feat: add network calls summary to AI session threads API - #27417
Merged
Conversation
Contributor
Docs previewCheck off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here. |
SasSwart
force-pushed
the
aigov-463-network-summary
branch
from
July 22, 2026 14:04
a4d26be to
8959a08
Compare
This was referenced Jul 22, 2026
SasSwart
marked this pull request as ready for review
July 28, 2026 13:24
SasSwart
commented
Jul 28, 2026
SasSwart
left a comment
Contributor
Author
There was a problem hiding this comment.
Self review complete. Mostly explanation but there are a some nits and an rbac change that need to happen.
Comment on lines
+596
to
+603
| -- Strip an optional scheme, then keep the host up to the first port, path, | ||
| -- query, or fragment delimiter. This assumes HTTP egress detail is a plain | ||
| -- scheme+host(+port) URL: it does not handle userinfo (user@host, which | ||
| -- would be captured into the host) or IPv6 literal hosts ([::1], where the | ||
| -- leading '[' is captured and the ':' terminates early). Boundary HTTP logs | ||
| -- do not currently emit those forms; revisit this extraction if they do. | ||
| SELECT substring(detail from '^(?:[A-Za-z][A-Za-z0-9+.-]*://)?([^/:?#]+)') AS domain | ||
| FROM session_boundary_logs |
Contributor
Author
There was a problem hiding this comment.
I don't like this at all. It's brittle and the use of regex here is a crutch for a weak data model. Nevertheless, I'm following @mtojek's advice and accepting that this is good enough for the immediate release and can be improved later.
Member
There was a problem hiding this comment.
Add a follow-up issue for later 👍
Comment on lines
+179
to
+182
| // NetworkCalls summarizes the Agent Firewall network calls made during the | ||
| // session. A nil value means the session did not pass through Agent | ||
| // Firewall, so network call monitoring was not active, which the UI | ||
| // surfaces as "Disabled". |
| } | ||
|
|
||
| func (q *querier) GetAIBridgeSessionTopDomains(ctx context.Context, arg database.GetAIBridgeSessionTopDomainsParams) ([]database.GetAIBridgeSessionTopDomainsRow, error) { | ||
| if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceAibridgeInterception); err != nil { |
Contributor
Author
There was a problem hiding this comment.
This is incorrect. It should use the resources defined for agent firewall instead.
johnstcn
reviewed
Jul 28, 2026
johnstcn
approved these changes
Jul 28, 2026
Expose total and blocked network calls plus top destination domains on the AI session threads endpoint. Total and blocked reuse the existing Agent Firewall aggregation from the sessions list query; top domains are a new GetAIBridgeSessionTopDomains aggregation over boundary logs using the same interception-window correlation. Refs AIGOV-463 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
…fetch Add multi-interception and shared-firewall-session tests asserting the network_calls summary total/blocked and top-domains counts partition correctly across consecutive windows and do not bleed across AI sessions that share one firewall session. Reduce the top-domains fetch to a single row, since the summary card renders only the most-contacted domain plus a "+N more" count derived from NetworkDomainCount (a window aggregate independent of the row cap). Document that the domain-extraction regex assumes scheme+host(+port) detail without userinfo or IPv6 literal hosts, and add a port-suffixed test row that pins host stripping. Refs AIGOV-463 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Co-authored-by: Cian Johnston <[email protected]>
SasSwart
force-pushed
the
aigov-463-network-summary
branch
from
July 30, 2026 10:16
63a4fff to
16d4f5d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backend for the AI session network summary. Exposes total/blocked network calls and top destination domains on the session threads endpoint (
GET /api/v2/ai-gateway/sessions/{id}).Total and blocked reuse the existing Agent Firewall aggregation from the sessions list query, so the numbers match the sessions table. Top domains are a new server-side aggregation (
GetAIBridgeSessionTopDomains) over boundary logs, using the same interception-window correlation. There is no network-error state, matching the current data model.Frontend consuming these fields is in a separate stacked PR.
PR map (merge strictly bottom-up)
This change is a 4-PR stack. Each PR depends on all the ones below it, so merge in this exact order:
main)network_call_logs(base feat: show network request summary on AI session detail card #27418)Refs AIGOV-463
🤖 Generated with Claude Code