cost-alert

# Cost Alert Audit the spend guardrails: which rules exist, which have fired, and what tripped them. ## Input The user provides: **$ARGUMENTS** This may be empty (review everything), `"unacked"` (only unacknowledged alerts), or a rule name to focus on. ## Data Sources | Endpoint | Returns | |----------|---------| | `GET /api/alerts/rules` | `{ rules: [{ id, name, rule_type, config, enabled, cooldown_seconds }] }` — the guardrail definitions | | `GET /api/alerts` | `{ alerts: [{ id, rule_id, rule_name, rule_type, session_id, agent_id, message, details, triggered_at, acked }], total, unacked, limit, offset }` — the fired-alert feed, newest first. `?unacked=true` filters to unacknowledged | ## What the rule types mean | `rule_type` | `config` | Fires when | |-------------|----------|------------| | `token_threshold` | `{ total_tokens }` | A session's cumulative tokens (input + output + cache_read + cache_write) cross the ceiling — the spend-relevant guardrail | | `event_pattern` | `{ event_type?, tool_name?, summary_contains?, count?, window_minutes? }` | Matching events reach `count` within the window | | `inactivity` | `{ minutes }` | An active session goes quiet for `minutes` | | `status_duration` | `{ status, minutes }` | An agent is stuck in `working`/`waiting` for `minutes` | For cost work, focus on `token_threshold`. Translate its token ceiling to dollars using the blended rate from `/api/pricing/cost` (`total_cost / total_tokens`) so the user sees the alarm in m...