMs?: number;
+    exitCode?: number;
+    outputs: MonitorExecOutputChunk[];
+    outputTruncated?: boolean;
+    timestamp: number;
+    lastActivityAt: number;
+}
+export interface ChatEvent {
+    runId: string;
+    sessionKey: string;
+    seq: number;
+    state: "delta" | "final" | "aborted" | "error";
+    message?: unknown;
+    errorMessage?: string;
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+    };
+    stopReason?: string;
+}
+export interface AgentEvent {
+    runId: string;
+    seq: number;
+    stream: string;
+    ts: number;
+    data: Record<string, unknown>;
+    sessionKey?: string;
+}
+export interface ExecStartedEvent {
+    pid: number;
+    command: string;
+    sessionId: string;
+    runId: string;
+    startedAt: number;
+}
+export interface ExecOutputEvent {
+    pid: number;
+    runId: string;
+    sessionId?: string;
+    stream: "stdout" | "stderr" | string;
+    output: string;
+}
+export interface ExecCompletedEvent {
+    pid: number;
+    runId: string;
+    sessionId?: string;
+    exitCode: number;
+    durationMs: number;
+    status: string;
+}
+export declare function parseSessionKey(key: string): {
+    agentId: string;
+    platform: string;
+    recipient: string;
+    isGroup: boolean;
+};
+export interface CollectionStats {
+    sessions: number;
+    actions: number;
+    execs: number;
+    runSessionMapSize: number;
+    totalCostUsd?: number;
+}
+export interface DiagnosticUsageEvent {
+    type: "model.usage";
+    ts: number;
+    seq: number;
+    sessionKey?: string;
+    sessionId?: string;
+    channel?: string;
+    provider?: string;
+    model?: string;
+    usage: {
+        input?: number;
+        output?: number;
+        cacheRead?: number;
+        cacheWrite?: number;
+        promptTokens?: number;
+        total?: number;
+    };
+    context?: {
+        limit?: number;
+        used?: number;
+    };
+    costUsd?: number;
+    durationMs?: number;
+}
+export interface CostUsageTotals {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+    totalTokens: number;
+    totalCost: number;
+    inputCost: number;
+    outputCost: number;
+    cacheReadCost: number;
+    cacheWriteCost: number;
+    missingCostEntries: number;
+}
+export interface CostUsageSummary {
+    totals: CostUsageTotals;
+    byModel?: Record<string, CostUsageTotals>;
+    bySession?: Record<string, CostUsageTotals>;
+}

package/dist/collections/types.js

@@ -0,0 +1,15 @@
+// ─── Session Types ───────────────────────────────────────────────────────────
+// ─── Utility Functions ───────────────────────────────────────────────────────
+export function parseSessionKey(key) {
+    // Format: "agent:main:discord:channel:1234567890"
+    // Or: "agent:main:telegram:group:12345"
+    // Or: "agent:main:whatsapp:+1234567890"
+    const parts = key.split(":");
+    const agentId = parts[1] || "unknown";
+    const platform = parts[2] || "unknown";
+    // Check if 4th part indicates a type (channel, group, dm, etc)
+    const hasType = ["channel", "group", "dm", "thread"].includes(parts[3] || "");
+    const isGroup = parts[3] === "group" || parts[3] === "channel";
+    const recipient = hasType ? parts.slice(3).join(":") : parts.slice(3).join(":");
+    return { agentId, platform, recipient, isGroup };
+}

package/dist/core/engine.js

@@ -2,6 +2,7 @@ import { AlertDispatcher } from "./alert-channel.js";
 import { OpenAlertsEventBus } from "./event-bus.js";
 import { createEvaluatorState, processEvent, processWatchdogTick, warmFromHistory } from "./evaluator.js";
 import { createPlatformSync } from "./platform.js";
+import { ALL_RULES } from "./rules.js";
 import { appendEvent, pruneLog, readAllEvents, readRecentEvents } from "./store.js";
 import { DEFAULTS, } from "./types.js";
 /**
@@ -88,7 +89,7 @@ export class OpenAlertsEngine {
         const channelNames = this.dispatcher.hasChannels
             ? `${this.dispatcher.channelCount} channel(s)`
             : "log-only (no alert channels)";
-        this.logger.info(`${this.logPrefix}: started, ${channelNames}, 8 rules active`);
+        this.logger.info(`${this.logPrefix}: started, ${channelNames}, ${ALL_RULES.length} rules active`);
     }
     /** Ingest a universal event. Can be called directly or via the event bus. */
     ingest(event) {

package/dist/core/index.d.ts

@@ -10,3 +10,4 @@ export { createLlmEnricher, type LlmEnricherOptions } from "./llm-enrichment.js"
 export { formatAlertMessage, formatAlertsOutput, formatHealthOutput, } from "./formatter.js";
 export { createPlatformSync, type PlatformSync } from "./platform.js";
 export { BoundedMap, type BoundedMapOptions, type BoundedMapStats, } from "./bounded-map.js";
+export type { MonitorSession, MonitorActionType, MonitorActionEventType, MonitorAction, MonitorExecEventType, MonitorExecProcessStatus, MonitorExecOutputChunk, MonitorExecEvent, MonitorExecProcess, CollectionStats, DiagnosticUsageEvent, CostUsageTotals, CostUsageSummary, } from "../collections/types.js";

package/dist/core/rules.js

@@ -22,6 +22,39 @@ function countInWindow(ctx, name, windowMs) {
     const cutoff = ctx.now - windowMs;
     return window.filter((e) => e.ts >= cutoff).length;
 }
+function sumInWindow(ctx, name, windowMs) {
+    const window = ctx.state.windows.get(name);
+    if (!window)
+        return 0;
+    const cutoff = ctx.now - windowMs;
+    let total = 0;
+    for (const entry of window) {
+        if (entry.ts >= cutoff) {
+            total += entry.value ?? 0;
+        }
+    }
+    return total;
+}
+function pushSummedBucket(ctx, name, value, bucketMs, maxEntries) {
+    if (!Number.isFinite(value) || value <= 0)
+        return;
+    const bucketTs = Math.floor(ctx.now / bucketMs) * bucketMs;
+    let window = ctx.state.windows.get(name);
+    if (!window) {
+        window = [];
+        ctx.state.windows.set(name, window);
+    }
+    const last = window[window.length - 1];
+    if (last && last.ts === bucketTs) {
+        last.value = (last.value ?? 0) + value;
+    }
+    else {
+        window.push({ ts: bucketTs, value });
+    }
+    if (window.length > maxEntries) {
+        window.splice(0, window.length - maxEntries);
+    }
+}
 function getRuleThreshold(ctx, ruleId, defaultVal) {
     return ctx.config.rules?.[ruleId]?.threshold ?? defaultVal;
 }
@@ -234,6 +267,68 @@ const highErrorRate = {
         };
     },
 };
+// ─── Rule: cost-hourly-spike ────────────────────────────────────────────────
+const costHourlySpike = {
+    id: "cost-hourly-spike",
+    defaultCooldownMs: 30 * 60 * 1000,
+    defaultThreshold: 5.0, // USD
+    evaluate(event, ctx) {
+        if (event.type !== "llm.token_usage")
+            return null;
+        if (!isRuleEnabled(ctx, "cost-hourly-spike"))
+            return null;
+        if (typeof event.costUsd !== "number" || !Number.isFinite(event.costUsd))
+            return null;
+        // Aggregate per-minute to keep 60m sums accurate under high event throughput.
+        pushSummedBucket(ctx, "cost-hourly-spike-usd", event.costUsd, 60_000, 120);
+        const hourlyUsd = sumInWindow(ctx, "cost-hourly-spike-usd", 60 * 60 * 1000);
+        const threshold = getRuleThreshold(ctx, "cost-hourly-spike", 5.0);
+        if (hourlyUsd <= threshold)
+            return null; // must exceed threshold
+        const fingerprint = "cost-hourly-spike";
+        return {
+            type: "alert",
+            id: makeAlertId("cost-hourly-spike", fingerprint, ctx.now),
+            ruleId: "cost-hourly-spike",
+            severity: "warn",
+            title: "Hourly LLM spend spike",
+            detail: `LLM spend reached $${hourlyUsd.toFixed(2)} in the last 60 minutes (threshold: $${threshold.toFixed(2)}).`,
+            ts: ctx.now,
+            fingerprint,
+        };
+    },
+};
+// ─── Rule: cost-daily-budget ────────────────────────────────────────────────
+const costDailyBudget = {
+    id: "cost-daily-budget",
+    defaultCooldownMs: 6 * 60 * 60 * 1000,
+    defaultThreshold: 20.0, // USD
+    evaluate(event, ctx) {
+        if (event.type !== "llm.token_usage")
+            return null;
+        if (!isRuleEnabled(ctx, "cost-daily-budget"))
+            return null;
+        if (typeof event.costUsd !== "number" || !Number.isFinite(event.costUsd))
+            return null;
+        // Aggregate per-minute and retain >24h buckets for boundary-safe sums.
+        pushSummedBucket(ctx, "cost-daily-budget-usd", event.costUsd, 60_000, 1_500);
+        const dailyUsd = sumInWindow(ctx, "cost-daily-budget-usd", 24 * 60 * 60 * 1000);
+        const threshold = getRuleThreshold(ctx, "cost-daily-budget", 20.0);
+        if (dailyUsd <= threshold)
+            return null; // must exceed threshold
+        const fingerprint = "cost-daily-budget";
+        return {
+            type: "alert",
+            id: makeAlertId("cost-daily-budget", fingerprint, ctx.now),
+            ruleId: "cost-daily-budget",
+            severity: "error",
+            title: "Daily LLM budget exceeded",
+            detail: `LLM spend reached $${dailyUsd.toFixed(2)} in the last 24 hours (threshold: $${threshold.toFixed(2)}).`,
+            ts: ctx.now,
+            fingerprint,
+        };
+    },
+};
 // ─── Rule: tool-errors ───────────────────────────────────────────────────
 const toolErrors = {
     id: "tool-errors",
@@ -307,6 +402,8 @@ export const ALL_RULES = [
     heartbeatFail,
     queueDepth,
     highErrorRate,
+    costHourlySpike,
+    costDailyBudget,
     toolErrors,
     gatewayDown,
 ];

package/dist/core/types.d.ts

@@ -1,5 +1,5 @@
 export type AlertSeverity = "info" | "warn" | "error" | "critical";
-export type OpenAlertsEventType = "llm.call" | "llm.error" | "llm.token_usage" | "tool.call" | "tool.error" | "agent.start" | "agent.end" | "agent.error" | "agent.stuck" | "session.start" | "session.end" | "session.stuck" | "infra.error" | "infra.heartbeat" | "infra.queue_depth" | "custom" | "watchdog.tick";
+export type OpenAlertsEventType = "llm.call" | "llm.error" | "llm.token_usage" | "tool.call" | "tool.error" | "agent.start" | "agent.end" | "agent.error" | "agent.stuck" | "session.start" | "session.end" | "session.stuck" | "infra.error" | "infra.heartbeat" | "infra.queue_depth" | "exec.start" | "exec.output" | "exec.end" | "custom" | "watchdog.tick";
 export type OpenAlertsEvent = {
     type: OpenAlertsEventType;
     ts: number;