feat: ✨ Session budget enforcement plugin

[evaline-ju]

Summary

• Adds a opt-in (include_plugin_tokenbudget) token-budget plugin for per-session lifetime enforcement for tokens, calls, and wall-clock duration, working with streaming SSE responses and buffered responses
• Include shadow mode (on_exceed: "observe") as alternative to denial
• Behavior on denial is 403 - note: for errors on the outbound plugin pipeline, like the token-exchange plugin, Cortex as a sidecar will not be able to surface these errors clearly through agents themselves
• Introduces a storage interface - note: the plugin depends on the interface, not Redis directly, Redis here provides a storage example for persisting count info across pod restarts and replicas
• Test coverage: unit, e2e
• Documentation in docs/token-budget-plugin.md with config reference, pipeline position

Related issue(s)

Closes #708

Testing Instructions

• Deploy Valkey (e.g. helm install valkey bitnami/valkey -n <ns>) or any Redis-compatible store
• Build with tag: cd authbridge && docker build -f cmd/authbridge-proxy/Dockerfile \ --build-arg GO_BUILD_TAGS="include_plugin_tokenbudget" \ -t authbridge:latest . and load into cluster
• Add the plugin to the outbound pipeline through authbridge-runtime-config (or see docs/token-budget-plugin.md), roll pod or wait for hot-reload

- name: token-budget
  config:
    redis_url: "redis://valkey.<ns>.svc:6379"
    max_tokens: 100
    max_calls: 3
    on_exceed: "observe"

• With on_exceed: "observe", send agent requests past limit, these requests should succeed and info can be seen in logs/through abctl
• To flip to on_exceed: "deny", edit the authbridge configmap

Assisted-By: Claude (Anthropic AI)

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b2667142-d13e-4b15-b5e3-af7a2380f863

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}