@juspay/neurolink 10.4.2 → 10.4.4

package/dist/cli/commands/proxy.d.ts

@@ -22,7 +22,7 @@ import { ProxyRuntimeConfigStore } from "../../lib/proxy/runtimeConfig.js";
  *   string) recorded when the supervisor we expect at `pid` was launched.
  *   When provided, this is cross-checked against `pid`'s actual OS-reported
  *   start time (see {@link getProcessStartTime}) — the args match alone
- *   ("neurolink" + "proxy" both present) is not airtight, since an
+ *   (the `neurolink proxy start` command is present) is not airtight, since an
  *   unrelated process (e.g. a shell running this very test suite, or a
  *   coincidentally-named script) could match it too. A pid recycled by such
  *   a process would have a start time far from the recorded supervisor
@@ -57,6 +57,7 @@ export declare function createProxyStartApp(params: {
     readiness: ProxyReadinessState;
 }>;
 export declare const proxyStartCommand: CommandModule<object, ProxyStartArgs>;
+export declare function sanitizeProxyStatusTerminalErrorMessage(message: string): string;
 export declare const proxyStatusCommand: CommandModule<object, ProxyStatusArgs>;
 export declare const proxyTelemetryCommand: CommandModule<object, ProxyTelemetryArgs>;
 export declare const proxyGuardCommand: CommandModule<object, ProxyGuardArgs>;

package/dist/cli/commands/proxy.js

@@ -12,11 +12,12 @@
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 import chalk from "chalk";
 import ora from "ora";
 import { buildProxyHealthResponse, createProxyReadinessState, markProxyDrainingForUpdate, markProxyReady, resumeProxyConnections, waitForProxyReadiness, } from "../../lib/proxy/proxyHealth.js";
 import { logger } from "../../lib/utils/logger.js";
-import { sanitizeForLog } from "../../lib/utils/logSanitize.js";
+import { redactUrlsInText, sanitizeForLog, } from "../../lib/utils/logSanitize.js";
 import { withTimeout } from "../../lib/utils/async/withTimeout.js";
 import { formatUptime, isProcessRunning, StateFileManager, } from "../utils/serverUtils.js";
 import { configureProxyKeepAliveDispatcher } from "../../lib/proxy/proxyDispatcher.js";
@@ -39,9 +40,11 @@ import { fileURLToPath } from "node:url";
 import packageJson from "../../../package.json" with { type: "json" };
 const _require = createRequire(import.meta.url);
 const PROXY_VERSION = packageJson.version;
+const PROXY_INTERNAL_ACCOUNT_LABEL = "proxy/internal";
 const PROXY_TELEMETRY_SCRIPT_PATH = fileURLToPath(new URL("../../../scripts/observability/manage-local-openobserve.sh", import.meta.url));
 const PROXY_LIFECYCLE_SHUTDOWN_TIMEOUT_MS = 5_000;
 const LEGACY_STATUS_ACCOUNT_CACHE_TTL_MS = 5_000;
+const PROXY_STATUS_TOKEN_READ_TIMEOUT_MS = 2_000;
 let legacyStatusAccountCache;
 // Allowed drift between a pid's OS-reported start time and the persisted
 // ProxySupervisorState.startTime before processLooksLikeProxySupervisor
@@ -187,7 +190,7 @@ async function getProcessStartTime(pid) {
  *   string) recorded when the supervisor we expect at `pid` was launched.
  *   When provided, this is cross-checked against `pid`'s actual OS-reported
  *   start time (see {@link getProcessStartTime}) — the args match alone
- *   ("neurolink" + "proxy" both present) is not airtight, since an
+ *   (the `neurolink proxy start` command is present) is not airtight, since an
  *   unrelated process (e.g. a shell running this very test suite, or a
  *   coincidentally-named script) could match it too. A pid recycled by such
  *   a process would have a start time far from the recorded supervisor
@@ -215,9 +218,9 @@ export async function processLooksLikeProxySupervisor(pid, expectedStartTimeIso)
     // "neurolink", an editor with a neurolink file open) would match, and a
     // stale/recycled pid running such a process could then be SIGTERM'd/
     // SIGKILL'd by `ensureSupervisorStoppedBeforeClear` during uninstall.
-    // Require the actual proxy-supervisor invocation — both "neurolink" AND
-    // the "proxy" subcommand present in args.
-    if (!(/neurolink/i.test(args) && /\bproxy\b/i.test(args))) {
+    // Require the actual proxy-supervisor invocation. Commands such as
+    // `neurolink proxy status` must never be mistaken for the listener owner.
+    if (!/\bneurolink(?:-proxy)?\b.*\bproxy\s+start\b/i.test(args)) {
         return false;
     }
     if (!expectedStartTimeIso) {
@@ -353,6 +356,15 @@ async function resolveLegacyStatusAccountLabel(storedAnthropicAccountCount) {
     };
     return label;
 }
+function deriveAccountAllowance(accountKey, now, allowlist, expirations, cooldowns) {
+    const allowed = isAccountAllowed(accountKey, allowlist);
+    const expiresAt = expirations.get(accountKey);
+    return {
+        allowed,
+        expired: expiresAt !== undefined && expiresAt <= now,
+        cooling: (cooldowns[accountKey]?.coolingUntil ?? 0) > now,
+    };
+}
 /**
  * Check if the launchd service is loaded and actively managing the proxy.
  * Returns true if launchctl reports the service as running.
@@ -1248,7 +1260,13 @@ export async function createProxyStartApp(params) {
     const recordRuntimeError = async (metadata, status, errorType, errorMessage, options) => {
         const clientMessage = options?.clientMessage ?? errorMessage;
         const clientErrorType = options?.clientErrorType ?? errorType;
-        recordFinalError(status);
+        recordFinalError(status, undefined, undefined, {
+            requestId: metadata.requestId,
+            errorType,
+            errorCode: options?.errorCode,
+            terminalOutcome: "handler_error",
+            message: errorMessage,
+        });
         await Promise.all([
             logRequest({
                 timestamp: new Date().toISOString(),
@@ -1522,21 +1540,45 @@ export async function createProxyStartApp(params) {
         const activeAccountAllowlist = runtimeConfig
             ? runtimeConfig.accountAllowlist
             : params.accountAllowlist;
-        const { getReconciledStats, getUsageStatsPersistenceStatus } = await import("../../lib/proxy/usageStats.js");
+        const { getReconciledUsageSnapshot, getUsageStatsPersistenceStatus } = await import("../../lib/proxy/usageStats.js");
         const { loadAccountCooldowns } = await import("../../lib/proxy/accountCooldown.js");
-        const stats = await getReconciledStats();
+        const usageSnapshot = await getReconciledUsageSnapshot();
+        const { stats, terminalErrors } = usageSnapshot;
+        const terminalErrorDetailsComparable = usageSnapshot.statsVersion === usageSnapshot.terminalErrorsVersion;
+        const lastTerminalError = terminalErrors.recent.at(-1) ?? null;
+        const terminalErrorDetailsMissing = terminalErrorDetailsComparable
+            ? Math.max(0, stats.totalErrors - terminalErrors.totalErrors)
+            : undefined;
+        const terminalErrorDetailsExcess = terminalErrorDetailsComparable
+            ? Math.max(0, terminalErrors.totalErrors - stats.totalErrors)
+            : undefined;
         const runtimeState = loadProxyState();
         const supervisorState = loadProxySupervisorState();
         const updateState = loadUpdateState();
         const cooldowns = await loadAccountCooldowns();
         const storedAccountKeys = new Set();
+        const storedAccountExpirations = new Map();
         const disabledAccountKeys = new Set();
         let accountInventoryLoaded = false;
         try {
             const { tokenStore } = await import("../../lib/auth/tokenStore.js");
-            for (const key of await tokenStore.listByPrefix("anthropic:")) {
-                storedAccountKeys.add(normalizeAnthropicAccountKey(key));
+            const storedKeys = await tokenStore.listByPrefix("anthropic:");
+            for (const key of storedKeys) {
+                const normalizedKey = normalizeAnthropicAccountKey(key);
+                storedAccountKeys.add(normalizedKey);
             }
+            await Promise.all(storedKeys.map(async (key) => {
+                const normalizedKey = normalizeAnthropicAccountKey(key);
+                try {
+                    const tokens = await withTimeout(tokenStore.peekTokens(key), PROXY_STATUS_TOKEN_READ_TIMEOUT_MS, "[proxy] /status token inspection timed out");
+                    if (tokens) {
+                        storedAccountExpirations.set(normalizedKey, tokens.expiresAt);
+                    }
+                }
+                catch (err) {
+                    logger.debug(`[proxy] /status: failed to inspect token metadata for ${normalizedKey}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }));
             for (const key of await tokenStore.listDisabled()) {
                 disabledAccountKeys.add(normalizeAnthropicAccountKey(key));
             }
@@ -1556,6 +1598,141 @@ export async function createProxyStartApp(params) {
         });
         const primaryAccount = await resolveStatusPrimaryAccount(activeProxyConfig);
         const activeUpdaterPid = supervisorState?.updaterPid ?? runtimeState?.updaterPid;
+        const accountRows = Object.values(stats.accounts).map((account) => {
+            const normalizedKey = normalizeAnthropicAccountKey(account.label);
+            const isLegacyAccount = account.type === "oauth" && account.label === legacyAccountLabel;
+            const accountKey = storedAccountKeys.has(normalizedKey)
+                ? normalizedKey
+                : isLegacyAccount
+                    ? LEGACY_ANTHROPIC_ACCOUNT_KEY
+                    : account.label === "env"
+                        ? ENV_ANTHROPIC_ACCOUNT_KEY
+                        : normalizedKey;
+            const isStored = storedAccountKeys.has(accountKey) || isLegacyAccount;
+            const { allowed, expired, cooling } = deriveAccountAllowance(accountKey, now, activeAccountAllowlist, storedAccountExpirations, cooldowns);
+            const accountStatus = account.type === "internal"
+                ? "internal"
+                : disabledAccountKeys.has(accountKey)
+                    ? "disabled"
+                    : expired
+                        ? "expired"
+                        : !allowed
+                            ? "excluded"
+                            : accountInventoryLoaded &&
+                                account.type === "oauth" &&
+                                !isStored
+                                ? "removed"
+                                : cooling
+                                    ? "cooling"
+                                    : "active";
+            return {
+                label: account.label,
+                type: account.type,
+                attempts: account.attemptCount,
+                requests: account.successCount + account.errorCount,
+                success: account.successCount,
+                errors: account.errorCount,
+                attemptErrors: account.attemptErrorCount,
+                rateLimits: account.rateLimitCount,
+                transientRateLimits: account.transientRateLimitCount,
+                quotaRateLimits: account.quotaRateLimitCount,
+                cooling,
+                status: accountStatus,
+                allowed: account.type === "internal" ? undefined : allowed,
+                expired: account.type === "oauth" ? expired : undefined,
+            };
+        });
+        const representedAccountKeys = new Set(accountRows
+            .filter((account) => account.type === "oauth")
+            .map((account) => normalizeAnthropicAccountKey(account.label)));
+        for (const accountKey of storedAccountKeys) {
+            if (representedAccountKeys.has(accountKey)) {
+                continue;
+            }
+            const { allowed, expired, cooling } = deriveAccountAllowance(accountKey, now, activeAccountAllowlist, storedAccountExpirations, cooldowns);
+            accountRows.push({
+                label: accountKey.slice("anthropic:".length),
+                type: "oauth",
+                attempts: 0,
+                requests: 0,
+                success: 0,
+                errors: 0,
+                attemptErrors: 0,
+                rateLimits: 0,
+                transientRateLimits: 0,
+                quotaRateLimits: 0,
+                cooling,
+                status: disabledAccountKeys.has(accountKey)
+                    ? "disabled"
+                    : expired
+                        ? "expired"
+                        : !allowed
+                            ? "excluded"
+                            : cooling
+                                ? "cooling"
+                                : "active",
+                allowed,
+                expired,
+            });
+        }
+        const attributed = accountRows.reduce((total, account) => ({
+            attempts: total.attempts + (account.attempts ?? 0),
+            requests: total.requests + (account.requests ?? 0),
+            success: total.success + (account.success ?? 0),
+            errors: total.errors + (account.errors ?? 0),
+            attemptErrors: total.attemptErrors + (account.attemptErrors ?? 0),
+            rateLimits: total.rateLimits + (account.rateLimits ?? 0),
+            transientRateLimits: total.transientRateLimits + (account.transientRateLimits ?? 0),
+            quotaRateLimits: total.quotaRateLimits + (account.quotaRateLimits ?? 0),
+        }), {
+            attempts: 0,
+            requests: 0,
+            success: 0,
+            errors: 0,
+            attemptErrors: 0,
+            rateLimits: 0,
+            transientRateLimits: 0,
+            quotaRateLimits: 0,
+        });
+        const unattributed = {
+            attempts: Math.max(0, stats.totalAttempts - attributed.attempts),
+            requests: Math.max(0, stats.totalRequests - attributed.requests),
+            success: Math.max(0, stats.totalSuccess - attributed.success),
+            errors: Math.max(0, stats.totalErrors - attributed.errors),
+            attemptErrors: Math.max(0, stats.totalAttemptErrors - attributed.attemptErrors),
+            rateLimits: Math.max(0, stats.totalRateLimits - attributed.rateLimits),
+            transientRateLimits: Math.max(0, stats.totalTransientRateLimits - attributed.transientRateLimits),
+            quotaRateLimits: Math.max(0, stats.totalQuotaRateLimits - attributed.quotaRateLimits),
+        };
+        if (Object.values(unattributed).some((count) => count > 0)) {
+            const internalRow = accountRows.find((account) => account.label === PROXY_INTERNAL_ACCOUNT_LABEL);
+            if (internalRow) {
+                internalRow.attempts =
+                    (internalRow.attempts ?? 0) + unattributed.attempts;
+                internalRow.requests =
+                    (internalRow.requests ?? 0) + unattributed.requests;
+                internalRow.success = (internalRow.success ?? 0) + unattributed.success;
+                internalRow.errors = (internalRow.errors ?? 0) + unattributed.errors;
+                internalRow.attemptErrors =
+                    (internalRow.attemptErrors ?? 0) + unattributed.attemptErrors;
+                internalRow.rateLimits =
+                    (internalRow.rateLimits ?? 0) + unattributed.rateLimits;
+                internalRow.transientRateLimits =
+                    (internalRow.transientRateLimits ?? 0) +
+                        unattributed.transientRateLimits;
+                internalRow.quotaRateLimits =
+                    (internalRow.quotaRateLimits ?? 0) + unattributed.quotaRateLimits;
+            }
+            else {
+                accountRows.push({
+                    label: PROXY_INTERNAL_ACCOUNT_LABEL,
+                    type: "internal",
+                    ...unattributed,
+                    cooling: false,
+                    status: "internal",
+                });
+            }
+        }
         return c.json({
             status: "running",
             ready: health.ready,
@@ -1578,42 +1755,12 @@ export async function createProxyStartApp(params) {
                 totalRateLimits: stats.totalRateLimits,
                 totalTransientRateLimits: stats.totalTransientRateLimits,
                 totalQuotaRateLimits: stats.totalQuotaRateLimits,
-                accounts: Object.values(stats.accounts).map((account) => {
-                    const normalizedKey = normalizeAnthropicAccountKey(account.label);
-                    const isLegacyAccount = account.type === "oauth" && account.label === legacyAccountLabel;
-                    const accountKey = storedAccountKeys.has(normalizedKey)
-                        ? normalizedKey
-                        : isLegacyAccount
-                            ? LEGACY_ANTHROPIC_ACCOUNT_KEY
-                            : account.label === "env"
-                                ? ENV_ANTHROPIC_ACCOUNT_KEY
-                                : normalizedKey;
-                    const isStored = storedAccountKeys.has(accountKey) || isLegacyAccount;
-                    const cooling = (cooldowns[accountKey]?.coolingUntil ?? 0) > now;
-                    const accountStatus = disabledAccountKeys.has(accountKey)
-                        ? "disabled"
-                        : !isAccountAllowed(accountKey, activeAccountAllowlist)
-                            ? "excluded"
-                            : accountInventoryLoaded && account.type === "oauth" && !isStored
-                                ? "removed"
-                                : cooling
-                                    ? "cooling"
-                                    : "active";
-                    return {
-                        label: account.label,
-                        type: account.type,
-                        attempts: account.attemptCount,
-                        requests: account.successCount + account.errorCount,
-                        success: account.successCount,
-                        errors: account.errorCount,
-                        attemptErrors: account.attemptErrorCount,
-                        rateLimits: account.rateLimitCount,
-                        transientRateLimits: account.transientRateLimitCount,
-                        quotaRateLimits: account.quotaRateLimitCount,
-                        cooling,
-                        status: accountStatus,
-                    };
-                }),
+                terminalErrors,
+                lastTerminalError,
+                terminalErrorDetailsComparable,
+                terminalErrorDetailsMissing,
+                terminalErrorDetailsExcess,
+                accounts: accountRows,
                 primaryAccount,
                 persistence: getUsageStatsPersistenceStatus(),
             },
@@ -1930,9 +2077,11 @@ function registerProxyShutdownHandlers(params) {
             }
         }
         const usageStatsFlush = import("../../lib/proxy/usageStats.js").then(({ flushUsageStats }) => flushUsageStats());
-        const [usageStatsFlushResult, lifecycleFlushResult] = await Promise.allSettled([
+        const requestLogsFlush = import("../../lib/proxy/requestLogger.js").then(({ flushRequestLogs }) => flushRequestLogs());
+        const [usageStatsFlushResult, lifecycleFlushResult, requestLogsFlushResult,] = await Promise.allSettled([
             withTimeout(usageStatsFlush, PROXY_LIFECYCLE_SHUTDOWN_TIMEOUT_MS, "Timed out flushing proxy usage statistics during shutdown"),
             withTimeout(flushProxyLifecycleEvents(), PROXY_LIFECYCLE_SHUTDOWN_TIMEOUT_MS, "Timed out flushing proxy lifecycle metadata during shutdown"),
+            withTimeout(requestLogsFlush, PROXY_LIFECYCLE_SHUTDOWN_TIMEOUT_MS, "Timed out flushing proxy request logs during shutdown"),
         ]);
         if (usageStatsFlushResult.status === "rejected") {
             const error = usageStatsFlushResult.reason;
@@ -1942,6 +2091,10 @@ function registerProxyShutdownHandlers(params) {
             const error = lifecycleFlushResult.reason;
             logger.debug(`[proxy] lifecycle metadata flush failed during shutdown: ${error instanceof Error ? error.message : String(error)}`);
         }
+        if (requestLogsFlushResult.status === "rejected") {
+            const error = requestLogsFlushResult.reason;
+            logger.warn(`[proxy] request log flush failed during shutdown: ${error instanceof Error ? error.message : String(error)}`);
+        }
         try {
             const { flushOpenTelemetry, shutdownOpenTelemetry } = await import("../../lib/services/server/ai/observability/instrumentation.js");
             await flushOpenTelemetry();
@@ -2136,8 +2289,27 @@ async function startProxyRuntime(params) {
     let stopRuntimeConfig;
     if (params.runtimeConfigStore) {
         const runtimeConfigStore = params.runtimeConfigStore;
-        const unsubscribeReload = runtimeConfigStore.subscribeReload(() => {
-            persistRuntimeConfig(runtimeConfigStore.getSnapshot());
+        const unsubscribeReload = runtimeConfigStore.subscribeReload((result) => {
+            const snapshot = runtimeConfigStore.getSnapshot();
+            persistRuntimeConfig(snapshot);
+            if (socketWorker &&
+                result.applied &&
+                result.changed &&
+                result.environmentChanged &&
+                process.connected &&
+                process.send) {
+                try {
+                    process.send({
+                        type: "proxy-worker:replacement-requested",
+                        generation: getProxyWorkerGeneration(),
+                        pid: process.pid,
+                        reason: "environment",
+                    });
+                }
+                catch (error) {
+                    logger.warn(`[proxy] failed to request environment replacement: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
         });
         const reloadOnSighup = () => {
             void runtimeConfigStore.reload("sighup");
@@ -2372,6 +2544,12 @@ async function startProxyCommandHandler(argv) {
         else if (usageStatsPersistence.lastRecoveryAt) {
             logger.warn(`[proxy] recovered corrupt usage statistics state at ${new Date(usageStatsPersistence.lastRecoveryAt).toISOString()}`);
         }
+        if (usageStatsPersistence.terminalErrorsLastError) {
+            logger.warn(`[proxy] terminal-error persistence unavailable: ${usageStatsPersistence.terminalErrorsLastError}`);
+        }
+        else if (usageStatsPersistence.terminalErrorsLastRecoveryAt) {
+            logger.warn(`[proxy] recovered corrupt terminal-error state at ${new Date(usageStatsPersistence.terminalErrorsLastRecoveryAt).toISOString()}`);
+        }
         const baseEnv = { ...process.env };
         const envResolution = resolveProxyEnvFile({
             explicitEnvFile: argv.envFile,
@@ -2524,8 +2702,17 @@ export const proxyStartCommand = {
 // =============================================================================
 // STATUS DISPLAY HELPERS
 // =============================================================================
+export function sanitizeProxyStatusTerminalErrorMessage(message) {
+    return stripVTControlCharacters(sanitizeForLog(redactUrlsInText(message), 700))
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, 200);
+}
 function printStatusStats(stats) {
     console.info(`\n  Stats:`);
+    if (stats.startedAt !== undefined) {
+        console.info(`    Since:       ${new Date(stats.startedAt).toISOString()}`);
+    }
     if (stats.totalAttempts !== undefined) {
         console.info(`    Attempts:    ${stats.totalAttempts}`);
     }
@@ -2538,6 +2725,32 @@ function printStatusStats(stats) {
             stats.totalQuotaRateLimits !== undefined
             ? ` (${stats.totalTransientRateLimits} transient, ${stats.totalQuotaRateLimits} quota)`
             : ""));
+    if (stats.terminalErrors) {
+        const causes = Object.entries(stats.terminalErrors.counts)
+            .filter(([, count]) => count > 0)
+            .map(([category, count]) => `${category}=${count}`)
+            .join(", ");
+        console.info(`    Error details: ${stats.terminalErrors.totalErrors}/${stats.totalErrors}` +
+            (causes ? ` (${causes})` : ""));
+        console.info(`    Detail since: ${new Date(stats.terminalErrors.startedAt).toISOString()}`);
+        if ((stats.terminalErrorDetailsMissing ?? 0) > 0 ||
+            (stats.terminalErrorDetailsExcess ?? 0) > 0) {
+            console.info(`    Detail gap:  ${stats.terminalErrorDetailsMissing ?? 0} missing, ${stats.terminalErrorDetailsExcess ?? 0} awaiting counter reconciliation`);
+        }
+        else if (stats.terminalErrorDetailsComparable === false) {
+            console.info("    Detail gap:  unavailable during snapshot reconciliation");
+        }
+        const lastError = stats.lastTerminalError ?? stats.terminalErrors.recent.at(-1);
+        if (lastError) {
+            const cause = lastError.errorType ?? lastError.category;
+            const code = lastError.errorCode ? `/${lastError.errorCode}` : "";
+            const account = lastError.account ? ` account=${lastError.account}` : "";
+            console.info(`    Last error:  ${new Date(lastError.at).toISOString()} ${cause}${code} status=${lastError.status}${account}`);
+            if (lastError.message) {
+                console.info(`    Last cause:  ${sanitizeProxyStatusTerminalErrorMessage(lastError.message)}`);
+            }
+        }
+    }
     if (stats.accounts?.length) {
         console.info(`\n  Accounts:`);
         const headers = [
@@ -2556,7 +2769,17 @@ function printStatusStats(stats) {
             String(account.success ?? 0),
             String(account.errors ?? 0),
             String(account.rateLimits ?? 0),
-            account.status ?? (account.cooling ? "cooling" : "active"),
+            (() => {
+                const status = account.status ?? (account.cooling ? "cooling" : "active");
+                const states = [status];
+                if (account.expired && status !== "expired") {
+                    states.push("expired");
+                }
+                if (account.allowed === false && status !== "excluded") {
+                    states.push("excluded");
+                }
+                return states.join(", ");
+            })(),
         ]);
         const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => row[index].length)));
         const numericColumns = new Set([2, 3, 4, 5]);
@@ -2646,20 +2869,23 @@ export const proxyStatusCommand = {
                             supervisorState.rolling.active?.pid === state?.pid)
                     : true);
             if ((state || supervisorState) && (servingWorker || supervisorRunning)) {
-                const activeHost = state?.host ?? supervisorState?.host ?? null;
-                const activePort = state?.port ?? supervisorState?.port ?? null;
+                const servingState = servingWorker ? state : null;
+                const activeHost = servingState?.host ?? supervisorState?.host ?? null;
+                const activePort = servingState?.port ?? supervisorState?.port ?? null;
                 status.running = true;
                 status.pid = servingWorker && state ? state.pid : null;
                 status.port = activePort;
                 status.host = activeHost;
-                status.mode = state
-                    ? state.passthrough
+                status.mode = servingState
+                    ? servingState.passthrough
                         ? "passthrough"
                         : "full"
                     : null;
-                status.strategy = state?.strategy ?? null;
+                status.strategy = servingState?.strategy ?? null;
                 status.startTime =
-                    state?.startTime ?? supervisorState?.startTime ?? null;
+                    (supervisorRunning ? supervisorState?.startTime : null) ??
+                        servingState?.startTime ??
+                        null;
                 status.uptime = status.startTime
                     ? Date.now() - new Date(status.startTime).getTime()
                     : null;
@@ -2667,17 +2893,18 @@ export const proxyStatusCommand = {
                     activeHost && activePort
                         ? `http://${activeHost === "0.0.0.0" ? "localhost" : activeHost}:${activePort}`
                         : null;
-                status.envFile = state?.envFile ?? null;
-                status.fallbackChain = state?.fallbackChain ?? null;
-                status.accountAllowlist = state?.accountAllowlist ?? null;
-                status.configGeneration = state?.configGeneration ?? null;
-                status.configLoadedAt = state?.configLoadedAt ?? null;
-                status.lastConfigReloadError = state?.lastConfigReloadError ?? null;
+                status.envFile = servingState?.envFile ?? null;
+                status.fallbackChain = servingState?.fallbackChain ?? null;
+                status.accountAllowlist = servingState?.accountAllowlist ?? null;
+                status.configGeneration = servingState?.configGeneration ?? null;
+                status.configLoadedAt = servingState?.configLoadedAt ?? null;
+                status.lastConfigReloadError =
+                    servingState?.lastConfigReloadError ?? null;
                 status.supervisorPid = supervisorPid ?? null;
                 status.supervisorRunning = supervisorRunning;
                 status.rolling = supervisorState?.rolling ?? null;
                 status.updaterPid =
-                    supervisorState?.updaterPid ?? state?.updaterPid ?? null;
+                    supervisorState?.updaterPid ?? servingState?.updaterPid ?? null;
                 status.updaterRunning = status.updaterPid
                     ? isProcessRunning(status.updaterPid)
                     : false;

package/dist/cli/commands/proxyAnalyze.js

@@ -11,7 +11,7 @@ function printAnalysis(report) {
     logger.always(chalk.gray("=".repeat(50)));
     logger.always(`  Since:       ${chalk.cyan(report.since)}`);
     logger.always(`  Logs:        ${chalk.cyan(report.logsDir)}`);
-    logger.always(`  Files:       ${report.files.requests} request, ${report.files.attempts} attempt, ${report.files.lifecycle} lifecycle`);
+    logger.always(`  Files:       ${report.files.requests} request, ${report.files.attempts} attempt, ${report.files.lifecycle} lifecycle, ${report.files.debug} debug`);
     logger.always("");
     logger.always(chalk.bold("  Reliability"));
     logger.always(report.coverage.finalRequests
@@ -68,6 +68,15 @@ function printAnalysis(report) {
     logger.always("");
     logger.always(chalk.bold("  Data Quality"));
     logger.always(`    ${report.dataQuality.linesRead} lines scanned, ${report.dataQuality.malformedLines} malformed, ${report.dataQuality.unsupportedLifecycleLines} unsupported lifecycle, ${report.dataQuality.lifecycleSequenceGaps} sequence gaps, ${report.dataQuality.lifecycleSequenceDuplicates} duplicates`);
+    for (const [stream, range] of Object.entries(report.dataQuality.streams)) {
+        if (range.observedFrom) {
+            logger.always(`    ${stream}: ${range.observedFrom} to ${range.observedTo}${range.startsAtOrBeforeRequestedWindow ? "" : chalk.yellow(" (starts after requested window)")}`);
+        }
+    }
+    const artifacts = report.dataQuality.bodyArtifacts;
+    if (artifacts.capturesIndexed > 0) {
+        logger.always(`    Body artifacts: ${artifacts.artifactsPresent}/${artifacts.artifactsReferenced} present, ${artifacts.artifactsMissing} missing, ${artifacts.writeFailures} write failures, ${artifacts.invalidPaths} invalid paths, ${artifacts.truncatedCaptures} truncated captures`);
+    }
     if (report.accounts.length > 0) {
         logger.always("");
         logger.always(chalk.bold("  Accounts"));

package/dist/lib/auth/tokenStore.d.ts

@@ -96,6 +96,8 @@ export declare class TokenStore {
      * @throws TokenStoreError if reading fails (other than file not found)
      */
     loadTokens(provider: string): Promise<StoredOAuthTokens | null>;
+    /** Reads tokens without updating access metadata or rewriting the store. */
+    peekTokens(provider: string): Promise<StoredOAuthTokens | null>;
     /**
      * Internal load without mutex — callers must already hold the mutex.
      */
@@ -179,6 +181,11 @@ export declare class TokenStore {
      * @param reason - Optional human-readable reason (e.g., "refresh_failed")
      */
     markDisabled(provider: string, reason?: string): Promise<void>;
+    /**
+     * Disables an account only when the persisted credentials still match the
+     * request that observed the authentication failure.
+     */
+    markDisabledIfCurrent(provider: string, expectedTokens: Pick<StoredOAuthTokens, "accessToken" | "refreshToken" | "expiresAt">, reason?: string): Promise<boolean>;
     /**
      * Re-enables a previously disabled provider (persisted to disk).
      *

package/dist/lib/auth/tokenStore.js

@@ -213,6 +213,22 @@ export class TokenStore {
             return result;
         });
     }
+    /** Reads tokens without updating access metadata or rewriting the store. */
+    async peekTokens(provider) {
+        return this._mutex.runExclusive(async () => {
+            try {
+                const storageData = await this.loadStorageData();
+                const tokens = storageData.providers[provider]?.tokens;
+                return tokens ? { ...tokens } : null;
+            }
+            catch (error) {
+                if (error instanceof TokenStoreError && error.code === "NOT_FOUND") {
+                    return null;
+                }
+                throw error;
+            }
+        });
+    }
     /**
      * Internal load without mutex — callers must already hold the mutex.
      */
@@ -539,6 +555,44 @@ export class TokenStore {
             });
         });
     }
+    /**
+     * Disables an account only when the persisted credentials still match the
+     * request that observed the authentication failure.
+     */
+    async markDisabledIfCurrent(provider, expectedTokens, reason) {
+        return this._mutex.runExclusive(async () => {
+            let storageData;
+            try {
+                storageData = await this.loadStorageData();
+            }
+            catch (error) {
+                if (error instanceof TokenStoreError && error.code === "NOT_FOUND") {
+                    return false;
+                }
+                throw error;
+            }
+            const providerData = storageData.providers[provider];
+            if (!providerData) {
+                return false;
+            }
+            const current = providerData.tokens;
+            if (current.accessToken !== expectedTokens.accessToken ||
+                current.refreshToken !== expectedTokens.refreshToken ||
+                current.expiresAt !== expectedTokens.expiresAt) {
+                return false;
+            }
+            providerData.disabled = true;
+            providerData.disabledAt = Date.now();
+            providerData.disabledReason = reason;
+            storageData.lastModified = Date.now();
+            await this.saveStorageData(storageData);
+            logger.info("Provider marked as disabled", {
+                provider,
+                reason: reason ?? "unspecified",
+            });
+            return true;
+        });
+    }
     /**
      * Re-enables a previously disabled provider (persisted to disk).
      *