feat(runtime): add customer-apps consumption command#236
Merged
cdot65 merged 4 commits intoMay 28, 2026
Conversation
…olations
Surfaces the SCM "AI Security > Runtime > API Applications" detail panel
through the CLI, sourced from the SDK's new mgmt.dashboard namespace:
airs runtime customer-apps consumption [appName]
[--time-interval 7|30|60]
[--output pretty|table|csv|json|yaml]
Single-app mode renders a pretty section with token consumption (with K/M
scale qualifiers), session counts, and firing detectors. Omitting appName
loops every customer app in the tenant. Structured outputs emit one row
per detector per app so downstream tools can pivot without join logic.
Notes
- Resolves appId from `customer-apps list` internally — users only pass
the human-readable name. Throws with guidance if the name isn't found.
- Validates --time-interval client-side against the API's enum
(7, 30, 60); other values are rejected before incurring a request.
- Per-detector rows include monitoring_since so the data is self-contained
for chargeback reporting.
Closes cdot65#222. Requires the new mgmt.dashboard SDK API
(cdot65/prisma-airs-sdk PR pending) — bump @cdot65/prisma-airs-sdk after
that lands and ships.
cdot65
reviewed
May 28, 2026
cdot65
left a comment
cdot65
left a comment
Owner
There was a problem hiding this comment.
Validation 2026-05-28 (post-SDK 0.11.0)
SDK PR cdot65/prisma-airs-sdk#175 merged 17:05Z; @cdot65/prisma-airs-sdk@0.11.0 published. Bumped dep, regenerated customer-apps.md reference, allowlisted runtime customer-apps consumption pending curated sidecars. Exercised end-to-end against a 6-app tenant (substituted Insomnia/CLI for chatbot — no chatbot in this tenant).
Results:
- Single app pretty output renders as described (header, monitoring window, token block, sessions, detector breakdown with severity counts)
-
--time-intervalaccepts 7/30/60, rejects 14 with client-side message--time-interval must be 7, 30, or 60 (the API rejects other values) - CSV one-row-per-detector with app context repeated — 7 rows for the 7-detector profile on
Insomnia - JSON / YAML structured output — same per-detector shape, app metadata repeated per record
- Table output renders cleanly
- All-apps loop completes (6 apps in tenant, all 6 processed, zero-traffic apps continue past silently — no early kill)
- Not-found error renders
Customer app not found: "no-such-app". Runairs runtime customer-apps listto see available apps. - All CI gates green post-bump (lint, typecheck, test, docs-check, docs-build)
Observations / asks
- Sidecars still owed. I allowlisted
runtime customer-apps consumptionindocs/cli/examples/.missing-allowlistto unblock CI; please replace that allowlist entry with curated sidecars indocs/cli/examples/runtime.yamlbefore merge. Phase 3 output above is reusable as fixture material. - Zero-traffic apps emit no rows in structured formats. When an app has 0 sessions,
--output csv|json|yamlreturns an empty body (no header row in CSV, empty array in JSON). Pretty rendersno detector violations in windowfor the same case. Consider emitting a single empty-state row in structured formats so downstream consumers don't have to special-case the no-data path. Not a blocker. - The mechanical
docs:genregen ofdocs/cli/runtime/customer-apps.mdwas missing from the PR (likely a missedpnpm docs:genbefore commit).
LGTM on the feature — ready for @scthornton's merge once sidecars are added.
Captures 8 examples (pretty/table/csv/json/yaml + 60-day window + all-apps loop + both error paths) from live tenant; removes the allowlist entry; regenerates customer-apps.md so the reference page now renders real input/output instead of "Example needed". Addresses follow-up cdot65#1 from the PR cdot65#236 validation comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Surfaces the SCM "AI Security > Runtime > API Applications" detail panel through the CLI, sourced from the new
mgmt.dashboardSDK namespace.Closes #222.
Status: DRAFT — pending SDK release
This PR consumes a new SDK API (
mgmt.dashboard.application+mgmt.dashboard.applicationViolationBreakdown) introduced in cdot65/prisma-airs-sdk#175. CI on this branch will not pass until that PR merges, the SDK ships (proposed0.11.0), and the@cdot65/prisma-airs-sdkdep here is bumped to the new minor. The implementation has been fully exercised end-to-end viapnpm linkagainst the local SDK source and a live tenant — see the test plan below.Command
appNameis optional — omit it to loop every customer app in the tenant. TheappIdis resolved internally fromcustomer-apps list.Live evidence — single app (pretty)
Live evidence — CSV (one row per detector, app-level context repeated)
Self-contained rows so the output can pipe directly into spreadsheets / BigQuery / etc. without join logic.
Error paths (also exercised live)
The API enforces
time_intervalas an enum (verified live: only7,30,60return 200; everything else returns 400). Client-side validation rejects bad values before incurring a request.Design notes
mgmt.dashboard.application(overview + tokens) andmgmt.dashboard.applicationViolationBreakdown(per-detector counts) are called in parallel and merged into a single normalizedCustomerAppConsumptionshape.appIdANDappName. The CLI only takes a name from users, then looks up the UUID viacustomer-apps list. This costs one extra API call per command invocation but keeps the UX simple.Test plan
pnpm build(tsc)pnpm lint(biome — only pre-existing warnings in test/walk.spec.ts unrelated to this PR)pnpm test(712/712 — adds 4 new tests forgetCustomerAppConsumption)consumption chatbot✓Out of scope (separate follow-ups)
customer-apps get403 bug (customer-apps get blocked by upstream 403 Access denied #115). The dashboard endpoints needed listing as an explicit feature first.