ambitry 0.1.3 → 0.1.5

package/dist/parse.js

@@ -94,7 +94,11 @@ export class ResponseParser {
                 this.outputTokens = e.message?.usage?.output_tokens ?? this.outputTokens;
                 break;
             case 'content_block_start':
-                if (e.content_block?.type === 'tool_use') {
+                // server_tool_use covers Anthropic's own tools (web search, code
+                // execution). They are calls the agent made and belong in the audit
+                // log; matching only tool_use leaves them invisible to both the trace
+                // and the policy.
+                if (e.content_block?.type === 'tool_use' || e.content_block?.type === 'server_tool_use') {
                     this.partial.set(e.index, { name: e.content_block.name, json: '' });
                 }
                 break;
@@ -176,7 +180,8 @@ export class ResponseParser {
             this.outputTokens = json.usage?.output_tokens ?? null;
             const content = json.content ?? [];
             for (let i = 0; i < content.length; i++) {
-                if (content[i]?.type === 'tool_use') {
+                const type = content[i]?.type;
+                if (type === 'tool_use' || type === 'server_tool_use') {
                     this.done.push({ name: content[i].name, input: content[i].input ?? {}, index: i });
                 }
             }

package/dist/viewer.js

@@ -103,13 +103,20 @@ function toolCells(t) {
   }).join('');
 }
 
-function meter(label, spent, cap) {
+function meter(label, spent, cap, unpriced) {
   const pct = cap ? Math.min(100, (spent / cap) * 100) : 0;
+  // An unpriced model contributes nothing to the total, so the figure is a
+  // floor rather than the spend. Saying so beats implying a precise zero.
+  const note = unpriced
+    ? unpriced + ' request' + (unpriced === 1 ? '' : 's') + ' unpriced'
+    : (cap ? null : 'no cap set');
   const bar = cap
     ? '<div class="bar' + (pct > 80 ? ' hot' : '') + '"><i style="width:' + pct + '%"></i></div>'
-    : '<div class="k" style="margin-top:8px">no cap set</div>';
-  return '<div class="card"><div class="k">' + label + '</div><div class="v">' + money(spent) +
-    (cap ? ' <span class="muted" style="font-size:13px">/ ' + money(cap) + '</span>' : '') + '</div>' + bar + '</div>';
+    : '';
+  return '<div class="card"><div class="k">' + label + '</div><div class="v">' +
+    (unpriced ? '≥ ' : '') + money(spent) +
+    (cap ? ' <span class="muted" style="font-size:13px">/ ' + money(cap) + '</span>' : '') + '</div>' +
+    bar + (note ? '<div class="k" style="margin-top:8px">' + note + '</div>' : '') + '</div>';
 }
 
 async function refresh() {
@@ -143,15 +150,27 @@ async function refresh() {
   // Counts denied tool calls as well as rejected requests. Tool denial
   // returns 200 with the call stripped, so counting status codes alone
   // reports zero blocks while enforcement is visibly working.
-  const blocked = traces.reduce((n, t) =>
-    n + (t.denied_count || 0) + (t.status === 403 ? 1 : 0), 0);
+  const byPolicy = traces.reduce((n, t) => n + (t.denied_count || 0), 0);
+  const stopped = traces.filter(t => t.status === 403).length;
+  const blocked = byPolicy + stopped;
+  // Naming the cause matters: a kill-switch stop is not a policy denial, and
+  // labelling everything "by policy" contradicts the card beside it that
+  // says the proxy is only logging.
+  const cause = byPolicy && stopped ? 'policy and kill switch'
+    : byPolicy ? 'tool calls denied'
+    : stopped ? 'requests stopped'
+    : 'nothing blocked';
+
+  // A request whose model has no published rate contributes nothing to spend.
+  const unpriced = traces.filter(t => t.cost_usd === null && t.status === 200).length;
+
   $('cards').innerHTML =
-    meter('Spend · last hour', status.spend.lastHour, status.limits.perHourUsd) +
-    meter('Spend · last day', status.spend.lastDay, status.limits.perDayUsd) +
+    meter('Spend · last hour', status.spend.lastHour, status.limits.perHourUsd, unpriced) +
+    meter('Spend · last day', status.spend.lastDay, status.limits.perDayUsd, unpriced) +
     '<div class="card"><div class="k">Requests</div><div class="v">' + traces.length + '</div>' +
       '<div class="k" style="margin-top:8px">' + (status.enforcing ? 'policy enforcing' : 'logging only') + '</div></div>' +
     '<div class="card"><div class="k">Blocked</div><div class="v">' + blocked + '</div>' +
-      '<div class="k" style="margin-top:8px">by policy</div></div>';
+      '<div class="k" style="margin-top:8px">' + cause + '</div></div>';
 
   if (!traces.length) {
     $('list').innerHTML = '<div class="empty">No traffic yet. Point your SDK at ' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ambitry",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Audit log and permission layer for AI agents. One-line integration, zero runtime dependencies.",
   "type": "module",
   "bin": {