cachegate 1.4.0 → 1.4.2

package/.env.example

@@ -78,6 +78,21 @@ ANTHROPIC_API_KEY=sk-ant-api03-...
 # explicitly distinct from whatever else reads DATABASE_URL in your stack.
 # MEMOCODE_ROUTER_DATABASE_URL=postgres://user:pass@host:5432/dbname
 
+# Optional: TLS verification for the Postgres connection above, if its
+# certificate isn't signed by a publicly-trusted CA (most managed
+# Postgres - RDS, Neon, Supabase - needs neither of these; it just works).
+# Some providers issue a self-signed certificate per database instance
+# instead (confirmed: Render's managed Postgres is one) - set PGSSL_CA to
+# that CA's own PEM content, or PGSSL_CA_PATH to a file containing it.
+# PGSSL_CA=-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----
+# PGSSL_CA_PATH=/path/to/ca.pem
+#
+# PGSSL_INSECURE=true turns TLS verification off entirely (encrypted, but
+# the server's identity is never checked) - an explicit escape hatch for a
+# deployment that can't set either of the above right now, not a normal
+# setting. Logs a warning on every use so it can't happen silently.
+# PGSSL_INSECURE=true
+
 # Optional: where JSONL metrics files live, if Postgres isn't
 # configured. Despite the name, this now names a DIRECTORY (kept for
 # backward compatibility with older configs that pointed it at a

package/README.md

@@ -7,12 +7,6 @@ A self-hostable, OpenAI-compatible proxy that routes LLM requests to the
 cheapest currently-healthy provider, caches responses both exactly and
 semantically, and tracks cost and latency per call.
 
-Would rather not run it yourself? [Cachegate Cloud](https://cachegate.memocodesystem.com)
-is a hosted version of this same engine — BYOK, so you're never paying
-us for tokens, only for the caching/routing layer on top. Everything
-below in this README describes the engine itself; both this repo and
-the hosted product share it.
-
 ## Why this instead of LiteLLM / Portkey / OpenRouter?
 
 Those are all excellent, and this doesn't try to out-feature them (140+
@@ -41,10 +35,7 @@ fills instead:
 
 - **Not a hosted service.** There's no cloud offering, no login, no
   billing, no multi-tenant key custody here — this is the engine you
-  run yourself. If you want that instead, [Cachegate Cloud](https://cachegate.memocodesystem.com)
-  is a separate, closed product built on top of this same engine — not
-  a fork of this one, and not something this repository will ever grow
-  into. This project intentionally doesn't ship the pieces (billing,
+  run yourself. This project intentionally doesn't ship the pieces (billing,
   multi-tenant key custody, a login system) that a competing hosted
   offering would need, and isn't looking for PRs that add them (see
   `CONTRIBUTING.md`'s scope note) — not because the license forbids it
@@ -192,8 +183,8 @@ the folder. Pick **standalone** if cachegate should be one shared
 service serving multiple apps (or you'd rather manage it as its own
 deployable thing). Pick **colocated** if you want everything - your app
 plus its router - in one repo, one place to look, no second project to
-maintain (this is exactly how this router lives inside MemoCode's own
-monorepo today).
+maintain (this is exactly how this router lives inside at least one
+production app's own monorepo today).
 
 **Reaching it once it's running:**
 - Same machine, calling app not containerized: `http://localhost:4000`.
@@ -625,9 +616,9 @@ positioning. A few things worth knowing before relying on it:
   no database of its own, but ephemeral on most hosts (a restart/
   redeploy wipes a container's own filesystem). Set `DATABASE_URL` to a
   real Postgres connection string and every metrics function
-  transparently reads/writes there instead - MemoCode's own embedded
-  deployment points this at its already-provisioned `memocode-db`
-  rather than standing up a separate database just for cost history.
+  transparently reads/writes there instead - a real embedded deployment
+  can point this at its own already-provisioned database rather than
+  standing up a separate one just for cost history.
   Same public API either way (`record`/`readRecent`/`providerStats`/
   `rangeSummary`/`pruneOlderThan`); nothing outside `metrics.js` needs
   to know or care which backend is actually running. Retention is the

package/eval/semantic-cache-eval-pairs.json

@@ -0,0 +1,28 @@
+[
+  { "a": "Summarize this document for me", "b": "Can you give me a summary of this document?", "expectMatch": true, "note": "paraphrase" },
+  { "a": "What's the capital of France?", "b": "Tell me the capital city of France", "expectMatch": true, "note": "paraphrase" },
+  { "a": "Translate this sentence to Spanish", "b": "Please translate this sentence into Spanish", "expectMatch": true, "note": "paraphrase" },
+  { "a": "How do I reverse a list in Python?", "b": "What's the Python way to reverse a list?", "expectMatch": true, "note": "paraphrase" },
+  { "a": "Explain quantum entanglement simply", "b": "Can you explain quantum entanglement in simple terms?", "expectMatch": true, "note": "paraphrase" },
+  { "a": "Write a haiku about autumn", "b": "Compose a haiku on the theme of autumn", "expectMatch": true, "note": "paraphrase" },
+  { "a": "What are the health benefits of green tea?", "b": "Tell me about the health benefits of drinking green tea", "expectMatch": true, "note": "paraphrase" },
+  { "a": "Fix this bug in my code", "b": "Can you help me fix this bug in my code?", "expectMatch": true, "note": "paraphrase" },
+  { "a": "Give me a recipe for chocolate chip cookies", "b": "What's a good chocolate chip cookie recipe?", "expectMatch": true, "note": "paraphrase" },
+  { "a": "Explain the difference between TCP and UDP", "b": "What's the difference between TCP and UDP protocols?", "expectMatch": true, "note": "paraphrase" },
+
+  { "a": "What is 15% of 200?", "b": "What is 25% of 900?", "expectMatch": false, "note": "same template, different number - the exact failure mode Step 21 caught on the literal-cache side" },
+  { "a": "Summarize invoice #12345, total $500", "b": "Summarize invoice #67890, total $9000", "expectMatch": false, "note": "same template, different value" },
+  { "a": "What happened on 2024-01-15?", "b": "What happened on 2024-03-22?", "expectMatch": false, "note": "same template, different date" },
+  { "a": "Convert 100 USD to EUR", "b": "Convert 500 USD to EUR", "expectMatch": false, "note": "same template, different amount" },
+  { "a": "What's the population of Canada?", "b": "What's the population of Brazil?", "expectMatch": false, "note": "same template, different subject" },
+  { "a": "Summarize the plot of Romeo and Juliet", "b": "Summarize the plot of Hamlet", "expectMatch": false, "note": "same template, different subject" },
+  { "a": "How many calories are in a banana?", "b": "How many calories are in an avocado?", "expectMatch": false, "note": "same template, different subject" },
+  { "a": "What year did World War II end?", "b": "What year did World War I end?", "expectMatch": false, "note": "same template, different subject" },
+
+  { "a": "Summarize this document for me", "b": "Translate this sentence to Spanish", "expectMatch": false, "note": "unrelated" },
+  { "a": "What's the capital of France?", "b": "Write a haiku about autumn", "expectMatch": false, "note": "unrelated" },
+  { "a": "Fix this bug in my code", "b": "Give me a recipe for chocolate chip cookies", "expectMatch": false, "note": "unrelated" },
+  { "a": "Explain quantum entanglement simply", "b": "What's the difference between TCP and UDP protocols?", "expectMatch": false, "note": "unrelated" },
+  { "a": "How do I reverse a list in Python?", "b": "What are the health benefits of green tea?", "expectMatch": false, "note": "unrelated" },
+  { "a": "What is 15% of 200?", "b": "Summarize the plot of Romeo and Juliet", "expectMatch": false, "note": "unrelated" }
+]

package/eval/semantic-cache-eval.js

@@ -0,0 +1,82 @@
+// model-router/eval/semantic-cache-eval.js
+//
+// Phase 2 roadmap, step 22.1/22.3 - measures precision/recall of
+// whichever `embeddings` backend is active, against semanticCache.js's
+// OWN cosineSimilarity() + threshold, using a curated positive/negative
+// prompt-pair set (semantic-cache-eval-pairs.json). This is an offline
+// measurement tool, not the request path and not run in CI - "ship only
+// after a real eval pass" (the moat doc's own words on this step) means
+// a human reads this report and decides, not a pass/fail gate that
+// silently blocks a build.
+//
+// Parameterized on the embeddings module (defaults to whichever one
+// ../embeddings currently resolves to) so the SAME dataset and harness
+// run unchanged against OpenAI (today's default) or the local model
+// (once step 22.2 lands - set SEMANTIC_CACHE_LOCAL_EMBEDDINGS=true and
+// re-run) - a real apples-to-apples comparison, not two different
+// measurements taken two different ways.
+//
+// Run: npm run eval:semantic-cache
+// (needs a real, enabled embeddings backend - OPENAI_API_KEY today)
+
+const { cosineSimilarity, DEFAULT_THRESHOLD } = require('../semanticCache');
+const defaultPairs = require('./semantic-cache-eval-pairs.json');
+
+async function runEval({
+  embeddings = require('../embeddings'),
+  threshold = DEFAULT_THRESHOLD,
+  pairs = defaultPairs
+} = {}) {
+  if (!embeddings.isEnabled()) {
+    throw new Error(
+      'No embeddings backend is enabled - set OPENAI_API_KEY (or, once available, ' +
+      'SEMANTIC_CACHE_LOCAL_EMBEDDINGS=true) before running this eval.'
+    );
+  }
+
+  let tp = 0;
+  let fp = 0;
+  let tn = 0;
+  let fn = 0;
+  const misclassified = [];
+
+  for (const pair of pairs) {
+    const [vecA, vecB] = await Promise.all([embeddings.embed(pair.a), embeddings.embed(pair.b)]);
+    const similarity = cosineSimilarity(vecA, vecB);
+    const predictedMatch = similarity >= threshold;
+
+    if (pair.expectMatch && predictedMatch) {
+      tp++;
+    } else if (pair.expectMatch && !predictedMatch) {
+      fn++;
+      misclassified.push({ ...pair, similarity, predictedMatch });
+    } else if (!pair.expectMatch && predictedMatch) {
+      fp++;
+      misclassified.push({ ...pair, similarity, predictedMatch });
+    } else {
+      tn++;
+    }
+  }
+
+  // null (not NaN, not a misleading 1/0) when there's nothing to be
+  // precise/complete about - e.g. a dataset with zero actual positives
+  // makes "recall" an undefined question, not a score of 0.
+  const precision = tp + fp > 0 ? tp / (tp + fp) : null;
+  const recall = tp + fn > 0 ? tp / (tp + fn) : null;
+
+  return { threshold, total: pairs.length, tp, fp, tn, fn, precision, recall, misclassified };
+}
+
+if (require.main === module) {
+  runEval()
+    .then((result) => {
+      console.log(JSON.stringify(result, null, 2));
+      process.exit(0);
+    })
+    .catch((err) => {
+      console.error('Eval failed:', err.message);
+      process.exit(1);
+    });
+}
+
+module.exports = { runEval };

package/metrics.js

@@ -42,31 +42,74 @@ const { Pool } = require('pg');
 // file storage above/below stays the default for exactly the reason
 // its own original comment gives: self-hosted/lightweight, zero new
 // infrastructure required to run this router standalone in some other
-// app. But the EMBEDDED deployment inside MemoCode specifically already
-// has a real Postgres database (memocode-db, provisioned for its own
-// user-account/library data regardless of this router) - reusing that
-// costs nothing new (no extra service, no extra bill, no extra account)
-// and, unlike the router's own container filesystem, genuinely survives
-// a restart/redeploy. DATABASE_URL is Render's own standard convention
-// for injecting a database's connection string (matches how
-// 000_backend/db.mjs reads the exact same variable for the exact same
-// reason) - set it and every function below transparently reads/writes
-// Postgres instead of local files; leave it unset and nothing here
-// changes at all.
+// app. But an embedded deployment (this engine running inside another
+// app's own backend) often already has a real Postgres database,
+// provisioned for its own user-account/library data regardless of this
+// router - reusing that costs nothing new (no extra service, no extra
+// bill, no extra account) and, unlike the router's own container
+// filesystem, genuinely survives a restart/redeploy. DATABASE_URL is
+// Render's own standard convention for injecting a database's
+// connection string (matches how a sibling backend's own db.mjs reads
+// the exact same variable for the exact same reason) - set it and every
+// function below transparently reads/writes Postgres instead of local
+// files; leave it unset and nothing here changes at all.
 function usingPostgres() {
   return Boolean(process.env.DATABASE_URL || process.env.MEMOCODE_ROUTER_DATABASE_URL);
 }
 
+// PGSSL_CA / PGSSL_CA_PATH: opt-in custom CA for verifying a hosted
+// Postgres whose certificate isn't signed by a publicly-trusted root - a
+// self-signed cert some managed providers issue per database instance
+// (confirmed live, 2026-09-13: Render's managed Postgres is one). PGSSL_CA
+// takes the certificate's own PEM content directly (handy on hosts that
+// inject env vars but not files); PGSSL_CA_PATH reads it from a file
+// instead (handy when it's already committed/mounted as one). Neither set
+// means the default Node trust store alone - correct and sufficient for
+// any provider whose cert chains to a public root (RDS, Neon, Supabase,
+// most managed Postgres).
+function resolvePgCa() {
+  if (process.env.PGSSL_CA) return process.env.PGSSL_CA;
+  if (process.env.PGSSL_CA_PATH) {
+    try {
+      return fs.readFileSync(process.env.PGSSL_CA_PATH, 'utf8');
+    } catch (err) {
+      throw new Error(`PGSSL_CA_PATH is set to "${process.env.PGSSL_CA_PATH}" but could not be read: ${err.message}`);
+    }
+  }
+  return null;
+}
+
+// Review finding: this used to be a hardcoded { rejectUnauthorized: false }
+// - TLS encrypted the connection but never verified WHO it was talking to,
+// for every deployment, with no way to opt into real verification even
+// with the right CA in hand. Default is now secure (rejectUnauthorized:
+// true, the public trust store) - correct out of the box for any provider
+// on a publicly-trusted CA. A provider whose cert isn't (self-signed,
+// issued per-instance) needs PGSSL_CA or PGSSL_CA_PATH set to that CA -
+// see resolvePgCa() above. PGSSL_INSECURE=true is the explicit, loud
+// escape hatch for a deployment that can't do either right now: the same
+// old behavior, but it can no longer happen by accident or silently.
+function pgSslConfig(connectionString) {
+  if (!connectionString || /localhost|127\.0\.0\.1/.test(connectionString)) return false;
+  if (process.env.PGSSL_INSECURE === 'true') {
+    console.warn(
+      "⚠️ PGSSL_INSECURE=true: Postgres TLS certificate verification is OFF. " +
+      "This connection is encrypted but the server's identity is NOT checked. " +
+      'Set PGSSL_CA or PGSSL_CA_PATH instead as soon as you can.'
+    );
+    return { rejectUnauthorized: false };
+  }
+  const ca = resolvePgCa();
+  return ca ? { ca, rejectUnauthorized: true } : { rejectUnauthorized: true };
+}
+
 let pgPool = null;
 function getPool() {
   if (!pgPool) {
     const connectionString = process.env.MEMOCODE_ROUTER_DATABASE_URL || process.env.DATABASE_URL;
     pgPool = new Pool({
       connectionString,
-      // Same rule db.mjs already uses: a real hosted Postgres (Render's
-      // managed instance) needs SSL; a local one (dev, this module's
-      // own tests) doesn't and would just fail the handshake if asked.
-      ssl: connectionString && !/localhost|127\.0\.0\.1/.test(connectionString) ? { rejectUnauthorized: false } : false
+      ssl: pgSslConfig(connectionString)
     });
   }
   return pgPool;
@@ -79,10 +122,11 @@ function getPool() {
 // NULLABLE, not NOT NULL - deliberately different from how a fork
 // starting fresh (CREATE TABLE with a required column) would do it.
 // This module has live deployments already running against an existing
-// table (MemoCode's own render wiring) where CREATE TABLE IF NOT EXISTS
-// is a no-op on an already-created table - ADD COLUMN IF NOT EXISTS is
-// what actually reaches an existing table's schema (same ALTER pattern
-// the sibling backend's db.mjs already uses for exactly this reason).
+// table (a real embedded deployment's own Render wiring) where CREATE
+// TABLE IF NOT EXISTS is a no-op on an already-created table - ADD
+// COLUMN IF NOT EXISTS is what actually reaches an existing table's
+// schema (same ALTER pattern a sibling backend's own db.mjs already
+// uses for exactly this reason).
 // Existing rows get scope = NULL, which is exactly right: they were
 // recorded before scope existed, under the one global/unscoped history,
 // and null-scope reads (see rowFilterSql below) return precisely that
@@ -496,8 +540,8 @@ async function providerStats(scope, windowSize = 50) {
  * duplicated logic.
  */
 
-// Shared "$ saved" formula (mirrors cachegate-cloud's usage.mjs
-// estimatedSavings / estimatedSavingsGlobal, 2026-09-05 Phase 2 step 20):
+// Shared "$ saved" formula (mirrors a wrapping deployment's own usage.mjs
+// estimatedSavings / estimatedSavingsGlobal):
 // for each model, the average cost of a cache-MISS (cache_hit === false,
 // no error) times that model's cache-HIT count, summed across models. A
 // model with hits but no recorded miss yet contributes 0 - never a
@@ -739,5 +783,6 @@ module.exports = {
   usingPostgres,
   matchesScope,
   closePostgresPoolForTests,
+  pgSslConfig,
   DATA_DIR
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cachegate",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Self-hostable, OpenAI-compatible LLM proxy: routes to the cheapest healthy provider, caches responses exactly and semantically, tracks cost and latency per call.",
   "license": "MIT",
   "main": "server.js",
@@ -24,7 +24,9 @@
     "tracing.js",
     "providers/",
     "public/",
-    ".env.example"
+    ".env.example",
+    "eval/semantic-cache-eval.js",
+    "eval/semantic-cache-eval-pairs.json"
   ],
   "engines": {
     "node": ">=18.0.0"

package/redisClient.js

@@ -42,12 +42,12 @@ const ready = new Promise((resolve) => { readyResolve = resolve; });
 // including the automatic-reconnect loop after the socket dies - gating
 // cache reads/writes on it lets every command queue on a dead socket and
 // hang the request instead of failing open. `isReady` is true only when
-// a command can actually execute right now. Live-verified in the
-// Cachegate Cloud build (its PR #12 review): with isOpen, a stopped
-// Redis hung /v1 requests for 2+ minutes; with isReady the same request
-// returned in 11ms, correctly skipping the cache. This is the backport
-// of that fix - the cloud vendored this engine and fixed its copy first;
-// the engine and the public cachegate repo still shipped the bug.
+// a command can actually execute right now. Live-verified in a real
+// hosted deployment: with isOpen, a stopped Redis hung /v1 requests for
+// 2+ minutes; with isReady the same request returned in 11ms, correctly
+// skipping the cache. This is the backport of that fix - a downstream
+// vendored copy of this engine caught and fixed it first; this repo
+// still shipped the bug until now.
 function isConnected() {
   return client.isReady;
 }

package/router.js

@@ -15,8 +15,7 @@
 // exactly as before, unchanged, in server.js. Nothing here overrides an
 // explicit choice - virtual models are opt-in.
 
-const anthropicProvider = require('./providers/anthropic');
-const openaiProvider = require('./providers/openai');
+const providers = require('./providers');
 const metrics = require('./metrics');
 
 // A tier groups equivalent-capability models across providers - the
@@ -90,8 +89,18 @@ function loadStrategy() {
   return raw;
 }
 
+// Normalizes an estimated cost for comparison: a real number sorts on its
+// own value, anything else (null - an estimator that ran but couldn't price
+// this model, e.g. OpenRouter on an id it has no rate for - or a missing
+// estimator entirely) sorts LAST. Found in review: `a.estimatedCostUsd -
+// b.estimatedCostUsd` on a `null` silently coerces to `0 - b`, which ranks
+// an UNKNOWN price as free - the opposite of "unknown, so don't prefer it."
+function comparableCost(candidate) {
+  return typeof candidate.estimatedCostUsd === 'number' ? candidate.estimatedCostUsd : Infinity;
+}
+
 function byCostAscending(a, b) {
-  return a.estimatedCostUsd - b.estimatedCostUsd;
+  return comparableCost(a) - comparableCost(b);
 }
 
 function byLatencyThenCost(a, b) {
@@ -130,10 +139,15 @@ function isVirtualModel(model) {
   return typeof model === 'string' && model.startsWith('router:');
 }
 
+// Routes through the provider registry (providers/index.js) instead of
+// naming providers here, so a new provider needs no edit in this file to be
+// cost-ranked. Found in review: this hardcoded anthropic/openai only, so
+// adding deepseek/openrouter to the registry never wired them into cost
+// estimation - every candidate on either got `null` here -> Infinity below
+// -> always ranked last, silently defeating the point of adding them.
 function estimatorFor(provider) {
-  if (provider === 'anthropic') return anthropicProvider.estimateCost;
-  if (provider === 'openai') return openaiProvider.estimateCost;
-  return null;
+  const mod = providers.get(provider);
+  return mod ? mod.estimateCost : null;
 }
 
 // A fixed token assumption used ONLY to compare candidates against each

package/server.js

@@ -91,11 +91,11 @@ function redactMessages(messages) {
 const app = express();
 // Step 36 (observability): initialize OTel once, at module load. A no-op
 // unless OTEL_ENABLED + OTEL_EXPORTER_OTLP_ENDPOINT are both set (see
-// tracing.js) - so both the standalone server and a wrapping deployment
-// (cachegate-cloud's cloud-server.js) get tracing without any extra call.
+// tracing.js) - so both the standalone server and a wrapping deployment's
+// own entry point get tracing without any extra call.
 tracing.initTracing();
 // `trust proxy`, now CONFIGURABLE and secure by default. The previous hardcoded `1` was chosen for
-// Cachegate Cloud's single-hop topology (2026-09-04) and is right THERE, but it is the wrong default
+// one specific hosted deployment's single-hop topology (2026-09-04) and is right THERE, but it is the wrong default
 // for the topology this engine's own README documents (`docker run -p 4000:4000`: no proxy at all).
 // In that topology `1` trusts a client-controlled X-Forwarded-For, so any caller can present a fresh
 // IP on every request and the per-IP limiter on the key-holding routes is defeated - fail-OPEN, and
@@ -103,9 +103,9 @@ tracing.initTracing();
 // away from correct. Every other security decision in this file fails closed (no DATABASE_URL, no
 // API_KEY_ENCRYPTION_SECRET, auth) and this should not be the exception.
 //
-// Deployment note: a proxied deployment MUST now set TRUST_PROXY explicitly - Cachegate Cloud sets
-// TRUST_PROXY=1 in render.yaml and RENDER-ENV-MAP.md. Upgrade impact is a boot-time warning on Render
-// (see below) plus a CHANGELOG entry, not a silent change of limiter scope.
+// Deployment note: a proxied deployment MUST now set TRUST_PROXY explicitly - a real deployment
+// behind Render's proxy sets TRUST_PROXY=1 in its own render.yaml. Upgrade impact is a boot-time
+// warning on Render (see below) plus a CHANGELOG entry, not a silent change of limiter scope.
 function resolveTrustProxy(raw) {
   const value = raw == null ? '' : String(raw).trim();
   if (value === '') {
@@ -145,8 +145,8 @@ app.set('trust proxy', resolveTrustProxy(process.env.TRUST_PROXY));
 // benefit).
 app.disable('x-powered-by');
 
-// Defense-in-depth backstop, the same treatment the MemoCode backend
-// already carries (its PRs #67/#71): Express 4 does NOT route an async
+// Defense-in-depth backstop, the same treatment a wrapping backend deployment
+// already carries: Express 4 does NOT route an async
 // route handler's rejected promise to the error middleware at the bottom
 // of this file - left unguarded, Node's default since v15 is to crash
 // the whole process, taking every other in-flight request with it. The
@@ -203,7 +203,7 @@ function constantTimeEqual(a, b) {
 // A deployer needing real multi-tenancy (issued-key auth instead of one
 // shared internal key, per-tenant BYOK provider keys, per-tenant rate
 // limiting) overrides these via configure() below instead of forking
-// this file - the fork this project's own Cachegate Cloud build had to
+// this file - the fork a real hosted deployment had to
 // maintain until now, duplicating every one of these decisions across a
 // full copy of server.js. Every default here is EXACTLY today's
 // single-tenant, unconfigured behavior - never calling configure()
@@ -231,7 +231,7 @@ const seams = {
   // today's single shared process.env key, the same for every scope. A
   // BYOK-style deployer overrides this to look the key up per-scope
   // instead - and since a real per-scope lookup is usually a database
-  // read (Cachegate Cloud's is a Postgres fetch + decrypt), the resolver
+  // read (a real BYOK deployment's is typically a Postgres fetch + decrypt), the resolver
   // may return a Promise; every call site below awaits it, which is a
   // no-op for a synchronous resolver, so both shapes are first-class.
   // (See the callers below: they never cache a client built from a
@@ -277,11 +277,11 @@ async function requireInternalKey(req, res, next) {
 // internal key) has no ceiling today. Defaults are deliberately
 // generous for real usage and overridable per deployment.
 //
-// The embedded deployment (this app's own MemoCode instance) has
-// exactly ONE caller identity - memocode-backend, one service, one
-// outbound IP - which means express-rate-limit's default per-IP
-// keying doesn't separate individual end users at all: this ceiling is
-// shared across EVERY MemoCode user's combined traffic, not per person.
+// An embedded deployment (this engine running inside another app's own
+// backend) has exactly ONE caller identity - one service, one outbound
+// IP - which means express-rate-limit's default per-IP keying doesn't
+// separate individual end users at all: this ceiling is shared across
+// EVERY end user's combined traffic, not per person.
 // 60/60s (the original default) turned out to be uncomfortably close
 // to what a single legitimate action can burst on its own: PDF
 // summarize dispatches one call per chapter, sequentially, up to
@@ -297,8 +297,8 @@ async function requireInternalKey(req, res, next) {
 // multi-tenancy step the router's own docs already flag as future
 // scope (see ROADMAP.md's embedded/standalone split), not something
 // this single-app deployment needs yet. Note for a STANDALONE
-// self-hoster (as opposed to MemoCode's own single-caller embedded
-// deployment the paragraph above describes): if your own callers each
+// self-hoster (as opposed to the single-caller embedded deployment
+// the paragraph above describes): if your own callers each
 // have distinct outbound IPs, this same per-IP default DOES separate
 // them from each other - the "shared ceiling" caveat above is specific
 // to a deployment with exactly one caller identity, not a general
@@ -312,12 +312,20 @@ async function requireInternalKey(req, res, next) {
 // (ipKeyGenerator) when never configured - not a bare `req.ip`, which
 // the library itself warns can let IPv6 users bypass limits (same
 // default it would have used had this option been omitted entirely).
+// Shared by every limiter in this file - review finding: readEndpointLimiter
+// below was defined without this at all, silently falling back to
+// express-rate-limit's OWN default, which is the bare `req.ip` the comment
+// above warns about - the exact IPv6 bypass this function exists to avoid,
+// present on /stats and /dashboard/data while /v1 was fixed. Pulled out
+// once so the two limiters can no longer drift apart on this again.
+const ipv6SafeKeyGenerator = (req, res) => (seams.rateLimitKeyGenerator ? seams.rateLimitKeyGenerator(req, res) : rateLimit.ipKeyGenerator(req.ip));
+
 const rateLimiter = rateLimit({
   windowMs: Number(process.env.RATE_LIMIT_WINDOW_MS) || 60_000,
   limit: Number(process.env.RATE_LIMIT_MAX) || 300,
   standardHeaders: true,
   legacyHeaders: false,
-  keyGenerator: (req, res) => (seams.rateLimitKeyGenerator ? seams.rateLimitKeyGenerator(req, res) : rateLimit.ipKeyGenerator(req.ip)),
+  keyGenerator: ipv6SafeKeyGenerator,
   message: { error: 'Too many requests - rate limit exceeded' }
 });
 
@@ -334,6 +342,7 @@ const readEndpointLimiter = rateLimit({
   limit: Number(process.env.READ_RATE_LIMIT_MAX) || 120,
   standardHeaders: true,
   legacyHeaders: false,
+  keyGenerator: ipv6SafeKeyGenerator,
   message: { error: 'Too many requests - rate limit exceeded' }
 });
 
@@ -462,10 +471,16 @@ app.get('/stats', requireInternalKey, readEndpointLimiter, async (req, res) => {
       // between them - moved here from the public GET /health (security-
       // review finding, 2026-09-02): this endpoint already requires the
       // internal key, /health never did.
-      providers: {
-        anthropic: Boolean(await seams.resolveProviderKey(req.scope, 'anthropic')),
-        openai: Boolean(await seams.resolveProviderKey(req.scope, 'openai'))
-      },
+      // Review finding: this hardcoded anthropic/openai only, so adding
+      // deepseek/openrouter to the registry never surfaced them here -
+      // an operator checking "which providers have a key configured"
+      // saw a false "no" for either. Built from providers.names() now,
+      // so a future provider needs no edit here to show up.
+      providers: Object.fromEntries(
+        await Promise.all(
+          providers.names().map(async (name) => [name, Boolean(await seams.resolveProviderKey(req.scope, name))])
+        )
+      ),
       routing_tiers: Object.keys(router.loadTiers()),
       routing_strategy: router.loadStrategy()
     });
@@ -1241,7 +1256,10 @@ if (require.main === module) {
   }
   app.listen(PORT, () => {
     console.log(`🚀 cachegate listening on port ${PORT}`);
-    console.log(`📡 Providers: Anthropic=${!!process.env.ANTHROPIC_API_KEY}, OpenAI=${!!process.env.OPENAI_API_KEY}`);
+    // Review finding: this hardcoded anthropic/openai only, so the boot
+    // log silently never mentioned deepseek/openrouter once they existed.
+    // Built from providers.names() now, same fix as /stats above.
+    console.log(`📡 Providers: ${providers.names().map((name) => `${name}=${!!process.env[providers.envKey(name)]}`).join(', ')}`);
     console.log(`💾 Redis cache: ${cache.isConnected() ? 'connected' : 'disabled'}`);
     console.log(`🗄️ Metrics storage: ${metrics.usingPostgres() ? 'Postgres' : 'local JSONL'}`);
     runScheduledPrune();
@@ -1249,4 +1267,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { app, isAuthConfigured, resolveEnvPathFromArgv, resolveTrustProxy, configure };
+module.exports = { app, isAuthConfigured, resolveEnvPathFromArgv, resolveTrustProxy, configure, ipv6SafeKeyGenerator };

package/streaming.js

@@ -17,7 +17,7 @@
 // cache_type) beyond real OpenAI's wire format - the same deviation the
 // non-streaming JSON response already makes. This proxy is
 // OpenAI-COMPATIBLE in request/response SHAPE, not a byte-for-byte
-// clone of OpenAI's actual API; MemoCode's own callers need the cost
+// clone of OpenAI's actual API; this proxy's own callers need the cost
 // data, and no spec-compliant client chokes on unknown extra JSON
 // fields it doesn't look for.