fix(worker): key rate limiter on peer IP, not forged headers

The rate limiter trusted X-Real-IP, so a client could dodge its limit by
sending a new header value on each request. It must key on the connection
peer address. The key also strips the port, so one client shares one bucket.

internal/db/gorm/observation_store_test.go

@@ -500,15 +500,13 @@ func TestObservationStore_CleanupOldObservations(t *testing.T) {
 
 	// Store observations beyond the limit WITHOUT async cleanup
 	// We disable async cleanup by not setting cleanupFunc
-	var allIDs []int64
 	for i := 0; i < 105; i++ {
 		observation := &models.ParsedObservation{
 			Type:  models.ObsTypeDiscovery,
 			Title: "Observation",
 		}
-		id, _, err := observationStore.StoreObservation(ctx, "claude-1", "test-project", observation, i, 10)
+		_, _, err := observationStore.StoreObservation(ctx, "claude-1", "test-project", observation, i, 10)
 		require.NoError(t, err)
-		allIDs = append(allIDs, id)
 		time.Sleep(2 * time.Millisecond) // Ensure different timestamps
 	}
 

internal/worker/handlers_update.go

@@ -218,9 +218,8 @@ func (s *Service) handleUpdateRestart(w http.ResponseWriter, r *http.Request) {
 
 	// Restart in background after response is sent
 	go func() {
-		if err := s.updater.Restart(); err != nil {
-			log.Error().Err(err).Msg("Failed to restart worker")
-		}
+		// Restart only returns when the new worker failed to start.
+		log.Error().Err(s.updater.Restart()).Msg("Failed to restart worker")
 	}()
 }
 
@@ -244,8 +243,7 @@ func (s *Service) handleRestart(w http.ResponseWriter, r *http.Request) {
 	go func() {
 		// Small delay to ensure response is sent
 		time.Sleep(100 * time.Millisecond)
-		if err := s.updater.Restart(); err != nil {
-			log.Error().Err(err).Msg("Failed to restart worker")
-		}
+		// Restart only returns when the new worker failed to start.
+		log.Error().Err(s.updater.Restart()).Msg("Failed to restart worker")
 	}()
 }

internal/worker/ratelimit.go

@@ -2,6 +2,7 @@
 package worker
 
 import (
+	"net"
 	"net/http"
 	"sync"
 	"time"
@@ -206,14 +207,13 @@ func (pcrl *PerClientRateLimiter) Stats() map[string]any {
 }
 
 // PerClientRateLimitMiddleware creates middleware that applies per-client rate limiting.
-// Uses X-Forwarded-For or RemoteAddr to identify clients.
+// Identifies clients by the peer IP of the connection; forwarding headers are spoofable and ignored.
 func PerClientRateLimitMiddleware(limiter *PerClientRateLimiter) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// Get client identifier (prefer X-Real-IP from RealIP middleware)
 			clientKey := r.RemoteAddr
-			if xff := r.Header.Get("X-Real-IP"); xff != "" {
-				clientKey = xff
+			if host, _, err := net.SplitHostPort(clientKey); err == nil {
+				clientKey = host
 			}
 
 			if !limiter.Allow(clientKey) {

internal/worker/ratelimit_test.go

@@ -0,0 +1,35 @@
+package worker
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestPerClientRateLimitMiddleware_KeysOnPeerIP(t *testing.T) {
+	h := PerClientRateLimitMiddleware(NewPerClientRateLimiter(0.001, 1))(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+
+	do := func(remote, realIP string) int {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.RemoteAddr = remote
+		if realIP != "" {
+			req.Header.Set("X-Real-IP", realIP)
+		}
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec.Code
+	}
+
+	if got := do("10.0.0.1:1111", "1.1.1.1"); got != http.StatusOK {
+		t.Fatalf("first request: got %d", got)
+	}
+	// Same peer, new port and forged header: must share the exhausted bucket.
+	if got := do("10.0.0.1:2222", "2.2.2.2"); got != http.StatusTooManyRequests {
+		t.Fatalf("spoofed header/new port bypassed limit: got %d", got)
+	}
+	// Different peer is unaffected.
+	if got := do("10.0.0.2:1111", ""); got != http.StatusOK {
+		t.Fatalf("other peer: got %d", got)
+	}
+}

internal/worker/sdk/dedup_test.go

@@ -1,6 +1,7 @@
 package sdk
 
 import (
+	"context"
 	"testing"
 
 	"github.com/lukaszraczylo/claude-mnemonic/internal/vector/sqlitevec"
@@ -121,7 +122,7 @@ func TestCheckVectorDeduplication_NilClient(t *testing.T) {
 		Narrative: "Some narrative text",
 	}
 
-	result := p.checkVectorDeduplication(nil, obs, "test-project")
+	result := p.checkVectorDeduplication(context.Background(), obs, "test-project")
 	if result.Action != "insert" {
 		t.Errorf("expected Action='insert' when vectorClient is nil, got %q", result.Action)
 	}
@@ -136,7 +137,7 @@ func TestCheckVectorDeduplication_EmptySearchText(t *testing.T) {
 		// All empty fields
 	}
 
-	result := p.checkVectorDeduplication(nil, obs, "test-project")
+	result := p.checkVectorDeduplication(context.Background(), obs, "test-project")
 	if result.Action != "insert" {
 		t.Errorf("expected Action='insert' for empty observation, got %q", result.Action)
 	}

internal/worker/service.go

@@ -1213,7 +1213,6 @@ func (s *Service) setupMiddleware() {
 
 	s.router.Use(middleware.Logger)
 	s.router.Use(middleware.Recoverer)
-	s.router.Use(middleware.RealIP)
 
 	// Add security headers (X-Frame-Options, X-Content-Type-Options, CSP, etc.)
 	s.router.Use(SecurityHeaders)
@@ -1227,7 +1226,7 @@ func (s *Service) setupMiddleware() {
 	// Add gzip compression for responses >1KB (reduces bandwidth ~70% for JSON)
 	s.router.Use(middleware.Compress(5)) // Level 5 = good balance of speed vs compression
 
-	// Apply per-client rate limiting (after RealIP so we get the real client IP)
+	// Apply per-client rate limiting (keyed on the socket peer address; forwarding headers are untrusted)
 	if s.rateLimiter != nil {
 		s.router.Use(PerClientRateLimitMiddleware(s.rateLimiter))
 	}

marketplace.json

@@ -13,7 +13,7 @@
     {
       "name": "claude-mnemonic",
       "description": "Persistent memory system for Claude Code - Go implementation with SQLite and ChromaDB vector search",
-      "version": "0.21.73",
+      "version": "0.21.81",
       "author": {
         "name": "lukaszraczylo",
         "url": "https://github.com/lukaszraczylo"
@@ -23,25 +23,25 @@
       "license": "MIT",
       "homepage": "https://github.com/lukaszraczylo/claude-mnemonic",
       "releases": {
-        "latest": "0.21.73",
+        "latest": "0.21.81",
         "versions": {
-          "0.21.73": {
-            "releaseDate": "2026-09-30",
+          "0.21.81": {
+            "releaseDate": "2026-10-03",
             "downloads": {
               "darwin-arm64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.73/claude-mnemonic_0.21.73_darwin_arm64.tar.gz",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.81/claude-mnemonic_0.21.81_darwin_arm64.tar.gz",
                 "format": "tar.gz",
-                "sha256": "a133fcb3fceb28ca469fcc9aae028474bd869522de2d6f9b0a23ec9a9b68e7b5"
+                "sha256": "8da5803dc0acd44b6e43b4c8d7ff2667811dd8ea5f7bf40643c91829e3e2c37c"
               },
               "linux-amd64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.73/claude-mnemonic_0.21.73_linux_amd64.tar.gz",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.81/claude-mnemonic_0.21.81_linux_amd64.tar.gz",
                 "format": "tar.gz",
-                "sha256": "c06be767495f545e72e305e0a076b191e74737c8212982f4468ba21bca565ce3"
+                "sha256": "b1a1e7a6317280ef2bce92e349ffdbbf0c9df5cf92f4bce0378c34194b871c01"
               },
               "windows-amd64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.73/claude-mnemonic_0.21.73_windows_amd64.zip",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.81/claude-mnemonic_0.21.81_windows_amd64.zip",
                 "format": "zip",
-                "sha256": "509bacf964d9bfc038570b3e2c59322d94602b4830c832404a4e2afbaf25ef7e"
+                "sha256": "869b99958371451a8efe91cc91a9f0eb654a355c0b77a769ab9916e7908c11b1"
               }
             }
           }