@solongate/proxy 0.83.6 → 0.83.8

package/dist/index.js

@@ -7573,6 +7573,41 @@ import { closeSync, existsSync as existsSync4, openSync as openSync3, readdirSyn
 import { homedir as homedir6 } from "os";
 import { createHash as createHash2 } from "crypto";
 import { isAbsolute, join as join8 } from "path";
+function localLogsSetting() {
+  const off = { enabled: false, configuredPath: null, usableHere: true, file: DEFAULT_LOCAL_LOG };
+  try {
+    for (const cache of policyCachesNewestFirst()) {
+      try {
+        const c2 = JSON.parse(readFileSync8(cache, "utf-8"));
+        const l = c2?.security?.localLogs;
+        if (!l || typeof l.enabled !== "boolean") continue;
+        if (!l.enabled) return { ...off, configuredPath: typeof l.path === "string" ? l.path.trim() || null : null };
+        const raw = typeof l.path === "string" ? l.path.trim() : "";
+        const dir = raw.replace(/[\\/]+$/, "");
+        if (!dir) return { enabled: true, configuredPath: null, usableHere: true, file: DEFAULT_LOCAL_LOG };
+        if (!isAbsolute(dir)) return { enabled: true, configuredPath: raw, usableHere: false, file: DEFAULT_LOCAL_LOG };
+        const file = join8(dir, "solongate-audit.jsonl");
+        const usable = existsSync4(file) || existsSync4(dir);
+        return { enabled: true, configuredPath: raw, usableHere: usable, file: usable ? file : DEFAULT_LOCAL_LOG };
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return off;
+}
+function policyCachesNewestFirst() {
+  const sgDir = join8(homedir6(), ".solongate");
+  return readdirSync(sgDir).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
+    const p = join8(sgDir, f);
+    let mtime = 0;
+    try {
+      mtime = statSync(p).mtimeMs;
+    } catch {
+    }
+    return { p, mtime };
+  }).sort((a, b) => b.mtime - a.mtime).map((x) => x.p);
+}
 function localLogFile() {
   try {
     const sgDir = join8(homedir6(), ".solongate");
@@ -8498,6 +8533,7 @@ function LivePanel({ active: active2 }) {
   const [cloudBuf, setCloudBuf] = useState2([]);
   const [localBuf, setLocalBuf] = useState2([]);
   const [localOn, setLocalOn] = useState2(null);
+  const [localPath, setLocalPath] = useState2(null);
   const [ring, setRing] = useState2(null);
   const [log3, setLog] = useState2([]);
   const [filter, setFilter] = useState2("all");
@@ -8552,12 +8588,11 @@ function LivePanel({ active: active2 }) {
   const paused = () => frozenRef.current || Date.now() < pausedUntil.current;
   const pollLocal = useCallback2(() => {
     if (frozenRef.current) return;
-    const lines = tailLines(localLogFile());
-    if (!lines.length) {
-      setLocalOn((prev) => prev === null ? false : prev);
-      return;
-    }
-    setLocalOn(true);
+    const setting = localLogsSetting();
+    setLocalOn(setting.enabled);
+    setLocalPath(setting);
+    const lines = tailLines(setting.file);
+    if (!lines.length) return;
     const fresh = [];
     for (const line of lines) {
       try {
@@ -9369,7 +9404,17 @@ function LivePanel({ active: active2 }) {
       searchRow,
       localOn === false ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
         /* @__PURE__ */ jsx2(Text2, { color: theme.warn, children: "local logs off" }),
-        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ` \u2014 enable: dataroom \u2192 Settings (local logs) or dashboard \u2192 Settings \xB7 hooks write ${localLogFile()}` })
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2014 enable: dataroom \u2192 Settings (local logs) or dashboard \u2192 Settings" })
+      ] }) : localOn && localPath && !localPath.usableHere ? (
+        // The folder is a PROJECT setting, so it can name a path that exists
+        // on another machine. Saying so beats showing a path nothing writes to.
+        /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx2(Text2, { color: theme.warn, children: "local logs on" }),
+          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ` \u2014 ${localPath.configuredPath} is not a folder on this device \xB7 writing to ${localPath.file}` })
+        ] })
+      ) : localOn && localBuf.length === 0 ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "local logs on" }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ` \u2014 no entries yet \xB7 hooks write ${localPath?.file ?? ""}` })
       ] }) : null,
       windowed.length === 0 ? (
         // With a source filter on, "awaiting traffic" reads as "nothing is
@@ -11573,6 +11618,18 @@ function SettingsPanel({
   const [diagBusy, setDiagBusy] = useState8(null);
   const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
   const [updBusy, setUpdBusy] = useState8(false);
+  const [llSetting, setLlSetting] = useState8(null);
+  useEffect7(() => {
+    const read = () => {
+      try {
+        setLlSetting(localLogsSetting());
+      } catch {
+      }
+    };
+    read();
+    const t = setInterval(read, 5e3);
+    return () => clearInterval(t);
+  }, []);
   const [canInstall, setCanInstall] = useState8(null);
   useEffect7(() => {
     let live2 = true;
@@ -12229,7 +12286,16 @@ function SettingsPanel({
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "path ".padEnd(11) }),
-          local?.path ? /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate2(local.path, cols - 14) }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "not set \u2014 enter to edit" })
+          local?.path ? (
+            // The folder is a PROJECT setting shared by every device on it, so
+            // it can name a path that only exists on another OS. The hooks then
+            // quietly fall back and this row was the last place still claiming
+            // the configured path was in use.
+            llSetting && local.enabled && !llSetting.usableHere ? /* @__PURE__ */ jsxs8(Fragment5, { children: [
+              /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: truncate2(local.path, Math.max(12, Math.floor((cols - 20) / 2))) }),
+              /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `  not valid here \u2192 ${truncate2(llSetting.file, Math.max(12, Math.floor((cols - 20) / 2)))}` })
+            ] }) : /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate2(local.path, cols - 14) })
+          ) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "not set \u2014 enter to edit" })
         ] });
       case "ll-server":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [

package/dist/tui/index.js

@@ -741,6 +741,41 @@ import { homedir as homedir2 } from "os";
 import { createHash } from "crypto";
 import { isAbsolute, join as join2 } from "path";
 var DEFAULT_LOCAL_LOG = join2(homedir2(), ".solongate", "local-logs", "solongate-audit.jsonl");
+function localLogsSetting() {
+  const off = { enabled: false, configuredPath: null, usableHere: true, file: DEFAULT_LOCAL_LOG };
+  try {
+    for (const cache of policyCachesNewestFirst()) {
+      try {
+        const c2 = JSON.parse(readFileSync2(cache, "utf-8"));
+        const l = c2?.security?.localLogs;
+        if (!l || typeof l.enabled !== "boolean") continue;
+        if (!l.enabled) return { ...off, configuredPath: typeof l.path === "string" ? l.path.trim() || null : null };
+        const raw = typeof l.path === "string" ? l.path.trim() : "";
+        const dir = raw.replace(/[\\/]+$/, "");
+        if (!dir) return { enabled: true, configuredPath: null, usableHere: true, file: DEFAULT_LOCAL_LOG };
+        if (!isAbsolute(dir)) return { enabled: true, configuredPath: raw, usableHere: false, file: DEFAULT_LOCAL_LOG };
+        const file = join2(dir, "solongate-audit.jsonl");
+        const usable = existsSync(file) || existsSync(dir);
+        return { enabled: true, configuredPath: raw, usableHere: usable, file: usable ? file : DEFAULT_LOCAL_LOG };
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return off;
+}
+function policyCachesNewestFirst() {
+  const sgDir = join2(homedir2(), ".solongate");
+  return readdirSync(sgDir).filter((f) => f.startsWith(".policy-cache-") && f.endsWith(".json")).map((f) => {
+    const p = join2(sgDir, f);
+    let mtime = 0;
+    try {
+      mtime = statSync(p).mtimeMs;
+    } catch {
+    }
+    return { p, mtime };
+  }).sort((a, b) => b.mtime - a.mtime).map((x) => x.p);
+}
 function localLogFile() {
   try {
     const sgDir = join2(homedir2(), ".solongate");
@@ -1619,6 +1654,7 @@ function LivePanel({ active: active2 }) {
   const [cloudBuf, setCloudBuf] = useState2([]);
   const [localBuf, setLocalBuf] = useState2([]);
   const [localOn, setLocalOn] = useState2(null);
+  const [localPath, setLocalPath] = useState2(null);
   const [ring, setRing] = useState2(null);
   const [log, setLog] = useState2([]);
   const [filter, setFilter] = useState2("all");
@@ -1673,12 +1709,11 @@ function LivePanel({ active: active2 }) {
   const paused = () => frozenRef.current || Date.now() < pausedUntil.current;
   const pollLocal = useCallback2(() => {
     if (frozenRef.current) return;
-    const lines = tailLines(localLogFile());
-    if (!lines.length) {
-      setLocalOn((prev) => prev === null ? false : prev);
-      return;
-    }
-    setLocalOn(true);
+    const setting = localLogsSetting();
+    setLocalOn(setting.enabled);
+    setLocalPath(setting);
+    const lines = tailLines(setting.file);
+    if (!lines.length) return;
     const fresh = [];
     for (const line of lines) {
       try {
@@ -2490,7 +2525,17 @@ function LivePanel({ active: active2 }) {
       searchRow,
       localOn === false ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
         /* @__PURE__ */ jsx2(Text2, { color: theme.warn, children: "local logs off" }),
-        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ` \u2014 enable: dataroom \u2192 Settings (local logs) or dashboard \u2192 Settings \xB7 hooks write ${localLogFile()}` })
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: " \u2014 enable: dataroom \u2192 Settings (local logs) or dashboard \u2192 Settings" })
+      ] }) : localOn && localPath && !localPath.usableHere ? (
+        // The folder is a PROJECT setting, so it can name a path that exists
+        // on another machine. Saying so beats showing a path nothing writes to.
+        /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+          /* @__PURE__ */ jsx2(Text2, { color: theme.warn, children: "local logs on" }),
+          /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ` \u2014 ${localPath.configuredPath} is not a folder on this device \xB7 writing to ${localPath.file}` })
+        ] })
+      ) : localOn && localBuf.length === 0 ? /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate", children: [
+        /* @__PURE__ */ jsx2(Text2, { color: theme.ok, children: "local logs on" }),
+        /* @__PURE__ */ jsx2(Text2, { color: theme.dim, children: ` \u2014 no entries yet \xB7 hooks write ${localPath?.file ?? ""}` })
       ] }) : null,
       windowed.length === 0 ? (
         // With a source filter on, "awaiting traffic" reads as "nothing is
@@ -4699,6 +4744,18 @@ function SettingsPanel({
   const [diagBusy, setDiagBusy] = useState8(null);
   const [autoUp, setAutoUp] = useState8(() => autoUpdateEnabled());
   const [updBusy, setUpdBusy] = useState8(false);
+  const [llSetting, setLlSetting] = useState8(null);
+  useEffect7(() => {
+    const read = () => {
+      try {
+        setLlSetting(localLogsSetting());
+      } catch {
+      }
+    };
+    read();
+    const t = setInterval(read, 5e3);
+    return () => clearInterval(t);
+  }, []);
   const [canInstall, setCanInstall] = useState8(null);
   useEffect7(() => {
     let live2 = true;
@@ -5355,7 +5412,16 @@ function SettingsPanel({
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [
           cursor(r),
           /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "path ".padEnd(11) }),
-          local?.path ? /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate(local.path, cols - 14) }) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "not set \u2014 enter to edit" })
+          local?.path ? (
+            // The folder is a PROJECT setting shared by every device on it, so
+            // it can name a path that only exists on another OS. The hooks then
+            // quietly fall back and this row was the last place still claiming
+            // the configured path was in use.
+            llSetting && local.enabled && !llSetting.usableHere ? /* @__PURE__ */ jsxs8(Fragment5, { children: [
+              /* @__PURE__ */ jsx8(Text8, { color: theme.warn, children: truncate(local.path, Math.max(12, Math.floor((cols - 20) / 2))) }),
+              /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: `  not valid here \u2192 ${truncate(llSetting.file, Math.max(12, Math.floor((cols - 20) / 2)))}` })
+            ] }) : /* @__PURE__ */ jsx8(Text8, { color: theme.accent, children: truncate(local.path, cols - 14) })
+          ) : /* @__PURE__ */ jsx8(Text8, { color: theme.dim, children: "not set \u2014 enter to edit" })
         ] });
       case "ll-server":
         return /* @__PURE__ */ jsxs8(Text8, { wrap: "truncate", children: [

package/dist/tui/local-log.d.ts

@@ -16,6 +16,27 @@ export declare const DEFAULT_LOCAL_LOG: string;
  * it the same way they do, preferring the most recently refreshed cache. Falls
  * back to the default path when nothing is configured or readable.
  */
+/** What local logging is set to on this device, and where it can actually go. */
+export interface LocalLogSetting {
+    /** The project setting, as the hooks read it. */
+    enabled: boolean;
+    /** The folder the project asked for, verbatim (null when nothing is set). */
+    configuredPath: string | null;
+    /** False when that folder cannot be used HERE — e.g. a Windows path on Linux. */
+    usableHere: boolean;
+    /** The file entries actually land in, after any fallback. */
+    file: string;
+}
+/**
+ * Read the local-logging SETTING, not its output.
+ *
+ * Live used to decide on/off by whether the log file had any lines in it, so an
+ * enabled log that happened to be empty — a fresh install, a folder just
+ * changed, an account just switched — reported "local logs off" and told the
+ * user to go and enable something that was already on. The setting and the
+ * evidence of the setting are different questions; this answers the first.
+ */
+export declare function localLogsSetting(): LocalLogSetting;
 export declare function localLogFile(): string;
 /** Resolved once per process for callers that want a plain path (the folder can
  *  only change via a dashboard edit, which needs a new session anyway). Prefer

package/hooks/guard.bundled.mjs

@@ -6530,13 +6530,13 @@ var init_src = __esm({
 });
 
 // hooks/guard.mjs
-import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync } from "node:fs";
+import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, openSync, readSync, closeSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { resolve, join, dirname, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
-var HOOK_VERSION = 72;
+var HOOK_VERSION = 73;
 function localLogsOnly(security) {
   if (security !== void 0) {
     const l = security && security.localLogs;
@@ -7915,35 +7915,62 @@ var RL_WINDOWS = [
   { key: "perHour", ms: 36e5, label: "hour" },
   { key: "perMinute", ms: 6e4, label: "minute" }
 ];
+var RL_REC = 14;
+var RL_MAX_READ = 1048576;
+var RL_MAX_FILE = 4194304;
 function rateLimitCheck(agentKey, limits) {
   try {
-    const file = join(resolve(homedir(), ".solongate"), ".ratelimit-" + agentKey + ".json");
+    const dir = resolve(homedir(), ".solongate");
+    const file = join(dir, ".ratelimit-" + agentKey + ".log");
     const now = Date.now();
-    let stamps = [];
-    if (existsSync(file)) {
-      try {
-        stamps = JSON.parse(readFileSync(file, "utf-8"));
-      } catch {
-        stamps = [];
-      }
+    try {
+      mkdirSync(dir, { recursive: true });
+    } catch {
+    }
+    try {
+      appendFileSync(file, String(now).padStart(13, "0") + "\n");
+    } catch {
+      return null;
+    }
+    let size = 0;
+    try {
+      size = statSync(file).size;
+    } catch {
+      return null;
+    }
+    const start = Math.max(0, size - RL_MAX_READ);
+    const from = start - start % RL_REC;
+    let buf = "";
+    try {
+      const fd = openSync(file, "r");
+      const b = Buffer.alloc(size - from);
+      readSync(fd, b, 0, b.length, from);
+      closeSync(fd);
+      buf = b.toString("latin1");
+    } catch {
+      return null;
+    }
+    const stamps = [];
+    for (let i = 0; i + RL_REC <= buf.length; i += RL_REC) {
+      const t = parseInt(buf.slice(i, i + 13), 10);
+      if (Number.isFinite(t) && now - t < 864e5)
+        stamps.push(t);
     }
-    if (!Array.isArray(stamps))
-      stamps = [];
-    stamps = stamps.filter((t) => typeof t === "number" && now - t < 864e5);
-    if (stamps.length > 5e4)
-      stamps = stamps.slice(-5e4);
     for (const w of RL_WINDOWS) {
       const limit = limits[w.key];
       if (limit > 0) {
         const count = stamps.reduce((n, t) => now - t < w.ms ? n + 1 : n, 0);
-        if (count >= limit)
+        if (count > limit)
           return { window: w.label, limit };
       }
     }
-    stamps.push(now);
-    try {
-      writeFileSync(file, JSON.stringify(stamps));
-    } catch {
+    if (size > RL_MAX_FILE) {
+      try {
+        const tmp = file + "." + process.pid + ".tmp";
+        writeFileSync(tmp, stamps.map((t) => String(t).padStart(13, "0") + "\n").join(""));
+        renameSync(tmp, file);
+      } catch {
+      }
     }
     return null;
   } catch {

package/hooks/guard.mjs

@@ -21,7 +21,7 @@
  * Logs DENY decisions to SolonGate Cloud. ALLOWs are logged by audit.mjs.
  * Auto-installed by: npx @solongate/proxy init --global
  */
-import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync } from 'node:fs';
+import { readFileSync, existsSync, statSync, readdirSync, writeFileSync, mkdirSync, chmodSync, renameSync, appendFileSync, rmSync, openSync, readSync, closeSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { resolve, join, dirname, isAbsolute } from 'node:path';
 import { homedir } from 'node:os';
@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 // the installed hook self-updates when the cloud version is higher (see
 // maybeSelfUpdate). This is what makes guard fixes propagate without a manual
 // reinstall — the same trust model as the OPA WASM this hook already runs.
-const HOOK_VERSION = 72;
+const HOOK_VERSION = 73;
 
 // True when local log storage is ON. In that mode logs are kept LOCAL ONLY and
 // nothing is sent to the cloud audit log.
@@ -1746,28 +1746,80 @@ const RL_WINDOWS = [
   { key: 'perHour', ms: 3600000, label: 'hour' },
   { key: 'perMinute', ms: 60000, label: 'minute' },
 ];
+// One call = one fixed-width record, appended. 13 digits of epoch ms + newline;
+// good until the year 2286, and fixed width is what lets the file be read by
+// offset without parsing it all.
+const RL_REC = 14;
+const RL_MAX_READ = 1_048_576; // tail we scan: ~74k calls, far past any window
+const RL_MAX_FILE = 4_194_304; // compact past this
+
+/**
+ * Rate limit, counted with an append-only log.
+ *
+ * This used to read a JSON array of timestamps, count, push one and write the
+ * whole array back. Under a burst of parallel tool calls — the exact thing a
+ * rate limit is for — every hook read the same array and wrote back its own
+ * copy, so increments were lost and the limit did not hold: measured at 14
+ * calls through a limit of 5, from 30 fired at once.
+ *
+ * An O_APPEND write of a short record does not interleave, so no call can erase
+ * another's. The reservation is made BEFORE the decision, which is what makes
+ * the count exact under concurrency: every process appends, then counts what is
+ * in the window, and the ones past the limit are the ones refused. A refused
+ * call therefore also occupies a slot, which is the honest reading of a rate
+ * limit — thirty attempts in a minute IS thirty calls a minute, whatever came
+ * back. (This is the same trick the guest allowance used for the same reason.)
+ */
 function rateLimitCheck(agentKey, limits) {
   try {
-    const file = join(resolve(homedir(), '.solongate'), '.ratelimit-' + agentKey + '.json');
+    const dir = resolve(homedir(), '.solongate');
+    // New name: the old .json holds an array this format cannot read, and one
+    // window resetting on upgrade is better than parsing ambiguity.
+    const file = join(dir, '.ratelimit-' + agentKey + '.log');
     const now = Date.now();
-    let stamps = [];
-    if (existsSync(file)) {
-      try { stamps = JSON.parse(readFileSync(file, 'utf-8')); } catch { stamps = []; }
+    try { mkdirSync(dir, { recursive: true }); } catch {}
+    // Reserve first. A failed append must not hand out a free call, so treat it
+    // as "cannot account for this" and fall open the same way the catch does.
+    try { appendFileSync(file, String(now).padStart(13, '0') + '\n'); } catch { return null; }
+
+    let size = 0;
+    try { size = statSync(file).size; } catch { return null; }
+    const start = Math.max(0, size - RL_MAX_READ);
+    // Align to a record boundary so a truncated head is never parsed.
+    const from = start - (start % RL_REC);
+    let buf = '';
+    try {
+      const fd = openSync(file, 'r');
+      const b = Buffer.alloc(size - from);
+      readSync(fd, b, 0, b.length, from);
+      closeSync(fd);
+      buf = b.toString('latin1');
+    } catch { return null; }
+
+    const stamps = [];
+    for (let i = 0; i + RL_REC <= buf.length; i += RL_REC) {
+      const t = parseInt(buf.slice(i, i + 13), 10);
+      if (Number.isFinite(t) && now - t < 86400000) stamps.push(t);
     }
-    if (!Array.isArray(stamps)) stamps = [];
-    // Prune to the longest window (24h) and cap size to bound work/IO.
-    stamps = stamps.filter((t) => typeof t === 'number' && now - t < 86400000);
-    if (stamps.length > 50000) stamps = stamps.slice(-50000);
-    // Check each enabled window against the current count (before adding now).
+    // Our own record is in here, so the limit is crossed at > rather than >=.
     for (const w of RL_WINDOWS) {
       const limit = limits[w.key];
       if (limit > 0) {
         const count = stamps.reduce((n, t) => (now - t < w.ms ? n + 1 : n), 0);
-        if (count >= limit) return { window: w.label, limit };
+        if (count > limit) return { window: w.label, limit };
       }
     }
-    stamps.push(now);
-    try { writeFileSync(file, JSON.stringify(stamps)); } catch {}
+
+    // Compaction, rarely: keep the last 24h. Written beside and renamed, so a
+    // reader never sees a half-written file. An append landing during the swap
+    // is lost, which costs one call of accuracy on a file this size.
+    if (size > RL_MAX_FILE) {
+      try {
+        const tmp = file + '.' + process.pid + '.tmp';
+        writeFileSync(tmp, stamps.map((t) => String(t).padStart(13, '0') + '\n').join(''));
+        renameSync(tmp, file);
+      } catch { /* keep growing rather than risk the file */ }
+    }
     return null;
   } catch {
     return null; // fail open

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solongate/proxy",
-  "version": "0.83.6",
+  "version": "0.83.8",
   "description": "AI tool security proxy: protect any AI tool server with customizable policies, path/command constraints, rate limiting, and audit logging. No code changes required.",
   "type": "module",
   "bin": {