feat: surface max mode usage in dashboard and cost alerts

Add max_mode_reqs and avg_cache_read_tokens to user cost breakdown
queries. Show max mode % column in user detail Cost Breakdown table
with amber highlighting and cache token tooltip. Enrich cost/req spike
alert messages with max mode percentage so recipients understand WHY
the cost per request is high, not just that it spiked.

Made-with: Cursor

Author: ofershap

src/app/users/[email]/user-detail-client.tsx

@@ -43,6 +43,8 @@ interface UserStats {
     overage_reqs: number;
     overage_cost_cents: number;
     error_reqs: number;
+    max_mode_reqs: number;
+    avg_cache_read_tokens: number;
   }>;
   mcpSummary: Array<{ tool_name: string; server_name: string; total_usage: number }>;
   commandsSummary: Array<{ command_name: string; total_usage: number }>;
@@ -317,6 +319,7 @@ export function UserDetailClient({ email, stats }: UserDetailClientProps) {
                     <th className="text-right px-4 py-2 font-medium">$/Req</th>
                     <th className="text-right px-4 py-2 font-medium">Total</th>
                     <th className="text-left px-4 py-2 font-medium">Included in Plan vs Overage</th>
+                    <th className="text-right px-4 py-2 font-medium">Max Mode</th>
                     <th className="text-right px-4 py-2 font-medium">Errors</th>
                   </tr>
                 </thead>
@@ -370,6 +373,18 @@ export function UserDetailClient({ email, stats }: UserDetailClientProps) {
                             </span>
                           </div>
                         </td>
+                        <td className="text-right px-4 py-2 font-mono">
+                          {r.max_mode_reqs > 0 ? (
+                            <span
+                              className="text-amber-400/80"
+                              title={`${r.max_mode_reqs}/${r.requests} requests used max mode (avg ${Math.round(r.avg_cache_read_tokens / 1000).toLocaleString()}k cache tokens/req)`}
+                            >
+                              {Math.round((r.max_mode_reqs / r.requests) * 100)}%
+                            </span>
+                          ) : (
+                            <span className="text-zinc-700">—</span>
+                          )}
+                        </td>
                         <td className="text-right px-4 py-2 font-mono">
                           {r.error_reqs > 0 ? (
                             <span

src/lib/anomaly/trends.ts

@@ -136,6 +136,9 @@ function detectCostPerReqSpikes(
     const todayCpr = (user.today_cost_per_req / 100).toFixed(2);
     const histCpr = (user.hist_avg_cost_per_req / 100).toFixed(2);
     const todaySpend = (user.today_spend_cents / 100).toFixed(2);
+    const maxModePct =
+      user.today_reqs > 0 ? Math.round((user.today_max_mode_reqs / user.today_reqs) * 100) : 0;
+    const maxModeNote = maxModePct > 0 ? ` [${maxModePct}% max mode]` : "";
 
     anomalies.push({
       userEmail: user.email,
@@ -144,7 +147,7 @@ function detectCostPerReqSpikes(
       metric: "cost_per_req",
       value: Math.round(user.today_cost_per_req),
       threshold: Math.round(user.hist_avg_cost_per_req * spikeMultiplier),
-      message: `${user.name}: cost/request spiked to $${todayCpr} (${ratio.toFixed(1)}x their avg of $${histCpr}), using ${user.today_top_model || "unknown"}, $${todaySpend} total today across ${user.today_reqs} reqs`,
+      message: `${user.name}: cost/request spiked to $${todayCpr}/req (${ratio.toFixed(1)}x their avg of $${histCpr}/req), using ${user.today_top_model || "unknown"}${maxModeNote}, $${todaySpend} total today across ${user.today_reqs} reqs`,
       detectedAt: now,
       resolvedAt: null,
       alertedAt: null,

src/lib/data/sqlite.ts

@@ -2235,6 +2235,8 @@ export function getUserUsageEventsSummary(
   overage_reqs: number;
   overage_cost_cents: number;
   error_reqs: number;
+  max_mode_reqs: number;
+  avg_cache_read_tokens: number;
 }> {
   const db = getDb();
   return db
@@ -2248,7 +2250,9 @@ export function getUserUsageEventsSummary(
       SUM(CASE WHEN kind LIKE 'Included%' THEN total_cents ELSE 0 END) as plan_cost_cents,
       SUM(CASE WHEN kind = 'Usage-based' THEN 1 ELSE 0 END) as overage_reqs,
       SUM(CASE WHEN kind = 'Usage-based' THEN total_cents ELSE 0 END) as overage_cost_cents,
-      SUM(CASE WHEN kind LIKE 'Errored%' THEN 1 ELSE 0 END) as error_reqs
+      SUM(CASE WHEN kind LIKE 'Errored%' THEN 1 ELSE 0 END) as error_reqs,
+      SUM(CASE WHEN max_mode = 1 THEN 1 ELSE 0 END) as max_mode_reqs,
+      ROUND(AVG(cache_read_tokens)) as avg_cache_read_tokens
     FROM usage_events
     WHERE user_email = ? AND CAST(timestamp AS INTEGER) >= ?
     GROUP BY model
@@ -2266,6 +2270,8 @@ export function getUserUsageEventsSummary(
     overage_reqs: number;
     overage_cost_cents: number;
     error_reqs: number;
+    max_mode_reqs: number;
+    avg_cache_read_tokens: number;
   }>;
 }
 
@@ -2945,6 +2951,8 @@ export function getUserCostPerRequest(
   today_top_model: string;
   hist_avg_cost_per_req: number | null;
   hist_days: number;
+  today_max_mode_reqs: number;
+  today_avg_cache_read: number;
 }> {
   const db = getDb();
   return db
@@ -2954,7 +2962,9 @@ export function getUserCostPerRequest(
           COALESCE(m.name, ue.user_email) as name,
           ROUND(SUM(ue.total_cents)) as spend_cents,
           COUNT(*) as reqs,
-          ROUND(SUM(ue.total_cents) / COUNT(*), 2) as cost_per_req
+          ROUND(SUM(ue.total_cents) / COUNT(*), 2) as cost_per_req,
+          SUM(CASE WHEN ue.max_mode = 1 THEN 1 ELSE 0 END) as max_mode_reqs,
+          ROUND(AVG(ue.cache_read_tokens)) as avg_cache_read
         FROM usage_events ue
         LEFT JOIN members m ON ue.user_email = m.email
         WHERE date(ue.timestamp/1000, 'unixepoch') = date('now')
@@ -2990,7 +3000,9 @@ export function getUserCostPerRequest(
         td.cost_per_req as today_cost_per_req,
         COALESCE(tt.model, '') as today_top_model,
         hd.avg_cost_per_req as hist_avg_cost_per_req,
-        COALESCE(hd.active_days, 0) as hist_days
+        COALESCE(hd.active_days, 0) as hist_days,
+        td.max_mode_reqs as today_max_mode_reqs,
+        td.avg_cache_read as today_avg_cache_read
       FROM today_data td
       LEFT JOIN today_top tt ON td.email = tt.email
       LEFT JOIN hist_data hd ON td.email = hd.email`,
@@ -3004,6 +3016,8 @@ export function getUserCostPerRequest(
     today_top_model: string;
     hist_avg_cost_per_req: number | null;
     hist_days: number;
+    today_max_mode_reqs: number;
+    today_avg_cache_read: number;
   }>;
 }