ldrouter 1.7.0 → 1.10.1

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.10.1] - 2026-09-01
+
+### Fixed
+
+- **Restore now reloads the database hot — no gateway restart needed**: `POST /api/admin/backup/restore` closes the in-process SQLite connection, swaps the file, reopens it in the same process, validates schema, and re-seeds the admin session — the admin stays logged in and sees the restored data immediately. Previously the admin had to restart the gateway after every restore.
+- **Restore no longer loses data on restart**: the restore previously renamed over `data.sqlite` while the app's stale `-wal`/`-shm` sidecars were left behind; on restart SQLite could replay the old WAL over the restored snapshot, making the gateway appear empty (setup screen). The restore now fully closes the old connection before swapping, so the stale sidecars never survive.
+- **Automatic rollback**: if the reopened restored database fails validation (e.g. schema mismatch), the gateway automatically rolls back to the pre-restore snapshot instead of staying broken.
+- **Restore snapshot leak closed**: the pre-restore snapshot connection is now always closed.
+
+### Changed
+
+- Settings → Backup & restore now auto-reloads the admin UI after a successful restore (restore toast: "Restored. Reloading…").
+
+## [1.10.0] - 2026-09-01
+
+### Added
+
+- **Real streaming model test**: clicking Test on a model now streams the upstream response token-by-token into the test dialog (`POST /api/admin/models/:id/test-stream` SSE endpoint, newline-delimited). Previously the dialog waited ~1s with no feedback before showing a static result; now content appears live as the model generates, with a blinking cursor, live TTFT/elapsed counter, and a final `test_meta` event with full latency/token/attempt stats. The old non-streaming `POST .../test` endpoint remains for backwards compatibility.
+
+### Fixed
+
+- **Test dialog no loading state**: the model test modal previously opened instantly but showed nothing for the ~1s the request took, looking like a hang. It now shows an immediate streaming view with progress as soon as the modal opens.
+
+## [1.9.1] - 2026-09-01
+
+### Fixed
+
+- **Request-content logging now visible**: Settings → Logging "Request-content logging" was saving payloads to the database (`prompt` / `prompt_and_response` modes) but the admin UI never displayed them, making the setting appear broken. The request detail dialog on `/requests` now shows "Request content" and "Response content" sections (sanitized, scrollable) whenever payloads were logged. Added integration test covering all four `contentLogMode` values end-to-end.
+
+## [1.9.0] - 2026-09-01
+
+### Added
+
+- **Realtime monitoring dashboard (/statistics)**: redesigned into a production-grade overview — summary cards now show icons, animated count-up, % delta vs previous period, and mini sparklines; a live **request routing flow** diagram (Incoming Traffic → AI Gateway → Providers with curved paths and animated pulse dots on each active route); a **Recent Requests** table with green/red status dots and time-ago labels; bottom metrics with circular Success Rate progress and Average Latency sparkline. All driven by the existing SSE stream (no new dependencies, CSS/SVG-native animations).
+- **Stats API extensions**: `GET /api/admin/stats` now returns `previous` (same-window comparison for deltas), `recent` (last 10 requests with provider info), `providers` (traffic/error-rate/latency/health per provider), and per-bucket `avgLatency`/`cacheRead` in `series`; `RequestLogSummary` gained `providerId`/`providerName`.
+
+
+
+### Added
+
+- **Notification toggles in Settings**: request notification cards and the notification sound can each be turned on/off in Settings → System ("Notifications" card); preferences persist server-side (`app_settings`) and apply immediately across the whole admin UI.
+- **Real-time /requests page**: the Requests log now subscribes to the SSE stream — new requests appear in the table live (page 1, honoring active filters) plus a "N new requests — refresh" badge, no manual page refresh needed.
+
+### Fixed
+
+- **Setup redirect (permanent fix)**: after creating the admin account the app now hard-reloads to `/login` instead of soft-navigating. Root cause: `SetupGate` cached `setupComplete=false` on mount and re-bounced every post-setup route back to `/setup`; a full reload clears the stale state.
+
 ## [1.7.0] - 2026-08-31
 
 ### Added

package/dist/server/db/migrate.js

@@ -87,6 +87,8 @@ function buildInitialSchemaSql() {
       gateway_cache_max_size_mb INTEGER NOT NULL DEFAULT 256,
       master_key_version INTEGER NOT NULL DEFAULT 1,
       master_key_configured INTEGER NOT NULL DEFAULT 0,
+      notifications_enabled INTEGER NOT NULL DEFAULT 1,
+      notification_sound_enabled INTEGER NOT NULL DEFAULT 1,
       updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
     );
 

package/dist/server/db/repositories/settings.js

@@ -17,6 +17,8 @@ function rowToSettings(row) {
         gatewayCacheMaxSizeMb: row.gatewayCacheMaxSizeMb,
         masterKeyConfigured: row.masterKeyConfigured,
         masterKeyVersion: row.masterKeyVersion,
+        notificationsEnabled: row.notificationsEnabled,
+        notificationSoundEnabled: row.notificationSoundEnabled,
     };
 }
 export function getSettings() {
@@ -55,6 +57,10 @@ export function updateSettings(patch) {
         update.gatewayCacheMaxSizeMb = patch.gatewayCacheMaxSizeMb;
     if (patch.masterKeyConfigured !== undefined)
         update.masterKeyConfigured = patch.masterKeyConfigured;
+    if (patch.notificationsEnabled !== undefined)
+        update.notificationsEnabled = patch.notificationsEnabled;
+    if (patch.notificationSoundEnabled !== undefined)
+        update.notificationSoundEnabled = patch.notificationSoundEnabled;
     db.update(schema.appSettings).set(update).where(eq(schema.appSettings.id, 1)).run();
     return getSettings();
 }

package/dist/server/db/schema.js

@@ -19,6 +19,9 @@ export const appSettings = sqliteTable('app_settings', {
     gatewayCacheMaxSizeMb: integer('gateway_cache_max_size_mb').notNull().default(256),
     masterKeyVersion: integer('master_key_version').notNull().default(1),
     masterKeyConfigured: integer('master_key_configured', { mode: 'boolean' }).notNull().notNull().default(false),
+    // Admin UI notification preferences (v1.8.0). Default true: notifications on, sound on.
+    notificationsEnabled: integer('notifications_enabled', { mode: 'boolean' }).notNull().default(true),
+    notificationSoundEnabled: integer('notification_sound_enabled', { mode: 'boolean' }).notNull().default(true),
     updatedAt: text('updated_at').notNull().default(sql `(strftime('%Y-%m-%dT%H:%M:%fZ','now'))`),
 });
 // ============================================================================

package/dist/server/routes/admin/backup.js

@@ -3,14 +3,54 @@ import fs from 'node:fs';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import crypto from 'node:crypto';
-import { getDb } from '../../db/index.js';
+import { getDb, closeDb, openDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
+import { sha256Hex } from '../../auth/ids.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { loadConfig } from '../../config/index.js';
 import { getSettings } from '../../db/repositories/settings.js';
 import { GatewayError } from '../../errors.js';
 import { getAppVersion } from '../../version.js';
+import { eq, sql } from 'drizzle-orm';
 const BACKUP_VERSION = 1;
+/** Reopen the in-process SQLite connection on the (possibly just-replaced)
+ *  database file. The old connection must already be closed: a hot restore
+ *  swaps the file on disk, then the gateway keeps serving from the new data
+ *  without a restart. Schema migrations and the app_settings bootstrap run
+ *  automatically on open. */
+function reopenDatabase(dbFile) {
+    const dir = path.dirname(dbFile);
+    const base = path.basename(dbFile);
+    // When the WAL is in non-persistent mode, SQLite keeps `data.sqlite-wal`
+    // and `data.sqlite-shm` next to the DB. After we replace the DB file the
+    // OLD wal/shm describe the PREVIOUS database — replaying them would
+    // resurrect the old data over the restored snapshot (the gateway looked
+    // like "nothing was restored"). They are safe to delete: the old
+    // connection is closed (wal fully checkpointed) and the restored backup is
+    // a consistent standalone snapshot.
+    for (const suffix of ['-wal', '-shm']) {
+        const stale = path.join(dir, `${base}${suffix}`);
+        try {
+            if (fs.existsSync(stale))
+                fs.unlinkSync(stale);
+        }
+        catch {
+            /* ignore: unlink failure is not fatal, next restart would retry */
+        }
+    }
+    openDb(dbFile);
+}
+/** Verify the current database (as restored) is consistent: matches the
+ *  schema version we expect and has the bootstrap app_settings row. */
+function assertDatabaseUsable(expectedSchemaVersion) {
+    const db = getDb();
+    const row = db.select().from(schema.appSettings).where(eq(schema.appSettings.id, 1)).get();
+    if (!row)
+        throw new Error('restored database is missing the app_settings bootstrap row');
+    if (row.schemaVersion !== expectedSchemaVersion) {
+        throw new Error(`restored database schema version mismatch: expected ${expectedSchemaVersion}, got ${row.schemaVersion}`);
+    }
+}
 export async function registerBackupRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.post('/api/admin/backup/create', async (req, reply) => {
@@ -82,21 +122,27 @@ export async function registerBackupRoutes(app) {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'not_sqlite' } });
             throw new GatewayError('invalid_request_error', 'Backup does not contain a valid SQLite database', { status: 400 });
         }
-        // Snapshot current DB before restore
-        const db = getDb();
-        void db;
+        const liveDb = cfg.dbFile;
+        // Snapshot current DB before restore (kept for manual rollback).
         const snapshot = path.join(cfg.dataDir, `pre-restore-${Date.now()}.sqlite`);
         const Database = (await import('better-sqlite3')).default;
-        const live = new Database(cfg.dbFile);
+        const live = new Database(liveDb);
         try {
             await live.backup(snapshot);
         }
         catch (e) {
+            live.close();
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'snapshot_failed', err: String(e) } });
             throw new GatewayError('gateway_error', 'Could not snapshot current database', { status: 500 });
         }
-        // Atomic replace
-        const liveDb = cfg.dbFile;
+        live.close();
+        // Close the in-process connection before swapping the file. The gateway
+        // keeps serving (no restart) but the file must be free: on Windows a
+        // rename fails while a handle is open. Reopening runs migrations + the
+        // app_settings bootstrap automatically.
+        getDb();
+        closeDb();
+        // Atomic replace.
         const tempDb = `${liveDb}.restore-${Date.now()}`;
         fs.writeFileSync(tempDb, buf);
         try {
@@ -107,7 +153,65 @@ export async function registerBackupRoutes(app) {
             recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'rename_failed', err: String(e) } });
             throw new GatewayError('gateway_error', 'Restore atomic replace failed', { status: 500 });
         }
+        // Hot-reload the database in-process: reopen the replaced file, validate
+        // it, and keep serving. No gateway restart needed.
+        try {
+            reopenDatabase(liveDb);
+            assertDatabaseUsable(envelope.schemaVersion);
+        }
+        catch (e) {
+            // Roll back to the snapshot taken before the restore so the gateway
+            // never stays on a broken database.
+            try {
+                closeDb();
+            }
+            catch { /* ignore */ }
+            try {
+                for (const suffix of ['-wal', '-shm']) {
+                    const stale = path.join(path.dirname(liveDb), `${path.basename(liveDb)}${suffix}`);
+                    if (fs.existsSync(stale))
+                        fs.unlinkSync(stale);
+                }
+                fs.copyFileSync(snapshot, liveDb);
+                openDb(liveDb);
+            }
+            catch (rollbackErr) {
+                const err = e.message;
+                const rerr = rollbackErr.message;
+                recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'rollback_failed', err, rollbackErr: rerr } });
+                throw new GatewayError('gateway_error', `Restore failed (${err}) and automatic rollback also failed (${rerr}). Please restart the gateway.`, { status: 500 });
+            }
+            recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'validation_failed', err: e.message } });
+            throw new GatewayError('gateway_error', `Restore failed: ${e.message}`, { status: 500 });
+        }
+        // The swap invalidates the previous admin session (its row lived in the
+        // old database). Re-create the current session in the restored database so
+        // the admin stays logged in across the hot restore.
+        const sessionToken = req.cookies['ld_session'];
+        const sessionId = req.adminSessionId;
+        if (sessionId && sessionToken) {
+            const db = getDb();
+            const expiresAt = new Date(Date.now() + 12 * 3600 * 1000).toISOString();
+            db.delete(schema.adminSessions).where(sql `id = ${sessionId}`).run();
+            db.insert(schema.adminSessions).values({
+                id: sessionId,
+                tokenDigest: sha256Hex(sessionToken),
+                expiresAt,
+                lastSeenAt: new Date().toISOString(),
+                ip: req.ip,
+            }).run();
+            // Re-seed the CSRF token that was bound to the old session.
+            const csrfRow = db.select().from(schema.csrfTokens).where(eq(schema.csrfTokens.sessionId, sessionId)).get();
+            if (!csrfRow) {
+                db.insert(schema.csrfTokens).values({
+                    id: crypto.randomUUID(),
+                    sessionId,
+                    token: crypto.randomBytes(32).toString('base64url'),
+                    expiresAt,
+                }).run();
+            }
+        }
         recordAudit({ action: 'db.restore', success: true, ip: req.ip, metadata: { schemaVersion: envelope.schemaVersion } });
-        return reply.code(200).send({ ok: true, message: 'Restore completed. Please restart the gateway for changes to take effect.' });
+        return reply.code(200).send({ ok: true, message: 'Database restored. The gateway continues running with the restored data — no restart needed.' });
     });
 }

package/dist/server/routes/admin/models.js

@@ -167,7 +167,97 @@ export async function registerModelRoutes(app) {
         recordAudit({ action: 'model.delete', success: true, targetType: 'model', targetId: id, targetName: m.publicModelId, ip: req.ip });
         return { ok: true };
     });
-    // Test endpoint: send a real request through the gateway pipeline to verify the model works
+    // Streaming test endpoint: streams SSE tokens to the client in real time.
+    app.post('/api/admin/models/:id/test-stream', async (req, reply) => {
+        const { id } = req.params;
+        const db = getDb();
+        const m = db.select().from(schema.models).where(eq(schema.models.id, id)).get();
+        if (!m)
+            throw new GatewayError('invalid_request_error', 'Model not found', { status: 404 });
+        if (!m.enabled)
+            throw new GatewayError('invalid_request_error', 'Model is disabled', { status: 400 });
+        if (!m.upstreamAvailable)
+            throw new GatewayError('invalid_request_error', 'Model is not available upstream', { status: 400 });
+        const provider = db.select().from(schema.providers).where(eq(schema.providers.id, m.providerId)).get();
+        if (!provider || !provider.enabled)
+            throw new GatewayError('invalid_request_error', 'Provider is disabled', { status: 400 });
+        // Hijack reply so runner streams SSE directly to the client.
+        reply.hijack();
+        const res = reply.raw;
+        const SSE_HEADERS = {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache',
+            Connection: 'keep-alive',
+        };
+        let headWritten = false;
+        const writeHeadOnce = () => {
+            if (headWritten)
+                return;
+            headWritten = true;
+            res.writeHead(200, SSE_HEADERS);
+        };
+        const send = (event, data) => {
+            writeHeadOnce();
+            res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+        };
+        // The runner calls reply.raw.end() as soon as the upstream completes.
+        // Defer that so we can append our own test_meta event before the
+        // real end(). Writes are forwarded live, so tokens still stream.
+        const fakeRaw = {
+            writeHead: () => writeHeadOnce(),
+            write: (chunk) => res.write(chunk),
+            end: () => { },
+        };
+        const { GatewayRunner } = await import('../../gateway/runner.js');
+        const runner = new GatewayRunner();
+        const canonicalReq = {
+            model: m.publicModelId,
+            messages: [{ role: 'user', content: [{ type: 'text', text: 'Bạn là model gì?' }] }],
+            stream: true,
+            maxOutputTokens: 256,
+            temperature: 0.7,
+        };
+        const requestId = `test-${uuid()}`;
+        const ctx = {
+            requestId,
+            clientIp: req.ip,
+            protocol: 'openai',
+            endpoint: 'chat/completions',
+            requestedModel: m.publicModelId,
+            key: null,
+            reply: { raw: fakeRaw },
+        };
+        const gatewayReq = {
+            canonical: canonicalReq,
+            protocol: 'openai',
+            endpoint: 'chat/completions',
+        };
+        try {
+            const outcome = await runner.execute(gatewayReq, ctx);
+            // Runner already wrote [DONE]. Append our own test_meta event so the
+            // client knows the test finished with full stats.
+            send('test_meta', {
+                success: outcome.success,
+                latencyMs: outcome.latencyMs,
+                ttftMs: outcome.ttftMs ?? null,
+                usage: outcome.usage,
+                attempts: outcome.attempts.map((a) => ({
+                    providerName: a.providerName,
+                    modelId: a.modelId,
+                    latencyMs: a.latencyMs,
+                    success: a.success,
+                    failureReason: a.failureReason,
+                })),
+            });
+        }
+        catch (e) {
+            send('test_error', { message: e.message });
+        }
+        finally {
+            res.end();
+        }
+    });
+    // Non-streaming test endpoint (kept for backwards compatibility)
     app.post('/api/admin/models/:id/test', async (req) => {
         const { id } = req.params;
         const db = getDb();

package/dist/server/routes/admin/requests.js

@@ -4,10 +4,23 @@ import { getDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
 import { redactJsonString } from '../../security/redact.js';
 import { onRequestLogged, offRequestLogged } from '../../gateway/events.js';
-// Shared row → API summary mapping (used by the list endpoint and the SSE stream).
-function toSummary(r, keyMap, modelMap) {
+export function loadSummaryMaps() {
+    const db = getDb();
+    const keys = db.select().from(schema.apiKeys).all();
+    const models = db.select().from(schema.models).all();
+    const providers = db.select().from(schema.providers).all();
+    return {
+        keyMap: new Map(keys.map((k) => [k.id, k])),
+        modelMap: new Map(models.map((m) => [m.id, m])),
+        providerMap: new Map(providers.map((p) => [p.id, p])),
+    };
+}
+// Shared row → API summary mapping (used by the list endpoint, the SSE stream, and stats).
+export function toSummary(r, maps) {
+    const { keyMap, modelMap, providerMap } = maps;
     const key = r.apiKeyId ? keyMap.get(r.apiKeyId) : null;
     const finalModel = r.finalModelId ? modelMap.get(r.finalModelId) : null;
+    const provider = finalModel?.providerId ? providerMap.get(finalModel.providerId) : null;
     return {
         id: r.id,
         createdAt: r.createdAt,
@@ -20,6 +33,8 @@ function toSummary(r, keyMap, modelMap) {
         requestedModel: r.requestedModel,
         resolvedTargetKind: r.resolvedTargetKind,
         finalModelPublicId: finalModel?.publicModelId ?? null,
+        providerId: provider ? finalModel.providerId : null,
+        providerName: provider?.name ?? null,
         streaming: Boolean(r.streaming),
         httpStatus: r.httpStatus,
         success: Boolean(r.success),
@@ -72,13 +87,10 @@ export async function registerRequestRoutes(app) {
         const whereExpr = conds.length ? and(...conds) : undefined;
         const rows = db.select().from(schema.requests).where(whereExpr).orderBy(desc(schema.requests.createdAt)).limit(limit).offset(offset).all();
         const totalRow = db.select({ c: sql `COUNT(*)` }).from(schema.requests).where(whereExpr).get();
-        const keys = db.select().from(schema.apiKeys).all();
-        const keyMap = new Map(keys.map((k) => [k.id, k]));
-        const models = db.select().from(schema.models).all();
-        const modelMap = new Map(models.map((m) => [m.id, m]));
+        const maps = loadSummaryMaps();
         return {
             total: totalRow?.c ?? 0,
-            requests: rows.map((r) => toSummary(r, keyMap, modelMap)),
+            requests: rows.map((r) => toSummary(r, maps)),
         };
     });
     // SSE stream of request completions (client reconnects with `since` of its last seen event).
@@ -107,10 +119,7 @@ export async function registerRequestRoutes(app) {
             }
         };
         const db = getDb();
-        const keys = db.select().from(schema.apiKeys).all();
-        const keyMap = new Map(keys.map((k) => [k.id, k]));
-        const models = db.select().from(schema.models).all();
-        const modelMap = new Map(models.map((m) => [m.id, m]));
+        const maps = loadSummaryMaps();
         // History replay: up to 20 most recent rows after `since` (oldest first so the client renders in order).
         const historyRows = db
             .select()
@@ -123,7 +132,7 @@ export async function registerRequestRoutes(app) {
         const replayIds = new Set();
         for (const r of historyRows) {
             replayIds.add(r.id);
-            send(`event: request\ndata: ${JSON.stringify(toSummary(r, keyMap, modelMap))}\n\n`);
+            send(`event: request\ndata: ${JSON.stringify(toSummary(r, maps))}\n\n`);
         }
         // Live: subscribe to the event bus.
         const handleRequestLogged = (requestId) => {
@@ -132,7 +141,7 @@ export async function registerRequestRoutes(app) {
             const row = db.select().from(schema.requests).where(eq(schema.requests.id, requestId)).get();
             if (!row)
                 return;
-            send(`event: request\ndata: ${JSON.stringify(toSummary(row, keyMap, modelMap))}\n\n`);
+            send(`event: request\ndata: ${JSON.stringify(toSummary(row, maps))}\n\n`);
         };
         onRequestLogged(handleRequestLogged);
         // Keepalive ping every 25s.

package/dist/server/routes/admin/settings.js

@@ -18,6 +18,8 @@ const UpdateBody = z.object({
     gatewayCacheEnabled: z.boolean().optional(),
     gatewayCacheDefaultTtlSeconds: z.number().int().min(1).max(86400).optional(),
     gatewayCacheMaxSizeMb: z.number().int().min(1).max(10240).optional(),
+    notificationsEnabled: z.boolean().optional(),
+    notificationSoundEnabled: z.boolean().optional(),
 });
 const PasswordChange = z.object({
     currentPassword: z.string().min(1),

package/dist/server/routes/admin/stats.js

@@ -1,7 +1,8 @@
-// Admin API: statistics (Today/7d/30d).
+// Admin API: statistics (Today/7d/30d) + routing dashboard data.
 import { and, eq, gte, lte, sql, desc } from 'drizzle-orm';
 import { getDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
+import { toSummary, loadSummaryMaps } from './requests.js';
 const PRESETS = {
     today: () => {
         const now = new Date();
@@ -96,6 +97,8 @@ export async function registerStatsRoutes(app) {
             errors: sql `SUM(CASE WHEN success=0 THEN 1 ELSE 0 END)`,
             inputTokens: sql `COALESCE(SUM(input_tokens),0)`,
             outputTokens: sql `COALESCE(SUM(output_tokens),0)`,
+            avgLatency: sql `COALESCE(AVG(CASE WHEN success=1 THEN total_latency_ms END),0)`,
+            cacheRead: sql `COALESCE(SUM(cache_read_tokens),0)`,
         })
             .from(schema.requests)
             .where(and(...conds))
@@ -134,24 +137,66 @@ export async function registerStatsRoutes(app) {
             .all();
         const keys = db.select().from(schema.apiKeys).all();
         const keyMap = new Map(keys.map((k) => [k.id, k]));
-        const topProviders = db
+        // ─── Previous period (for delta badges in summary cards) ───────────────
+        const durationMs = to.getTime() - from.getTime();
+        const prevFrom = new Date(from.getTime() - durationMs).toISOString();
+        const prevTo = from.toISOString();
+        const previousSummary = buildSummary(db, prevFrom, prevTo);
+        // ─── Recent requests (last 10, full RequestLogSummary) ─────────────────
+        const maps = loadSummaryMaps();
+        const recentRows = db
+            .select()
+            .from(schema.requests)
+            .orderBy(desc(schema.requests.createdAt))
+            .limit(10)
+            .all();
+        const recent = recentRows.map((r) => toSummary(r, maps));
+        // ─── Providers: traffic + latency + health for routing-flow diagram ────
+        const providerAggs = db
             .select({
             providerId: schema.requestAttempts.providerId,
-            c: sql `COUNT(*)`,
+            total: sql `COUNT(*)`,
             err: sql `SUM(CASE WHEN success=0 THEN 1 ELSE 0 END)`,
+            avgLat: sql `COALESCE(AVG(CASE WHEN success=1 THEN latency_ms END),0)`,
         })
             .from(schema.requestAttempts)
             .where(and(gte(schema.requestAttempts.startedAt, fromIso), lte(schema.requestAttempts.startedAt, toIso)))
             .groupBy(schema.requestAttempts.providerId)
-            .orderBy(desc(sql `COUNT(*)`))
             .all();
-        const providers = db.select().from(schema.providers).all();
-        const providerMap = new Map(providers.map((p) => [p.id, p]));
+        const allProviders = db.select().from(schema.providers).all();
+        const providerLookup = new Map(allProviders.map((p) => [p.id, p]));
+        const modelCounts = db
+            .select({ providerId: schema.models.providerId, c: sql `COUNT(*)` })
+            .from(schema.models)
+            .groupBy(schema.models.providerId)
+            .all();
+        const countMap = new Map(modelCounts.map((r) => [r.providerId, Number(r.c)]));
+        const providers = providerAggs
+            .map((r) => {
+            const p = providerLookup.get(r.providerId);
+            if (!p)
+                return null;
+            const total = Number(r.total);
+            return {
+                id: r.providerId,
+                name: p.name,
+                slug: p.slug,
+                health: p.healthState,
+                enabled: p.enabled,
+                modelCount: countMap.get(r.providerId) ?? 0,
+                requests: total,
+                errorRate: total > 0 ? Number(r.err) / total : 0,
+                avgLatencyMs: Number(r.avgLat),
+            };
+        })
+            .filter((x) => x !== null)
+            .sort((a, b) => b.requests - a.requests);
         const range = { from: fromIso, to: toIso, bucket };
         return {
             range,
             summary: statsSummary,
-            series: seriesRows.map((r) => ({ t: r.t, requests: Number(r.requests), errors: Number(r.errors), inputTokens: Number(r.inputTokens), outputTokens: Number(r.outputTokens) })),
+            previous: previousSummary,
+            series: seriesRows.map((r) => ({ t: r.t, requests: Number(r.requests), errors: Number(r.errors), inputTokens: Number(r.inputTokens), outputTokens: Number(r.outputTokens), avgLatency: Number(r.avgLatency ?? 0), cacheRead: Number(r.cacheRead ?? 0) })),
             topModels: topModels.map((r) => ({
                 publicId: r.modelId ? modelMap.get(r.modelId)?.publicModelId ?? r.modelId : 'unknown',
                 requests: Number(r.c),
@@ -163,15 +208,59 @@ export async function registerStatsRoutes(app) {
                 requests: Number(r.c),
                 totalTokens: Number(r.tokens),
             })),
-            topProviders: topProviders.map((r) => ({
-                name: providerMap.get(r.providerId)?.name ?? r.providerId,
-                slug: providerMap.get(r.providerId)?.slug ?? '',
-                requests: Number(r.c),
-                errorRate: Number(r.c) > 0 ? Number(r.err) / Number(r.c) : 0,
-            })),
+            recent,
+            providers,
         };
     });
 }
+/**
+ * Fast summary (no percentiles / TTFT — used for previous window and live
+ * incremental aggregation). Returns counts sufficient to derive ratios.
+ */
+function buildSummary(db, fromIso, toIso) {
+    const conds = [gte(schema.requests.createdAt, fromIso), lte(schema.requests.createdAt, toIso)];
+    const r = db
+        .select({
+        total: sql `COUNT(*)`,
+        success: sql `SUM(CASE WHEN success=1 THEN 1 ELSE 0 END)`,
+        failed: sql `SUM(CASE WHEN success=0 THEN 1 ELSE 0 END)`,
+        inputTokens: sql `COALESCE(SUM(input_tokens),0)`,
+        outputTokens: sql `COALESCE(SUM(output_tokens),0)`,
+        cacheRead: sql `COALESCE(SUM(cache_read_tokens),0)`,
+        cacheWrite: sql `COALESCE(SUM(cache_write_tokens),0)`,
+        reasoning: sql `COALESCE(SUM(reasoning_tokens),0)`,
+        avgLatency: sql `COALESCE(AVG(CASE WHEN success=1 THEN total_latency_ms END),0)`,
+        avgTtft: sql `AVG(CASE WHEN success=1 AND ttft_ms IS NOT NULL THEN ttft_ms END)`,
+        gatewayCacheHits: sql `SUM(CASE WHEN gateway_cache_hit=1 THEN 1 ELSE 0 END)`,
+        fallbacks: sql `SUM(CASE WHEN attempts_count > 1 THEN 1 ELSE 0 END)`,
+    })
+        .from(schema.requests)
+        .where(and(...conds))
+        .get();
+    const total = Number(r?.total ?? 0);
+    const success = Number(r?.success ?? 0);
+    const cacheRead = Number(r?.cacheRead ?? 0);
+    const inputTokens = Number(r?.inputTokens ?? 0);
+    return {
+        totalRequests: total,
+        successfulRequests: success,
+        failedRequests: Number(r?.failed ?? 0),
+        successRate: total ? success / total : 0,
+        inputTokens,
+        outputTokens: Number(r?.outputTokens ?? 0),
+        totalTokens: inputTokens + Number(r?.outputTokens ?? 0),
+        cacheReadTokens: cacheRead,
+        cacheWriteTokens: Number(r?.cacheWrite ?? 0),
+        reasoningTokens: Number(r?.reasoning ?? 0),
+        averageLatencyMs: Number(r?.avgLatency ?? 0),
+        p95LatencyMs: 0, // caller fills via percentile query
+        averageTtftMs: (r?.avgTtft ?? null),
+        p95TtftMs: null,
+        cacheHitRate: success ? cacheRead > 0 ? cacheRead / Math.max(1, inputTokens + cacheRead) : 0 : 0,
+        gatewayCacheHitRate: total ? Number(r?.gatewayCacheHits ?? 0) / total : 0,
+        fallbackRate: total ? Number(r?.fallbacks ?? 0) / total : 0,
+    };
+}
 function percentile(sorted, p) {
     if (sorted.length === 0)
         return 0;