perf(mothership): cache the superuser routing gate

getMothershipBaseURL joined user+settings on EVERY chat turn to learn what
is true for almost everyone: not a superuser. The negative gate now sits in
an LRU (max 50k, 60s TTL); real superusers still read fresh each turn so an
environment flip applies immediately, and the settings PATCH invalidates
the toggling user's entry (same-process write → reader).

Claude-Session: https://claude.ai/code/session_01CgaxNAaeD3taGdghbXn17w

Author: Sg312

apps/sim/app/api/users/me/settings/route.ts

@@ -8,6 +8,7 @@ import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { invalidateSuperUserGate } from '@/lib/mothership/server/agent-url'
 import { defaultUserSettings, getUserSettings } from '@/lib/users/queries'
 
 const logger = createLogger('UserSettingsAPI')
@@ -71,6 +72,10 @@ export const PATCH = withRouteHandler(async (request: NextRequest) => {
         },
       })
 
+    /* Chat-turn routing caches the superuser gate; a toggle here must reach the very
+       next turn, so drop this user's cached entry (same-process write → reader). */
+    if ('superUserModeEnabled' in validatedData) invalidateSuperUserGate(userId)
+
     return NextResponse.json({ success: true }, { status: 200 })
   } catch (error: any) {
     logger.error(`[${requestId}] Settings update error`, error)

apps/sim/lib/mothership/server/agent-url.test.ts

@@ -2,6 +2,7 @@ import { user } from '@sim/db/schema'
 import { queueTableRows, resetDbChainMock } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
+  clearSuperUserGate,
   getMothershipBaseURL,
   getMothershipSourceEnvHeaders,
   MOTHERSHIP_SOURCE_ENV_HEADER,
@@ -36,6 +37,7 @@ describe('getMothershipBaseURL', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
+    clearSuperUserGate()
     envMock.COPILOT_SOURCE_ENV = undefined
   })
 
@@ -50,6 +52,27 @@ describe('getMothershipBaseURL', () => {
     )
   })
 
+  it('caches the negative gate: a non-superuser skips the DB on repeat turns until invalidated', async () => {
+    queueTableRows(user, [
+      { role: 'user', superUserModeEnabled: false, mothershipEnvironment: 'dev' },
+    ])
+    await expect(getMothershipBaseURL({ userId: 'user-cache' })).resolves.toBe(
+      'https://default.mothership.test'
+    )
+    // A superuser row is now queued — a cache hit never reads it and stays default.
+    queueTableRows(user, [
+      { role: 'admin', superUserModeEnabled: true, mothershipEnvironment: 'dev' },
+    ])
+    await expect(getMothershipBaseURL({ userId: 'user-cache' })).resolves.toBe(
+      'https://default.mothership.test'
+    )
+    // Invalidation (the settings PATCH path) makes the next turn read fresh.
+    clearSuperUserGate()
+    await expect(getMothershipBaseURL({ userId: 'user-cache' })).resolves.toBe(
+      'https://dev.mothership.test'
+    )
+  })
+
   it('ignores stored and explicit environments for non-admin users', async () => {
     queueTableRows(user, [
       { role: 'user', superUserModeEnabled: true, mothershipEnvironment: 'dev' },

apps/sim/lib/mothership/server/agent-url.ts

@@ -1,6 +1,7 @@
 import { db } from '@sim/db'
 import { settings, user } from '@sim/db/schema'
 import { eq } from 'drizzle-orm'
+import { LRUCache } from 'lru-cache'
 import { type MothershipEnvironment, mothershipEnvironmentSchema } from '@/lib/api/contracts'
 import { env } from '@/lib/core/config/env'
 import { SIM_AGENT_API_URL, SIM_AGENT_API_URL_DEFAULT } from '@/lib/mothership/constants'
@@ -40,6 +41,23 @@ function getDefaultMothershipBaseURL(fallbackUrl?: string | null): string {
   return normalizeUrl(fallback) ?? normalizeUrl(SIM_AGENT_API_URL) ?? SIM_AGENT_API_URL_DEFAULT
 }
 
+/**
+ * Superuser-gate cache: almost every user is NOT an admin with superuser mode on, yet the
+ * check joined user+settings on every chat turn. Caching only the negative gate keeps the
+ * hot path DB-free while a real superuser's environment selection stays fresh per turn
+ * (their env flip must apply immediately). A newly granted superuser waits at most one TTL.
+ */
+const superUserGate = new LRUCache<string, boolean>({ max: 50_000, ttl: 60_000 })
+
+export function invalidateSuperUserGate(userId: string): void {
+  superUserGate.delete(userId)
+}
+
+/** Test-only: drops every cached gate so each case sees its own queued DB rows. */
+export function clearSuperUserGate(): void {
+  superUserGate.clear()
+}
+
 export async function getMothershipBaseURL(
   options: GetMothershipBaseURLOptions = {}
 ): Promise<string> {
@@ -48,6 +66,8 @@ export async function getMothershipBaseURL(
   const { userId } = options
   if (!userId) return defaultUrl
 
+  if (superUserGate.get(userId) === false) return defaultUrl
+
   const [row] = await db
     .select({
       role: user.role,
@@ -60,6 +80,7 @@ export async function getMothershipBaseURL(
     .limit(1)
 
   const effectiveSuperUser = row?.role === 'admin' && (row.superUserModeEnabled ?? false)
+  superUserGate.set(userId, effectiveSuperUser)
   if (!effectiveSuperUser) return defaultUrl
 
   const selectedEnvironment = options.environment ?? row.mothershipEnvironment