agent-relay-server 0.105.2 → 0.107.0

package/src/routes/provider-quotas.ts

@@ -1,5 +1,5 @@
 import { isRecord } from "agent-relay-sdk";
-import { acquireProviderQuotaLease, getOrchestrator, getProviderQuotaLease, listProviderQuotas, releaseProviderQuotaLease, upsertProviderQuota } from "../db";
+import { acquireProviderQuotaLease, getOrchestrator, getProviderQuotaLease, getProviderQuotaHistory, listProviderQuotas, releaseProviderQuotaLease, upsertProviderQuota } from "../db";
 import { emitRelayEvent } from "../events";
 import { quotaStateFromUnknown, providerQuotaErrorFromUnknown } from "../quota";
 import { authContextFromRequest } from "../services/auth-context";
@@ -79,6 +79,18 @@ export const getProviderQuotaAdvisoryRoute: Handler = () => {
   return json({ advisories });
 };
 
+// #609 — per-provider 30-day quota history (consumed by #607 analytics chart + #608 sparkline).
+export const getProviderQuotaHistoryRoute: Handler = (req) => {
+  const url = new URL(req.url);
+  const provider = url.searchParams.get("provider");
+  if (!provider) return error("provider query parameter required");
+  const sinceMs = url.searchParams.get("sinceMs") ? Number(url.searchParams.get("sinceMs")) : undefined;
+  if (sinceMs !== undefined && (!Number.isFinite(sinceMs) || sinceMs < 0)) return error("sinceMs must be a positive timestamp");
+  const accountKey = url.searchParams.get("accountKey") ?? undefined;
+  const limit = parseQueryInt(url.searchParams.get("limit"), { min: 1, max: 10_000, clamp: true });
+  return json(getProviderQuotaHistory(provider, { sinceMs, accountKey, limit: limit ?? undefined }));
+};
+
 export const postProviderQuotaRoute: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/security.ts

@@ -199,6 +199,7 @@ export function requiredScopeFor(method: string, pathname: string): string | nul
   if (pathname.startsWith("/api/pairs")) return method === "GET" ? "pairs:read" : "pairs:write";
   if (pathname === "/api/provider-quota-leases/acquire" || pathname === "/api/provider-quota-leases/release") return "quota:write";
   if (pathname === "/api/provider-quotas/advisory") return "agent:read";
+  if (pathname === "/api/provider-quotas/history") return "agent:read";
   if (pathname === "/api/provider-quotas") return method === "GET" ? "agent:read" : "quota:write";
   if (pathname === "/api/routing-policy") return method === "GET" ? "agent:read" : "settings:write:routing";
   if (pathname === "/api/teams/config") return method === "GET" ? "teams:read" : "settings:write:teams";
@@ -286,6 +287,7 @@ export function requiredComponentScopeFor(method: string, pathname: string): str
   if (pathname.startsWith("/api/agents")) return method === "GET" ? "agent:read" : "agent:write";
   if (pathname === "/api/provider-quota-leases/acquire" || pathname === "/api/provider-quota-leases/release") return "quota:write";
   if (pathname === "/api/provider-quotas/advisory") return "agent:read";
+  if (pathname === "/api/provider-quotas/history") return "agent:read";
   if (pathname === "/api/provider-quotas") return method === "GET" ? "agent:read" : "quota:write";
   // Per-provider quota config (#605): reads are agent:read (the orchestrator
   // collector reads its config each tick); writes are settings:write:provider.

package/src/services/transient-agent-reaper.ts

@@ -37,6 +37,19 @@ function defaultCommitsAhead(ws: WorkspaceRecord): number | null {
   }
 }
 
+// #800 — A transient agent is protected from reaping ONLY by one of three evidence-based states:
+// it is not idle (still working), it is not ready (mid-startup/teardown), or it carries a REAL
+// provider block. `isProviderBlocked` reads the agent's own `meta.providerState`, which is set
+// exclusively from hard evidence — an HTTP 429 / StopFailure hook, the scraped CLI usage-limit
+// modal, an approval gate, or a model-unavailable hold (see runner rate-limit.ts / control-server).
+// It is NEVER derived from a quota-utilization number. The reaper deliberately does not read quota
+// utilization at all, so a provider merely sitting at high 7d/5h utilization can neither cause nor
+// prevent a reap. This keeps the false "high-util ⇒ blocked ⇒ reaped" chain (#800) impossible by
+// construction: utilization is not an input to this decision.
+function reapProtected(agent: ReturnType<typeof listAgents>[number]): boolean {
+  return agent.status !== "idle" || !agent.ready || isProviderBlocked(agent);
+}
+
 let _commitsAheadFn: (ws: WorkspaceRecord) => number | null = defaultCommitsAhead;
 
 export function overrideCommitsAheadForTests(fn: (ws: WorkspaceRecord) => number | null): void {
@@ -109,7 +122,9 @@ export function reapTransientAgents(): Record<string, unknown> {
     // A held agent (rate-limit hold #286, or any provider-blocked state) reads as
     // idle+ready but is NOT done — reaping it would kill work that's just waiting
     // for the limit to reset. Treat it as not-idle; the clock restarts on resume.
-    if (agent.status !== "idle" || !agent.ready || isProviderBlocked(agent)) { transientTracker.delete(agent.id); continue; }
+    // #800 — `reapProtected` is the single home for that decision: it honors only
+    // evidence-based block states, never a high quota-utilization number.
+    if (reapProtected(agent)) { transientTracker.delete(agent.id); continue; }
     const entry = transientTracker.get(agent.id) ?? { firstIdleAt: now };
     transientTracker.set(agent.id, entry);
     const idleForMs = now - entry.firstIdleAt;

package/src/token-db.ts

@@ -78,7 +78,7 @@ const BUILT_IN_PROFILES: Array<Omit<TokenProfile, "createdAt" | "updatedAt">> =
     name: "Provider Agent",
     description: "Coding-agent runtime access for messages, commands, tasks, and scoped memory reads.",
     role: "provider",
-    scope: ["agent:read", "agent:write", "message:read", "message:send", "schedule:write", "command:read", "command:write", "task:read", "task:write", "memory:read", "artifact:read", "artifact:write", "mcp:use", "plans:read", "plans:write", "teams:read", "teams:write", "blackboard:read", "blackboard:write", "project:read", "project:write", "issue:read", "issue:write", "notifications:read", "notifications:write", "insights:write", "quota:write"],
+    scope: ["agent:read", "agent:write", "message:read", "message:send", "schedule:write", "command:read", "command:write", "task:read", "task:write", "memory:read", "artifact:read", "artifact:write", "mcp:use", "plans:read", "plans:write", "teams:read", "teams:write", "blackboard:read", "blackboard:write", "project:read", "project:write", "issue:read", "issue:write", "notifications:read", "notifications:write", "channel:egress", "insights:write", "quota:write"],
     ttlSeconds: 24 * 60 * 60,
     builtIn: true,
     createdBy: "system",
@@ -88,7 +88,7 @@ const BUILT_IN_PROFILES: Array<Omit<TokenProfile, "createdAt" | "updatedAt">> =
     name: "Provider Child Agent",
     description: "Delegated child-agent runtime access, constrained to its parent and spawn request.",
     role: "provider",
-    scope: ["agent:read", "agent:write", "message:read", "message:send", "schedule:write", "command:read", "command:write", "task:read", "task:write", "memory:read", "artifact:read", "artifact:write", "mcp:use", "teams:read", "blackboard:read", "blackboard:write", "project:read", "project:write", "issue:read", "issue:write", "notifications:read", "notifications:write", "insights:write", "quota:write"],
+    scope: ["agent:read", "agent:write", "message:read", "message:send", "schedule:write", "command:read", "command:write", "task:read", "task:write", "memory:read", "artifact:read", "artifact:write", "mcp:use", "teams:read", "blackboard:read", "blackboard:write", "project:read", "project:write", "issue:read", "issue:write", "notifications:read", "notifications:write", "channel:egress", "insights:write", "quota:write"],
     constraints: { canDelegate: false },
     ttlSeconds: 2 * 60 * 60,
     builtIn: true,
@@ -99,7 +99,7 @@ const BUILT_IN_PROFILES: Array<Omit<TokenProfile, "createdAt" | "updatedAt">> =
     name: "Provider Interactive Agent",
     description: "User-launched provider runtime access constrained to its own agent and cwd for long interactive sessions.",
     role: "provider",
-    scope: ["agent:read", "agent:write", "message:read", "message:send", "schedule:write", "command:read", "command:write", "task:read", "task:write", "memory:read", "artifact:read", "artifact:write", "mcp:use", "teams:read", "blackboard:read", "blackboard:write", "project:read", "project:write", "issue:read", "issue:write", "notifications:read", "notifications:write", "insights:write", "quota:write"],
+    scope: ["agent:read", "agent:write", "message:read", "message:send", "schedule:write", "command:read", "command:write", "task:read", "task:write", "memory:read", "artifact:read", "artifact:write", "mcp:use", "teams:read", "blackboard:read", "blackboard:write", "project:read", "project:write", "issue:read", "issue:write", "notifications:read", "notifications:write", "channel:egress", "insights:write", "quota:write"],
     constraints: { terminalAttach: false, logsRead: false, canDelegate: false },
     ttlSeconds: 30 * 24 * 60 * 60,
     builtIn: true,