Repository navigation
Closes the last two follow-ups from the v1.8.1 audit.
/api/chat rate limit (real, not a stub)
Before this release the route returned hard-coded `X-RateLimit-Limit: 60` / `X-RateLimit-Remaining: 59` on every success — no enforcement at all. If a signed session cookie leaks, downstream LLM spend has no server-side cap.
Now: in-memory token bucket keyed by the verified session value.
- Default capacity 60, refill 1 token/second (60 req/min steady state, 60-request burst).
- On exhaustion: `429 RATE_LIMITED` with `Retry-After`, real `X-RateLimit-Limit` / `X-RateLimit-Remaining: 0`.
- On success: response headers report actual remaining tokens.
- `src/lib/rate-limit.ts` + `src/lib/rate-limit.test.ts` (5 unit tests) + new 429 case in `route.test.ts`.
Scale caveat: state is per-process. Fine for single-region Vercel / single self-hosted instance. For horizontally scaled deploys, swap the `buckets` Map for an Upstash / Redis store behind the same interface — the callsite in `route.ts` does not change.
@convergio/core publish guidance
`packages/core/AGENTS.md` now explicitly warns that the package re-exports via `../../src/*` relative paths and would 404 from an npm tarball. Sketches the minimum viable publish flow (prepack bundling + `files` field + `pnpm pack` smoke test) for whenever we do decide to publish standalone. Until then, treat as in-monorepo only.
Verification
- `pnpm typecheck` / `pnpm lint` / `pnpm test` 135 / 135 / `pnpm build` all clean
- CI green: Lint & Typecheck, Build & Unit Tests, E2E Tests
Audit close-out
This release is the final one from the post-v1.8.0 audit sweep. All eight follow-ups are shipped:
| # | Item | Release |
|---|---|---|
| 1 | Stabilise smoke E2E, remove `continue-on-error` | v1.8.2 |
| 2 | Verify SESSION_SECRET prod guard end-to-end | v1.8.1 (confirmed live) |
| 3 | Lazy-load MnBrain3D / three.js | v1.8.3 |
| 4 | `skipLibCheck: false` | v1.8.5 |
| 5 | `packages/core` monorepo caveat | v1.8.6 |
| 6 | Coverage ratchet + 20 smoke tests | v1.8.4 |
| 7 | `.convergio/config.toml` alignment | v1.8.1 |
| 8 | /api/chat rate limit | v1.8.6 |