refactor(monitoring): N2 - tach monitoring_tab.py, CanonicalAuditLogger, MonitoringQueryService, go circular import, sandbox matrix

- ui/monitoring_tab.py (1546 dong) tach thanh presentation/monitoring/**
  (container + 7 tab/card + shared helper), ui/monitoring_tab.py con lai
  re-export shim de app.py khong doi.
- infrastructure/telemetry/audit_logger.py: CanonicalAuditLogger, core/audit_log.py
  thanh wrapper mong, tuong thich nguoc 100% voi schema .jsonl cu.
- application/monitoring/monitoring_query_service.py: MonitoringQueryService
  read-only, filter/sort/pagination, khong import PySide6.
- Go circular import model_pricing<->usage_tracker va agent_security<->
  agent_security_alert (core/agent_security_types.py moi).
- infrastructure/sandbox/sandbox_capabilities.py: SandboxCapabilityMatrix
  theo OS (Windows/Linux/macOS), chua dau noi vao core/sandbox_manager.py.
- conftest.py: sua loi checkout khong ten cowork_local khien pytest import
  nham thu muc khac.
- 77 test moi, 167/167 pass. QA da xac nhan UI/business logic khong doi
  (xem evidence/report/unified_report.html).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

core/agent_security.py

@@ -27,27 +27,12 @@ from __future__ import annotations
 
 import json
 import re
-from dataclasses import dataclass
 from typing import List, Optional
 
 from ..providers.base import Provider
 from . import security_rules
-
-
-class SecurityBlocked(RuntimeError):
-    """A guardrail refused an action. ``verdict`` carries the full detail for
-    the admin alert; ``str(exc)`` is the short, user-facing reason."""
-
-    def __init__(self, verdict: "SecurityVerdict"):
-        super().__init__(verdict.reason or f"Blocked by agent security ({verdict.layer}).")
-        self.verdict = verdict
-
-
-@dataclass
-class SecurityVerdict:
-    allowed: bool
-    reason: str = ""
-    layer: str = ""   # "prompt" | "attachment" | "command"
+from .agent_security_alert import notify_admin
+from .agent_security_types import SecurityBlocked, SecurityVerdict
 
 
 def combined_rules_text(config, max_chars: int = 8000, agent_kind: str = "cowork") -> str:
@@ -236,7 +221,6 @@ def enforce_prompt(provider: Provider, messages: List[dict], config, emit,
     emit({"type": "notice", "level": "warning",
           "text": f"🛡 Yêu cầu bị chặn bởi Agent Security: {verdict.reason}"})
     from . import audit_log
-    from .agent_security_alert import notify_admin
 
     audit_log.record("security_block", "prompt", False, verdict.reason)
     notify_admin(config, verdict, detail=user_text[:1000])
@@ -266,7 +250,6 @@ def enforce_command(provider: Provider, name: str, args: dict, config, emit,
     emit({"type": "notice", "level": "warning",
           "text": f"🛡 Lệnh bị chặn bởi Agent Security ({verdict.layer}): {verdict.reason}"})
     from . import audit_log
-    from .agent_security_alert import notify_admin
 
     audit_log.record("security_block", name, False, f"{verdict.layer}: {verdict.reason}")
     notify_admin(config, verdict, detail=command)

core/agent_security_alert.py

@@ -12,7 +12,7 @@ from __future__ import annotations
 from typing import Tuple
 
 from . import ms365_graph
-from .agent_security import SecurityVerdict
+from .agent_security_types import SecurityVerdict
 from .ms365_auth import Ms365AuthError, get_access_token
 
 

core/agent_security_types.py

@@ -0,0 +1,33 @@
+"""Shared value types for the Agent Security guardrails.
+
+``SecurityVerdict``/``SecurityBlocked`` used to be defined in
+``agent_security.py``, which forced ``agent_security_alert.py`` (which only
+needs the *type*, to annotate/read ``notify_admin``'s ``verdict`` argument) to
+import from it — while ``agent_security.py`` itself needed to call
+``agent_security_alert.notify_admin()``, an architectural cycle only avoided
+at runtime by deferring that second import inside a function body.
+
+Hoisting the shared type into this dependency-free leaf module lets both
+sides import it directly, so ``agent_security.py`` can import
+``agent_security_alert`` at module top level too — no cycle, no deferred
+imports needed for this pair.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass
+class SecurityVerdict:
+    allowed: bool
+    reason: str = ""
+    layer: str = ""   # "prompt" | "attachment" | "command"
+
+
+class SecurityBlocked(RuntimeError):
+    """A guardrail refused an action. ``verdict`` carries the full detail for
+    the admin alert; ``str(exc)`` is the short, user-facing reason."""
+
+    def __init__(self, verdict: SecurityVerdict):
+        super().__init__(verdict.reason or f"Blocked by agent security ({verdict.layer}).")
+        self.verdict = verdict

core/audit_log.py

@@ -6,15 +6,23 @@ storage systems).
 One JSON line per event, one file per day under ``~/.cowork_local/audit/`` —
 same on-disk shape as ``usage_tracker.py`` (day-sharded ``.jsonl``, append-only,
 ``record()`` never raises so audit logging can never break a chat turn).
+
+This module is now a thin, backward-compatible wrapper around
+:class:`infrastructure.telemetry.audit_logger.CanonicalAuditLogger` — every
+existing call site (``agent_security.py``, ``chat_agent.py``, ``tools.py``,
+``ext_connectors.py``, ``mcp_client.py``, ``ms365_local.py``,
+``permissions.py``, ``ui/structure_graph_view.py``, ``app.py``) keeps calling
+``audit_log.set_identity``/``record``/``load_events`` exactly as before; only
+the implementation moved.
 """
 from __future__ import annotations
 
-import json
-from datetime import date, datetime
+from datetime import date
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
 from ..config import CONFIG_DIR
+from ..infrastructure.telemetry.audit_logger import CanonicalAuditLogger
 
 AUDIT_DIR = CONFIG_DIR / "audit"
 
@@ -23,66 +31,21 @@ AUDIT_DIR = CONFIG_DIR / "audit"
 # action), "mcp_call" (a call to an external MCP server's tool).
 Kind = str
 
-# Process-global identity — who's logged in, their role, and this machine's
-# name — set once right after login (app.py::run()), mirroring
-# usage_tracker.py's identical pattern. NOT thread-local: fixed per process.
-_identity_account = ""
-_identity_role = ""
-_identity_machine = ""
-_identity_shared_dir = ""
+_logger = CanonicalAuditLogger(AUDIT_DIR)
 
 
 def set_identity(account: str, machine: str, role: str = "", shared_dir: str = "") -> None:
     """Called once after login succeeds. ``shared_dir``, when reachable,
     makes every subsequent :func:`record` ALSO best-effort-append to the
     shared cross-machine telemetry store (see :mod:`telemetry_shared`)."""
-    global _identity_account, _identity_role, _identity_machine, _identity_shared_dir
-    _identity_account = account or ""
-    _identity_role = role or ""
-    _identity_machine = machine or ""
-    _identity_shared_dir = shared_dir or ""
+    _logger.set_identity(account, machine, role=role, shared_dir=shared_dir)
 
 
 def record(kind: Kind, name: str, ok: bool, detail: str = "",
           agent_role: str = "") -> None:
     """Append one audit event. Never raises — audit logging must never break
     a chat turn, a permission decision, or a tool call."""
-    try:
-        now = datetime.now()
-        event = {
-            "ts": now.isoformat(timespec="seconds"),
-            "kind": kind,
-            "agent_role": agent_role or "",
-            "name": name or "",
-            "ok": bool(ok),
-            "detail": (detail or "")[:2000],   # bounded — never let a huge blob bloat the log
-            "account": _identity_account,
-            "role": _identity_role,
-            "machine": _identity_machine,
-        }
-        AUDIT_DIR.mkdir(parents=True, exist_ok=True)
-        path = AUDIT_DIR / f"{now.strftime('%Y-%m-%d')}.jsonl"
-        with path.open("a", encoding="utf-8") as f:
-            f.write(json.dumps(event, ensure_ascii=False) + "\n")
-        _write_shared(event, now)
-    except Exception:  # noqa: BLE001
-        pass
-
-
-def _write_shared(event: Dict[str, Any], now: datetime) -> None:
-    """Best-effort mirror of ``event`` into the shared cross-machine store —
-    one file PER MACHINE per day, so no two machines ever write the same
-    file. Never raises."""
-    if not _identity_shared_dir or not _identity_machine:
-        return
-    try:
-        shared = Path(_identity_shared_dir).expanduser() / "telemetry" / "audit"
-        shared.mkdir(parents=True, exist_ok=True)
-        path = shared / f"{_identity_machine}-{now.strftime('%Y-%m-%d')}.jsonl"
-        with path.open("a", encoding="utf-8") as f:
-            f.write(json.dumps(event, ensure_ascii=False) + "\n")
-    except Exception:  # noqa: BLE001
-        pass
+    _logger.record(kind, name, ok, detail=detail, agent_role=agent_role)
 
 
 def load_events(start: Optional[date] = None, end: Optional[date] = None,
@@ -91,25 +54,5 @@ def load_events(start: Optional[date] = None, end: Optional[date] = None,
     """Events between ``start``/``end`` (inclusive; None = unbounded),
     optionally filtered to one ``kind`` — this IS how each Monitoring
     Dashboard panel gets its own slice of the same underlying log."""
-    directory = directory or AUDIT_DIR
-    if not directory.exists():
-        return []
-    events: List[Dict[str, Any]] = []
-    for path in sorted(directory.glob("*.jsonl")):
-        try:
-            day = datetime.strptime(path.stem, "%Y-%m-%d").date()
-        except ValueError:
-            continue
-        if (start and day < start) or (end and day > end):
-            continue
-        try:
-            for line in path.read_text(encoding="utf-8").splitlines():
-                if not line.strip():
-                    continue
-                event = json.loads(line)
-                if kind is not None and event.get("kind") != kind:
-                    continue
-                events.append(event)
-        except (OSError, json.JSONDecodeError):
-            continue
-    return events
+    events = _logger.load_events(start=start, end=end, kind=kind, directory=directory)
+    return [e.to_dict() for e in events]

core/model_pricing.py

@@ -32,6 +32,14 @@ _SYMBOL_CCY = {"₫": "VND", "vnd": "VND", "đ": "VND",
 
 _DEFAULT_UNIT = "Million tokens"
 
+# Flat USD/1M-token fallback rates used by turn_cost_usd() when a model isn't
+# in the price table. Owned here (not usage_tracker.DEFAULT_PRICING) so this
+# module never needs to import usage_tracker — usage_tracker imports this
+# module instead, keeping the dependency one-directional. Values match
+# usage_tracker.DEFAULT_PRICING's price_per_mtok_in_usd/out_usd exactly.
+_FALLBACK_RATE_IN_USD = 0.5
+_FALLBACK_RATE_OUT_USD = 1.5
+
 
 # ---- currency ------------------------------------------------------------
 def _rates(config) -> Dict[str, float]:
@@ -138,9 +146,11 @@ def turn_cost_usd(model: str, in_tok: int, out_tok: int, config) -> float:
     switches models (a different model → its own row / rates)."""
     rates = usd_rates_for(model, config)
     if rates is None:
-        from . import usage_tracker as ut
-        p = {**ut.DEFAULT_PRICING, **((getattr(config, "data", {}) or {}).get("usage") or {})}
-        rates = {"in": float(p["price_per_mtok_in_usd"]), "out": float(p["price_per_mtok_out_usd"])}
+        usage = (getattr(config, "data", {}) or {}).get("usage") or {}
+        rates = {
+            "in": float(usage.get("price_per_mtok_in_usd", _FALLBACK_RATE_IN_USD)),
+            "out": float(usage.get("price_per_mtok_out_usd", _FALLBACK_RATE_OUT_USD)),
+        }
     return (in_tok or 0) / 1e6 * rates["in"] + (out_tok or 0) / 1e6 * rates["out"]
 
 

core/usage_tracker.py

@@ -19,6 +19,7 @@ from pathlib import Path
 from typing import Any, Dict, List, Optional
 
 from ..config import CONFIG_DIR
+from . import model_pricing as mp
 
 USAGE_DIR = CONFIG_DIR / "usage"
 
@@ -49,6 +50,18 @@ def set_context(source: str, label: str = "") -> None:
     _local.label = label
 
 
+def current_context() -> tuple:
+    """The ``(source, label)`` currently tagged on THIS thread.
+
+    Public counterpart to :func:`set_context`, added for
+    ``infrastructure/telemetry/usage_sink.py``: a subscriber that needs to
+    attribute one event to a different surface must be able to save the
+    caller's context and put it back afterwards, instead of leaving the worker
+    thread permanently retagged.
+    """
+    return getattr(_local, "source", "") or "", getattr(_local, "label", "") or ""
+
+
 # ---- per-thread usage accumulator -----------------------------------------
 # A step/run that wants to know its OWN token/cost (not the all-time file total)
 # calls begin_accumulation(), reads accumulated() before/after a unit of work,
@@ -397,7 +410,6 @@ def set_budget(config, amount: float, currency: Optional[str] = None) -> None:
     order and ``budget_set_at`` only has 1-second resolution, so a timestamp
     cutoff could mis-include/exclude an event recorded in that same second —
     the count baseline is exact regardless of timing."""
-    from . import model_pricing as mp
     usage = config.data.setdefault("usage", {})
     ccy = (currency or usage.get("currency") or "USD").upper()
     usage["budget_amount_usd"] = mp.convert(float(amount or 0), ccy, "USD", config)