Budgets & shared enforcement

A budget check happens before the call

For each supported request, Leash calculates a conservative allowance from the priced model, request size and maximum output. It checks spent plus reserved amounts before forwarding, then reconciles the reservation with reported usage.

This protects against simultaneous calls spending the same available balance. A conservative reservation can reject a request whose eventual cost would have been lower. Unpriced models fail closed until they have an explicit price.

Set a boundary you are comfortable with

Use Settings → Budgets for daily and default session caps. Repository and session rules can add narrower boundaries. A block rule prevents admission; an alert-only rule sends a warning and is not a hard cap. Local CLI configuration lives in ~/.leash/config.toml.

export LEASH_SESSION_CAP_USD=5
export LEASH_DAILY_CAP_USD=25
export LEASH_MONTHLY_CAP_USD=200
leash start

Share one budget across devices

Metadata sync alone does not combine local counters. In local mode, two devices with a $100 cap each have independent budgets. For one shared $100 boundary, enable shared enforcement in Settings → Gateway & shared budgets.

Shared devices ask the control API for atomic admission before sending each request directly to the provider. A Postgres transaction reserves all applicable workspace, team, user, project/repository and session amounts together. Provider keys and prompts remain on the machine.

Sync earlier usage, enable shared mode, and wait for participating devices to receive the setting. Inspect connection state: a disconnected device cannot receive a mode change immediately. Previously unsynced local usage is outside the shared ledger's initial totals.

Reservations survive interruption

A local reservation interrupted by a crash stays conservatively charged. Stop the proxy, inspect provider usage, and reconcile the specific reservation rather than deleting ledger records. Shared and gateway reservations have separate central recovery rules: expired dispatched calls are charged conservatively; never-dispatched admissions can release their allowance.

leash reconcile RESERVATION_ID --cost 0.12