ambitry 0.1.2 → 0.1.4

package/README.md

@@ -150,6 +150,8 @@ Point a provider at a different upstream — Azure, a gateway, a local model —
 
 Cost is computed from published per-token rates. Models with no known rate report `null` rather than a guess; a cost dashboard that quietly invents numbers is worse than one that admits ignorance.
 
+**One request modification, and the only one.** OpenAI-compatible providers omit token usage from streamed responses unless `stream_options.include_usage` is set, and almost no agent code sets it — so without this, cost and spend caps would be blank for most streaming traffic. Ambitry adds that flag to outgoing OpenAI streaming requests when you haven't set it yourself. The visible effect is one extra terminal chunk carrying usage, which SDKs treat as a normal chunk with no choices. If you set `stream_options` yourself, it's left alone, and Anthropic requests are never modified.
+
 ## Development
 
 ```bash

package/dist/server.js

@@ -33,9 +33,22 @@ export function createServer({ store, controls }) {
                 examples: ['http://localhost:8787/anthropic', 'http://localhost:8787/openai/v1'],
             });
         }
-        const body = await readBody(req);
+        let body = await readBody(req);
         const parsed = parseRequest(route.provider.id, body);
         const requestJson = safeJson(body);
+        // OpenAI-compatible providers omit usage from streamed responses unless
+        // stream_options.include_usage is set, and almost no agent code sets it.
+        // Without this the cost column is empty for most streaming traffic, which
+        // guts the spend caps. Anthropic always reports usage, so this is only
+        // needed here. The cost is one extra terminal chunk carrying usage, which
+        // SDKs treat as a normal chunk with no choices.
+        if (route.provider.id === 'openai' && parsed.stream && requestJson && typeof requestJson === 'object') {
+            const r = requestJson;
+            if (r.stream_options === undefined) {
+                r.stream_options = { include_usage: true };
+                body = Buffer.from(JSON.stringify(r));
+            }
+        }
         // Scanned on the way out, so a leak is caught on the request that carries
         // it rather than after the provider has already received it.
         const findings = scanRequest(requestJson);

package/dist/viewer.js

@@ -103,13 +103,20 @@ function toolCells(t) {
   }).join('');
 }
 
-function meter(label, spent, cap) {
+function meter(label, spent, cap, unpriced) {
   const pct = cap ? Math.min(100, (spent / cap) * 100) : 0;
+  // An unpriced model contributes nothing to the total, so the figure is a
+  // floor rather than the spend. Saying so beats implying a precise zero.
+  const note = unpriced
+    ? unpriced + ' request' + (unpriced === 1 ? '' : 's') + ' unpriced'
+    : (cap ? null : 'no cap set');
   const bar = cap
     ? '<div class="bar' + (pct > 80 ? ' hot' : '') + '"><i style="width:' + pct + '%"></i></div>'
-    : '<div class="k" style="margin-top:8px">no cap set</div>';
-  return '<div class="card"><div class="k">' + label + '</div><div class="v">' + money(spent) +
-    (cap ? ' <span class="muted" style="font-size:13px">/ ' + money(cap) + '</span>' : '') + '</div>' + bar + '</div>';
+    : '';
+  return '<div class="card"><div class="k">' + label + '</div><div class="v">' +
+    (unpriced ? '≥ ' : '') + money(spent) +
+    (cap ? ' <span class="muted" style="font-size:13px">/ ' + money(cap) + '</span>' : '') + '</div>' +
+    bar + (note ? '<div class="k" style="margin-top:8px">' + note + '</div>' : '') + '</div>';
 }
 
 async function refresh() {
@@ -143,15 +150,27 @@ async function refresh() {
   // Counts denied tool calls as well as rejected requests. Tool denial
   // returns 200 with the call stripped, so counting status codes alone
   // reports zero blocks while enforcement is visibly working.
-  const blocked = traces.reduce((n, t) =>
-    n + (t.denied_count || 0) + (t.status === 403 ? 1 : 0), 0);
+  const byPolicy = traces.reduce((n, t) => n + (t.denied_count || 0), 0);
+  const stopped = traces.filter(t => t.status === 403).length;
+  const blocked = byPolicy + stopped;
+  // Naming the cause matters: a kill-switch stop is not a policy denial, and
+  // labelling everything "by policy" contradicts the card beside it that
+  // says the proxy is only logging.
+  const cause = byPolicy && stopped ? 'policy and kill switch'
+    : byPolicy ? 'tool calls denied'
+    : stopped ? 'requests stopped'
+    : 'nothing blocked';
+
+  // A request whose model has no published rate contributes nothing to spend.
+  const unpriced = traces.filter(t => t.cost_usd === null && t.status === 200).length;
+
   $('cards').innerHTML =
-    meter('Spend · last hour', status.spend.lastHour, status.limits.perHourUsd) +
-    meter('Spend · last day', status.spend.lastDay, status.limits.perDayUsd) +
+    meter('Spend · last hour', status.spend.lastHour, status.limits.perHourUsd, unpriced) +
+    meter('Spend · last day', status.spend.lastDay, status.limits.perDayUsd, unpriced) +
     '<div class="card"><div class="k">Requests</div><div class="v">' + traces.length + '</div>' +
       '<div class="k" style="margin-top:8px">' + (status.enforcing ? 'policy enforcing' : 'logging only') + '</div></div>' +
     '<div class="card"><div class="k">Blocked</div><div class="v">' + blocked + '</div>' +
-      '<div class="k" style="margin-top:8px">by policy</div></div>';
+      '<div class="k" style="margin-top:8px">' + cause + '</div></div>';
 
   if (!traces.length) {
     $('list').innerHTML = '<div class="empty">No traffic yet. Point your SDK at ' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ambitry",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Audit log and permission layer for AI agents. One-line integration, zero runtime dependencies.",
   "type": "module",
   "bin": {