@juspay/neurolink 10.12.4 → 10.12.6

package/dist/cli/commands/proxy.js

@@ -22,6 +22,7 @@ import { withTimeout } from "../../lib/utils/async/withTimeout.js";
 import { formatUptime, isProcessRunning, StateFileManager, } from "../utils/serverUtils.js";
 import { configureProxyKeepAliveDispatcher } from "../../lib/proxy/proxyDispatcher.js";
 import { ProxyRuntimeConfigStore } from "../../lib/proxy/runtimeConfig.js";
+import { startProxyLogCleanupScheduler } from "../../lib/proxy/logCleanupScheduler.js";
 import { anthropicAccountKeysEqual, createAccountAllowlist, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../lib/proxy/accountSelection.js";
 import { beginProxyRequest, getProxyActivitySnapshot, trackProxyResponse, } from "../../lib/proxy/proxyActivity.js";
 import { flushProxyLifecycleEvents, getProxyLifecycleLoggerSnapshot, hashProxyLifecycleSessionId, logProxyLifecycleEvent, } from "../../lib/proxy/proxyLifecycle.js";
@@ -1208,10 +1209,12 @@ async function createProxyNeurolinkRuntime(logsDir) {
     process.env.NEUROLINK_SKIP_MCP = "true";
     const { NeuroLink } = await import("../../lib/neurolink.js");
     const neurolink = new NeuroLink();
-    const { initRequestLogger, cleanupLogs } = await import("../../lib/proxy/requestLogger.js");
+    const { initRequestLogger } = await import("../../lib/proxy/requestLogger.js");
     initRequestLogger(true, logsDir);
-    cleanupLogs(7, 500);
-    return { neurolink, cleanupLogs };
+    return {
+        neurolink,
+        logsDir: logsDir ?? join(homedir(), ".neurolink", "logs"),
+    };
 }
 function registerProxyRequestTracking(app, requestMetadata, readiness) {
     app.use("/v1/*", async (c, next) => {
@@ -2158,7 +2161,7 @@ async function refreshProxyTokensInBackground(accountAllowlist) {
         // non-fatal
     }
 }
-function startProxyBackgroundMaintenance(cleanupLogs, getAccountAllowlist) {
+function startProxyBackgroundMaintenance(logsDir, getAccountAllowlist) {
     const refreshInterval = setInterval(() => {
         if (backgroundRefreshInProgress) {
             return;
@@ -2172,15 +2175,8 @@ function startProxyBackgroundMaintenance(cleanupLogs, getAccountAllowlist) {
             backgroundRefreshInProgress = false;
         });
     }, 30_000);
-    const logCleanupInterval = setInterval(() => {
-        try {
-            cleanupLogs(7, 500);
-        }
-        catch (error) {
-            logger.debug(`[proxy] background log cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }, 60 * 60 * 1000);
-    return { refreshInterval, logCleanupInterval };
+    const logCleanupScheduler = startProxyLogCleanupScheduler({ logsDir });
+    return { refreshInterval, logCleanupScheduler };
 }
 function registerProxyShutdownHandlers(params) {
     let shutdownStarted = false;
@@ -2220,7 +2216,7 @@ function registerProxyShutdownHandlers(params) {
         }
         shutdownStarted = true;
         clearInterval(params.refreshInterval);
-        clearInterval(params.logCleanupInterval);
+        await params.logCleanupScheduler.stop();
         params.updaterSupervisor?.stop();
         params.stopRuntimeConfig?.();
         logger.always(`\nShutting down proxy (${signal})...`);
@@ -2524,7 +2520,7 @@ async function startProxyRuntime(params) {
     else {
         logger.always(chalk.dim("  ⊘ Dev mode: skipping client auto-configuration"));
     }
-    const maintenance = startProxyBackgroundMaintenance(params.cleanupLogs, () => params.runtimeConfigStore
+    const maintenance = startProxyBackgroundMaintenance(params.logsDir, () => params.runtimeConfigStore
         ? params.runtimeConfigStore.getSnapshot().accountAllowlist
         : params.accountAllowlist);
     const shutdown = registerProxyShutdownHandlers({
@@ -2719,7 +2715,7 @@ async function startProxyCommandHandler(argv) {
         // of opening a new flow per request — cuts outbound flow churn through host
         // content-filters. Runs once, after env load so it can be tuned via env.
         configureProxyKeepAliveDispatcher();
-        const { neurolink, cleanupLogs } = await createProxyNeurolinkRuntime(devPaths?.logsDir);
+        const { neurolink, logsDir } = await createProxyNeurolinkRuntime(devPaths?.logsDir);
         const configPath = argv.config
             ? resolve(argv.config)
             : join(homedir(), ".neurolink", "proxy-config.yaml");
@@ -2770,7 +2766,7 @@ async function startProxyCommandHandler(argv) {
             accountAllowlist,
             loadedEnvFile,
             passthrough,
-            cleanupLogs,
+            logsDir,
             runtimeConfigStore,
         });
     }

package/dist/cli/commands/proxyAnalyze.js

@@ -18,9 +18,11 @@ function printAnalysis(report) {
     logger.always(report.coverage.finalRequests
         ? `    Completed: ${report.requests.completed} (${chalk.green(`${report.requests.success} success`)}, ${chalk.red(`${report.requests.errors} errors`)})`
         : chalk.yellow("    Completed: unavailable (no final request logs)"));
-    logger.always(report.coverage.attempts && report.coverage.finalRequests
+    logger.always(report.coverage.attempts &&
+        report.coverage.finalRequests &&
+        report.coverage.comparableRequestAttempts
         ? `    Recovered after retry: ${report.requests.recoveredAfterRetry}`
-        : chalk.yellow("    Recovered after retry: unavailable"));
+        : chalk.yellow("    Recovered after retry: unavailable (request/attempt windows are incomplete or non-comparable)"));
     if (report.requests.errors > 0) {
         logger.always(`    Final error types: ${JSON.stringify(report.requests.errorTypes)}`);
     }
@@ -79,11 +81,14 @@ function printAnalysis(report) {
     }
     logger.always("");
     logger.always(chalk.bold("  Data Quality"));
+    if (!report.coverage.comparableRequestAttempts) {
+        logger.always(chalk.yellow("    WARNING: request and attempt totals do not cover a comparable full window; do not reconcile them as one cohort"));
+    }
     logger.always(`    ${report.dataQuality.linesRead} lines scanned, ${report.dataQuality.malformedLines} malformed, ${report.dataQuality.unsupportedLifecycleLines} unsupported lifecycle, ${report.dataQuality.lifecycleSequenceGaps} sequence gaps, ${report.dataQuality.lifecycleSequenceDuplicates} duplicates`);
     logger.always(`    Routing decisions: ${report.dataQuality.routingDecisions.valid} valid, ${report.dataQuality.routingDecisions.invalid} invalid, ${report.dataQuality.routingDecisions.absent} absent`);
     for (const [stream, range] of Object.entries(report.dataQuality.streams)) {
         if (range.observedFrom) {
-            logger.always(`    ${stream}: ${range.observedFrom} to ${range.observedTo}${range.startsAtOrBeforeRequestedWindow ? "" : chalk.yellow(" (starts after requested window)")}`);
+            logger.always(`    ${stream}: ${range.observedFrom} to ${range.observedTo}${range.completeWindow ? "" : chalk.yellow(" (partial: starts after requested window)")}`);
         }
     }
     const artifacts = report.dataQuality.bodyArtifacts;

package/dist/lib/processors/archive/ArchiveProcessor.js

@@ -37,6 +37,7 @@
  */
 import * as path from "path";
 import { BaseFileProcessor } from "../base/BaseFileProcessor.js";
+import { isDecompressionBoundExceeded, readZipEntryWithinLimit, } from "./zipEntryReader.js";
 import { SIZE_LIMITS_MB } from "../config/index.js";
 import { FileErrorCode } from "../errors/index.js";
 // =============================================================================
@@ -159,71 +160,6 @@ const SINGLE_STREAM_TOOLS = {
     xz: "xz",
     zst: "zstd",
 };
-/**
- * Read one ZIP entry's bytes without trusting the size it declares.
- *
- * `entry.getData()` cannot be used for this. It sizes its output buffer from
- * the central-directory `size` field, which the archive author chooses, and
- * adm-zip only arms its own guard when that field is positive:
- *
- *   const option = version >= 15 && expectedLength > 0
- *     ? { maxOutputLength: expectedLength } : {};
- *
- * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
- * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
- * The declared size is the attack, so nothing here may depend on it: the cap
- * comes from our own limit and is handed to the decoder.
- *
- * CRC is verified on both paths rather than dropped, so bypassing `getData()`
- * does not also quietly lose its corruption check — a STORED entry is copied
- * out rather than decoded, but it can be damaged just the same. It detects
- * damage, not malice — the CRC field is attacker-controlled too.
- */
-function readZipEntryWithinLimit(entry, maxBytes, zlibModule) {
-    const compressed = entry.getCompressedData();
-    const matchesCrc = (data) => (zlibModule.crc32(data) >>> 0) === (entry.header.crc >>> 0);
-    // STORED: the bytes are already the payload, so its own length is the bound.
-    if (entry.header.method === ZIP_METHOD_STORED) {
-        if (compressed.length > maxBytes) {
-            return { status: "too-large" };
-        }
-        return matchesCrc(compressed)
-            ? { status: "ok", buffer: compressed }
-            : { status: "corrupt" };
-    }
-    if (entry.header.method !== ZIP_METHOD_DEFLATED) {
-        return { status: "unsupported-method" };
-    }
-    let inflated;
-    try {
-        inflated = zlibModule.inflateRawSync(compressed, {
-            maxOutputLength: maxBytes,
-        });
-    }
-    catch (error) {
-        if (isDecompressionBoundExceeded(error)) {
-            return { status: "too-large" };
-        }
-        return { status: "corrupt" };
-    }
-    return matchesCrc(inflated)
-        ? { status: "ok", buffer: inflated }
-        : { status: "corrupt" };
-}
-/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
-const ZIP_METHOD_STORED = 0;
-const ZIP_METHOD_DEFLATED = 8;
-/**
- * Whether a zlib rejection is the output bound firing rather than bad input.
- *
- * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
- * which is the whole point — but it surfaces as a plain `RangeError`, and a
- * bomb reported as "failed to decompress" reads as a corrupt upload and invites
- * the user to send it again. It will fail identically every time.
- *
- * Keyed on `code`, not the message: the message embeds a byte count.
- */
-const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
 /** File extensions recognized as archive formats */
 const SUPPORTED_ARCHIVE_EXTENSIONS = [".zip", ".tar", ".gz", ".tgz", ".bz2", ".tbz2", ".jar", ".xz", ".txz", ".zst", ".tzst"];
 // =============================================================================
@@ -1419,6 +1355,7 @@ export class ArchiveProcessor extends BaseFileProcessor {
                 .sort((a, b) => a.uncompressedSize - b.uncompressedSize);
             let totalExtracted = 0;
             let extractCount = 0;
+            const zlibModule = await import("zlib");
             for (const entry of candidates) {
                 if (extractCount >= ARCHIVE_CONFIG.MAX_EXTRACT_ENTRIES) {
                     break;
@@ -1431,8 +1368,17 @@ export class ArchiveProcessor extends BaseFileProcessor {
                     if (!zipEntry) {
                         continue;
                     }
-                    const data = zipEntry.getData();
-                    if (!data || data.length === 0) {
+                    // This path was already bounded, but only by coincidence: entries
+                    // declaring 0 are dropped above, oversized declarations are dropped
+                    // above, and adm-zip caps everything else at the size it declares.
+                    // That leaves the ceiling resting on library internals we do not
+                    // trust anywhere else in this file, so it is spelled out here.
+                    const read = readZipEntryWithinLimit(zipEntry, Math.min(ARCHIVE_CONFIG.MAX_EXTRACT_ENTRY_SIZE, ARCHIVE_CONFIG.MAX_TOTAL_EXTRACT_SIZE - totalExtracted), zlibModule);
+                    if (read.status !== "ok") {
+                        continue;
+                    }
+                    const data = read.buffer;
+                    if (data.length === 0) {
                         continue;
                     }
                     // Simple binary detection: check for null bytes in first 512 bytes

package/dist/lib/processors/archive/zipEntryReader.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Bounded ZIP entry reading, shared by every processor that opens a ZIP.
+ *
+ * Extracted from ArchiveProcessor because the Office formats are ZIPs too:
+ * .pptx and .odt read their entries directly and so can be handed the same
+ * bomb, and need the same refusal. One implementation rather than three means
+ * a correction to the guard lands everywhere at once.
+ *
+ * .docx and .xlsx deliberately do NOT use this. mammoth and exceljs unzip for
+ * themselves and were measured refusing a 400MB bomb at 46MB and 53MB peak,
+ * so wrapping them in a pre-scan bought no safety and roughly tripled the cost
+ * of every ordinary document.
+ *
+ * @module processors/archive/zipEntryReader
+ */
+import type { ArchiveEntryReadResult, BoundedZipEntry } from "../../types/index.js";
+/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
+export declare const ZIP_METHOD_STORED = 0;
+export declare const ZIP_METHOD_DEFLATED = 8;
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+export declare const isDecompressionBoundExceeded: (error: unknown) => boolean;
+/**
+ * Read one ZIP entry's bytes without trusting the size it declares.
+ *
+ * `entry.getData()` cannot be used for this. It sizes its output buffer from
+ * the central-directory `size` field, which the archive author chooses, and
+ * adm-zip only arms its own guard when that field is positive:
+ *
+ *   const option = version >= 15 && expectedLength > 0
+ *     ? { maxOutputLength: expectedLength } : {};
+ *
+ * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
+ * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
+ * The declared size is the attack, so nothing here may depend on it: the cap
+ * comes from our own limit and is handed to the decoder.
+ *
+ * CRC is verified on both paths rather than dropped, so bypassing `getData()`
+ * does not also quietly lose its corruption check — a STORED entry is copied
+ * out rather than decoded, but it can be damaged just the same. It detects
+ * damage, not malice — the CRC field is attacker-controlled too.
+ */
+export declare function readZipEntryWithinLimit(entry: BoundedZipEntry, maxBytes: number, zlibModule: typeof import("zlib")): ArchiveEntryReadResult;

package/dist/lib/processors/archive/zipEntryReader.js

@@ -0,0 +1,81 @@
+/**
+ * Bounded ZIP entry reading, shared by every processor that opens a ZIP.
+ *
+ * Extracted from ArchiveProcessor because the Office formats are ZIPs too:
+ * .pptx and .odt read their entries directly and so can be handed the same
+ * bomb, and need the same refusal. One implementation rather than three means
+ * a correction to the guard lands everywhere at once.
+ *
+ * .docx and .xlsx deliberately do NOT use this. mammoth and exceljs unzip for
+ * themselves and were measured refusing a 400MB bomb at 46MB and 53MB peak,
+ * so wrapping them in a pre-scan bought no safety and roughly tripled the cost
+ * of every ordinary document.
+ *
+ * @module processors/archive/zipEntryReader
+ */
+/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
+export const ZIP_METHOD_STORED = 0;
+export const ZIP_METHOD_DEFLATED = 8;
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+export const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
+/**
+ * Read one ZIP entry's bytes without trusting the size it declares.
+ *
+ * `entry.getData()` cannot be used for this. It sizes its output buffer from
+ * the central-directory `size` field, which the archive author chooses, and
+ * adm-zip only arms its own guard when that field is positive:
+ *
+ *   const option = version >= 15 && expectedLength > 0
+ *     ? { maxOutputLength: expectedLength } : {};
+ *
+ * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
+ * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
+ * The declared size is the attack, so nothing here may depend on it: the cap
+ * comes from our own limit and is handed to the decoder.
+ *
+ * CRC is verified on both paths rather than dropped, so bypassing `getData()`
+ * does not also quietly lose its corruption check — a STORED entry is copied
+ * out rather than decoded, but it can be damaged just the same. It detects
+ * damage, not malice — the CRC field is attacker-controlled too.
+ */
+export function readZipEntryWithinLimit(entry, maxBytes, zlibModule) {
+    const compressed = entry.getCompressedData();
+    const matchesCrc = (data) => (zlibModule.crc32(data) >>> 0) === (entry.header.crc >>> 0);
+    // STORED: the bytes are already the payload, so its own length is the bound.
+    if (entry.header.method === ZIP_METHOD_STORED) {
+        if (compressed.length > maxBytes) {
+            return { status: "too-large" };
+        }
+        return matchesCrc(compressed)
+            ? { status: "ok", buffer: compressed }
+            : { status: "corrupt" };
+    }
+    if (entry.header.method !== ZIP_METHOD_DEFLATED) {
+        return { status: "unsupported-method" };
+    }
+    let inflated;
+    try {
+        inflated = zlibModule.inflateRawSync(compressed, {
+            maxOutputLength: maxBytes,
+        });
+    }
+    catch (error) {
+        if (isDecompressionBoundExceeded(error)) {
+            return { status: "too-large" };
+        }
+        return { status: "corrupt" };
+    }
+    return matchesCrc(inflated)
+        ? { status: "ok", buffer: inflated }
+        : { status: "corrupt" };
+}
+//# sourceMappingURL=zipEntryReader.js.map

package/dist/lib/processors/document/OpenDocumentProcessor.js

@@ -7,7 +7,9 @@
  * @module processors/document/OpenDocumentProcessor
  */
 import { createRequire } from "node:module";
+import * as zlib from "node:zlib";
 import { BaseFileProcessor } from "../base/BaseFileProcessor.js";
+import { readZipEntryWithinLimit } from "../archive/zipEntryReader.js";
 import { SIZE_LIMITS } from "../config/index.js";
 const require = createRequire(import.meta.url);
 // Re-import for local use within this file
@@ -64,7 +66,17 @@ export class OpenDocumentProcessor extends BaseFileProcessor {
             // Try to get content.xml
             const contentEntry = zip.getEntry("content.xml");
             if (contentEntry) {
-                const xmlContent = contentEntry.getData().toString("utf-8");
+                // Bounded rather than `getData()`: an ODF file is a ZIP, so its
+                // content.xml can declare any uncompressed size it likes, and
+                // `maxSizeMB` only ever saw the compressed archive on the way in.
+                const read = readZipEntryWithinLimit(contentEntry, SIZE_LIMITS.DOCUMENT_MAX_MB * 1024 * 1024, zlib);
+                if (read.status === "too-large") {
+                    throw new Error(`content.xml exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit for OpenDocument content`);
+                }
+                if (read.status !== "ok") {
+                    throw new Error("content.xml could not be read from the archive");
+                }
+                const xmlContent = read.buffer.toString("utf-8");
                 const extracted = this.extractTextFromXml(xmlContent);
                 textContent = extracted.text;
                 paragraphCount = extracted.paragraphCount;

package/dist/lib/processors/document/PptxProcessor.js

@@ -27,6 +27,47 @@
  * ```
  */
 import AdmZip from "adm-zip";
+import * as zlib from "node:zlib";
+import { readZipEntryWithinLimit } from "../archive/zipEntryReader.js";
+import { SIZE_LIMITS } from "../config/index.js";
+/**
+ * Total budget for everything read out of one presentation.
+ *
+ * This class is a static utility with no `BaseFileProcessor` behind it, so
+ * there is no `maxSizeMB` to inherit and nothing else was bounding these
+ * reads at all — not even a late check. A .pptx is a ZIP, so any entry in it
+ * can declare whatever uncompressed size its author likes.
+ */
+const PPTX_MAX_TOTAL_BYTES = SIZE_LIMITS.DOCUMENT_MAX_MB * 1024 * 1024;
+/**
+ * Read entries out of one presentation, refusing once the total passes budget.
+ *
+ * The budget spans the call rather than each entry: a deck of two hundred
+ * slides that each sit just under a per-entry limit is the obvious way around
+ * one. Returns null for an absent or unreadable entry, which every call site
+ * already treats as "no content here".
+ */
+function createBoundedEntryReader() {
+    let spent = 0;
+    return (entry) => {
+        if (!entry) {
+            return null;
+        }
+        const remaining = PPTX_MAX_TOTAL_BYTES - spent;
+        if (remaining <= 0) {
+            throw new Error(`PPTX content exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit`);
+        }
+        const read = readZipEntryWithinLimit(entry, remaining, zlib);
+        if (read.status === "too-large") {
+            throw new Error(`PPTX content exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit`);
+        }
+        if (read.status !== "ok") {
+            return null;
+        }
+        spent += read.buffer.length;
+        return read.buffer.toString("utf-8");
+    };
+}
 /**
  * Regex to match text content within PowerPoint XML `<a:t>` elements.
  * These elements contain the actual visible text on slides.
@@ -63,14 +104,17 @@ export class PptxProcessor {
     static async extractText(content) {
         const zip = new AdmZip(content);
         const entries = zip.getEntries();
+        const readEntry = createBoundedEntryReader();
         // Collect slide entries with their slide numbers for sorting
         const slides = [];
         for (const entry of entries) {
             const match = entry.entryName.match(SLIDE_ENTRY_REGEX);
             if (match) {
                 const slideNumber = parseInt(match[1], 10);
-                const xmlContent = entry.getData().toString("utf-8");
-                slides.push({ slideNumber, xml: xmlContent });
+                const xmlContent = readEntry(entry);
+                if (xmlContent !== null) {
+                    slides.push({ slideNumber, xml: xmlContent });
+                }
             }
         }
         // Sort slides by number (slide1, slide2, ...)
@@ -82,7 +126,7 @@ export class PptxProcessor {
         parts.push(`Presentation: ${slides.length} slide(s)\n`);
         for (const slide of slides) {
             const texts = PptxProcessor.extractTextFromXml(slide.xml);
-            const notes = PptxProcessor.extractNotesForSlide(zip, slide.slideNumber);
+            const notes = PptxProcessor.extractNotesForSlide(zip, slide.slideNumber, readEntry);
             // Emit a slide section when it has either body text or speaker notes.
             if (texts.length > 0 || notes) {
                 parts.push(`### Slide ${slide.slideNumber}`);
@@ -111,12 +155,11 @@ export class PptxProcessor {
      * @param slideNumber - 1-indexed slide number
      * @returns The notes text (runs joined by a space), or null when absent
      */
-    static extractNotesForSlide(zip, slideNumber) {
-        const relsEntry = zip.getEntry(SLIDE_RELS_NAME(slideNumber));
-        if (!relsEntry) {
+    static extractNotesForSlide(zip, slideNumber, readEntry) {
+        const relsXml = readEntry(zip.getEntry(SLIDE_RELS_NAME(slideNumber)));
+        if (relsXml === null) {
             return null;
         }
-        const relsXml = relsEntry.getData().toString("utf-8");
         let notesTarget = null;
         RELATIONSHIP_TAG_REGEX.lastIndex = 0;
         for (let match = RELATIONSHIP_TAG_REGEX.exec(relsXml); match !== null; match = RELATIONSHIP_TAG_REGEX.exec(relsXml)) {
@@ -134,11 +177,11 @@ export class PptxProcessor {
         const normalized = notesTarget
             .replace(/^\.\.\//, "ppt/")
             .replace(/^\/+/, "");
-        const notesEntry = zip.getEntry(normalized);
-        if (!notesEntry) {
+        const notesXml = readEntry(zip.getEntry(normalized));
+        if (notesXml === null) {
             return null;
         }
-        const notes = PptxProcessor.extractTextFromXml(notesEntry.getData().toString("utf-8")).join(" ");
+        const notes = PptxProcessor.extractTextFromXml(notesXml).join(" ");
         return notes.trim() || null;
     }
     /**
@@ -175,6 +218,7 @@ export class PptxProcessor {
     static async extractSlides(content, slideNumbers) {
         const zip = new AdmZip(content);
         const entries = zip.getEntries();
+        const readEntry = createBoundedEntryReader();
         // Collect all slides
         const slides = [];
         for (const entry of entries) {
@@ -182,8 +226,10 @@ export class PptxProcessor {
             if (match) {
                 const slideNumber = parseInt(match[1], 10);
                 if (slideNumbers.includes(slideNumber)) {
-                    const xmlContent = entry.getData().toString("utf-8");
-                    slides.push({ slideNumber, xml: xmlContent });
+                    const xmlContent = readEntry(entry);
+                    if (xmlContent !== null) {
+                        slides.push({ slideNumber, xml: xmlContent });
+                    }
                 }
             }
         }

package/dist/lib/proxy/logCleanupScheduler.d.ts

@@ -0,0 +1,12 @@
+import type { ProxyLogCleanupScheduler } from "../types/index.js";
+/**
+ * Runs retention in a worker so large log trees cannot delay readiness or
+ * block active streams. Concurrent runs are coalesced into the active scan.
+ */
+export declare function startProxyLogCleanupScheduler(params: {
+    logsDir: string;
+    maxAgeDays?: number;
+    maxSizeMb?: number;
+    initialDelayMs?: number;
+    intervalMs?: number;
+}): ProxyLogCleanupScheduler;

package/dist/lib/proxy/logCleanupScheduler.js

@@ -0,0 +1,74 @@
+import { Worker } from "node:worker_threads";
+import { withTimeout } from "../utils/async/withTimeout.js";
+import { logger } from "../utils/logger.js";
+const DEFAULT_INITIAL_DELAY_MS = 30_000;
+const DEFAULT_INTERVAL_MS = 60 * 60 * 1000;
+const WORKER_TERMINATION_TIMEOUT_MS = 5_000;
+/**
+ * Runs retention in a worker so large log trees cannot delay readiness or
+ * block active streams. Concurrent runs are coalesced into the active scan.
+ */
+export function startProxyLogCleanupScheduler(params) {
+    const maxAgeDays = params.maxAgeDays ?? 7;
+    const maxSizeMb = params.maxSizeMb ?? 500;
+    let activeWorker;
+    let stopped = false;
+    const trigger = () => {
+        if (stopped || activeWorker) {
+            return false;
+        }
+        let worker;
+        try {
+            worker = new Worker(params.workerUrl ??
+                new URL("./logCleanupWorkerEntry.js", import.meta.url), {
+                execArgv: process.execArgv.filter((argument) => !argument.startsWith("--input-type")),
+                workerData: {
+                    logsDir: params.logsDir,
+                    maxAgeDays,
+                    maxSizeMb,
+                },
+            });
+        }
+        catch (error) {
+            logger.debug(`[proxy] could not start background log cleanup: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+        activeWorker = worker;
+        worker.unref();
+        worker.once("error", (error) => {
+            logger.debug(`[proxy] background log cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        worker.once("exit", (code) => {
+            if (activeWorker === worker) {
+                activeWorker = undefined;
+            }
+            if (code !== 0 && !stopped) {
+                logger.debug(`[proxy] background log cleanup exited with code ${code}`);
+            }
+        });
+        return true;
+    };
+    const initialTimer = setTimeout(trigger, params.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS);
+    initialTimer.unref();
+    const interval = setInterval(trigger, params.intervalMs ?? DEFAULT_INTERVAL_MS);
+    interval.unref();
+    return {
+        trigger,
+        stop: async () => {
+            stopped = true;
+            clearTimeout(initialTimer);
+            clearInterval(interval);
+            const worker = activeWorker;
+            activeWorker = undefined;
+            if (worker) {
+                try {
+                    await withTimeout(worker.terminate(), WORKER_TERMINATION_TIMEOUT_MS, "Timed out terminating the proxy log cleanup worker");
+                }
+                catch (error) {
+                    logger.debug(`[proxy] background log cleanup termination failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        },
+    };
+}
+//# sourceMappingURL=logCleanupScheduler.js.map

package/dist/lib/proxy/logCleanupWorkerEntry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/proxy/logCleanupWorkerEntry.js

@@ -0,0 +1,15 @@
+import { parentPort, workerData } from "node:worker_threads";
+import { cleanupLogsAt } from "./requestLogger.js";
+const data = workerData;
+try {
+    cleanupLogsAt(data.logsDir, data.maxAgeDays, data.maxSizeMb);
+    parentPort?.postMessage({ ok: true });
+}
+catch (error) {
+    parentPort?.postMessage({
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+    });
+    process.exitCode = 1;
+}
+//# sourceMappingURL=logCleanupWorkerEntry.js.map

package/dist/lib/proxy/proxyAnalysis.js

@@ -737,6 +737,10 @@ export async function analyzeProxyLogs(options) {
     const artifactsReferenced = artifactsPresent + artifactsMissing;
     const finalSummary = summarizeFinalRequests(finalRequests, terminalStreamErrors, attemptsByRequest, accounts);
     const routingSummary = summarizeRouting(finalRequests);
+    const streamComplete = (stream) => {
+        const range = observedRanges[stream];
+        return range.from !== null && range.from <= sinceMs;
+    };
     return {
         generatedAt: new Date(nowMs).toISOString(),
         since: new Date(sinceMs).toISOString(),
@@ -755,6 +759,7 @@ export async function analyzeProxyLogs(options) {
             attemptLatency: attemptLatency.length > 0,
             cacheUsage: finalSummary.cache.requestsWithUsage > 0,
             routingDecisions: routingSummary.totalRecords > 0,
+            comparableRequestAttempts: streamComplete("requests") && streamComplete("attempts"),
         },
         dataQuality: {
             linesRead,
@@ -768,6 +773,7 @@ export async function analyzeProxyLogs(options) {
                     observedFrom: range.from === null ? null : new Date(range.from).toISOString(),
                     observedTo: range.to === null ? null : new Date(range.to).toISOString(),
                     startsAtOrBeforeRequestedWindow: range.from !== null && range.from <= sinceMs,
+                    completeWindow: range.from !== null && range.from <= sinceMs,
                 },
             ])),
             bodyArtifacts: {

package/dist/lib/proxy/requestLogger.d.ts

@@ -70,3 +70,9 @@ export declare function logStreamError(entry: {
  * Non-fatal — proxy keeps working even if cleanup fails.
  */
 export declare function cleanupLogs(maxAgeDays?: number, maxSizeMb?: number): void;
+/**
+ * Path-scoped retention implementation used by the proxy cleanup worker.
+ * This function is intentionally synchronous: callers must run it outside the
+ * request-serving process when the directory can contain many artifacts.
+ */
+export declare function cleanupLogsAt(activeLogDir: string, maxAgeDays?: number, maxSizeMb?: number): void;