@gethelio/proxy 0.12.0 → 0.13.1

package/README.md

@@ -46,10 +46,12 @@ Two integration paths:
 
 Helio governs at the strongest grade each path physically allows, and records it per call:
 
-- **Structural** (stdio MCP) — Helio owns the only path to the tool; the agent cannot route around it.
+- **Structural** (stdio MCP) — Helio owns the child process it spawned, so nothing on the MCP path routes around it; a co-located process that can run the same command line is outside this grade (see the note below).
 - **Network** (HTTP MCP) — structural given you control the upstream's egress.
 - **Host-enforced** (hook adapters via the [adapter API](https://github.com/gethelio/helio/blob/main/docs/adapter-api.md), e.g. OpenClaw) — for frameworks that run tools in-process and expose hooks rather than an MCP transport. The framework's hook gate enforces; Helio decides. This is a cooperative, lower grade than the proxy path, and Helio labels it as such rather than overclaiming. Helio's decisions still cannot be evicted from the agent's context or prompt-injected, and any attempt to route around them is visible in the audit trail.
 
+All three grades assume the proxy's config, secret, and audit store are outside the agent's reach. In the default local install they are not: the proxy runs as the same user as the agent. [SECURITY.md](https://github.com/gethelio/helio/blob/main/SECURITY.md#process-and-filesystem-boundaries) states the boundary and the deployments that close it.
+
 ## Quick Start (5 minutes)
 
 ### 1. Install
@@ -62,7 +64,7 @@ This single package includes the built-in dashboard UI bundle.
 
 ### 2. Configure
 
-`npx @gethelio/proxy init` already created a `helio.yaml` in your project root. Open it (e.g. `nano helio.yaml`, or in your editor) and point `upstream.url` at your existing MCP server. Helio proxies a single upstream MCP server.
+`npx @gethelio/proxy init` already created a `helio.yaml` in your project root. Open it (e.g. `nano helio.yaml`, or in your editor) and point `upstream.url` at your existing MCP server. The singular `upstream:` form stays fully supported; to govern more than one MCP server, declare a named `upstreams:` list in its place (set exactly one of the two). Tool sets are never merged: each named upstream is served at its own `/mcp/<name>` door. See the [Configuration Reference](https://github.com/gethelio/helio/blob/main/docs/configuration.md#upstreams).
 
 > **Heads up — Helio starts in audit-only mode.** `init` scaffolds the `policies` section **commented out**, so out of the box Helio runs with `default: allow` and **zero rules**: it records every tool call to the audit trail but **blocks nothing**. Uncomment and edit `policies` (or paste your own rules) to start enforcing. See the [Policy Guide](https://github.com/gethelio/helio/blob/main/docs/policies.md) for rule syntax.
 
@@ -152,7 +154,7 @@ No MCP server to test against? Helio ships a zero-dependency echo server you can
 
 About `dashboard.api_secret`:
 
-- **If you ran `npx @gethelio/proxy init`**, your `helio.yaml` already contains a generated `api_secret` (a literal 32-byte hex value, also printed when you ran `init`). It's set — skip this step.
+- **If you ran `npx @gethelio/proxy init`**, your `helio.yaml` already contains the SHA-256 digest of a generated secret, and `init` printed the secret itself once. Keep the printed value; it is what you log in with. Skip this step.
 - **If you authored `helio.yaml` by hand** using the `${HELIO_DASHBOARD_SECRET}` placeholder shown above, set the variable before `start`:
 
   ```bash
@@ -193,7 +195,7 @@ Either way the call appears in the dashboard with its policy decision. (`get_wea
 http://localhost:3100
 ```
 
-If prompted, log in with the `dashboard.api_secret` that `init` generated (also printed when you ran it).
+If prompted, log in with the dashboard secret that `init` printed (the file holds only its digest).
 
 That's it. Every tool call now passes through Helio with a full audit trail, rate limits, and spend controls.
 
@@ -365,6 +367,7 @@ Ready-made configurations for common patterns:
 - **[Slack Approvals](https://github.com/gethelio/helio/tree/main/examples/slack-approvals)**: Route destructive actions to Slack
 - **[Spend Limits](https://github.com/gethelio/helio/tree/main/examples/spend-limits)**: Govern payment tool usage
 - **[Budgets](https://github.com/gethelio/helio/tree/main/examples/budgets)**: A cross-tool budget across Stripe and PayPal tools with break-glass overage approvals, paired with a category cap that only charges calls declaring their spend category
+- **[Multi-Upstream](https://github.com/gethelio/helio/tree/main/examples/multi-upstream)**: Two named upstreams behind one proxy, with a door-scoped rate limit and budget
 
 ## Contributing