cost-alert

1# Cost Alert
2 
3Audit the spend guardrails: which rules exist, which have fired, and what tripped them.
4 
5## Input
6 
7The user provides: **$ARGUMENTS**
8 
9This may be empty (review everything), `"unacked"` (only unacknowledged alerts),
10or a rule name to focus on.
11 
12## Data Sources
13 
14| Endpoint | Returns |
15|----------|---------|
16| `GET /api/alerts/rules` | `{ rules: [{ id, name, rule_type, config, enabled, cooldown_seconds }] }` — the guardrail definitions |
17| `GET /api/alerts` | `{ alerts: [{ id, rule_id, rule_name, rule_type, session_id, agent_id, message, details, triggered_at, acked }], total, unacked, limit, offset }` — the fired-alert feed, newest first. `?unacked=true` filters to unacknowledged |
18 
19## What the rule types mean
20 
21| `rule_type` | `config` | Fires when |
22|-------------|----------|------------|
23| `token_threshold` | `{ total_tokens }` | A session's cumulative tokens (input + output + cache_read + cache_write) cross the ceiling — the spend-relevant guardrail |
24| `event_pattern` | `{ event_type?, tool_name?, summary_contains?, count?, window_minutes? }` | Matching events reach `count` within the window |
25| `inactivity` | `{ minutes }` | An active session goes quiet for `minutes` |
26| `status_duration` | `{ status, minutes }` | An agent is stuck in `working`/`waiting` for `minutes` |
27…