feat: multi-provider routing with sensitive content guard

Add complexity-based routing to distribute tasks across providers
(Anthropic, Cerebras, DeepInfra, OpenRouter) based on task difficulty.
Sensitive content (API keys, secrets, PII) is automatically detected
and restricted to approved providers only.

- Add sensitive-guard: pre-routing check blocks secrets from third-party LLMs
- Add complexity-scorer: 0-1 scoring with regression test corpus (26 pinned prompts)
- Add provider-pricing: cost table for routing decisions
- Add Anthropic Batch API client with 50% discount async processing
- Add Cerebras + DeepInfra adapter stubs (OpenAI-compatible)
- Add MCP provider handlers (delegate_to_model, list_providers, provider_status)
- Refactor provider-adapter: remove unused Gemini types, deduplicate headers
- Fix: preference path no longer bypasses sensitive guard in model-router
- Fix: timer leak in batch-client waitForCompletion (unref)
- Bump version to 1.2.0

Author: StackMemory Bot (CLI)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackmemoryai/stackmemory",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "Project-scoped memory for AI coding tools. Durable context across sessions with MCP integration, frames, smart retrieval, Claude Code skills, and automatic hooks.",
   "engines": {
     "node": ">=20.0.0",
@@ -93,6 +93,10 @@
     "format": "prettier --write src/**/*.ts scripts/**/*.ts",
     "test": "vitest",
     "test:ui": "vitest --ui",
+    "test:unit": "vitest run --project unit",
+    "test:integration": "vitest run --project integration",
+    "test:live": "vitest run --project live",
+    "test:all": "vitest run",
     "test:run": "vitest run",
     "test:pre-publish": "./scripts/test-pre-publish-quick.sh",
     "test:pre-commit": "vitest related --run --reporter=dot --silent --bail=1",

scripts/test-pre-publish-quick.sh

@@ -53,7 +53,7 @@ log_success "Package structure valid"
 
 # Core tests + search benchmark (100-frame smoke)
 log_info "Running tests..."
-npx vitest run --reporter=dot --bail=3 --retry 1 2>&1 | tail -5
+npm run test:all -- --reporter=dot --bail=3 --retry 1 2>&1 | tail -5
 if [ ${PIPESTATUS[0]} -ne 0 ]; then
     log_error "Tests failed"
 fi

src/core/config/feature-flags.ts

@@ -15,6 +15,7 @@ export interface FeatureFlags {
   aiSummaries: boolean;
   skills: boolean;
   ralph: boolean;
+  multiProvider: boolean;
 }
 
 /**
@@ -62,6 +63,11 @@ export function isFeatureEnabled(feature: keyof FeatureFlags): boolean {
       // Ralph enabled by default in development (unless explicitly disabled)
       // For npm package users, must be explicitly enabled
       return process.env['STACKMEMORY_RALPH'] !== 'false';
+    case 'multiProvider':
+      return (
+        process.env['STACKMEMORY_MULTI_PROVIDER'] === 'true' ||
+        process.env['STACKMEMORY_MULTI_PROVIDER'] === '1'
+      );
     default:
       return false;
   }
@@ -78,6 +84,7 @@ export function getFeatureFlags(): FeatureFlags {
     aiSummaries: isFeatureEnabled('aiSummaries'),
     skills: isFeatureEnabled('skills'),
     ralph: isFeatureEnabled('ralph'),
+    multiProvider: isFeatureEnabled('multiProvider'),
   };
 }
 
@@ -105,5 +112,8 @@ export function logFeatureStatus(): void {
     console.log(
       `  Ralph: ${flags.ralph ? 'enabled' : 'disabled (set STACKMEMORY_RALPH=true)'}`
     );
+    console.log(
+      `  MultiProvider: ${flags.multiProvider ? 'enabled' : 'disabled (set STACKMEMORY_MULTI_PROVIDER=true)'}`
+    );
   }
 }

src/core/extensions/__tests__/cerebras-adapter.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { CerebrasAdapter } from '../cerebras-adapter.js';
+
+describe('CerebrasAdapter', () => {
+  let adapter: CerebrasAdapter;
+
+  beforeEach(() => {
+    adapter = new CerebrasAdapter({
+      apiKey: 'test-key',
+      baseUrl: 'https://api.cerebras.ai/v1',
+    });
+  });
+
+  it('should have correct id and name', () => {
+    expect(adapter.id).toBe('cerebras');
+    expect(adapter.name).toBe('Cerebras');
+  });
+
+  it('should not support any provider extensions', () => {
+    expect(adapter.supportsExtension('claude')).toBe(false);
+    expect(adapter.supportsExtension('gpt')).toBe(false);
+    expect(adapter.supportsExtension('gemini')).toBe(false);
+  });
+
+  it('should list Cerebras models', async () => {
+    const models = await adapter.listModels();
+    expect(models).toContain('llama-4-scout-17b-16e-instruct');
+    expect(models.length).toBeGreaterThan(0);
+  });
+
+  it('should use Cerebras base URL by default', () => {
+    const defaultAdapter = new CerebrasAdapter({ apiKey: 'key' });
+    // Validate by attempting a completion with a mock — the URL is set internally
+    expect(defaultAdapter).toBeDefined();
+  });
+
+  it('should format request as OpenAI-compatible', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          choices: [{ message: { content: 'hello' }, finish_reason: 'stop' }],
+          usage: { prompt_tokens: 10, completion_tokens: 5 },
+        }),
+        { status: 200 }
+      )
+    );
+
+    const result = await adapter.complete([{ role: 'user', content: 'test' }], {
+      model: 'llama-4-scout-17b-16e-instruct',
+      maxTokens: 100,
+    });
+
+    expect(result.content[0]).toMatchObject({ type: 'text', text: 'hello' });
+    expect(result.usage.inputTokens).toBe(10);
+    expect(result.usage.outputTokens).toBe(5);
+
+    const [url, opts] = fetchSpy.mock.calls[0];
+    expect(url).toContain('cerebras.ai');
+    expect((opts as any).headers?.Authorization).toBe('Bearer test-key');
+
+    fetchSpy.mockRestore();
+  });
+
+  it('should throw on API error during complete', async () => {
+    const fetchSpy = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(
+        new Response('Unauthorized', {
+          status: 401,
+          statusText: 'Unauthorized',
+        })
+      );
+
+    await expect(
+      adapter.complete([{ role: 'user', content: 'test' }], {
+        model: 'llama3.1-8b',
+        maxTokens: 100,
+      })
+    ).rejects.toThrow('GPT API error: 401');
+
+    fetchSpy.mockRestore();
+  });
+});

src/core/extensions/__tests__/deepinfra-adapter.test.ts

@@ -0,0 +1,87 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { DeepInfraAdapter } from '../deepinfra-adapter.js';
+
+describe('DeepInfraAdapter', () => {
+  let adapter: DeepInfraAdapter;
+
+  beforeEach(() => {
+    adapter = new DeepInfraAdapter({
+      apiKey: 'test-key',
+      baseUrl: 'https://api.deepinfra.com/v1/openai',
+    });
+  });
+
+  it('should have correct id and name', () => {
+    expect(adapter.id).toBe('deepinfra');
+    expect(adapter.name).toBe('DeepInfra');
+  });
+
+  it('should not support any provider extensions', () => {
+    expect(adapter.supportsExtension('claude')).toBe(false);
+    expect(adapter.supportsExtension('gpt')).toBe(false);
+  });
+
+  it('should list DeepInfra models', async () => {
+    const models = await adapter.listModels();
+    expect(models).toContain('THUDM/glm-4-9b-chat');
+    expect(models.length).toBeGreaterThan(0);
+  });
+
+  it('should use DeepInfra base URL by default', () => {
+    const defaultAdapter = new DeepInfraAdapter({ apiKey: 'key' });
+    expect(defaultAdapter).toBeDefined();
+  });
+
+  it('should format request correctly for DeepInfra endpoint', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          choices: [
+            {
+              message: { content: 'response from glm' },
+              finish_reason: 'stop',
+            },
+          ],
+          usage: { prompt_tokens: 20, completion_tokens: 15 },
+        }),
+        { status: 200 }
+      )
+    );
+
+    const result = await adapter.complete(
+      [{ role: 'user', content: 'hello' }],
+      { model: 'THUDM/glm-4-9b-chat', maxTokens: 256 }
+    );
+
+    expect(result.content[0]).toMatchObject({
+      type: 'text',
+      text: 'response from glm',
+    });
+    expect(result.usage).toEqual({ inputTokens: 20, outputTokens: 15 });
+
+    const [url] = fetchSpy.mock.calls[0];
+    expect(url).toContain('deepinfra.com');
+
+    fetchSpy.mockRestore();
+  });
+
+  it('should throw on API error during complete', async () => {
+    const fetchSpy = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(
+        new Response('rate limited', {
+          status: 429,
+          statusText: 'Too Many Requests',
+        })
+      );
+
+    await expect(
+      adapter.complete([{ role: 'user', content: 'test' }], {
+        model: 'THUDM/glm-4-9b-chat',
+        maxTokens: 100,
+      })
+    ).rejects.toThrow('GPT API error: 429');
+
+    fetchSpy.mockRestore();
+  });
+});

src/core/extensions/__tests__/openrouter-integration.test.ts

@@ -0,0 +1,48 @@
+/**
+ * Live integration test for OpenRouter via GPTAdapter.
+ * Skipped when OPENROUTER_API_KEY is not set.
+ */
+import { describe, it, expect } from 'vitest';
+import { GPTAdapter } from '../provider-adapter.js';
+
+const OPENROUTER_API_KEY = process.env.OPENROUTER_API_KEY;
+const MODEL = 'meta-llama/llama-4-scout';
+
+describe.skipIf(!OPENROUTER_API_KEY)('OpenRouter GPTAdapter (live)', () => {
+  let adapter: GPTAdapter;
+
+  adapter = new GPTAdapter({
+    apiKey: OPENROUTER_API_KEY!,
+    baseUrl: 'https://openrouter.ai/api',
+  });
+
+  it('should complete a prompt and return text content', async () => {
+    const result = await adapter.complete(
+      [{ role: 'user', content: 'Reply with exactly: hello world' }],
+      { model: MODEL, maxTokens: 64, temperature: 0 }
+    );
+
+    const text = result.content
+      .filter((c) => c.type === 'text')
+      .map((c) => (c as { type: 'text'; text: string }).text)
+      .join('');
+
+    expect(text.length).toBeGreaterThan(0);
+    expect(result.stopReason).toBeDefined();
+  }, 30_000);
+
+  it('should return usage with inputTokens > 0', async () => {
+    const result = await adapter.complete(
+      [{ role: 'user', content: 'Say hi' }],
+      { model: MODEL, maxTokens: 16, temperature: 0 }
+    );
+
+    expect(result.usage.inputTokens).toBeGreaterThan(0);
+    expect(result.usage.outputTokens).toBeGreaterThan(0);
+  }, 30_000);
+
+  it('should validate connection successfully', async () => {
+    const ok = await adapter.validateConnection();
+    expect(ok).toBe(true);
+  }, 30_000);
+});