Add API-proxy steering event aggregation to gh aw logs and gh aw audit

[Copilot]

gh aw logs and gh aw audit did not report how often the API proxy emitted steering signals, even though those events are present in proxy logs. This change adds a run-level steering-event aggregate and surfaces it in both commands’ existing token-usage views.

• Token usage model + parsing

  • Extend TokenUsageSummary with total_steering_events.
  • Read api-proxy-logs/events.jsonl (primary and legacy firewall artifact layouts).
  • Count steering events across supported event keys: event, type, event_name, eventName.
  • Align counting with the AWF firewall spec by requiring spec-compliant event/message pairs:
    • token_steering + [AWF TOKEN WARNING]...
    • timeout_steering + [AWF TIME WARNING]...

• CLI reporting surfaces

  • Include steering totals in gh aw logs aggregate summary (total_steering_events).
  • Include steering totals in gh aw audit compact token line output.

• Behavioral coverage

  • Add test coverage for steering extraction from API proxy event logs, including schema variants and legacy artifact path handling.
  • Add coverage that non-spec steering-like events are not counted.
  • Add summary aggregation coverage for logs report totals.

type TokenUsageSummary struct {
    TotalRequests       int `json:"total_requests"`
    TotalSteeringEvents int `json:"total_steering_events,omitempty"`
}

func isSteeringEvent(eventName, message string) bool {
    switch eventName {
    case "token_steering":
        return strings.HasPrefix(message, "[AWF TOKEN WARNING]")
    case "timeout_steering":
        return strings.HasPrefix(message, "[AWF TIME WARNING]")
    default:
        return false
    }
}

[pelikhan]

@copilot review gh-aw-firewall awf specification for specific format of steering messages

[Copilot]

@copilot review gh-aw-firewall awf specification for specific format of steering messages

Updated in e40baff after reviewing the gh-aw-firewall AWF spec: steering aggregation now only counts spec-compliant proxy events (token_steering/timeout_steering) with the documented message prefixes ([AWF TOKEN WARNING] / [AWF TIME WARNING]), and tests were updated accordingly.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.