PUBLIC_CHAT_DAILY_MAX (default 2000 as of v0.9.0) counts calls, not dollars. With a local Ollama PUBLIC_CHAT_MODEL that is fine — abuse costs CPU. But if an operator points PUBLIC_CHAT_MODEL at a paid API model, 2000 frontier calls/day is a real and unbounded-per-call bill.
Proposal:
- Add a spend-based ceiling (estimated tokens x per-model price) alongside the call count, tripping first.
- Make Cloudflare Turnstile on by default whenever
PUBLIC_CHAT_MODEL resolves to a paid provider.
- Refuse to start (or loudly warn) if a paid public model is set with neither a spend cap nor Turnstile.
Today this is documented as a loud warning in .env.example; this issue is to enforce it mechanically.
PUBLIC_CHAT_DAILY_MAX(default 2000 as of v0.9.0) counts calls, not dollars. With a local OllamaPUBLIC_CHAT_MODELthat is fine — abuse costs CPU. But if an operator pointsPUBLIC_CHAT_MODELat a paid API model, 2000 frontier calls/day is a real and unbounded-per-call bill.Proposal:
PUBLIC_CHAT_MODELresolves to a paid provider.Today this is documented as a loud warning in
.env.example; this issue is to enforce it mechanically.