Conversation
Addresses all actionable findings from pre-release security audit:
CRITICAL: Timing-safe admin token comparison (crypto/subtle)
HIGH: Bound request (10MB) and response (50MB) bodies in proxy,
sanitize error messages in proxy/admin/dashboard handlers,
add structured logger to admin and dashboard handlers
MEDIUM: Rate limiter cleanup goroutine, agent session max cap (10K)
with LRU eviction, budget cache eviction + RWMutex race fix,
MCP path traversal sanitization, CDN SRI hash, CORS middleware,
CSRF protection via X-Requested-With header, TLS support
LOW: Demo config token warning
Skipped: L1 key fingerprinting (known trade-off), L2 filepath.Match
wildcards (admin-only), L4 Prometheus unauthenticated (standard).
…gent/model charts, latency percentiles, token timeseries, blocked keys UI Backend: - Add QueryRecentSessions, QueryLatencyPercentiles, QueryTokenTimeseries to Ledger interface - Implement for both SQLite (Go-computed percentiles) and PostgreSQL (native PERCENTILE_CONT) - Add SessionRecord, LatencyStats, LatencyBucket, TokenTimeseriesPoint model structs - Add 3 new dashboard endpoints: /sessions/history, /latency, /timeseries/tokens - Add budget status endpoint: GET /api/admin/budgets/status with utilization data Frontend: - Agent cost leaderboard and model usage horizontal bar charts - Session tabs (Active / Recent 24h / Recent 7d) with task, tokens, duration columns - Session anomaly highlighting (>3x mean cost/calls gets red border) - Latency P50/P90/P99 stat cards and histogram distribution chart - Token timeseries stacked area chart with Cost/Tokens tab toggle - Budget status progress bars with green/yellow/red color coding - Blocked keys table with add/remove UI - Sticky table headers for scrollable tables - Min-height on grid panels to prevent empty-state collapse
The new QueryTokenTimeseries method pushed "minute" and "day" string occurrences to 4, triggering goconst in CI.
Integrates the SVG logo (octopus with bar chart body) into the dashboard header as a 32px inline mark with blue-accented wordmark, and into the docs hero section as a 64px mark replacing the old "AL" text badge. Adds SVG favicons to both sites.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/api/dashboard/costsendpointQueryRecentSessionsLedger method, plus task, tokens, and duration columnsGET /api/admin/budgets/statusendpoint with progress bar UI (green/yellow/red at 70%/90%)QueryLatencyPercentilesLedger method (Go-computed for SQLite, nativePERCENTILE_CONTfor Postgres), P50/P90/P99 stat cards, and histogram chartQueryTokenTimeseriesLedger method with stacked area chart and Cost/Tokens tab toggle15 files changed, +1313 / -32 lines across backend (Ledger interface, SQLite, Postgres, handlers) and frontend (HTML, JS, CSS).
Test plan