let apiProxyLogsDir = config.proxyLogsDir
    ? path.join(config.proxyLogsDir, 'api-proxy-logs')
    : path.join(config.workDir, 'api-proxy-logs');
  if (!fs.existsSync(apiProxyLogsDir)) {
    let created = false;

    // When proxyLogsDir is configured, prefer creating the subdirectory inside it.
    // If permissions are too restrictive (e.g., owned by Squid UID 13, mode 0755),
    // handle EACCES gracefully and fall back to a sibling directory under workDir.
    if (config.proxyLogsDir) {
      try {
        fs.mkdirSync(apiProxyLogsDir, { recursive: true, mode: 0o777 });
        fs.chmodSync(apiProxyLogsDir, 0o777);
        created = true;
      } catch (err) {
        const e = err as NodeJS.ErrnoException;
        if (e.code === 'EACCES') {
          // Try to relax permissions on proxyLogsDir and retry once
          try {
            fs.chmodSync(config.proxyLogsDir, 0o777);
            fs.mkdirSync(apiProxyLogsDir, { recursive: true, mode: 0o777 });
            fs.chmodSync(apiProxyLogsDir, 0o777);
            created = true;
          } catch (err2) {
            const e2 = err2 as NodeJS.ErrnoException;
            if (e2.code !== 'EACCES') {
              // Non-permission error: rethrow to avoid masking real problems
              throw err2;
            }

            // Fall back to previous behavior: use workDir/api-proxy-logs as a sibling directory.
            const fallbackDir = path.join(config.workDir, 'api-proxy-logs');
            apiProxyLogsDir = fallbackDir;
            if (!fs.existsSync(fallbackDir)) {
              fs.mkdirSync(fallbackDir, { recursive: true, mode: 0o777 });
              fs.chmodSync(fallbackDir, 0o777);
            }
            logger.warn(
              `proxyLogsDir (${config.proxyLogsDir}) is not writable; ` +
              `using fallback API proxy logs directory at: ${fallbackDir}. ` +
              `Original error: ${e2.message}`
            );
            created = true;
          }
        } else {
          // Unexpected error: rethrow
          throw err;
        }
      }
    }

   // If proxyLogsDir is not set or creation above did not run, create under workDir.
    if (!created && !fs.existsSync(apiProxyLogsDir)) {
      fs.mkdirSync(apiProxyLogsDir, { recursive: true, mode: 0o777 });
      // Explicitly set permissions to 0o777 (not affected by umask)
      fs.chmodSync(apiProxyLogsDir, 0o777);
    }