ambitry 0.1.0 → 0.1.1

package/dist/db.d.ts

@@ -14,6 +14,9 @@ export interface TraceRow {
     request_json: string;
     response_json: string | null;
     error: string | null;
+    /** Present on recentTraces only: comma-separated tool names, and denials. */
+    tool_names?: string | null;
+    denied_count?: number;
 }
 export interface ToolCallRow {
     id: string;
@@ -85,6 +88,14 @@ export declare class Store {
         decision: Decision;
         started_at: number;
     }[];
+    /**
+     * Recent traces, each carrying a summary of its tool calls.
+     *
+     * The counts are joined here rather than derived client-side because a
+     * denied tool call returns HTTP 200 with the call stripped — so anything
+     * counting blocks by status code reports zero while enforcement is
+     * actively working.
+     */
     recentTraces(limit?: number): TraceRow[];
     trace(id: string): {
         trace: TraceRow;

package/dist/db.js

@@ -117,9 +117,25 @@ export class Store {
          order by t.started_at asc`)
             .all(since);
     }
+    /**
+     * Recent traces, each carrying a summary of its tool calls.
+     *
+     * The counts are joined here rather than derived client-side because a
+     * denied tool call returns HTTP 200 with the call stripped — so anything
+     * counting blocks by status code reports zero while enforcement is
+     * actively working.
+     */
     recentTraces(limit = 100) {
         return this.db
-            .prepare(`select * from traces order by started_at desc limit ?`)
+            .prepare(`select t.*,
+           -- decision:name pairs, because group_concat order is not defined
+           -- and the client must know which specific call was denied.
+           (select group_concat(c.decision || ':' || c.name, ',')
+              from tool_calls c where c.trace_id = t.id) as tool_names,
+           (select count(*) from tool_calls c where c.trace_id = t.id and c.decision = 'deny') as denied_count
+         from traces t
+         order by t.started_at desc
+         limit ?`)
             .all(limit);
     }
     trace(id) {

package/dist/viewer.js

@@ -90,6 +90,19 @@ const $ = (id) => document.getElementById(id);
 const money = (n) => n == null ? '—' : '$' + Number(n).toFixed(n < 1 ? 4 : 2);
 const esc = (s) => String(s).replace(/[&<>]/g, (c) => ({'&':'&amp;','<':'&lt;','>':'&gt;'}[c]));
 
+// Tool names for a row, with denied ones marked. The whole point of the
+// product is visible here, so an empty cell is a wasted line.
+function toolCells(t) {
+  const pairs = (t.tool_names || '').split(',').filter(Boolean);
+  if (!pairs.length) return '<span class="muted">' + (t.streamed ? 'stream' : '—') + '</span>';
+  return pairs.map(p => {
+    const cut = p.indexOf(':');
+    const decision = p.slice(0, cut);
+    const name = p.slice(cut + 1);
+    return '<span class="tag ' + (decision === 'deny' ? 'no' : 'ok') + '">' + esc(name) + '</span>';
+  }).join('');
+}
+
 function meter(label, spent, cap) {
   const pct = cap ? Math.min(100, (spent / cap) * 100) : 0;
   const bar = cap
@@ -122,7 +135,11 @@ async function refresh() {
       '<span class="mono">' + x.occurrences + '× in ' + x.traces + ' request' + (x.traces === 1 ? '' : 's') +
       '</span></div>').join('') + '</div>';
 
-  const blocked = traces.filter(t => t.status === 403).length;
+  // Counts denied tool calls as well as rejected requests. Tool denial
+  // returns 200 with the call stripped, so counting status codes alone
+  // reports zero blocks while enforcement is visibly working.
+  const blocked = traces.reduce((n, t) =>
+    n + (t.denied_count || 0) + (t.status === 403 ? 1 : 0), 0);
   $('cards').innerHTML =
     meter('Spend · last hour', status.spend.lastHour, status.limits.perHourUsd) +
     meter('Spend · last day', status.spend.lastDay, status.limits.perDayUsd) +
@@ -143,7 +160,7 @@ async function refresh() {
       '<td>' + new Date(t.started_at).toLocaleTimeString() +
         (t.status === 403 ? ' <span class="tag no">blocked</span>' : '') + '</td>' +
       '<td>' + esc(t.model || '—') + '</td>' +
-      '<td class="muted">' + (t.streamed ? 'stream' : '') + '</td>' +
+      '<td>' + toolCells(t) + '</td>' +
       '<td class="num">' + ((t.input_tokens ?? 0) + (t.output_tokens ?? 0) || '—') + '</td>' +
       '<td class="num">' + money(t.cost_usd) + '</td></tr>').join('') +
     '</tbody></table>';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ambitry",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Audit log and permission layer for AI agents. One-line integration, zero runtime dependencies.",
   "type": "module",
   "bin": {