@chatpanel/gateway 0.6.42 → 0.6.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.42",
+  "version": "0.6.43",
   "description": "Local privacy gateway \u2014 redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/access-log-store.js

@@ -0,0 +1,45 @@
+// Persist the observability access ring across gateway restarts.
+//
+// The pure ring (createAccessLog, @chatpanel/events) is in-memory by design. But the gateway
+// restarts often — every update — and an empty "which agent read what" panel after each
+// restart reads as "nothing is set up" when plenty is. So we back the ring with a tiny file:
+// load it at start, debounce-write it on change. This is SAFE to persist because every event
+// is already metadata only — client, tool, ms, and a REDACTED note (a search query's text is
+// never in it). 0600, capped, under ~/.chatpanel.
+//
+// Kept out of the pure events module on purpose: persistence is a platform concern (node:fs),
+// and the shared contract must stay dependency-free and runnable in a browser.
+
+import { createAccessLog, ACCESS_LOG_MAX } from './observability.js';
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import os from 'node:os';
+
+const PATH = process.env.CHATPANEL_ACCESS_LOG || join(os.homedir(), '.chatpanel', 'access-log.json');
+
+export function createPersistentAccessLog({ max = ACCESS_LOG_MAX, path = PATH, persistMs = 1000 } = {}) {
+  const log = createAccessLog(max);
+
+  // Load prior events, oldest-first, so the ring keeps chronological order.
+  try {
+    const arr = JSON.parse(readFileSync(path, 'utf8'));
+    if (Array.isArray(arr)) for (const e of arr) if (e && typeof e === 'object') log.push(e);
+  } catch { /* no prior log, or unreadable — start empty */ }
+
+  let timer = null;
+  const persist = () => {
+    try {
+      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+      // snapshot() is newest-first; store oldest-first so a reload preserves order.
+      writeFileSync(path, JSON.stringify(log.snapshot().reverse()), { mode: 0o600 });
+    } catch { /* best effort — telemetry must never break the gateway */ }
+  };
+  const schedule = () => { clearTimeout(timer); timer = setTimeout(persist, persistMs); if (timer.unref) timer.unref(); };
+
+  return {
+    push(evt) { const e = log.push(evt); schedule(); return e; },
+    snapshot: (n) => log.snapshot(n),
+    get size() { return log.size; },
+    clear() { log.clear(); persist(); },
+  };
+}

package/src/server.js

@@ -41,12 +41,13 @@ import { STT_MODEL_CATALOG, isKnownSttModel, isValidCustomSttId, DEFAULT_STT_MOD
 import { resolvePro, checkQuota, consume, usage } from './freegate.js';
 import { publicConfig, applyConfigPatch, applyNerModelSelection, persistConfig, configPath } from './configstore.js';
 import { resolveDestination, aggregateModelsAsync } from './router.js';
-import { createAccessLog, makeAccessEvent } from './observability.js';
+import { makeAccessEvent } from './observability.js';
+import { createPersistentAccessLog } from './access-log-store.js';
 import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.42';
+export const VERSION = '0.6.43';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -54,12 +55,12 @@ export const VERSION = '0.6.42';
 // See docs/architecture-data-tiers.
 const historyStore = await createHistoryStore();
 
-// OBSERVABILITY — an in-memory ring of "which agent read what, when". Populated by the
-// MCP server process (chatpanel-gateway mcp) reporting each tool call here, so a person
-// can SEE cross-agent access in ChatPanel's dashboard. In-memory by design: a working
-// session's activity, not an audit trail that itself becomes data to protect. The note on
-// each event is redacted (never a search query) by makeAccessEvent.
-const accessLog = createAccessLog();
+// OBSERVABILITY — a ring of "which agent read what, when", persisted across restarts (the
+// gateway updates often; an empty panel after each restart reads as "nothing is set up").
+// Populated by the MCP process (chatpanel-gateway mcp) reporting each tool call, so a person
+// can SEE cross-agent access in ChatPanel's dashboard. Safe to persist: every event is
+// metadata only — client/tool/ms + a REDACTED note (a search query's text is never in it).
+const accessLog = createPersistentAccessLog();
 
 const KNOWN_AGENTS = new Set(['codex', 'claude', 'opencode', 'pi', 'kiro', 'antigravity']);