/tma1

name: tma1
description: "Query TMA1 observability data (Claude Code, Codex, GitHub Copilot CLI, OpenClaw, any OTel SDK). Use when the user asks: how much did I spend, token usage, what has my agent been doing, agent cost, show me traces, show me events, check for errors, model comparison, tool usage."
context: fork
allowed-tools: ["mcp__tma1__exec_query", "Bash"]

TMA1 Observability Query

You are helping the user query their local TMA1 observability data.

TMA1 stores data from five kinds of sources:

• **Claude Code** sends OTel **metrics** (cumulative counters) + **logs** (event stream) + hooks + JSONL transcripts
• **Codex** sends OTel **logs** + **metrics** + session JSONL (auto-parsed from `~/.codex/sessions/`)
• **GitHub Copilot CLI** — session JSONL only (auto-parsed from `~/.copilot/session-state/<sessionId>/events.jsonl`, no OTel). Data lives in `tma1_hook_events` (`agent_source='copilot_cli'`) and `tma1_messages` (`session_id LIKE 'cp:%'`).
• **OpenClaw** sends OTel **traces** (spans with openclaw.* attributes) + **metrics** (openclaw_* tables) + session JSONL (auto-parsed from `~/.openclaw/agents/*/sessions/`)
• **Other agents** (standard GenAI SDK) send OTel **traces** (spans with gen_ai.* semantic conventions)

Step 1: Check TMA1 is running

curl -sf http://localhost:14318/health

If this fails, tell the user to run `/tma1-setup` first.

Step 2: Detect available data sources

exec_query: SELECT table_name FROM information_schema.tables WHERE table_schema = 'public'

Check which tables exist to determine what queries to use:

• If `claude_code_cost_usage_USD_total` exists → use Claude Code metrics queries
• If `codex_turn_token_usage_sum` or `codex_*` tables exist → use Codex queries
• If `openclaw_tokens_total` exists → use OpenClaw queries
• If `opentelemetry_traces` exists → use traces-based queries (check column names to distinguish OpenClaw vs GenAI)
• If `opentelemetry_logs` exists → use logs queries for event details
• If `tma1_hook_events` has rows with `agent_source = 'copilot_cli'` → use Copilot CLI queries
• If `tma1_hook_events` or `tma1_messages` exists → use session/conversation queries

Step 3: Choose and run query

Run every query below through the **`mcp__tma1__exec_query`** MCP tool — one read-only `SELECT` per call, returning `columns` + `rows`. It caps rows (`row_limit`, default 100) and cell length (`cell_chars`, default 2000), and sets `truncated` when it had to cut.

If that tool isn't available (an agent without TMA1's MCP server wired up), fall back to the HTTP API:

curl -s -X POST http://localhost:14318/api/query \
  -H 'Content-Type: application/json' \
  -d '{"sql": "<SQL>"}'

Don't reach for SQL when a purpose-built tool answers the question: `search_sessions` finds sessions by keyword, `get_session_transcript` reads one session's conversation, `get_peer_sessions` lists recent work by agent, `get_session_state` describes the session you're in.

**Important**: The underlying database (GreptimeDB) uses `json_get_string()`, `json_get_int()`, `json_get_float()` for JSON column access. The `->` / `->>` operators are NOT supported. Keys containing dots (like `session.id`) are interpreted as nested paths and cannot be accessed via `json_get_*`. All timestamps are stored and returned in **UTC**. Convert in SQL when the user wants local time (`ts + INTERVAL '8 hours'`), or, on the curl fallback, send `-H 'X-Greptime-Timezone: Asia/Shanghai'` to shift both WHERE-clause parsing and rendering.

---

Claude Code Queries (logs + metrics)

**Note:** Claude Code resets OTel cumulative counters on each new session. Use **logs** (`opentelemetry_logs WHERE body = 'claude_code.api_request'`) for accurate cost/token totals. The `_total` metric tables only reflect the last session's counter value.

Cost summary (from logs — accurate across sessions)

SELECT json_get_string(log_attributes, 'model') AS model,
       ROUND(SUM(json_get_float(log_attributes, 'cost_usd')), 4) AS cost_usd,
       COUNT(*) AS requests
FROM opentelemetry_logs
WHERE body = 'claude_code.api_request'
  AND timestamp >= DATE_TRUNC('day', NOW())
GROUP BY model
ORDER BY cost_usd DESC

Token usage (from logs — accurate across sessions)

SELECT json_get_string(log_attributes, 'model') AS model,
       SUM(json_get_int(log_attributes, 'input_tokens')) AS input_tok,
       SUM(json_get_int(log_attributes, 'output_tokens')) AS output_tok,
       SUM(json_get_int(log_attributes, 'cache_read_tokens')) AS cache_read,
       SUM(json_get_int(log_attributes, 'cache_creation_tokens')) AS cache_write
FROM opentelemetry_logs
WHERE body = 'claude_code.api_request'
  AND timestamp >= DATE_TRUNC('day', NOW())
GROUP BY model
ORDER BY input_tok DESC

Recent API requests (from logs)

SELECT timestamp,
       json_get_string(log_attributes, 'model') AS model,
       json_get_int(log_attributes, 'input_tokens') AS input_tok,
       json_get_int(log_attributes, 'output_tokens') AS output_tok,
       json_get_float(log_attributes, 'cost_usd') AS cost_usd,
       json_get_float(log_attributes, 'duration_ms') AS duration_ms
FROM opentelemetry_logs
WHERE body = 'claude_code.api_request'
ORDER BY timestamp DESC
LIMIT 20

API errors

SELECT timestamp,
       json_get_string(log_attributes, 'model') AS model,
       json_get_string(log_attributes, 'error') AS error,
       json_get_string(log_attributes, 'status_code') AS status_code,
       json_get_float(log_attributes, 'duration_ms') AS duration_ms
FROM opentelemetry_logs
WHERE body = 'claude_code.api_error'
ORDER BY timestamp DESC
LIMIT 20

Tool usage (from logs)

SELECT json_get_string(log_attributes, 'tool_name') AS tool,
       COUNT(*) AS uses,
       ROUND(AVG(json_get_float(log_attributes, 'duration_ms'))) AS avg_ms,
       SUM(CASE WHEN json_get_string(log_attributes, 'success') = 'true' THEN 1 ELSE 0 END) AS ok,
       SUM(CASE WHEN json_get_s