Customer console
Screen-by-screen specification of console.workspaces.build.
console.workspaces.build — one organization's view of its own usage.
Overview screen
The landing screen answers four questions without a click: what is it costing, what is running, is it fast, and is anything broken.
Everything streams. The spend sparkline, the session counts and the latency percentiles update without a refresh.
| Element | Source |
|---|---|
| Spend, forecast, cap progress | GET /usage, GET /usage/forecast |
| Session counts by tier and state | GET /sessions plus the events stream |
| Start-latency percentiles | GET /usage/timeseries?metric=session_start_ms |
| Warm hit ratio | Same, metric=pool_hit_ratio |
| Recent failures | GET /events?type=session.failed |
Sessions
The screen customers spend the most time in.
Cost on every row is deliberate. A session that has quietly cost more than expected is visible without opening anything.
Session detail
Tabs, with the tier determining which are present.
| Tab | Contents | Tiers |
|---|---|---|
| Summary | State, placement, template digest, policy digest, resources, timeouts, live usage | All |
| Runs | Every run with command, exit code, duration, output | All |
| Terminal | Live PTY via xterm.js | 2–4 |
| Files | Browsable filesystem, download, upload, inline preview | 1–4 |
| Network | Every connection: destination, rule matched, bytes — denials highlighted | 1–4 |
| Browser | Open pages, screenshots, recording playback, HAR | 3 |
| Desktop | Live WebRTC view, handoff control, recording playback | 4 |
| Trace | Full lifecycle timeline | All |
| Cost | Per-meter breakdown with running total | All |
The Network tab is the one support points people at. "My install fails" is almost always a denied destination, and the tab shows it in one line with the rule that denied it.
Actions
Kill (types the session ID to confirm) · Snapshot · Pause and resume · Extend idle timeout ·
Download workspace as an archive · Copy a reproduction curl.
Runs
Cross-session run history, filtered by status, kind, session, end user and time. The default filter is failures, because a list of successful runs is rarely what anyone came for.
Output is searchable across runs, which is how a customer finds every occurrence of an error string without knowing which session produced it.
Templates
Build from a declarative spec in the editor, watch the build log stream, see the vulnerability scan, publish, pin to a warm pool per region.
The cold rate per template is the number that matters: a template with a high cold rate is either unpinned or too rarely used to hold pool depth. The console says which.
Storage
Volumes, snapshots and recordings in one place, with the thing nobody tracks surfaced by default:
⚠ 14 volumes unattached for more than 30 days — $184/month ⚠ 2,104 snapshots with no retention policy — $412/month
Bulk select and delete, with a cost delta shown before confirming.
Lifecycle rules are edited here and are the same object the API exposes.
Policies
A visual editor over the same YAML the API takes, with the YAML always visible and editable directly.
Egress mode, allow and deny rules, DNS settings, TLS inspection, bandwidth CLI allowlist binaries permitted at tier 2+ Tool allowlist which catalog tools, which require confirmation Secrets which secrets are injectable into which tiers
Two features that make policy editing safe:
- Simulate. Paste a destination, a binary or a tool name and see whether the current draft allows it, and which rule decides.
- Impact preview. Before saving, the console shows how many sessions in the last seven days would have been affected by the change. Tightening an allowlist that would have broken 40% of last week's sessions is worth knowing before saving.
Policies are versioned, diffable and revertable.
Tools
The tier 0 surface: catalog, MCP server registration, health per server, and the confirmations queue.
This is the human-in-the-loop surface for destructive tools, and it is a real queue people sit in front of, not an afterthought.
End users
Sorted by spend by default. Edit quotas and caps inline. The list header shows the untagged-usage
total, which is the signal that a code path is forgetting end_user_id.
Usage and billing
Cost explorer
Group by meter, tier, project, end user, region or label. Stack, filter, compare to the previous period, export.
Invoices and credits
List, detail with per-line breakdown, PDF download, credit balance and grants with expiry dates, auto-recharge configuration, dispute flow.
Spend caps
Set per organization, project or end user, with threshold alerts. The editor shows current spend against the proposed cap so a cap below current spend is obvious before saving.
Settings
| Section | Contents |
|---|---|
| Projects | Create, archive, default region, default policy, per-project quotas |
| API keys | Create with scopes and expiry, see last_used_at, revoke. Plaintext shown once |
| Webhooks | Endpoints, event subscriptions, delivery log with per-attempt detail, replay |
| Members | Invite, assign roles, remove |
| SSO | OIDC or SAML configuration, domain capture, SCIM |
| Residency | Allowed regions, enforced platform-wide |
| Notifications | Which events reach which channel: email, Slack, webhook |
The webhook delivery log is worth calling out: every attempt with its response code, body and timing, plus one-click replay. It removes the entire class of support conversation that begins "I don't think you're sending the webhook".
Audit
Searchable by actor, action, target and time. Exportable as CSV or JSONL. Break-glass entries are highlighted — if a platform operator accessed a session, the customer sees it here with the reason and the approvers.