security hardening

services/patternStore.js

@@ -128,9 +128,10 @@ function shouldFireCooldownEscalating(key, thresholdsMs) {
   let state = escalatingCooldowns.get(key);
 
   if (!state) {
-    state = { startedAtMs: now, lastFireAtMs: null, fireCount: 0 };
+    state = { startedAtMs: now, lastFireAtMs: null, fireCount: 0, lastUsed: now };
     escalatingCooldowns.set(key, state);
   }
+  state.lastUsed = now;
 
   const nextThreshold = sortedThresholds[state.fireCount];
   if (typeof nextThreshold !== 'number') return null;
@@ -147,6 +148,19 @@ function clearEscalating(key) {
   escalatingCooldowns.delete(key);
 }
 
+const ESCALATING_COOLDOWN_TTL_MS = 48 * 60 * 60 * 1000;
+const ESCALATING_CLEANUP_INTERVAL_MS = 6 * 60 * 60 * 1000;
+
+function cleanupStaleEscalatingCooldowns() {
+  const cutoff = Date.now() - ESCALATING_COOLDOWN_TTL_MS;
+  for (const [key, state] of escalatingCooldowns.entries()) {
+    const lastUsed = state.lastUsed || state.lastFireAtMs || state.startedAtMs || 0;
+    if (lastUsed < cutoff) escalatingCooldowns.delete(key);
+  }
+}
+
+setInterval(cleanupStaleEscalatingCooldowns, ESCALATING_CLEANUP_INTERVAL_MS).unref?.();
+
 function scheduleDailyReset() {
   setTimeout(() => {
     store.today = new Map();