fix: reduce alert noise and add actionable cost driver diagnosis

- Disable cycle outlier detection by default (cycleOutlierMultiplier=0)
  since it just flags active users against an inactive team median
- Add cost driver breakdown to daily spike and cost/req alerts showing
  thinking % and max-mode % with dollar amounts
- Remove useless "500 premium reqs" from alert messages (legacy field,
  same for everyone)
- Separate cycle_spend metric from daily spend to prevent dedup collision
- Add spend legend and blue color to user detail chart tooltip

Made-with: Cursor

Author: ofershap

src/components/charts/spend-trend-chart.tsx

@@ -92,6 +92,10 @@ export function SpendTrendChart({ data, selectedDays, avgPerDay }: SpendTrendCha
       <div className="flex items-baseline gap-2 mb-2">
         <h3 className="text-xs font-medium text-zinc-400">Daily Spend</h3>
         <span className="text-[10px] text-zinc-600">{data.length} days of data</span>
+        <span className="text-[10px] text-blue-400/70 flex items-center gap-1">
+          <span className="inline-block w-3 border-t border-blue-400" />
+          spend
+        </span>
         {hasCostPerReq && (
           <span className="text-[10px] text-purple-400/70 flex items-center gap-1">
             <span className="inline-block w-3 border-t border-dashed border-purple-400" />
@@ -144,7 +148,9 @@ export function SpendTrendChart({ data, selectedDays, avgPerDay }: SpendTrendCha
                     {!isInRange && <span className="text-zinc-600 ml-1">(context)</span>}
                     {isProvisional && <span className="text-amber-500 ml-1">(partial)</span>}
                   </div>
-                  <div className="font-mono font-bold text-sm">{fmtDollars(pt.spend)}</div>
+                  <div className="font-mono font-bold text-sm text-blue-400">
+                    {fmtDollars(pt.spend)}
+                  </div>
                   {pt.change !== 0 && (
                     <div style={{ color: changeColor }} className="font-mono text-[11px]">
                       {changeSign}

src/lib/alerts/email.ts

@@ -10,6 +10,7 @@ function getClient(): Resend | null {
 function formatValue(metric: string, value: number): string {
   switch (metric) {
     case "spend":
+    case "cycle_spend":
       return `$${(value / 100).toFixed(2)}`;
     case "cost_per_req":
       return `$${(value / 100).toFixed(2)}/req`;

src/lib/alerts/slack.ts

@@ -18,6 +18,7 @@ function severityEmoji(severity: string): string {
 function formatValue(metric: string, value: number): string {
   switch (metric) {
     case "spend":
+    case "cycle_spend":
       return `$${(value / 100).toFixed(2)}`;
     case "cost_per_req":
       return `$${(value / 100).toFixed(2)}/req`;

src/lib/anomaly/thresholds.ts

@@ -27,7 +27,7 @@ export function detectThresholdAnomalies(config: DetectionConfig): Anomaly[] {
         metric: "spend",
         value: s.spend_cents,
         threshold: config.thresholds.maxSpendCentsPerCycle,
-        message: `${s.name}: spend $${(s.spend_cents / 100).toFixed(2)} exceeds limit $${(config.thresholds.maxSpendCentsPerCycle / 100).toFixed(2)} (${s.fast_premium_requests} premium reqs)`,
+        message: `${s.name}: spend $${(s.spend_cents / 100).toFixed(2)} exceeds limit $${(config.thresholds.maxSpendCentsPerCycle / 100).toFixed(2)}`,
         detectedAt: now,
         resolvedAt: null,
         alertedAt: null,

src/lib/anomaly/trends.ts

@@ -5,11 +5,30 @@ import {
   getUserDailySpendHistory,
   getCycleSpendWithModels,
   getUserCostPerRequest,
+  getUserCostDrivers,
 } from "../data";
 
 const MIN_DAILY_SPEND_CENTS = 5000;
 const MIN_CYCLE_MEDIAN_CENTS = 1000;
 
+function buildCostDriverNote(email: string, date?: string): string {
+  const drivers = getUserCostDrivers(email, date);
+  if (!drivers) return "";
+
+  const parts: string[] = [];
+  if (drivers.thinking_pct > 0) {
+    const thinkingDollars = (drivers.thinking_spend_cents / 100).toFixed(0);
+    parts.push(`${drivers.thinking_pct}% thinking ($${thinkingDollars})`);
+  }
+  if (drivers.max_pct > 0) {
+    const maxDollars = (drivers.max_spend_cents / 100).toFixed(0);
+    parts.push(`${drivers.max_pct}% max-mode ($${maxDollars})`);
+  }
+
+  if (parts.length === 0) return "";
+  return ` · cost drivers: ${parts.join(", ")}`;
+}
+
 export function detectTrendAnomalies(config: DetectionConfig): Anomaly[] {
   const anomalies: Anomaly[] = [];
   const now = new Date().toISOString();
@@ -23,7 +42,9 @@ export function detectTrendAnomalies(config: DetectionConfig): Anomaly[] {
   } = config.trends;
 
   detectSpendSpikes(anomalies, now, spendSpikeMultiplier, spendSpikeLookbackDays);
-  detectCycleOutliers(anomalies, now, cycleOutlierMultiplier);
+  if (cycleOutlierMultiplier > 0) {
+    detectCycleOutliers(anomalies, now, cycleOutlierMultiplier);
+  }
   detectCostPerReqSpikes(
     anomalies,
     now,
@@ -58,14 +79,15 @@ function detectSpendSpikes(
     if (ratio > spikeMultiplier) {
       const todayDollars = (user.spend_cents / 100).toFixed(2);
       const avgDollars = (history.avg_spend / 100).toFixed(2);
+      const driverNote = buildCostDriverNote(user.email, targetDate);
       anomalies.push({
         userEmail: user.email,
         type: "trend",
         severity: ratio > spikeMultiplier * 3 ? "critical" : "warning",
         metric: "spend",
         value: user.spend_cents,
         threshold: history.avg_spend * spikeMultiplier,
-        message: `${user.name}: daily spend spiked to $${todayDollars} (${ratio.toFixed(1)}x their ${lookbackDays}-day avg of $${avgDollars}), model: ${user.most_used_model || "unknown"}`,
+        message: `${user.name}: daily spend spiked to $${todayDollars} (${ratio.toFixed(1)}x their ${lookbackDays}-day avg of $${avgDollars}), model: ${user.most_used_model || "unknown"}${driverNote}`,
         detectedAt: now,
         resolvedAt: null,
         alertedAt: null,
@@ -97,10 +119,10 @@ function detectCycleOutliers(anomalies: Anomaly[], now: string, outlierMultiplie
         userEmail: user.email,
         type: "trend",
         severity: ratio > outlierMultiplier * 3 ? "critical" : "warning",
-        metric: "spend",
+        metric: "cycle_spend",
         value: user.spend_cents,
         threshold: median * outlierMultiplier,
-        message: `${user.name}: cycle spend $${userDollars} is ${ratio.toFixed(1)}x the team median ($${medianDollars}), model: ${user.most_used_model || "unknown"}, ${user.fast_premium_requests} premium reqs`,
+        message: `${user.name}: cycle spend $${userDollars} is ${ratio.toFixed(1)}x the team median ($${medianDollars}), model: ${user.most_used_model || "unknown"}`,
         detectedAt: now,
         resolvedAt: null,
         alertedAt: null,
@@ -136,9 +158,7 @@ function detectCostPerReqSpikes(
     const todayCpr = (user.today_cost_per_req / 100).toFixed(2);
     const histCpr = (user.hist_avg_cost_per_req / 100).toFixed(2);
     const todaySpend = (user.today_spend_cents / 100).toFixed(2);
-    const maxModePct =
-      user.today_reqs > 0 ? Math.round((user.today_max_mode_reqs / user.today_reqs) * 100) : 0;
-    const maxModeNote = maxModePct > 0 ? ` [${maxModePct}% max mode]` : "";
+    const driverNote = buildCostDriverNote(user.email);
 
     anomalies.push({
       userEmail: user.email,
@@ -147,7 +167,7 @@ function detectCostPerReqSpikes(
       metric: "cost_per_req",
       value: Math.round(user.today_cost_per_req),
       threshold: Math.round(user.hist_avg_cost_per_req * spikeMultiplier),
-      message: `${user.name}: cost/request spiked to $${todayCpr}/req (${ratio.toFixed(1)}x their avg of $${histCpr}/req), using ${user.today_top_model || "unknown"}${maxModeNote}, $${todaySpend} total today across ${user.today_reqs} reqs`,
+      message: `${user.name}: cost/request spiked to $${todayCpr}/req (${ratio.toFixed(1)}x their avg of $${histCpr}/req), using ${user.today_top_model || "unknown"}, $${todaySpend} total today across ${user.today_reqs} reqs${driverNote}`,
       detectedAt: now,
       resolvedAt: null,
       alertedAt: null,

src/lib/data/sqlite.ts

@@ -3067,6 +3067,52 @@ export function getCycleSpendWithModels(): Array<{
   }>;
 }
 
+export interface CostDriverSummary {
+  thinking_pct: number;
+  max_pct: number;
+  thinking_spend_cents: number;
+  max_spend_cents: number;
+  total_spend_cents: number;
+  top_model: string;
+}
+
+export function getUserCostDrivers(email: string, date?: string): CostDriverSummary | null {
+  const db = getDb();
+  const dateFilter = date ? `date(ue.timestamp/1000, 'unixepoch') = ?` : `date(ue.timestamp/1000, 'unixepoch') = date('now')`;
+  const params = date ? [email, date] : [email];
+  const row = db
+    .prepare(
+      `SELECT
+        ROUND(100.0 * SUM(CASE WHEN ue.model LIKE '%thinking%' THEN 1 ELSE 0 END) / COUNT(*)) as thinking_pct,
+        ROUND(100.0 * SUM(CASE WHEN ue.max_mode = 1 THEN 1 ELSE 0 END) / COUNT(*)) as max_pct,
+        ROUND(SUM(CASE WHEN ue.model LIKE '%thinking%' THEN ue.total_cents ELSE 0 END)) as thinking_spend_cents,
+        ROUND(SUM(CASE WHEN ue.max_mode = 1 THEN ue.total_cents ELSE 0 END)) as max_spend_cents,
+        ROUND(SUM(ue.total_cents)) as total_spend_cents
+      FROM usage_events ue
+      WHERE ue.user_email = ? AND ${dateFilter} AND ue.total_cents > 0`,
+    )
+    .get(...params) as { thinking_pct: number | null; max_pct: number | null; thinking_spend_cents: number; max_spend_cents: number; total_spend_cents: number } | undefined;
+
+  if (!row || !row.total_spend_cents) return null;
+
+  const topModel = db
+    .prepare(
+      `SELECT model, SUM(total_cents) as s FROM usage_events
+       WHERE user_email = ? AND ${dateFilter} AND total_cents > 0
+       GROUP BY model ORDER BY s DESC LIMIT 1`,
+    )
+    .get(...params) as { model: string } | undefined;
+
+  return {
+    thinking_pct: row.thinking_pct ?? 0,
+    max_pct: row.max_pct ?? 0,
+    thinking_spend_cents: row.thinking_spend_cents,
+    max_spend_cents: row.max_spend_cents,
+    total_spend_cents: row.total_spend_cents,
+    top_model: topModel?.model ?? "",
+  };
+}
+
 export function getActiveMembers(): Array<{ email: string; user_id: string | null; name: string }> {
   const db = getDb();
   return db

src/lib/types.ts

@@ -337,6 +337,7 @@ export type AnomalySeverity = "info" | "warning" | "critical";
 export type AnomalyType = "threshold" | "zscore" | "trend";
 export type AnomalyMetric =
   | "spend"
+  | "cycle_spend"
   | "requests"
   | "tokens"
   | "plan_exhausted"
@@ -412,7 +413,7 @@ export const DEFAULT_CONFIG: DetectionConfig = {
   trends: {
     spendSpikeMultiplier: 5,
     spendSpikeLookbackDays: 7,
-    cycleOutlierMultiplier: 10,
+    cycleOutlierMultiplier: 0,
     costPerReqSpikeMultiplier: 3,
     costPerReqMinSpendCents: 2000,
     costPerReqMinAbsoluteCents: 500,