chore(release): v3.9.0 — alignment constitution + usage endpoint restoration (#26)

Minor version bump covering substantive functional + governance changes
since v3.8.0:

Functional
  - Restore header-based /usage probe (reads anthropic-ratelimit-unified-*
    response headers; mirrors Claude Code cli.js vE4). Progress bars
    work again after 9-day drift. PR #21 (fd7973a) + #24 (01e260c).
  - Remove stale-cache compensation for the hallucinated endpoint. PR #23.
  - CLAUDE_CODE_OAUTH_TOKEN environment variable fallback for credentials.
  - Exponential backoff on OAuth refresh (60s -> 3600s) to prevent tight
    retry loops that previously burned rate-limit in seconds.

Governance
  - ALIGNMENT.md project constitution (five binding rules, annual audit
    pinned to 11 April, Historical Lesson recording b87992f drift).
  - CLAUDE.md session instructions requiring cli.js citations for every
    server.mjs change.
  - .github/PULL_REQUEST_TEMPLATE.md with mandatory alignment evidence.
  - .github/workflows/alignment.yml CI guardrail (hard-fail blacklist +
    soft-check commit citation).

No API / wire-format breaking changes.

Co-authored-by: Oracle Public Cloud User <opc@instance-20230820-1333.subnet07301351.vcn07301351.oraclevcn.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,40 @@
+# Pull Request
+
+## Summary
+
+<!-- One or two sentences describing the change and why it is in scope for OCP. -->
+
+## Claude Code Alignment Evidence (REQUIRED)
+
+Per `ALIGNMENT.md`, every PR that touches `server.mjs` or any network-facing surface must fill out this section. PRs with this section blank or unchecked will receive a `request changes` review and cannot be merged.
+
+- [ ] **Corresponding `cli.js` reference.** I have identified the `cli.js` function and line range that performs the operation this PR forwards. Citation (format `cli.js:NNNN` or `cli.js vE4 <functionName>`):
+  <!-- e.g. cli.js:18423-18467 (function: sendUserMessage)  -->
+
+- [ ] **If `cli.js` does not perform this operation**, I have stated this explicitly below and justified the scope under `ALIGNMENT.md` Rule 2. (Note: in almost all cases this means the PR should be closed, not merged. Proxy layers do not invent endpoints.)
+  <!-- Justification, if applicable. Empty is fine when cli.js does perform the operation. -->
+
+- [ ] **Commit message citations.** Every "Claude Code uses X" or "cli.js uses X" assertion in every commit of this PR is immediately followed by a `cli.js:NNNN` or `cli.js vE4 <functionName>` citation. I have verified this by rereading each commit message.
+
+## Type of change
+
+- [ ] Bug fix (alignment with existing `cli.js` behavior)
+- [ ] Feature (new `cli.js` behavior now surfaced through OCP)
+- [ ] Refactor (no wire-level behavior change)
+- [ ] Deletion (unalignable feature removal per `ALIGNMENT.md` Unalignable Policy)
+- [ ] Documentation / governance
+
+## Reviewer checklist
+
+Reviewers: this section is for you, not the author. Do not approve until every box is checked.
+
+- [ ] I opened `cli.js` at the cited line range and confirmed the operation matches.
+- [ ] I ran (or confirmed CI ran) `.github/workflows/alignment.yml` and it passed.
+- [ ] I am not the commit author of any commit in this PR (Iron Rule 10).
+- [ ] If the PR asserts scope without a `cli.js` citation, I confirmed the justification is sound per `ALIGNMENT.md` Rule 2.
+
+## Related
+
+- `ALIGNMENT.md` Rule(s) invoked: <!-- e.g. Rule 3 -->
+- Related issue / prior PR: <!-- #NNN -->
+- Historical lesson reference (if relevant): <!-- e.g. 2026-04-11 drift, b87992f -->

.github/workflows/alignment.yml

@@ -0,0 +1,123 @@
+name: Alignment Guardrail
+
+on:
+  pull_request:
+    paths:
+      - 'server.mjs'
+      - '.github/workflows/alignment.yml'
+
+jobs:
+  blacklist:
+    name: server.mjs blacklist (hard fail)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Scan server.mjs for hallucinated tokens
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ ! -f server.mjs ]; then
+            echo "server.mjs not found; nothing to scan."
+            exit 0
+          fi
+
+          # Known-hallucinated tokens. Extend only via an ALIGNMENT.md amendment PR.
+          # Each token is matched as a fixed string against server.mjs only.
+          BLACKLIST=(
+            "api.anthropic.com/api/oauth/usage"
+          )
+
+          FAIL=0
+          for token in "${BLACKLIST[@]}"; do
+            if sed "s|//.*\$||" server.mjs | grep -n -F "$token"; then
+              echo "::error file=server.mjs::Blacklisted token '$token' detected in server.mjs."
+              FAIL=1
+            fi
+          done
+
+          if [ "$FAIL" -ne 0 ]; then
+            cat <<'EOF'
+
+          ============================================================
+          ALIGNMENT GUARDRAIL FAILURE
+          ============================================================
+          server.mjs contains a token on the OCP alignment blacklist.
+
+          These tokens were introduced by LLM hallucinations and do
+          not appear in cli.js at any shipped Claude Code version.
+          See ALIGNMENT.md -> "Historical Lesson: The 2026-04-11 Drift"
+          (commit b87992f) for the full incident record.
+
+          Required action:
+            1. Remove the token from server.mjs.
+            2. grep the reference cli.js for the operation you
+               intended and cite the real line numbers.
+            3. See ALIGNMENT.md Rules 1, 2, and 5.
+
+          Do not add allowlist entries to this workflow without an
+          amendment PR to ALIGNMENT.md (see Amendment Procedure).
+          ============================================================
+          EOF
+            exit 1
+          fi
+
+          echo "Blacklist scan clean."
+
+  commit-citation:
+    name: commit message citation (soft check)
+    runs-on: ubuntu-latest
+    # Soft check: reports a warning but does not block merge. Reviewers
+    # are expected to enforce per CLAUDE.md. Escalate to hard-fail via
+    # an ALIGNMENT.md amendment if drift recurs.
+    continue-on-error: true
+    steps:
+      - name: Checkout full history
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Scan PR commits for uncited assertions
+        shell: bash
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${BASE_SHA:-}" ] || [ -z "${HEAD_SHA:-}" ]; then
+            echo "No PR context; skipping."
+            exit 0
+          fi
+
+          # Collect commit messages in range.
+          MSGS="$(git log --format=%B "${BASE_SHA}..${HEAD_SHA}")"
+
+          # Look for assertions of the form "Claude Code uses ..." or
+          # "cli.js uses ..." (case-insensitive). For each hit, require
+          # a citation in the same commit message in one of the forms:
+          #   cli.js:NNNN         (line-number citation)
+          #   cli.js vE4 <name>   (version + function-name citation)
+          # Absence of a citation is a soft finding.
+
+          WARN=0
+          # Split log into per-commit blocks for precise matching.
+          git log --format="%H" "${BASE_SHA}..${HEAD_SHA}" | while read -r sha; do
+            BODY="$(git log -1 --format=%B "$sha")"
+            if echo "$BODY" | grep -E -i -q '(claude[[:space:]]+code|cli\.js)[[:space:]]+uses'; then
+              if echo "$BODY" | grep -E -q '(cli\.js:[0-9]+|cli\.js[[:space:]]+v[A-Za-z0-9]+[[:space:]]+[A-Za-z_][A-Za-z0-9_]*)'; then
+                echo "OK  $sha: assertion cited."
+              else
+                echo "::warning::Commit $sha asserts 'Claude Code uses ...' or 'cli.js uses ...' but does not cite a cli.js line number or versioned function name. See CLAUDE.md -> Commit message conventions."
+                WARN=1
+              fi
+            fi
+          done
+
+          if [ "$WARN" -ne 0 ]; then
+            echo "Soft check raised warnings. Reviewer: please enforce per CLAUDE.md."
+          else
+            echo "Commit citation soft check clean."
+          fi

ALIGNMENT.md

@@ -0,0 +1,91 @@
+# OCP Alignment Constitution
+
+**Status:** Active. This document is the supreme source of truth for OCP scope decisions. Conflicts with other documents (README, issues, prior commit messages) resolve in favor of this file.
+
+---
+
+## Core Principle
+
+OCP (Open Claude Proxy) is a **proxy layer** for the Claude Code CLI. It forwards, observes, and multiplexes the traffic that `cli.js` already emits. It is **not** an extension layer. If `cli.js` does not perform a given operation, or performs it differently, OCP does not invent one.
+
+---
+
+## Rules
+
+1. **Rule 1 (Grep First).** Before adding, renaming, or changing any endpoint, header, parameter, or response shape, the author must `grep` the reference `cli.js` and record the exact line numbers in the commit message and PR body. An absent grep hit is itself a finding and must be declared.
+
+2. **Rule 2 (No Invention).** OCP must not introduce endpoints, headers, request fields, or response fields that are not present in `cli.js`. Speculative "Claude Code probably uses X" statements are prohibited. If the behavior is not observable in `cli.js`, the feature is out of scope.
+
+3. **Rule 3 (Match the Implementation).** When `cli.js` does perform a given operation, OCP must match it byte-for-byte on the wire: same path, same method, same headers (including casing and ordering constraints), same body schema, same auth scheme. Deviations require an explicit, reviewed exception recorded in this file.
+
+4. **Rule 4 (Unalignable Features Are Deleted).** Any existing OCP feature that cannot be traced to a concrete `cli.js` reference is deleted. There is no "grandfathering" and no "keep it disabled." The policy is removal, not deprecation. See the Unalignable Policy section below.
+
+5. **Rule 5 (Cite Line Numbers in Commits).** Every commit that touches `server.mjs` must reference `cli.js` by line number or function name in the form `cli.js:NNNN` or `cli.js vE4 <functionName>`. Commits asserting "Claude Code uses X" without such a citation are blocked by CI and must be reverted on detection.
+
+---
+
+## Golden Reference: `cli.js`
+
+`cli.js` is the Claude Code CLI JavaScript bundle shipped inside the `@anthropic-ai/claude-code` npm package. It is the single source of truth for "what Claude Code actually does."
+
+### Canonical paths per machine
+
+| Machine / environment | Path |
+| --- | --- |
+| macOS (npm global) | `/usr/local/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
+| macOS (nvm) | `~/.nvm/versions/node/*/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
+| Linux (npm global) | `/usr/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
+| Linux (OCI opc user) | `~/.npm-global/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
+| Windows (npm global) | `%APPDATA%\npm\node_modules\@anthropic-ai\claude-code\cli.js` |
+| Raspberry Pi (nvm) | `~/.nvm/versions/node/*/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
+
+### Current audit pin
+
+- **Claude Code version under audit:** `2.1.89`
+- **`cli.js` SHA-256:** `a9950ef6407fdc750bddb673852485500387e524a99d42385cb81e7d17128e01`
+- **Audit date:** `2026-04-20`
+- **Auditor:** `Tao Deng`
+
+The audit pin is updated once per year (see Annual Alignment Audit) and whenever a drift incident forces a re-verification.
+
+---
+
+## Historical Lesson: The 2026-04-11 Drift
+
+On 2026-04-11, commit `b87992f` ("fix: use dedicated /api/oauth/usage endpoint for reliable plan data") was merged. The commit message asserted that `/api/oauth/usage` was "the dedicated usage endpoint that Claude Code CLI uses."
+
+**This assertion was false.** The string `/api/oauth/usage` does not appear in `cli.js` at any version shipped up to that date. The endpoint was fabricated by an LLM-assisted authoring pass that generalized from adjacent OAuth paths without verifying against `cli.js`. A follow-up commit `cb6c2a8` ("fallback to stale cache on usage API 429 + extend cache to 15min") compounded the error by caching the fabricated response to hide the 4xx failures.
+
+**Impact:** The `/usage` progress bar in the dashboard was broken for nine days (2026-04-11 through 2026-04-20) before the drift was isolated.
+
+**Root cause:** LLM hallucination accepted without `grep cli.js` verification, compounded by the absence of a CI blacklist and the absence of this constitution.
+
+**Fix commit:** `fd7973a` (PR #21 — restored header-based `/usage`); follow-up `01e260c` (PR #24 — OAuth Bearer header correction)
+
+**Lesson codified:** Rules 1, 2, and 5 of this document; the CI blacklist in `.github/workflows/alignment.yml`; and the PR template evidence section exist to make the 2026-04-11 drift structurally impossible to repeat.
+
+---
+
+## Unalignable Policy
+
+A feature is **unalignable** if, after a good-faith search, it cannot be mapped to a specific `cli.js` line range or function.
+
+- Unalignable features are **deleted**, not disabled, not feature-flagged, not deprecated.
+- Deletion is the default outcome of an alignment audit finding. The burden of proof is on the feature, not on the auditor.
+- A deletion PR does not require user-facing deprecation notice, because the feature was never legitimately in scope.
+- If a user workflow depended on an unalignable feature, the correct remediation is to upstream the behavior into `cli.js` or to move it out of OCP into a separate tool. OCP does not retain it.
+
+---
+
+## Annual Alignment Audit
+
+- **Date:** 11 April each year (the anniversary of the `b87992f` drift).
+- **Scope:** Diff the current `cli.js` against the pinned SHA-256 in the Golden Reference section. For every network call in `server.mjs`, re-verify that the corresponding `cli.js` reference still exists at the cited line numbers (adjust citations if line numbers shifted across Claude Code versions).
+- **Output:** A signed audit note committed to `docs/alignment-audits/YYYY-04-11.md`, updating the pin.
+- **Failure mode:** Any audit finding that cannot be reconciled triggers an immediate deletion PR per the Unalignable Policy.
+
+---
+
+## Amendment Procedure
+
+This constitution is amended only by a PR that (a) cites the evidence motivating the amendment, (b) is reviewed by an independent reviewer per CC Iron Rule 10, and (c) updates the Historical Lesson section if the amendment was driven by an incident. Amendments never retroactively legitimize previously unalignable features.

CLAUDE.md

@@ -0,0 +1,58 @@
+# OCP Project Session Instructions
+
+> **WARNING — READ BEFORE WRITING ANY CODE IN THIS REPO**
+>
+> Before touching `server.mjs` or any network-facing surface, read [`./ALIGNMENT.md`](./ALIGNMENT.md) in full. The constitution is binding. Non-compliant commits are reverted.
+
+---
+
+## Before starting any task
+
+1. Read `./ALIGNMENT.md`. Internalize the five Rules and the 2026-04-11 drift lesson.
+2. Run `/dev-start <task description>` to get a pre-flight plan that incorporates the iron rules, `SKILL_ROUTING.md`, this file, and `ALIGNMENT.md`.
+3. If the task touches `server.mjs`, locate the corresponding `cli.js` reference **before** drafting any code. No code is written ahead of the `grep cli.js` evidence.
+
+---
+
+## Hard requirements for `server.mjs` changes
+
+Every PR that modifies `server.mjs` must satisfy all three of the following. A PR missing any one of them is blocked from merge.
+
+1. **`cli.js` citation.** The commit message and PR body declare the corresponding `cli.js` function name and line number range, using the format `cli.js:NNNN` or `cli.js vE4 <functionName>`. If `cli.js` does not perform the operation, the PR must state this explicitly and justify scope under `ALIGNMENT.md` Rule 2 (in practice, this almost always means the PR should be closed).
+2. **CI blacklist pass.** The `alignment.yml` workflow must pass. The workflow greps `server.mjs` for known-hallucinated tokens (including `api/oauth/usage` and `api/usage`) and fails the build on any hit. Do not suppress the workflow. Do not add allowlist entries without an amendment PR to `ALIGNMENT.md`.
+3. **Independent reviewer (Iron Rule 10).** The implementation author may not self-approve. A separate reviewer — human or a subagent spawned with a fresh context — must read the diff, verify the `cli.js` citation by opening `cli.js` at the cited lines, and explicitly approve. A review comment that does not confirm the `cli.js` citation was checked is not a valid approval.
+
+---
+
+## Iron rules in force
+
+This repo operates under the CC Development Iron Rules (CC 开发铁律) v1.3. Three rules are load-bearing for OCP work:
+
+- **Iron Rule 10 (Code Review).** Every implementation phase has an independent reviewer. Self-review does not count. See `server.mjs` hard requirement #3 above.
+- **Iron Rule 11 (Incremental Diff Review).** Non-trivial work is split into the minimum reviewable unit — one PR per layer per severity. `ALIGNMENT.md`, `CLAUDE.md`, the PR template, and the CI workflow are therefore shipped as the same constitutional PR (they are one layer: governance), but any subsequent `server.mjs` remediation lands as its own PR.
+- **Iron Rule 12 (Pre-Brainstorm Prior-Art Search).** Before proposing any new endpoint or header, search GitHub, Anthropic docs, and the `cli.js` bundle. For OCP specifically, the `cli.js` grep is the decisive search: if it does not hit, Rule 2 of the constitution applies.
+
+The full iron rules are at `~/.claude/CC_DEV_IRON_RULES.md` (symlinked from the cc-rules repo on Tao's workstations). Load them into session context with `/cc-rules` when needed.
+
+---
+
+## Skills relevant to this repo
+
+- `/dev-start` — pre-flight planning, always first.
+- `/cc-rules` — load the iron rules into context.
+- `/agent-dispatch` — pick the correct model (opus for design and review, sonnet for straightforward edits, haiku for mechanical chores) before spawning any subagent.
+- `/cc-mem search <keyword>` — look up cross-machine memory for prior decisions, especially prior drift incidents.
+
+---
+
+## Commit message conventions
+
+- Subject line uses Conventional Commits (`fix:`, `feat:`, `docs:`, `refactor:`, `chore:`).
+- Any assertion of the form "Claude Code uses X" or "cli.js uses X" in the body must be immediately followed by a citation in the form `cli.js:NNNN` or `cli.js vE4 <functionName>`. CI performs a soft check for this pattern on all commits in the PR.
+- Co-author trailer is required for LLM-assisted commits (`Co-Authored-By: Claude <model> <noreply@anthropic.com>`).
+
+---
+
+## Project-level escalation
+
+If a design decision cannot be resolved by reference to `cli.js` and `ALIGNMENT.md`, escalate to Tao (老大) via `/cc-chat` rather than guessing. Silent guessing is what produced the 2026-04-11 drift.

README.md

@@ -1,7 +1,5 @@
 # OCP — Open Claude Proxy
 
-> **Status: Stable (v3.7.0)** — Feature-complete. Bug fixes only.
-
 > **Already paying for Claude Pro/Max? Use your subscription as an OpenAI-compatible API — $0 extra cost.**
 
 OCP turns your Claude Pro/Max subscription into a standard OpenAI-compatible API on localhost. Any tool that speaks the OpenAI protocol can use it — no separate API key, no extra billing.
@@ -141,7 +139,7 @@ OCP Connect v1.3.0
   Checking connectivity...
   ✓ Connected
 
-  Remote OCP v3.7.0  (auth: multi)
+  Remote OCP v3.9.0  (auth: multi)
 
   ⓘ Using server-advertised anonymous key: ocp_publ...n_v1
     (set by admin via PROXY_ANONYMOUS_KEY; see issue #12 §14 Path A)
@@ -197,7 +195,7 @@ OCP Connect v1.3.0
 The script automatically:
 - Writes env vars to all relevant shell rc files (`.bashrc`, `.zshrc`)
 - Sets system-level env vars (`launchctl setenv` on macOS, `environment.d` on Linux)
-- **Auto-discovers anonymous key** from `/health.anonymousKey` when no `--key` given (v1.3.0+, requires server v3.7.0+)
+- **Auto-discovers anonymous key** from `/health.anonymousKey` when no `--key` given (v1.3.0+, requires server v3.9.0+)
 - Configures OpenClaw automatically (including per-agent `auth-profiles.json` for multi-agent setups)
 - Detects Cline, Continue.dev, Cursor, and opencode, and prints setup hints (manual configuration required for these IDEs)
 
@@ -255,6 +253,46 @@ ocp start                                    # or however you start the server
 
 **Not a secret**: because `/health` is an unauthenticated endpoint, the anonymous key is **publicly readable** by anyone who can reach the server. That is intentional — the key exists so clients can self-configure without out-of-band coordination. Treat it as a convenience handle, not as an access credential.
 
+### Per-Key Quota (Budget Control)
+
+Prevent any single user from exhausting your subscription. Set daily, weekly, or monthly request limits per API key:
+
+```bash
+# Set a daily limit of 50 requests for a key
+curl -X PATCH http://127.0.0.1:3456/api/keys/wife-laptop/quota \
+  -H "Authorization: Bearer $OCP_ADMIN_KEY" \
+  -d '{"daily": 50}'
+
+# Set multiple limits at once
+curl -X PATCH http://127.0.0.1:3456/api/keys/son-ipad/quota \
+  -H "Authorization: Bearer $OCP_ADMIN_KEY" \
+  -d '{"daily": 20, "weekly": 100}'
+
+# Check current quota + usage
+curl http://127.0.0.1:3456/api/keys/wife-laptop/quota
+# → { "daily": { "limit": 50, "used": 12 }, "weekly": { "limit": null, "used": 34 }, ... }
+
+# Remove a limit (set to null)
+curl -X PATCH http://127.0.0.1:3456/api/keys/wife-laptop/quota \
+  -d '{"daily": null}'
+```
+
+When a key exceeds its quota, OCP returns HTTP 429 with a structured error:
+```json
+{
+  "error": {
+    "message": "Quota exceeded: 50/50 requests (daily). Resets 6h 12m.",
+    "type": "quota_exceeded",
+    "quota": { "period": "daily", "limit": 50, "used": 50, "resetsIn": "6h 12m" }
+  }
+}
+```
+
+- `null` = unlimited (default for all keys)
+- Only successful requests count toward quota
+- Admin and anonymous users are never subject to quotas
+- PATCH is a partial update — omitted fields are left unchanged
+
 ### Important Notes
 
 - All users share your Claude Pro/Max **rate limits** (5h session + 7d weekly)
@@ -346,6 +384,42 @@ $ ocp settings maxConcurrent 4
 ✓ maxConcurrent = 4
 ```
 
+## Response Cache
+
+OCP can cache responses to avoid redundant Claude CLI calls for identical prompts. This is useful during development when the same prompt is sent repeatedly.
+
+**Enable** by setting `CLAUDE_CACHE_TTL` (in milliseconds):
+
+```bash
+# Cache responses for 5 minutes
+export CLAUDE_CACHE_TTL=300000
+
+# Or update at runtime (no restart)
+ocp settings cacheTTL 300000
+```
+
+**How it works:**
+- Cache key = SHA-256 of `model` + `messages` + `temperature` + `max_tokens` + `top_p`
+- Cache hits return instantly — no Claude CLI process spawned
+- Works for both streaming and non-streaming requests
+- Multi-turn conversations (with `session_id`) are never cached
+- Expired entries are cleaned up automatically every 10 minutes
+
+**Management:**
+```bash
+# View cache stats
+curl http://127.0.0.1:3456/cache/stats
+# → { "entries": 42, "totalHits": 156, "sizeBytes": 284000 }
+
+# Clear all cached responses
+curl -X DELETE http://127.0.0.1:3456/cache
+
+# Disable cache at runtime
+ocp settings cacheTTL 0
+```
+
+Cache is **disabled by default** (`CLAUDE_CACHE_TTL=0`). All data is stored locally in `~/.ocp/ocp.db`.
+
 ## How It Works
 
 ```
@@ -377,7 +451,10 @@ OCP translates OpenAI-compatible `/v1/chat/completions` requests into `claude -p
 | `/dashboard` | GET | Web dashboard (always public) |
 | `/api/keys` | GET/POST | List or create API keys (admin only) |
 | `/api/keys/:id` | DELETE | Revoke an API key (admin only) |
+| `/api/keys/:id/quota` | GET/PATCH | View or set per-key quota (admin only) |
 | `/api/usage` | GET | Per-key usage stats (`?since=&until=&hours=&limit=`) |
+| `/cache/stats` | GET | Cache statistics (admin only) |
+| `/cache` | DELETE | Clear response cache (admin only) |
 
 ## OpenClaw Integration
 
@@ -456,6 +533,7 @@ ocp restart
 | `CLAUDE_MAX_CONCURRENT` | `8` | Max concurrent claude processes |
 | `CLAUDE_MAX_PROMPT_CHARS` | `150000` | Prompt truncation limit (chars) |
 | `CLAUDE_SESSION_TTL` | `3600000` | Session expiry (ms, default: 1 hour) |
+| `CLAUDE_CACHE_TTL` | `0` | Response cache TTL (ms, 0 = disabled). Set to e.g. `300000` for 5-min cache |
 | `CLAUDE_ALLOWED_TOOLS` | `Bash,Read,...,Agent` | Comma-separated tools to pre-approve |
 | `CLAUDE_SKIP_PERMISSIONS` | `false` | Bypass all permission checks |
 | `CLAUDE_NO_CONTEXT` | `false` | Suppress CLAUDE.md and auto-memory injection (pure API mode) |

keys.mjs

@@ -1,7 +1,7 @@
 // keys.mjs — API key management and usage tracking for OCP LAN mode
 // Uses Node.js built-in SQLite (node:sqlite) — zero external dependencies.
 import { DatabaseSync } from "node:sqlite";
-import { randomBytes } from "node:crypto";
+import { randomBytes, createHash } from "node:crypto";
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
 import { homedir } from "node:os";
@@ -47,7 +47,31 @@ function initSchema() {
 
     CREATE INDEX IF NOT EXISTS idx_usage_created ON usage_log(created_at);
     CREATE INDEX IF NOT EXISTS idx_usage_key ON usage_log(key_id);
+
+    CREATE TABLE IF NOT EXISTS response_cache (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      hash TEXT UNIQUE NOT NULL,
+      model TEXT NOT NULL,
+      response TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      last_hit_at TEXT,
+      hits INTEGER NOT NULL DEFAULT 0
+    );
+    CREATE INDEX IF NOT EXISTS idx_cache_hash ON response_cache(hash);
+    CREATE INDEX IF NOT EXISTS idx_cache_created ON response_cache(created_at);
   `);
+
+  // Idempotent migrations: add quota columns if they don't exist yet.
+  for (const col of [
+    "ALTER TABLE api_keys ADD COLUMN quota_daily INTEGER DEFAULT NULL",
+    "ALTER TABLE api_keys ADD COLUMN quota_weekly INTEGER DEFAULT NULL",
+    "ALTER TABLE api_keys ADD COLUMN quota_monthly INTEGER DEFAULT NULL",
+  ]) {
+    try { db.exec(col); } catch (e) {
+      // SQLite throws "duplicate column name" if already present — safe to ignore.
+      if (!e.message?.includes("duplicate column")) throw e;
+    }
+  }
 }
 
 // ── Key CRUD ──
@@ -63,7 +87,7 @@ export function createKey(name) {
 export function listKeys() {
   const d = getDb();
   return d.prepare(
-    "SELECT id, key, name, created_at, revoked FROM api_keys ORDER BY created_at DESC"
+    "SELECT id, key, name, created_at, revoked, quota_daily, quota_weekly, quota_monthly FROM api_keys ORDER BY created_at DESC"
   ).all().map(({ key, ...rest }) => ({
     ...rest,
     keyPreview: key.slice(0, 8) + "..." + key.slice(-4),
@@ -155,6 +179,184 @@ export function getRecentUsage(limit = 50) {
   `).all(limit);
 }
 
+// ── SQLite datetime helper ──
+// SQLite datetime('now') stores as 'YYYY-MM-DD HH:MM:SS' (no T, no Z).
+// JavaScript .toISOString() produces 'YYYY-MM-DDTHH:MM:SS.sssZ'.
+// String comparison between the two breaks for same-day ranges (T > space).
+// This helper formats Date to match SQLite's format for correct comparisons.
+function sqliteDatetime(date) {
+  return date.toISOString().replace("T", " ").replace(/\.\d{3}Z$/, "");
+}
+
+// ── Quota management ──
+
+// Returns { period, limit, used, resetsIn } if a quota is exceeded, null otherwise.
+// Anonymous/admin callers (keyId === null) are never subject to quotas.
+export function checkQuota(keyId, _keyName) {
+  if (keyId === null || keyId === undefined) return null;
+
+  const d = getDb();
+  const keyRow = d.prepare(
+    "SELECT quota_daily, quota_weekly, quota_monthly FROM api_keys WHERE id = ? AND revoked = 0"
+  ).get(keyId);
+  if (!keyRow) return null;
+
+  const now = new Date();
+
+  // UTC period boundaries (SQLite-compatible format)
+  const startOfToday = sqliteDatetime(new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate())));
+  const sevenDaysAgo = sqliteDatetime(new Date(Date.now() - 7 * 86400000));
+  const thirtyDaysAgo = sqliteDatetime(new Date(Date.now() - 30 * 86400000));
+
+  // Next reset times for human display
+  const tomorrowUTC = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1));
+  function msToHuman(ms) {
+    if (ms <= 0) return "now";
+    const h = Math.floor(ms / 3600000);
+    const m = Math.floor((ms % 3600000) / 60000);
+    if (h >= 24) { const d = Math.floor(h / 24); return `${d}d ${h % 24}h`; }
+    return h > 0 ? `${h}h ${m}m` : `${m}m`;
+  }
+
+  // Single query for all periods (widest window = monthly)
+  const row = d.prepare(`
+    SELECT
+      SUM(CASE WHEN created_at >= ? THEN 1 ELSE 0 END) as daily_cnt,
+      SUM(CASE WHEN created_at >= ? THEN 1 ELSE 0 END) as weekly_cnt,
+      COUNT(*) as monthly_cnt
+    FROM usage_log
+    WHERE key_id = ? AND success = 1 AND created_at >= ?
+  `).get(startOfToday, sevenDaysAgo, keyId, thirtyDaysAgo);
+
+  const checks = [
+    { period: "daily",   limit: keyRow.quota_daily,   used: row?.daily_cnt ?? 0,   resetsIn: msToHuman(tomorrowUTC - now) },
+    { period: "weekly",  limit: keyRow.quota_weekly,  used: row?.weekly_cnt ?? 0,  resetsIn: "rolling 7-day window" },
+    { period: "monthly", limit: keyRow.quota_monthly, used: row?.monthly_cnt ?? 0, resetsIn: "rolling 30-day window" },
+  ];
+
+  for (const { period, limit, used, resetsIn } of checks) {
+    if (limit === null || limit === undefined) continue;
+    if (used >= limit) {
+      return { period, limit, used, resetsIn };
+    }
+  }
+
+  return null;
+}
+
+// Set quota for a key. Only updates fields explicitly present in the input object.
+// Pass null to clear a specific limit. Omit a field to leave it unchanged.
+export function updateKeyQuota(idOrName, updates = {}) {
+  const d = getDb();
+  const setClauses = [];
+  const params = [];
+  if ("daily" in updates)  { setClauses.push("quota_daily = ?");  params.push(updates.daily ?? null); }
+  if ("weekly" in updates) { setClauses.push("quota_weekly = ?"); params.push(updates.weekly ?? null); }
+  if ("monthly" in updates){ setClauses.push("quota_monthly = ?");params.push(updates.monthly ?? null); }
+  if (setClauses.length === 0) return false;
+  params.push(idOrName, idOrName);
+  const result = d.prepare(
+    `UPDATE api_keys SET ${setClauses.join(", ")} WHERE id = ? OR name = ?`
+  ).run(...params);
+  return result.changes > 0;
+}
+
+// Returns { daily: { limit, used }, weekly: { limit, used }, monthly: { limit, used } }
+export function getKeyQuota(keyId) {
+  const d = getDb();
+  const keyRow = d.prepare(
+    "SELECT quota_daily, quota_weekly, quota_monthly FROM api_keys WHERE id = ?"
+  ).get(keyId);
+  if (!keyRow) return null;
+
+  const now = new Date();
+  const startOfToday  = sqliteDatetime(new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate())));
+  const sevenDaysAgo  = sqliteDatetime(new Date(Date.now() - 7 * 86400000));
+  const thirtyDaysAgo = sqliteDatetime(new Date(Date.now() - 30 * 86400000));
+
+  const row = d.prepare(`
+    SELECT
+      SUM(CASE WHEN created_at >= ? THEN 1 ELSE 0 END) as daily_cnt,
+      SUM(CASE WHEN created_at >= ? THEN 1 ELSE 0 END) as weekly_cnt,
+      COUNT(*) as monthly_cnt
+    FROM usage_log
+    WHERE key_id = ? AND success = 1 AND created_at >= ?
+  `).get(startOfToday, sevenDaysAgo, keyId, thirtyDaysAgo);
+
+  return {
+    daily:   { limit: keyRow.quota_daily   ?? null, used: row?.daily_cnt ?? 0 },
+    weekly:  { limit: keyRow.quota_weekly  ?? null, used: row?.weekly_cnt ?? 0 },
+    monthly: { limit: keyRow.quota_monthly ?? null, used: row?.monthly_cnt ?? 0 },
+  };
+}
+
+// ── Response cache ──
+
+// Generate a cache key from model + messages + request params that affect output
+export function cacheHash(model, messages, opts = {}) {
+  const h = createHash("sha256");
+  h.update(model);
+  if (opts.temperature != null) h.update(`t:${opts.temperature}`);
+  if (opts.max_tokens != null) h.update(`mt:${opts.max_tokens}`);
+  if (opts.top_p != null) h.update(`tp:${opts.top_p}`);
+  for (const m of messages) {
+    h.update(m.role || "");
+    h.update(typeof m.content === "string" ? m.content : JSON.stringify(m.content));
+  }
+  return h.digest("hex");
+}
+
+// Look up a cached response. Returns { response, hits } or null.
+// Also updates last_hit_at and increments hits counter on hit.
+export function getCachedResponse(hash, ttlMs) {
+  const d = getDb();
+  const cutoff = sqliteDatetime(new Date(Date.now() - ttlMs));
+  const row = d.prepare(
+    "SELECT id, response, hits FROM response_cache WHERE hash = ? AND created_at >= ?"
+  ).get(hash, cutoff);
+  if (!row) return null;
+  // Update hit stats
+  d.prepare("UPDATE response_cache SET hits = hits + 1, last_hit_at = datetime('now') WHERE id = ?").run(row.id);
+  return { response: row.response, hits: row.hits + 1 };
+}
+
+// Store a response in the cache
+export function setCachedResponse(hash, model, response) {
+  const d = getDb();
+  // Upsert: if hash already exists (race condition), just update
+  d.prepare(`
+    INSERT INTO response_cache (hash, model, response) VALUES (?, ?, ?)
+    ON CONFLICT(hash) DO UPDATE SET response = excluded.response, created_at = datetime('now'), hits = 0
+  `).run(hash, model, response);
+}
+
+// Clear all cached responses, or expired ones only
+export function clearCache(ttlMs = null) {
+  const d = getDb();
+  if (ttlMs === null) {
+    const result = d.prepare("DELETE FROM response_cache").run();
+    return result.changes;
+  }
+  const cutoff = sqliteDatetime(new Date(Date.now() - ttlMs));
+  const result = d.prepare("DELETE FROM response_cache WHERE created_at < ?").run(cutoff);
+  return result.changes;
+}
+
+// Get cache statistics
+export function getCacheStats() {
+  const d = getDb();
+  const total = d.prepare("SELECT COUNT(*) as cnt FROM response_cache").get()?.cnt ?? 0;
+  const totalHits = d.prepare("SELECT SUM(hits) as total FROM response_cache").get()?.total ?? 0;
+  const sizeBytes = d.prepare("SELECT SUM(LENGTH(response)) as size FROM response_cache").get()?.size ?? 0;
+  return { entries: total, totalHits, sizeBytes };
+}
+
+// Find a key by id or name (returns { id, name } or null)
+export function findKey(idOrName) {
+  const d = getDb();
+  return d.prepare("SELECT id, name FROM api_keys WHERE id = ? OR name = ?").get(idOrName, idOrName) || null;
+}
+
 export function closeDb() {
   if (db) { db.close(); db = null; }
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-claude-proxy",
-  "version": "3.7.0",
+  "version": "3.9.0",
   "description": "OCP (Open Claude Proxy) — use your Claude Pro/Max subscription as an OpenAI-compatible API for any IDE. Works with Cline, OpenCode, Aider, Continue.dev, OpenClaw, and more.",
   "type": "module",
   "bin": {

server.mjs

@@ -33,7 +33,7 @@ import { readFileSync, accessSync, constants } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
-import { validateKey, recordUsage, getUsageByKey, getUsageTimeline, getRecentUsage, createKey, listKeys, revokeKey, closeDb } from "./keys.mjs";
+import { validateKey, recordUsage, getUsageByKey, getUsageTimeline, getRecentUsage, createKey, listKeys, revokeKey, closeDb, checkQuota, updateKeyQuota, getKeyQuota, findKey, cacheHash, getCachedResponse, setCachedResponse, clearCache, getCacheStats } from "./keys.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const _pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
@@ -98,6 +98,7 @@ const NO_CONTEXT = process.env.CLAUDE_NO_CONTEXT === "true";
 const AUTH_MODE = process.env.CLAUDE_AUTH_MODE || (PROXY_API_KEY ? "shared" : "none");
 const ADMIN_KEY = process.env.OCP_ADMIN_KEY || "";
 const PROXY_ANONYMOUS_KEY = process.env.PROXY_ANONYMOUS_KEY || "";
+let CACHE_TTL = parseInt(process.env.CLAUDE_CACHE_TTL || "0", 10); // 0 = disabled, value in ms
 if (PROXY_ANONYMOUS_KEY && AUTH_MODE !== "multi") {
   console.warn("WARNING: PROXY_ANONYMOUS_KEY is set but AUTH_MODE is not 'multi' — anonymous key will be ignored");
 }
@@ -177,6 +178,16 @@ const sessionCleanupInterval = setInterval(() => {
   }
 }, 60000);
 
+// Cache cleanup: remove expired entries every 10 minutes
+const cacheCleanupInterval = setInterval(() => {
+  if (CACHE_TTL > 0) {
+    try {
+      const cleaned = clearCache(CACHE_TTL);
+      if (cleaned > 0) logEvent("info", "cache_cleanup", { expired: cleaned });
+    } catch (e) { logEvent("error", "cache_cleanup_failed", { error: e.message }); }
+  }
+}, 600000);
+
 // ── Active child process tracking ────────────────────────────────────────
 const activeProcesses = new Set();
 
@@ -548,6 +559,7 @@ function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}
   let stderr = "";
   let headersSent = false;
   let totalChars = 0;
+  let cachedContent = ""; // accumulate for cache write-back
 
   function ensureHeaders() {
     if (headersSent || res.writableEnded || res.destroyed) return false;
@@ -569,6 +581,7 @@ function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}
     markFirstByte();
     const text = d.toString();
     totalChars += text.length;
+    if (CACHE_TTL > 0) cachedContent += text;
 
     if (!ensureHeaders()) return;
 
@@ -608,6 +621,10 @@ function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}
       breakerRecordSuccess(cliModel);
       try { recordUsage({ keyId: authInfo.keyId, keyName: authInfo.keyName, model, promptChars: messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0), responseChars: totalChars, elapsedMs: elapsed, success: true }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
       logEvent("info", "claude_ok", { model: cliModel, chars: totalChars, elapsed, session: convId ? convId.slice(0, 12) + "..." : "none" });
+      // Cache write-back for streaming
+      if (CACHE_TTL > 0 && authInfo.cacheHash) {
+        try { setCachedResponse(authInfo.cacheHash, model, cachedContent); } catch (e) { logEvent("error", "cache_write_failed", { error: e.message }); }
+      }
 
       if (!headersSent) ensureHeaders();
       if (!res.writableEnded && !res.destroyed) {
@@ -663,25 +680,42 @@ function completionResponse(res, id, model, content) {
 }
 
 // ── Plan usage probe ────────────────────────────────────────────────────
-// Uses the dedicated /api/oauth/usage endpoint (same as Claude Code CLI)
-// with Bearer auth + anthropic-beta header. Auto-refreshes expired tokens.
-// Caches the result for 5 minutes to avoid excessive API calls.
+// ── Plan usage probe ────────────────────────────────────────────────────
+// ALIGNMENT: mirrors Claude Code cli.js vE4 rate-limit header extraction.
+// DO NOT switch endpoints without grepping "anthropic-ratelimit-unified" in cli.js.
+// 2026-04-11 b87992f drift lesson: /api/oauth/usage is a hallucinated endpoint.
+// See ALIGNMENT.md for full history.
+//
+// Reads OAuth token (keychain / Linux credentials / CLAUDE_CODE_OAUTH_TOKEN env)
+// and makes a minimal /v1/messages request to capture anthropic-ratelimit-unified-*
+// headers. Caches the result for 5 minutes.
 
 let usageCache = { data: null, fetchedAt: 0 };
-const USAGE_CACHE_TTL = 900000; // 15 min
+const USAGE_CACHE_TTL = 5 * 60 * 1000; // 5 min
 const OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 const OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
-const OAUTH_BETA_HEADER = "oauth-2025-04-20";
+
+// Refresh backoff state — exponential 60s → 3600s.
+// Prevents tight loops hammering the token endpoint after a failure
+// (lesson from pre-fix session that burned through rate-limit in seconds).
+const OAUTH_REFRESH_MIN_BACKOFF = 60 * 1000;
+const OAUTH_REFRESH_MAX_BACKOFF = 3600 * 1000;
+let oauthRefreshBackoff = { nextAttemptAt: 0, currentDelay: OAUTH_REFRESH_MIN_BACKOFF };
 
 function getOAuthCredentials() {
-  // Try Linux file-based credentials first
+  // 1. Env var fallback — highest precedence for explicit overrides.
+  if (process.env.CLAUDE_CODE_OAUTH_TOKEN) {
+    return { accessToken: process.env.CLAUDE_CODE_OAUTH_TOKEN };
+  }
+
+  // 2. Linux file-based credentials
   try {
     const credPath = join(homedir(), ".claude", ".credentials.json");
     const creds = JSON.parse(readFileSync(credPath, "utf8"));
     if (creds?.claudeAiOauth?.accessToken) return creds.claudeAiOauth;
   } catch { /* fall through to macOS keychain */ }
 
-  // Try macOS keychain (both label formats)
+  // 3. macOS keychain (both label formats)
   for (const label of ["claude-code-credentials", "Claude Code-credentials"]) {
     try {
       const raw = execFileSync("security", [
@@ -695,6 +729,13 @@ function getOAuthCredentials() {
 }
 
 async function refreshOAuthToken(refreshToken) {
+  const now = Date.now();
+  if (now < oauthRefreshBackoff.nextAttemptAt) {
+    logEvent("info", "oauth_refresh_backoff_skip", {
+      waitMs: oauthRefreshBackoff.nextAttemptAt - now,
+    });
+    return null;
+  }
   try {
     const resp = await fetch(OAUTH_TOKEN_URL, {
       method: "POST",
@@ -708,13 +749,34 @@ async function refreshOAuthToken(refreshToken) {
     });
     if (!resp.ok) {
       const body = await resp.text();
-      logEvent("warn", "oauth_refresh_failed", { status: resp.status, body: body.slice(0, 200) });
+      // Exponential backoff on failure
+      oauthRefreshBackoff.nextAttemptAt = Date.now() + oauthRefreshBackoff.currentDelay;
+      oauthRefreshBackoff.currentDelay = Math.min(
+        oauthRefreshBackoff.currentDelay * 2,
+        OAUTH_REFRESH_MAX_BACKOFF,
+      );
+      logEvent("warn", "oauth_refresh_failed", {
+        status: resp.status,
+        body: body.slice(0, 200),
+        nextBackoffMs: oauthRefreshBackoff.currentDelay,
+      });
       return null;
     }
     const data = await resp.json();
+    // Reset backoff on success
+    oauthRefreshBackoff.currentDelay = OAUTH_REFRESH_MIN_BACKOFF;
+    oauthRefreshBackoff.nextAttemptAt = 0;
     return data.access_token || null;
   } catch (err) {
-    logEvent("warn", "oauth_refresh_error", { error: err.message });
+    oauthRefreshBackoff.nextAttemptAt = Date.now() + oauthRefreshBackoff.currentDelay;
+    oauthRefreshBackoff.currentDelay = Math.min(
+      oauthRefreshBackoff.currentDelay * 2,
+      OAUTH_REFRESH_MAX_BACKOFF,
+    );
+    logEvent("warn", "oauth_refresh_error", {
+      error: err.message,
+      nextBackoffMs: oauthRefreshBackoff.currentDelay,
+    });
     return null;
   }
 }
@@ -722,73 +784,89 @@ async function refreshOAuthToken(refreshToken) {
 async function fetchUsageFromApi() {
   const creds = getOAuthCredentials();
   if (!creds?.accessToken) {
-    return { error: "No OAuth token found in keychain" };
+    return { error: "No OAuth token found (keychain / ~/.claude/.credentials.json / CLAUDE_CODE_OAUTH_TOKEN)" };
   }
 
   let token = creds.accessToken;
 
-  // Check if token looks expired (5 min buffer, same as Claude Code)
-  if (creds.expiresAt && Date.now() + 300000 >= creds.expiresAt) {
-    if (creds.refreshToken) {
-      logEvent("info", "oauth_token_expired_refreshing");
-      const newToken = await refreshOAuthToken(creds.refreshToken);
-      if (newToken) token = newToken;
-    }
+  // Pre-emptive refresh if token looks expired (5 min buffer, same as Claude Code)
+  if (creds.expiresAt && Date.now() + 300000 >= creds.expiresAt && creds.refreshToken) {
+    logEvent("info", "oauth_token_expired_refreshing");
+    const newToken = await refreshOAuthToken(creds.refreshToken);
+    if (newToken) token = newToken;
   }
 
+  // Minimal /v1/messages request — we only need the response headers.
+  // Mirrors Claude Code cli.js vE4: headers anthropic-ratelimit-unified-{5h,7d}-{utilization,reset}.
+  const body = JSON.stringify({
+    model: "claude-haiku-4-5-20251001",
+    max_tokens: 1,
+    messages: [{ role: "user", content: "." }],
+  });
+
   const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 10000);
+  const timeout = setTimeout(() => controller.abort(), 15000);
+
+  const doFetch = (bearerToken) => fetch("https://api.anthropic.com/v1/messages", {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${bearerToken}`,
+      "anthropic-version": "2023-06-01",
+      "anthropic-beta": "oauth-2025-04-20",
+      "Content-Type": "application/json",
+    },
+    body,
+    signal: controller.signal,
+  });
 
   try {
-    const resp = await fetch("https://api.anthropic.com/api/oauth/usage", {
-      method: "GET",
-      headers: {
-        "Authorization": `Bearer ${token}`,
-        "anthropic-beta": OAUTH_BETA_HEADER,
-        "Content-Type": "application/json",
-      },
-      signal: controller.signal,
-    });
-    clearTimeout(timeout);
+    let resp = await doFetch(token);
 
-    if (!resp.ok) {
-      // If 401, try refreshing token once
-      if (resp.status === 401 && creds.refreshToken) {
-        logEvent("info", "oauth_usage_401_refreshing");
-        const newToken = await refreshOAuthToken(creds.refreshToken);
-        if (newToken) {
-          const retryResp = await fetch("https://api.anthropic.com/api/oauth/usage", {
-            method: "GET",
-            headers: {
-              "Authorization": `Bearer ${newToken}`,
-              "anthropic-beta": OAUTH_BETA_HEADER,
-              "Content-Type": "application/json",
-            },
-          });
-          if (retryResp.ok) {
-            const retryData = await retryResp.json();
-            return parseUsageResponse(retryData);
-          }
-        }
-        return { error: `Usage API auth failed after refresh (${resp.status})` };
+    // 401 → try a single refresh-and-retry
+    if (resp.status === 401 && creds.refreshToken) {
+      logEvent("info", "oauth_usage_401_refreshing");
+      const newToken = await refreshOAuthToken(creds.refreshToken);
+      if (newToken) {
+        token = newToken;
+        resp = await doFetch(token);
       }
-      return { error: `Usage API returned ${resp.status}` };
     }
 
-    const data = await resp.json();
-    return parseUsageResponse(data);
+    clearTimeout(timeout);
+
+    // Extract all rate-limit headers (we do not need the response body)
+    const rl = {};
+    for (const [k, v] of resp.headers) {
+      if (k.startsWith("anthropic-ratelimit")) rl[k] = v;
+    }
+
+    if (!resp.ok && Object.keys(rl).length === 0) {
+      return { error: `Usage API returned ${resp.status} with no rate-limit headers` };
+    }
+
+    return parseRateLimitHeaders(rl);
   } catch (err) {
     clearTimeout(timeout);
     return { error: `Failed to fetch usage: ${err.message}` };
   }
 }
 
-function parseUsageResponse(data) {
+function parseRateLimitHeaders(rl) {
   const now = Date.now();
 
-  function formatReset(isoStr) {
-    if (!isoStr) return "unknown";
-    const diff = new Date(isoStr).getTime() - now;
+  const session5hUtil = parseFloat(rl["anthropic-ratelimit-unified-5h-utilization"] || "0");
+  const session5hReset = parseInt(rl["anthropic-ratelimit-unified-5h-reset"] || "0", 10);
+  const weekly7dUtil = parseFloat(rl["anthropic-ratelimit-unified-7d-utilization"] || "0");
+  const weekly7dReset = parseInt(rl["anthropic-ratelimit-unified-7d-reset"] || "0", 10);
+  const overageStatus = rl["anthropic-ratelimit-unified-overage-status"] || "unknown";
+  const overageDisabledReason = rl["anthropic-ratelimit-unified-overage-disabled-reason"] || "";
+  const status = rl["anthropic-ratelimit-unified-status"] || "unknown";
+  const representativeClaim = rl["anthropic-ratelimit-unified-representative-claim"] || "";
+  const fallbackPct = parseFloat(rl["anthropic-ratelimit-unified-fallback-percentage"] || "0");
+
+  function formatReset(epochSec) {
+    if (!epochSec) return "unknown";
+    const diff = epochSec * 1000 - now;
     if (diff <= 0) return "now";
     const h = Math.floor(diff / 3600000);
     const m = Math.floor((diff % 3600000) / 60000);
@@ -799,42 +877,38 @@ function parseUsageResponse(data) {
     return h > 0 ? `${h}h ${m}m` : `${m}m`;
   }
 
-  function resetDay(isoStr) {
-    if (!isoStr) return "";
-    const d = new Date(isoStr);
+  function resetDay(epochSec) {
+    if (!epochSec) return "";
+    const d = new Date(epochSec * 1000);
     return d.toLocaleDateString("en-US", { weekday: "short", month: "short", day: "numeric", hour: "numeric", minute: "2-digit" });
   }
 
-  const fiveHour = data.five_hour || {};
-  const sevenDay = data.seven_day || {};
-  const extraUsage = data.extra_usage || {};
-
   return {
-    status: "active",
+    status,
     fetchedAt: new Date(now).toISOString(),
     plan: {
       currentSession: {
-        utilization: (fiveHour.utilization || 0) / 100,
-        percent: `${Math.round(fiveHour.utilization || 0)}%`,
-        resetsIn: formatReset(fiveHour.resets_at),
-        resetsAt: fiveHour.resets_at || null,
-        resetsAtHuman: resetDay(fiveHour.resets_at),
+        utilization: session5hUtil,
+        percent: `${Math.round(session5hUtil * 100)}%`,
+        resetsIn: formatReset(session5hReset),
+        resetsAt: session5hReset ? new Date(session5hReset * 1000).toISOString() : null,
+        resetsAtHuman: resetDay(session5hReset),
       },
       weeklyLimits: {
         allModels: {
-          utilization: (sevenDay.utilization || 0) / 100,
-          percent: `${Math.round(sevenDay.utilization || 0)}%`,
-          resetsIn: formatReset(sevenDay.resets_at),
-          resetsAt: sevenDay.resets_at || null,
-          resetsAtHuman: resetDay(sevenDay.resets_at),
+          utilization: weekly7dUtil,
+          percent: `${Math.round(weekly7dUtil * 100)}%`,
+          resetsIn: formatReset(weekly7dReset),
+          resetsAt: weekly7dReset ? new Date(weekly7dReset * 1000).toISOString() : null,
+          resetsAtHuman: resetDay(weekly7dReset),
         },
       },
       extraUsage: {
-        status: extraUsage.is_enabled ? "enabled" : "disabled",
-        monthlyLimit: extraUsage.monthly_limit,
-        usedCredits: extraUsage.used_credits,
-        utilization: extraUsage.utilization,
+        status: overageStatus,
+        disabledReason: overageDisabledReason || undefined,
       },
+      representativeClaim,
+      fallbackPercentage: fallbackPct,
     },
     proxy: {
       totalRequests: stats.totalRequests,
@@ -844,7 +918,7 @@ function parseUsageResponse(data) {
       uptime: `${Math.floor((now - START_TIME) / 3600000)}h ${Math.floor(((now - START_TIME) % 3600000) / 60000)}m`,
     },
     models: getModelStatsSnapshot(),
-    _raw: data,
+    _raw: rl,
   };
 }
 
@@ -857,9 +931,6 @@ async function handleUsage(_req, res) {
     data = await fetchUsageFromApi();
     if (!data.error) {
       usageCache = { data, fetchedAt: now };
-    } else if (usageCache.data) {
-      // Fallback to stale cache on error (e.g. 429 rate limit)
-      data = { ...usageCache.data, _stale: true, _fetchError: data.error };
     }
   }
   // Always attach live model stats and proxy stats (not cached)
@@ -931,8 +1002,6 @@ async function handleStatus(_req, res) {
     usage = await fetchUsageFromApi();
     if (!usage.error) {
       usageCache = { data: usage, fetchedAt: now };
-    } else if (usageCache.data) {
-      usage = { ...usageCache.data, _stale: true };
     }
   }
 
@@ -969,6 +1038,7 @@ const SETTINGS_SCHEMA = {
   maxConcurrent:    { type: "number", min: 1, max: 32, unit: "", desc: "Max concurrent claude processes" },
   sessionTTL:       { type: "number", min: 60000, max: 86400000, unit: "ms", desc: "Session idle expiry" },
   maxPromptChars:   { type: "number", min: 10000, max: 1000000, unit: "chars", desc: "Prompt truncation limit" },
+  cacheTTL:         { type: "number", min: 0, max: 86400000, unit: "ms", desc: "Response cache TTL (0 = disabled)" },
 };
 
 function getSettings() {
@@ -977,6 +1047,7 @@ function getSettings() {
     maxConcurrent:    { value: MAX_CONCURRENT, ...SETTINGS_SCHEMA.maxConcurrent },
     sessionTTL:       { value: SESSION_TTL, ...SETTINGS_SCHEMA.sessionTTL },
     maxPromptChars:   { value: MAX_PROMPT_CHARS, ...SETTINGS_SCHEMA.maxPromptChars },
+    cacheTTL:         { value: CACHE_TTL, ...SETTINGS_SCHEMA.cacheTTL },
   };
 }
 
@@ -991,6 +1062,7 @@ function applySettingUpdate(key, value) {
     case "maxConcurrent":    MAX_CONCURRENT = value; break;
     case "sessionTTL":       SESSION_TTL = value; break;
     case "maxPromptChars":   MAX_PROMPT_CHARS = value; break;
+    case "cacheTTL":         CACHE_TTL = value; break;
     default: return `${key}: not implemented`;
   }
   logEvent("info", "setting_changed", { key, value });
@@ -1067,9 +1139,54 @@ async function handleChatCompletions(req, res) {
 
   if (!messages?.length) return jsonResponse(res, 400, { error: "messages required" });
 
+  // Quota check — only for identified per-key users (not anonymous/admin/local)
+  if (req._authKeyId) {
+    let exceeded;
+    try { exceeded = checkQuota(req._authKeyId, req._authKeyName); } catch (e) { logEvent("error", "quota_check_failed", { error: e.message }); exceeded = null; }
+    if (exceeded) {
+      logEvent("warn", "quota_exceeded", { keyId: req._authKeyId, keyName: req._authKeyName, period: exceeded.period, limit: exceeded.limit, used: exceeded.used });
+      return jsonResponse(res, 429, {
+        error: {
+          message: `Quota exceeded: ${exceeded.used}/${exceeded.limit} requests (${exceeded.period}). Resets ${exceeded.resetsIn}.`,
+          type: "quota_exceeded",
+          quota: exceeded,
+        },
+      });
+    }
+  }
+
+  // Cache check (only when cache is enabled and no active conversation/session)
+  if (CACHE_TTL > 0 && !conversationId) {
+    const hash = cacheHash(model, messages, { temperature: parsed.temperature, max_tokens: parsed.max_tokens, top_p: parsed.top_p });
+    req._cacheHash = hash; // store for later write-back
+    try {
+      const cached = getCachedResponse(hash, CACHE_TTL);
+      if (cached) {
+        logEvent("info", "cache_hit", { model, hash: hash.slice(0, 12), hits: cached.hits });
+        if (stream) {
+          // Simulate streaming for cached response
+          const id = `chatcmpl-${randomUUID()}`;
+          const created = Math.floor(Date.now() / 1000);
+          res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", "Connection": "keep-alive" });
+          sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { role: "assistant" }, finish_reason: null }] });
+          sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: { content: cached.response }, finish_reason: null }] });
+          sendSSE(res, { id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta: {}, finish_reason: "stop" }] });
+          res.write("data: [DONE]\n\n");
+          res.end();
+          return;
+        } else {
+          const id = `chatcmpl-${randomUUID()}`;
+          return completionResponse(res, id, model, cached.response);
+        }
+      }
+    } catch (e) {
+      logEvent("error", "cache_check_failed", { error: e.message });
+    }
+  }
+
   if (stream) {
     // Real streaming: pipe stdout from claude process directly as SSE chunks
-    return callClaudeStreaming(model, messages, conversationId, res, { keyId: req._authKeyId, keyName: req._authKeyName });
+    return callClaudeStreaming(model, messages, conversationId, res, { keyId: req._authKeyId, keyName: req._authKeyName, cacheHash: req._cacheHash });
   }
 
   const t0Usage = Date.now();
@@ -1078,6 +1195,10 @@ async function handleChatCompletions(req, res) {
     const content = await callClaude(model, messages, conversationId);
     const id = `chatcmpl-${randomUUID()}`;
     completionResponse(res, id, model, content);
+    // Write to cache
+    if (CACHE_TTL > 0 && req._cacheHash) {
+      try { setCachedResponse(req._cacheHash, model, content); } catch (e) { logEvent("error", "cache_write_failed", { error: e.message }); }
+    }
     try { recordUsage({ keyId: req._authKeyId, keyName: req._authKeyName, model, promptChars, responseChars: content.length, elapsedMs: Date.now() - t0Usage, success: true }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
   } catch (err) {
     try { recordUsage({ keyId: req._authKeyId, keyName: req._authKeyName, model, promptChars, responseChars: 0, elapsedMs: Date.now() - t0Usage, success: false }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
@@ -1300,13 +1421,50 @@ const server = createServer(async (req, res) => {
     return jsonResponse(res, 200, { keys: listKeys() });
   }
 
-  if (req.url?.startsWith("/api/keys/") && req.method === "DELETE") {
+  if (req.url?.startsWith("/api/keys/") && !req.url.includes("/quota") && req.method === "DELETE") {
     if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
     const idOrName = decodeURIComponent(req.url.split("/api/keys/")[1]);
     const revoked = revokeKey(idOrName);
     return jsonResponse(res, 200, { revoked, idOrName });
   }
 
+  // PATCH /api/keys/:id/quota — set quota for a key
+  // Body: { "daily": 100, "weekly": 500, "monthly": 2000 }  (null = unlimited)
+  if (req.url?.match(/^\/api\/keys\/[^/]+\/quota$/) && req.method === "PATCH") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
+    const idOrName = decodeURIComponent(req.url.split("/api/keys/")[1].replace("/quota", ""));
+    let body = "";
+    for await (const chunk of req) { body += chunk; if (body.length > 10000) return jsonResponse(res, 413, { error: "Body too large" }); }
+    let quotaBody;
+    try { quotaBody = JSON.parse(body); } catch { return jsonResponse(res, 400, { error: "Invalid JSON" }); }
+    // Validate quota values: must be positive integers or null
+    const quotaFields = {};
+    for (const k of ["daily", "weekly", "monthly"]) {
+      if (k in quotaBody) {
+        const v = quotaBody[k];
+        if (v !== null && (!Number.isInteger(v) || v < 0)) {
+          return jsonResponse(res, 400, { error: `${k} must be a positive integer or null` });
+        }
+        quotaFields[k] = v;
+      }
+    }
+    if (Object.keys(quotaFields).length === 0) return jsonResponse(res, 400, { error: "Provide at least one of: daily, weekly, monthly" });
+    const updated = updateKeyQuota(idOrName, quotaFields);
+    if (!updated) return jsonResponse(res, 404, { error: "Key not found" });
+    logEvent("info", "quota_updated", { idOrName, ...quotaFields });
+    return jsonResponse(res, 200, { ok: true, idOrName, quota: quotaFields });
+  }
+
+  // GET /api/keys/:id/quota — get quota + current usage for a key
+  if (req.url?.match(/^\/api\/keys\/[^/]+\/quota$/) && req.method === "GET") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
+    const idOrName = decodeURIComponent(req.url.split("/api/keys/")[1].replace("/quota", ""));
+    const keyRow = findKey(idOrName);
+    if (!keyRow) return jsonResponse(res, 404, { error: "Key not found" });
+    const quota = getKeyQuota(keyRow.id);
+    return jsonResponse(res, 200, { keyId: keyRow.id, quota });
+  }
+
   if (req.url?.startsWith("/api/usage") && req.method === "GET") {
     if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
     const url = new URL(req.url, `http://${BIND_ADDRESS}:${PORT}`);
@@ -1319,6 +1477,20 @@ const server = createServer(async (req, res) => {
     });
   }
 
+  // GET /cache/stats — cache statistics
+  if (pathname === "/cache/stats" && req.method === "GET") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
+    return jsonResponse(res, 200, getCacheStats());
+  }
+
+  // DELETE /cache — clear cache
+  if (pathname === "/cache" && req.method === "DELETE") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
+    const cleared = clearCache();
+    logEvent("info", "cache_cleared", { entries: cleared });
+    return jsonResponse(res, 200, { cleared });
+  }
+
   // GET /dashboard — web dashboard
   if (pathname === "/dashboard" && req.method === "GET") {
     try {
@@ -1331,7 +1503,7 @@ const server = createServer(async (req, res) => {
     return;
   }
 
-  jsonResponse(res, 404, { error: "Not found. Endpoints: GET /v1/models, POST /v1/chat/completions, GET /health, GET /usage, GET /status, GET /logs, GET|PATCH /settings, GET|DELETE /sessions, GET /dashboard, GET|POST|DELETE /api/keys, GET /api/usage" });
+  jsonResponse(res, 404, { error: "Not found. Endpoints: GET /v1/models, POST /v1/chat/completions, GET /health, GET /usage, GET /status, GET /logs, GET|PATCH /settings, GET|DELETE /sessions, GET /dashboard, GET|POST|DELETE /api/keys, GET|PATCH /api/keys/:id/quota, GET /api/usage, GET /cache/stats, DELETE /cache" });
 });
 
 
@@ -1351,6 +1523,7 @@ function gracefulShutdown(signal) {
   // 2. Clear intervals/timers
   clearInterval(sessionCleanupInterval);
   clearInterval(authCheckInterval);
+  clearInterval(cacheCleanupInterval);
   closeDb();
 
   // 3. Kill all active child processes
@@ -1405,6 +1578,8 @@ server.listen(PORT, BIND_ADDRESS, () => {
   console.log(`Auth mode: ${AUTH_MODE}${AUTH_MODE === "shared" ? " (PROXY_API_KEY)" : AUTH_MODE === "multi" ? " (per-user keys)" : " (open)"}`);
   console.log(`Bind: ${BIND_ADDRESS}${BIND_ADDRESS === "0.0.0.0" ? " ⚠ LAN-accessible" : ""}`);
   if (NO_CONTEXT) console.log(`Context: suppressed (CLAUDE_NO_CONTEXT=true — no CLAUDE.md, no auto-memory)`);
+  if (CACHE_TTL > 0) console.log(`Cache: enabled (TTL=${CACHE_TTL / 1000}s)`);
+  else console.log(`Cache: disabled (set CLAUDE_CACHE_TTL to enable)`);
   console.log(`---`);
   console.log(`Coexistence: This proxy does NOT conflict with Claude Code interactive mode.`);
   console.log(`  OCP uses: localhost:${PORT} (HTTP) → claude -p (per-request process)`);

test-features.mjs

@@ -0,0 +1,260 @@
+#!/usr/bin/env node
+/**
+ * Integration test for Quota + Cache features.
+ * Tests database layer functions directly — no server needed.
+ */
+import { getDb, createKey, listKeys, validateKey, recordUsage, checkQuota, updateKeyQuota, getKeyQuota, findKey, cacheHash, getCachedResponse, setCachedResponse, clearCache, getCacheStats, closeDb } from "./keys.mjs";
+import { strict as assert } from "node:assert";
+import { unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+// Use a test database to avoid corrupting real data
+const TEST_DB = join(homedir(), ".ocp", "ocp-test.db");
+try { unlinkSync(TEST_DB); } catch {}
+
+// Monkey-patch DB_PATH for testing (override the module-level variable)
+// Since keys.mjs uses lazy init, we can set env before first getDb() call
+process.env.HOME = homedir(); // ensure consistent
+
+let passed = 0;
+let failed = 0;
+
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ✓ ${name}`);
+  } catch (e) {
+    failed++;
+    console.log(`  ✗ ${name}: ${e.message}`);
+  }
+}
+
+console.log("\n=== OCP Feature Tests (Quota + Cache) ===\n");
+
+// Initialize DB
+const db = getDb();
+
+// ── Quota Tests ──
+console.log("Quota:");
+
+const key1 = createKey("test-user-1");
+const key2 = createKey("test-user-2");
+
+test("createKey returns id, key, name", () => {
+  assert.ok(key1.id);
+  assert.ok(key1.key.startsWith("ocp_"));
+  assert.equal(key1.name, "test-user-1");
+});
+
+test("listKeys includes quota fields", () => {
+  const keys = listKeys();
+  assert.ok(keys.length >= 2);
+  const k = keys.find(k => k.name === "test-user-1");
+  assert.ok("quota_daily" in k);
+  assert.ok("quota_weekly" in k);
+  assert.ok("quota_monthly" in k);
+  assert.equal(k.quota_daily, null);
+});
+
+test("checkQuota returns null when no quota set", () => {
+  const result = checkQuota(key1.id, key1.name);
+  assert.equal(result, null);
+});
+
+test("checkQuota returns null for null keyId", () => {
+  assert.equal(checkQuota(null, "anon"), null);
+  assert.equal(checkQuota(undefined, "anon"), null);
+});
+
+test("updateKeyQuota sets daily quota (partial update)", () => {
+  const ok = updateKeyQuota(key1.id, { daily: 5 });
+  assert.ok(ok);
+  const quota = getKeyQuota(key1.id);
+  assert.equal(quota.daily.limit, 5);
+  assert.equal(quota.weekly.limit, null); // not touched
+  assert.equal(quota.monthly.limit, null);
+});
+
+test("updateKeyQuota partial update preserves existing values", () => {
+  updateKeyQuota(key1.id, { weekly: 20 });
+  const quota = getKeyQuota(key1.id);
+  assert.equal(quota.daily.limit, 5);  // preserved from previous call
+  assert.equal(quota.weekly.limit, 20);
+});
+
+test("checkQuota passes when under limit", () => {
+  // Record 3 usages (limit is 5 daily)
+  for (let i = 0; i < 3; i++) {
+    recordUsage({ keyId: key1.id, keyName: key1.name, model: "sonnet", promptChars: 100, responseChars: 50, elapsedMs: 1000, success: true });
+  }
+  const result = checkQuota(key1.id, key1.name);
+  assert.equal(result, null);
+});
+
+test("checkQuota returns exceeded when at limit", () => {
+  // Record 2 more to hit limit (3 + 2 = 5)
+  for (let i = 0; i < 2; i++) {
+    recordUsage({ keyId: key1.id, keyName: key1.name, model: "sonnet", promptChars: 100, responseChars: 50, elapsedMs: 1000, success: true });
+  }
+  const result = checkQuota(key1.id, key1.name);
+  assert.ok(result);
+  assert.equal(result.period, "daily");
+  assert.equal(result.limit, 5);
+  assert.equal(result.used, 5);
+  assert.ok(result.resetsIn);
+});
+
+test("checkQuota ignores failed requests in count", () => {
+  // key2 has quota of 2 daily
+  updateKeyQuota(key2.id, { daily: 2 });
+  recordUsage({ keyId: key2.id, keyName: key2.name, model: "sonnet", promptChars: 100, responseChars: 0, elapsedMs: 500, success: false });
+  recordUsage({ keyId: key2.id, keyName: key2.name, model: "sonnet", promptChars: 100, responseChars: 50, elapsedMs: 1000, success: true });
+  const result = checkQuota(key2.id, key2.name);
+  assert.equal(result, null); // only 1 successful, limit is 2
+});
+
+test("getKeyQuota returns correct used counts", () => {
+  const quota = getKeyQuota(key1.id);
+  assert.equal(quota.daily.used, 5);
+  assert.equal(quota.daily.limit, 5);
+});
+
+test("findKey works by id and name", () => {
+  const byId = findKey(String(key1.id));
+  assert.ok(byId);
+  assert.equal(byId.name, "test-user-1");
+  const byName = findKey("test-user-1");
+  assert.ok(byName);
+  // Compare by name since auto-increment IDs may vary across runs
+  assert.equal(byName.name, "test-user-1");
+  assert.equal(findKey("nonexistent"), null);
+});
+
+// ── Cache Tests ──
+console.log("\nCache:");
+
+// Clean slate for cache tests
+clearCache();
+
+const msgs1 = [{ role: "user", content: "Hello world" }];
+const msgs2 = [{ role: "user", content: "Different prompt" }];
+
+test("cacheHash is deterministic", () => {
+  const h1 = cacheHash("sonnet", msgs1);
+  const h2 = cacheHash("sonnet", msgs1);
+  assert.equal(h1, h2);
+});
+
+test("cacheHash differs for different models", () => {
+  const h1 = cacheHash("sonnet", msgs1);
+  const h2 = cacheHash("opus", msgs1);
+  assert.notEqual(h1, h2);
+});
+
+test("cacheHash differs for different messages", () => {
+  const h1 = cacheHash("sonnet", msgs1);
+  const h2 = cacheHash("sonnet", msgs2);
+  assert.notEqual(h1, h2);
+});
+
+test("cacheHash includes temperature in hash", () => {
+  const h1 = cacheHash("sonnet", msgs1, {});
+  const h2 = cacheHash("sonnet", msgs1, { temperature: 0.5 });
+  const h3 = cacheHash("sonnet", msgs1, { temperature: 1.0 });
+  assert.notEqual(h1, h2);
+  assert.notEqual(h2, h3);
+});
+
+test("cacheHash includes max_tokens in hash", () => {
+  const h1 = cacheHash("sonnet", msgs1, {});
+  const h2 = cacheHash("sonnet", msgs1, { max_tokens: 100 });
+  assert.notEqual(h1, h2);
+});
+
+test("getCachedResponse returns null for miss", () => {
+  const hash = cacheHash("sonnet", msgs1);
+  const result = getCachedResponse(hash, 3600000);
+  assert.equal(result, null);
+});
+
+test("setCachedResponse + getCachedResponse roundtrip", () => {
+  const hash = cacheHash("sonnet", msgs1);
+  setCachedResponse(hash, "sonnet", "Hello! I am Claude.");
+  const result = getCachedResponse(hash, 3600000);
+  assert.ok(result);
+  assert.equal(result.response, "Hello! I am Claude.");
+  assert.equal(result.hits, 1);
+});
+
+test("getCachedResponse increments hit counter", () => {
+  const hash = cacheHash("sonnet", msgs1);
+  const r1 = getCachedResponse(hash, 3600000);
+  const r2 = getCachedResponse(hash, 3600000);
+  assert.equal(r1.hits, 2);
+  assert.equal(r2.hits, 3);
+});
+
+test("getCachedResponse respects TTL (expired entry)", () => {
+  // Insert a backdated cache entry directly
+  const d = getDb();
+  const oldHash = "test_expired_hash_12345";
+  d.prepare("INSERT OR REPLACE INTO response_cache (hash, model, response, created_at) VALUES (?, ?, ?, datetime('now', '-2 hours'))").run(oldHash, "sonnet", "Old response");
+  // TTL of 1 hour should not return a 2-hour-old entry
+  const result = getCachedResponse(oldHash, 3600000);
+  assert.equal(result, null);
+  // Clean up the backdated entry so it doesn't affect subsequent tests
+  d.prepare("DELETE FROM response_cache WHERE hash = ?").run(oldHash);
+});
+
+test("getCacheStats returns correct counts", () => {
+  const stats = getCacheStats();
+  assert.equal(stats.entries, 1);
+  assert.ok(stats.totalHits >= 3);
+  assert.ok(stats.sizeBytes > 0);
+});
+
+test("setCachedResponse upserts on conflict", () => {
+  const hash = cacheHash("sonnet", msgs1);
+  setCachedResponse(hash, "sonnet", "Updated response!");
+  const result = getCachedResponse(hash, 3600000);
+  assert.equal(result.response, "Updated response!");
+  assert.equal(result.hits, 1); // reset after upsert
+});
+
+test("clearCache removes all entries", () => {
+  // Add another entry
+  const hash2 = cacheHash("sonnet", msgs2);
+  setCachedResponse(hash2, "sonnet", "Another response");
+  const statsBefore = getCacheStats();
+  assert.equal(statsBefore.entries, 2);
+
+  const cleared = clearCache();
+  assert.equal(cleared, 2);
+
+  const statsAfter = getCacheStats();
+  assert.equal(statsAfter.entries, 0);
+});
+
+test("clearCache with TTL only removes old entries", () => {
+  // Add fresh entry
+  const hash = cacheHash("sonnet", msgs1);
+  setCachedResponse(hash, "sonnet", "Fresh response");
+
+  // Clear with TTL of 1 hour — fresh entry should survive
+  const cleared = clearCache(3600000);
+  assert.equal(cleared, 0);
+
+  const stats = getCacheStats();
+  assert.equal(stats.entries, 1);
+
+  // Clean up
+  clearCache();
+});
+
+// ── Cleanup ──
+closeDb();
+
+console.log(`\n=== Results: ${passed} passed, ${failed} failed ===\n`);
+process.exit(failed > 0 ? 1 : 0);