Add daily developer report: API key health + 24h token usage push

POST /admin/daily_report (trigger-secret gated, fails closed) makes a real
1-token call per provider with the app's own keys and pushes a summary of
the last 24h of llm_usage_log (calls, tokens, estimated cost per provider)
to DEV_REPORT_USER_ID. Meant to be hit once a day by a scheduled Fly
Machine, so a dead key is noticed within a day instead of by chance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app.py

@@ -367,6 +367,25 @@ async def proactive_run(req: Request, background_tasks: BackgroundTasks):
     return {"scheduled": True}
 
 
+@APP.post("/admin/daily_report")
+def admin_daily_report(req: Request):
+    """
+    Daily developer report: checks the app's own Anthropic/OpenAI keys with a
+    real 1-token call and pushes a 24h token-usage summary to DEV_REPORT_USER_ID.
+    Called once a day by a scheduled Fly Machine. Unlike /proactive/run this
+    fails closed — it spends (a tiny amount of) LLM credit and returns usage
+    data, so it must never run unauthenticated if the secret is missing.
+    """
+    trigger_secret = os.environ.get("PROACTIVE_TRIGGER_SECRET", "")
+    if not trigger_secret or req.headers.get("x-trigger-secret", "") != trigger_secret:
+        raise HTTPException(status_code=403, detail="Invalid trigger secret")
+
+    # Sync endpoint: FastAPI runs it in a worker thread, so the ~2 LLM pings
+    # and the usage query never block the event loop / live chat traffic.
+    from util_daily_report import run_daily_report
+    return run_daily_report()
+
+
 @APP.post("/proactive/mark_read")
 async def proactive_mark_read(req: Request):
     """Mark the last unread proactive message as read for the authenticated user."""

util_daily_report.py

@@ -0,0 +1,148 @@
+# util_daily_report.py
+# Daily developer report, pushed to the developer's phone: whether the app's
+# own Anthropic/OpenAI keys still work, and the last 24h of LLM token usage.
+#
+# Triggered once a day by a scheduled Fly Machine calling POST /admin/daily_report
+# (same pattern as the hourly /proactive/run trigger). Recipient is the user id
+# in the DEV_REPORT_USER_ID secret; delivery reuses the app's Expo push path.
+#
+# Why a real completion call and not an auth-only check: a key can authenticate
+# fine on free endpoints (e.g. /v1/models) while being unable to bill — that is
+# exactly how a broken OpenAI key once went unnoticed. And the 2026-09-29/30
+# Anthropic outage went unnoticed for a day because failed calls are swallowed
+# by the pipelines, so nothing user-visible flagged it.
+
+import os
+from collections import defaultdict
+from datetime import datetime, timedelta, timezone
+
+import litellm
+
+from db_client import supabase
+from util_push import send_expo_push_notification
+
+# Cheapest model per provider — the check only needs to prove the key can bill.
+_KEY_CHECKS = {
+    "Anthropic": ("ANTHROPIC_API_KEY", "anthropic/claude-haiku-4-5"),
+    "OpenAI":    ("OPENAI_API_KEY",    "gpt-4.1-nano"),
+}
+
+
+def check_provider_keys() -> dict:
+    """{provider: None if working, else a short error string}. Calls litellm
+    directly (not llm_client) so the check never uses a user's own key and
+    never lands in llm_usage_log. Never includes any part of the key itself."""
+    results = {}
+    for provider, (env_name, model) in _KEY_CHECKS.items():
+        key = os.environ.get(env_name, "")
+        if not key:
+            results[provider] = f"{env_name} not set"
+            continue
+        try:
+            litellm.completion(
+                model=model,
+                messages=[{"role": "user", "content": "ping"}],
+                max_tokens=1,
+                api_key=key,
+            )
+            results[provider] = None
+        except Exception as e:
+            msg = str(e).replace(key, "***")
+            results[provider] = f"{type(e).__name__}: {msg[:120]}"
+    return results
+
+
+def _provider_of(model: str) -> str:
+    return "Anthropic" if "claude" in model.lower() else "OpenAI"
+
+
+def summarize_usage(hours: int = 24) -> dict:
+    """Token totals and estimated USD cost from llm_usage_log over the last
+    `hours`, grouped by provider and by model. Cost is litellm's price table,
+    an estimate — the provider consoles are the billing truth. Includes calls
+    made with users' own (BYOK) keys, which are billed to them, not the app."""
+    since = (datetime.now(timezone.utc) - timedelta(hours=hours)).isoformat()
+    rows, page = [], 1000
+    while True:
+        batch = (
+            supabase.table("llm_usage_log")
+            .select("model,prompt_tokens,completion_tokens,total_tokens")
+            .gte("created_at", since)
+            .range(len(rows), len(rows) + page - 1)
+            .execute()
+            .data
+        ) or []
+        rows.extend(batch)
+        if len(batch) < page:
+            break
+
+    by_model = defaultdict(lambda: {"calls": 0, "tokens": 0, "cost": 0.0})
+    for r in rows:
+        model = r.get("model") or "unknown"
+        pt, ct = r.get("prompt_tokens") or 0, r.get("completion_tokens") or 0
+        m = by_model[model]
+        m["calls"] += 1
+        m["tokens"] += r.get("total_tokens") or (pt + ct)
+        try:
+            p_cost, c_cost = litellm.cost_per_token(model=model, prompt_tokens=pt, completion_tokens=ct)
+            m["cost"] += p_cost + c_cost
+        except Exception:
+            pass  # unpriced model: tokens still counted, cost omitted
+
+    by_provider = defaultdict(lambda: {"calls": 0, "tokens": 0, "cost": 0.0})
+    for model, m in by_model.items():
+        p = by_provider[_provider_of(model)]
+        for k in ("calls", "tokens", "cost"):
+            p[k] += m[k]
+
+    return {
+        "calls": len(rows),
+        "tokens": sum(m["tokens"] for m in by_model.values()),
+        "cost": sum(m["cost"] for m in by_model.values()),
+        "by_provider": dict(by_provider),
+        "by_model": dict(by_model),
+    }
+
+
+def _fmt_tokens(n: int) -> str:
+    if n >= 1_000_000:
+        return f"{n / 1_000_000:.1f}M"
+    if n >= 1_000:
+        return f"{n / 1_000:.0f}k"
+    return str(n)
+
+
+def build_report(keys: dict, usage: dict) -> tuple[str, str]:
+    """(title, body) for the push notification."""
+    failing = [p for p, err in keys.items() if err]
+    title = ("⚠️ Key failing: " + ", ".join(failing)) if failing else "✅ Daily report: keys OK"
+
+    lines = [f"{p} key FAILING — {keys[p]}" for p in failing]
+    lines.append(
+        f"24h: {usage['calls']} calls · {_fmt_tokens(usage['tokens'])} tokens · ≈${usage['cost']:.2f}"
+    )
+    for provider in ("Anthropic", "OpenAI"):
+        p = usage["by_provider"].get(provider)
+        if p:
+            lines.append(f"{provider}: {_fmt_tokens(p['tokens'])} tokens · ≈${p['cost']:.2f}")
+    return title, "\n".join(lines)
+
+
+def run_daily_report() -> dict:
+    keys = check_provider_keys()
+    try:
+        usage = summarize_usage()
+    except Exception as e:
+        print(f"[daily_report] usage summary failed: {e}")
+        usage = {"calls": 0, "tokens": 0, "cost": 0.0, "by_provider": {}, "by_model": {}}
+    title, body = build_report(keys, usage)
+    print(f"[daily_report] {title} | {body!r}")
+
+    recipient = os.environ.get("DEV_REPORT_USER_ID", "")
+    sent = bool(recipient) and send_expo_push_notification(
+        user_id=recipient, title=title, body=body, data={"type": "dev_report"}
+    )
+    if not recipient:
+        print("[daily_report] DEV_REPORT_USER_ID not set — report logged only")
+    return {"title": title, "body": body, "pushed": sent,
+            "keys_ok": not any(keys.values()), "by_model": usage["by_model"]}