@juspay/neurolink 10.8.11 → 10.8.13

package/dist/cli/commands/mcp.js

@@ -116,6 +116,40 @@ const POPULAR_MCP_SERVERS = {
     },
 };
 const MCP_STATUS_TIMEOUT_MS = 30_000;
+/** Where `externalServerManager` looks for manually configured servers. */
+const MCP_CONFIG_FILENAME = ".mcp-config.json";
+/**
+ * Explain an empty server list in terms of what the user's directory actually
+ * looks like.
+ *
+ * "Found 0 MCP servers" plus two generic tips reads as an error with no cause:
+ * the common case is simply that this project has no `.mcp-config.json`, and
+ * saying so turns a dead end into a next step. When the file *is* present, the
+ * cause is different — it parsed but declared nothing usable — so the advice
+ * has to be different too, otherwise we'd send the user to create a file they
+ * already have.
+ */
+function explainEmptyServerList() {
+    const configPath = path.join(process.cwd(), MCP_CONFIG_FILENAME);
+    const configExists = fs.existsSync(configPath);
+    const lines = [];
+    if (configExists) {
+        lines.push(chalk.blue(`📄 Found ${MCP_CONFIG_FILENAME}, but it declares no usable servers.`), chalk.blue(`   Check the "mcpServers" object in ${configPath} — each entry needs a "command" (stdio) or "url" (http/sse/websocket).`));
+    }
+    else {
+        lines.push(chalk.blue(`📄 No ${MCP_CONFIG_FILENAME} in this directory (${process.cwd()}).`), chalk.blue("   That file is where NeuroLink reads manually configured servers from."));
+    }
+    // Neither `install` nor `add` persists anything: both route through
+    // NeuroLink.addInMemoryMCPServer(), which registers into the in-process tool
+    // registry and is gone when the process exits. Nothing in the CLI writes
+    // MCP_CONFIG_FILENAME. Saying otherwise sends the user looking for a file
+    // that was never created — so the persistent path is spelled out as the
+    // manual edit it actually is.
+    lines.push("", chalk.blue("Next steps:"), chalk.blue(configExists
+        ? `  • Add an entry to the "mcpServers" object in ${MCP_CONFIG_FILENAME} — editing that file is the only way to configure a server permanently.`
+        : `  • Create ${MCP_CONFIG_FILENAME} here with an "mcpServers" object — each entry needs a "command" (stdio) or "url" (http/sse/websocket). Writing that file is the only way to configure a server permanently.`), chalk.blue("  • neurolink mcp install <server>   register a popular server for the current run only"), chalk.blue("  • neurolink mcp discover           discover tools from servers already reachable"), chalk.blue("  • neurolink mcp --help             all MCP subcommands"));
+    return lines.join("\n");
+}
 /**
  * MCP CLI command factory
  */
@@ -199,9 +233,9 @@ export class MCPCommandFactory {
                     default: false,
                     description: "Suppress non-essential output",
                 })
-                    .example("neurolink discover", "Discover MCP servers from all sources")
-                    .example("neurolink discover --source claude-desktop", "Discover from Claude Desktop only")
-                    .example("neurolink discover --auto-install", "Discover and auto-install servers");
+                    .example("neurolink mcp discover", "Discover MCP servers from all sources")
+                    .example("neurolink mcp discover --source claude-desktop", "Discover from Claude Desktop only")
+                    .example("neurolink mcp discover --auto-install", "Discover and auto-install servers");
             },
             handler: async (argv) => await MCPCommandFactory.executeDiscover(argv),
         };
@@ -357,8 +391,7 @@ export class MCPCommandFactory {
             }
             if (allServers.length === 0) {
                 logger.always(chalk.yellow("No MCP servers configured."));
-                logger.always(chalk.blue("💡 Use 'neurolink mcp install <server>' to install popular servers"));
-                logger.always(chalk.blue("💡 Use 'neurolink discover' to find existing servers"));
+                logger.always(explainEmptyServerList());
                 return;
             }
             // Format and display results

package/dist/cli/commands/proxy.d.ts

@@ -11,8 +11,27 @@
  */
 import type { CommandModule } from "yargs";
 import type { Hono } from "hono";
-import type { AccountAllowlist, LoadedProxyConfig, ModelRouterInterface, ProxyGuardArgs, ProxyNeurolinkRuntime, ProxyStartArgs, ProxyStartStrategy, ProxyStatusArgs, ProxyTelemetryArgs, ProxyReadinessState } from "../../lib/types/index.js";
+import type { AccountAllowlist, LoadedProxyConfig, ModelRouterInterface, ProxyGuardArgs, ProxyNeurolinkRuntime, ProxyStartArgs, ProxyStartStrategy, ProxySupervisorState, ProxyStatusArgs, ProxyTelemetryArgs, ProxyReadinessState } from "../../lib/types/index.js";
 import { ProxyRuntimeConfigStore } from "../../lib/proxy/runtimeConfig.js";
+/**
+ * Drop a supervisor `version` that is not a string.
+ *
+ * `StateFileManager.load()` is a bare `JSON.parse(content) as T` — it validates
+ * nothing. A state file written by a different build, or half-written during a
+ * crash, can carry any JSON type here, and every status renderer interpolates
+ * the field straight into `v${...}`. Coercing at the single load boundary keeps
+ * a non-string from reaching the output as "v[object Object]".
+ */
+export declare function normalizeSupervisorState(state: ProxySupervisorState | null): ProxySupervisorState | null;
+/**
+ * Whether a rolling handoff can actually occur.
+ *
+ * A live supervisor PID alone is not enough: a supervisor from a build
+ * predating rolling state leaves `rolling` absent, and calling that a handoff
+ * makes both `/status` clients and the CLI wait for an activation that will
+ * never come. Gate on the capability, not on the process.
+ */
+export declare function isRollingHandoffCapable(state: ProxySupervisorState | null, isRunning?: (pid: number) => boolean): boolean;
 /**
  * Best-effort check that a pid actually belongs to a neurolink proxy process,
  * so a stale/recycled supervisor pid is never mistaken for a live supervisor

package/dist/cli/commands/proxy.js

@@ -81,8 +81,42 @@ function clearProxyState() {
 function saveProxySupervisorState(state) {
     proxySupervisorStateManager.save(state);
 }
+/**
+ * Drop a supervisor `version` that is not a string.
+ *
+ * `StateFileManager.load()` is a bare `JSON.parse(content) as T` — it validates
+ * nothing. A state file written by a different build, or half-written during a
+ * crash, can carry any JSON type here, and every status renderer interpolates
+ * the field straight into `v${...}`. Coercing at the single load boundary keeps
+ * a non-string from reaching the output as "v[object Object]".
+ */
+export function normalizeSupervisorState(state) {
+    if (!state) {
+        return null;
+    }
+    return typeof state.version === "string" || state.version === undefined
+        ? state
+        : { ...state, version: undefined };
+}
+/**
+ * Whether a rolling handoff can actually occur.
+ *
+ * A live supervisor PID alone is not enough: a supervisor from a build
+ * predating rolling state leaves `rolling` absent, and calling that a handoff
+ * makes both `/status` clients and the CLI wait for an activation that will
+ * never come. Gate on the capability, not on the process.
+ */
+export function isRollingHandoffCapable(state, isRunning = isProcessRunning) {
+    if (!state) {
+        return false;
+    }
+    // Structural, not just non-null: the same unvalidated `as T` load that lets
+    // `version` be an object lets `rolling` be a string.
+    const hasRollingState = typeof state.rolling === "object" && state.rolling !== null;
+    return isRunning(state.pid) && hasRollingState;
+}
 function loadProxySupervisorState() {
-    return proxySupervisorStateManager.load();
+    return normalizeSupervisorState(proxySupervisorStateManager.load());
 }
 function clearProxySupervisorState() {
     proxySupervisorStateManager.clear();
@@ -1556,6 +1590,7 @@ export async function createProxyStartApp(params) {
             : undefined;
         const runtimeState = loadProxyState();
         const supervisorState = loadProxySupervisorState();
+        const rollingSupervisorRunning = isRollingHandoffCapable(supervisorState);
         const updateState = loadUpdateState();
         const cooldowns = await loadAccountCooldowns();
         const storedAccountKeys = new Set();
@@ -1779,6 +1814,7 @@ export async function createProxyStartApp(params) {
             autoUpdate: {
                 enabled: isProxyAutoUpdateEnabled(),
                 supervisorPid: supervisorState?.pid ?? null,
+                supervisorVersion: supervisorState?.version ?? null,
                 rolling: supervisorState?.rolling ?? null,
                 updaterPid: activeUpdaterPid ?? null,
                 updaterRunning: activeUpdaterPid
@@ -1786,7 +1822,16 @@ export async function createProxyStartApp(params) {
                     : false,
                 liveVersion: PROXY_VERSION,
                 latestVersion: updateState?.lastCheckVersion || null,
+                lastDetectedVersion: updateState?.lastCheckVersion || null,
+                installedVersion: updateState?.installedVersion ??
+                    updateState?.lastUpdateVersion ??
+                    null,
+                activatedVersion: PROXY_VERSION,
+                pendingActivationVersion: updateState?.pendingRestartVersion ?? null,
                 pendingRestartVersion: updateState?.pendingRestartVersion ?? null,
+                activationMode: rollingSupervisorRunning
+                    ? "rolling-handoff"
+                    : "restart",
                 deferredUpdate: updateState?.deferredUpdate ?? null,
                 lastCheckAt: updateState?.lastCheckAt ?? null,
                 lastUpdateAt: updateState?.lastUpdateAt ?? null,
@@ -2426,6 +2471,7 @@ async function runLaunchdProxySupervisor(argv, spinner) {
                 host,
                 port,
                 startTime: supervisorStartedAt,
+                version: PROXY_VERSION,
                 updaterPid: currentUpdaterPid,
                 rolling: snapshot,
             });
@@ -2850,11 +2896,18 @@ export const proxyStatusCommand = {
                 autoUpdateEnabled: isProxyAutoUpdateEnabled(),
                 workerVersion: null,
                 supervisorPid: null,
+                supervisorVersion: supervisorState?.version ?? null,
                 supervisorRunning: false,
                 rolling: null,
                 updaterPid: null,
                 updaterRunning: false,
                 latestVersion: updateState?.lastCheckVersion || null,
+                lastDetectedVersion: updateState?.lastCheckVersion || null,
+                installedVersion: updateState?.installedVersion ??
+                    updateState?.lastUpdateVersion ??
+                    null,
+                activatedVersion: supervisorState?.rolling.active?.version ?? null,
+                pendingActivationVersion: updateState?.pendingRestartVersion ?? null,
                 pendingRestartVersion: updateState?.pendingRestartVersion ?? null,
                 deferredUpdate: updateState?.deferredUpdate ?? null,
                 lastUpdateFailure: updateState?.lastFailure ?? null,
@@ -2904,6 +2957,7 @@ export const proxyStatusCommand = {
                     servingState?.lastConfigReloadError ?? null;
                 status.supervisorPid = supervisorPid ?? null;
                 status.supervisorRunning = supervisorRunning;
+                status.supervisorVersion = supervisorState?.version ?? null;
                 status.rolling = supervisorState?.rolling ?? null;
                 status.updaterPid =
                     supervisorState?.updaterPid ?? servingState?.updaterPid ?? null;
@@ -2927,6 +2981,7 @@ export const proxyStatusCommand = {
                             typeof statusData.version === "string"
                                 ? statusData.version
                                 : null;
+                        status.activatedVersion = status.workerVersion;
                         if (typeof liveConfig?.generation === "number") {
                             status.configGeneration = liveConfig.generation;
                         }
@@ -2959,6 +3014,9 @@ export const proxyStatusCommand = {
                 if (status.supervisorPid) {
                     logger.always(`  ${chalk.bold("Supervisor:")} ${status.supervisorRunning ? chalk.cyan(status.supervisorPid) : chalk.red(`${status.supervisorPid} (not running)`)}`);
                 }
+                if (status.supervisorVersion) {
+                    logger.always(`  ${chalk.bold("Supervisor version:")} ${chalk.cyan(`v${status.supervisorVersion}`)}`);
+                }
                 if (status.workerVersion) {
                     logger.always(`  ${chalk.bold("Version:")}    ${chalk.cyan(`v${status.workerVersion}`)}`);
                 }
@@ -2977,8 +3035,14 @@ export const proxyStatusCommand = {
                 logger.always(`  ${chalk.bold("Started:")}    ${chalk.cyan(status.startTime)}`);
                 logger.always(`  ${chalk.bold("Uptime:")}     ${chalk.cyan(formatUptime(status.uptime ?? 0))}`);
                 logger.always(`  ${chalk.bold("Auto-update:")} ${status.autoUpdateEnabled ? chalk.green(status.updaterRunning ? `enabled (PID ${status.updaterPid})` : "enabled (worker unavailable)") : chalk.yellow("disabled")}`);
-                if (status.pendingRestartVersion) {
-                    logger.always(`  ${chalk.bold("Pending:")}    ${chalk.yellow(`v${status.pendingRestartVersion} installed; restart pending`)}`);
+                if (status.pendingActivationVersion) {
+                    // A live supervisor PID alone does NOT mean rolling handoff is
+                    // available: a supervisor from a build predating rolling state leaves
+                    // `rolling` absent, and calling that a handoff tells the operator to
+                    // wait for an activation that will never come. Gate on the capability,
+                    // not on the process.
+                    const rollingCapable = status.supervisorRunning && status.rolling !== null;
+                    logger.always(`  ${chalk.bold(rollingCapable ? "Pending handoff:" : "Pending restart:")} ${chalk.yellow(`v${status.pendingActivationVersion} installed; ${rollingCapable ? "rolling activation pending" : "restart pending"}`)}`);
                 }
                 if (status.rolling?.candidate) {
                     logger.always(`  ${chalk.bold("Handoff:")}    ${chalk.yellow(`preparing v${status.rolling.candidate.expectedVersion} (PID ${status.rolling.candidate.pid})`)}`);
@@ -2995,6 +3059,12 @@ export const proxyStatusCommand = {
                 if (status.latestVersion) {
                     logger.always(`  ${chalk.bold("Latest:")}     ${chalk.cyan(`v${status.latestVersion}`)}`);
                 }
+                if (status.installedVersion) {
+                    logger.always(`  ${chalk.bold("Installed:")}  ${chalk.cyan(`v${status.installedVersion}`)}`);
+                }
+                if (status.activatedVersion) {
+                    logger.always(`  ${chalk.bold("Activated:")}  ${chalk.cyan(`v${status.activatedVersion}`)}`);
+                }
                 if (status.lastUpdateFailure) {
                     logger.always(`  ${chalk.bold("Update error:")} ${chalk.red(`${status.lastUpdateFailure.stage}: ${status.lastUpdateFailure.message}`)}`);
                 }

package/dist/lib/proxy/modelRouter.d.ts

@@ -1,8 +1,18 @@
 import type { FallbackEntry, ModelMapping, ProxyRoutingConfig, RouteResult } from "../types/index.js";
-/** Default and accepted range for concurrent upstream requests per OAuth account. */
+/** Accepted range for an explicitly configured OAuth account admission cap. */
 export declare const MIN_MAX_INFLIGHT_PER_ACCOUNT = 1;
 export declare const MAX_MAX_INFLIGHT_PER_ACCOUNT = 20;
-export declare const DEFAULT_MAX_INFLIGHT_PER_ACCOUNT = 2;
+/**
+ * The single definition of "a usable admission cap": an integer inside the
+ * accepted range. Anything else — `0`, `1.5`, `21`, `NaN` — means unlimited.
+ *
+ * `parseProxyConfig()` already drops invalid YAML values, but `ProxyRoutingConfig`
+ * is an exported type, so a programmatic caller can hand `ModelRouter` a value
+ * that never passed through it. Without this, `getMaxInflightPerAccount()` would
+ * report a bound (`0`, `21`) that the admission path ignores as unlimited, and
+ * the two would disagree about whether the account is capped.
+ */
+export declare function normalizeMaxInflightPerAccount(capacity: number | undefined): number | undefined;
 export declare class ModelRouter {
     private readonly mappings;
     private readonly passthrough;
@@ -15,8 +25,8 @@ export declare class ModelRouter {
     getFallbackChain(): FallbackEntry[];
     /** Whether translation-layer auto-provider fallback is explicitly enabled. */
     isAutoFallbackEnabled(): boolean;
-    /** Maximum concurrent upstream requests admitted for each OAuth account. */
-    getMaxInflightPerAccount(): number;
+    /** Explicit per-account admission cap, or undefined when admission is unlimited. */
+    getMaxInflightPerAccount(): number | undefined;
     /** Return the raw model mapping entries (used by /v1/models). */
     getModelMappings(): ModelMapping[];
     /** Return models configured for passthrough (used by /v1/models). */

package/dist/lib/proxy/modelRouter.js

@@ -1,7 +1,24 @@
-/** Default and accepted range for concurrent upstream requests per OAuth account. */
+/** Accepted range for an explicitly configured OAuth account admission cap. */
 export const MIN_MAX_INFLIGHT_PER_ACCOUNT = 1;
 export const MAX_MAX_INFLIGHT_PER_ACCOUNT = 20;
-export const DEFAULT_MAX_INFLIGHT_PER_ACCOUNT = 2;
+/**
+ * The single definition of "a usable admission cap": an integer inside the
+ * accepted range. Anything else — `0`, `1.5`, `21`, `NaN` — means unlimited.
+ *
+ * `parseProxyConfig()` already drops invalid YAML values, but `ProxyRoutingConfig`
+ * is an exported type, so a programmatic caller can hand `ModelRouter` a value
+ * that never passed through it. Without this, `getMaxInflightPerAccount()` would
+ * report a bound (`0`, `21`) that the admission path ignores as unlimited, and
+ * the two would disagree about whether the account is capped.
+ */
+export function normalizeMaxInflightPerAccount(capacity) {
+    return typeof capacity === "number" &&
+        Number.isInteger(capacity) &&
+        capacity >= MIN_MAX_INFLIGHT_PER_ACCOUNT &&
+        capacity <= MAX_MAX_INFLIGHT_PER_ACCOUNT
+        ? capacity
+        : undefined;
+}
 export class ModelRouter {
     mappings;
     passthrough;
@@ -13,8 +30,7 @@ export class ModelRouter {
         this.passthrough = new Set(config.passthroughModels ?? []);
         this.fallback = config.fallbackChain;
         this.autoFallback = config.autoFallback === true;
-        this.maxInflightPerAccount =
-            config.maxInflightPerAccount ?? DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
+        this.maxInflightPerAccount = normalizeMaxInflightPerAccount(config.maxInflightPerAccount);
     }
     resolve(requestedModel) {
         const mapping = this.mappings.get(requestedModel);
@@ -42,7 +58,7 @@ export class ModelRouter {
     isAutoFallbackEnabled() {
         return this.autoFallback;
     }
-    /** Maximum concurrent upstream requests admitted for each OAuth account. */
+    /** Explicit per-account admission cap, or undefined when admission is unlimited. */
     getMaxInflightPerAccount() {
         return this.maxInflightPerAccount;
     }

package/dist/lib/proxy/updateState.d.ts

@@ -48,7 +48,7 @@ export declare function suppressVersion(version: string, reason: string, stateFi
  * @param stateFilePath - Override path for testing
  */
 export declare function recordSuccessfulUpdate(version: string, stateFilePath?: string): void;
-/** Record that package installation completed but the live restart is pending. */
+/** Record that the package was validated but live activation is still pending. */
 export declare function recordUpdateInstalled(version: string, stateFilePath?: string): void;
 /** Abandon a matching installed version so the next cycle may reinstall it. */
 export declare function abandonPendingUpdate(version: string, stateFilePath?: string): boolean;

package/dist/lib/proxy/updateState.js

@@ -87,6 +87,7 @@ export function getDefaultUpdateState() {
         lastCheckAt: new Date(0).toISOString(),
         lastCheckVersion: "",
         suppressedVersions: {},
+        installedVersion: null,
         lastUpdateAt: null,
         lastUpdateVersion: null,
         pendingRestartVersion: null,
@@ -124,6 +125,20 @@ export function loadUpdateState(stateFilePath) {
             ...getDefaultUpdateState(),
             ...candidate,
             suppressedVersions: candidate.suppressedVersions ?? {},
+            // Backfill order matters for state files written before `installedVersion`
+            // existed. Back then `recordUpdateInstalled()` set ONLY
+            // `pendingRestartVersion`, leaving `lastUpdateVersion` on the previously
+            // activated build — so a validated-but-not-yet-running update lives in
+            // `pendingRestartVersion` and is the newer of the two. Reading
+            // `lastUpdateVersion` first would report the superseded version as
+            // installed and re-offer an update that is already on disk.
+            installedVersion: typeof candidate.installedVersion === "string"
+                ? candidate.installedVersion
+                : typeof candidate.pendingRestartVersion === "string"
+                    ? candidate.pendingRestartVersion
+                    : typeof candidate.lastUpdateVersion === "string"
+                        ? candidate.lastUpdateVersion
+                        : null,
             pendingRestartVersion: typeof candidate.pendingRestartVersion === "string"
                 ? candidate.pendingRestartVersion
                 : null,
@@ -208,15 +223,17 @@ export function recordSuccessfulUpdate(version, stateFilePath) {
     const state = loadUpdateState(stateFilePath) ?? getDefaultUpdateState();
     state.lastUpdateAt = new Date().toISOString();
     state.lastUpdateVersion = version;
+    state.installedVersion = version;
     state.pendingRestartVersion = null;
     state.deferredUpdate = null;
     state.lastFailure = null;
     delete state.suppressedVersions[version];
     saveUpdateState(state, stateFilePath);
 }
-/** Record that package installation completed but the live restart is pending. */
+/** Record that the package was validated but live activation is still pending. */
 export function recordUpdateInstalled(version, stateFilePath) {
     const state = loadUpdateState(stateFilePath) ?? getDefaultUpdateState();
+    state.installedVersion = version;
     state.pendingRestartVersion = version;
     state.lastFailure = null;
     saveUpdateState(state, stateFilePath);

package/dist/lib/server/routes/claudeProxyRoutes.d.ts

@@ -12,8 +12,9 @@
 import { buildTranslationOptions } from "../../proxy/proxyTranslationEngine.js";
 import { ProxyTracer } from "../../proxy/proxyTracer.js";
 import { isPermanentRefreshFailure } from "../../proxy/tokenRefresh.js";
-import type { AccountAllowlist, AccountAdmissionLease, AccountCooldownPlan, AccountQuota, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicLoopState, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyQuotaCooldownUpdate, ProxyPassthroughAccount, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
-declare function tryAcquireAccountAdmission(accountKey: string, capacity: number): AccountAdmissionLease | undefined;
+import type { AccountAllowlist, AccountAdmissionLease, AccountCooldownPlan, AccountQuota, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicLoopState, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyQuotaCooldownUpdate, ProxyPassthroughAccount, QueuedAccountAdmission, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
+declare function tryAcquireAccountAdmission(accountKey: string, capacity: number | undefined): AccountAdmissionLease | undefined;
+declare function enqueueAccountAdmission(accountKey: string, capacity: number): QueuedAccountAdmission;
 declare function acquireAccountAdmission(accountKey: string, capacity: number, abortSignal?: AbortSignal, timeoutMs?: number): Promise<AccountAdmissionLease | undefined>;
 declare function acquireFirstAvailableAccountAdmission(accountKeys: string[], capacity: number, abortSignal?: AbortSignal, timeoutMs?: number): Promise<{
     accountKey: string;
@@ -375,10 +376,12 @@ export declare const __testHooks: {
     acquireAccountAdmission: typeof acquireAccountAdmission;
     acquireFirstAvailableAccountAdmission: typeof acquireFirstAvailableAccountAdmission;
     tryAcquireAccountAdmission: typeof tryAcquireAccountAdmission;
+    enqueueAccountAdmission: typeof enqueueAccountAdmission;
     getAccountAdmissionSnapshot: (accountKey: string) => {
         active: number;
         waiting: number;
     };
+    hasAccountAdmissionState: (accountKey: string) => boolean;
     describeTransportError: typeof describeTransportError;
     redactProviderErrorMessage: typeof redactProviderErrorMessage;
     isUpstreamOverload: typeof isUpstreamOverload;

package/dist/lib/server/routes/claudeProxyRoutes.js

@@ -29,7 +29,7 @@ import { createSSEInterceptor } from "../../proxy/sseInterceptor.js";
 import { createStreamTerminalOutcomeTracker, mergeStreamTerminalOutcome, preflightAnthropicStream, } from "../../proxy/streamOutcome.js";
 import { isPermanentRefreshFailure, needsRefresh, persistTokens, refreshToken, refreshTokenFromLatest, } from "../../proxy/tokenRefresh.js";
 import { buildProxyTranslationPlan, parseRetryAfterMs, } from "../../proxy/routingPolicy.js";
-import { DEFAULT_MAX_INFLIGHT_PER_ACCOUNT, MAX_MAX_INFLIGHT_PER_ACCOUNT, MIN_MAX_INFLIGHT_PER_ACCOUNT, } from "../../proxy/modelRouter.js";
+import { normalizeMaxInflightPerAccount } from "../../proxy/modelRouter.js";
 import { writeJsonSnapshotAtomically } from "../../proxy/snapshotPersistence.js";
 import { recordAttempt, recordAttemptError, recordFinalError, recordFinalSuccess, } from "../../proxy/usageStats.js";
 import { sanitizeForLog } from "../../utils/logSanitize.js";
@@ -122,6 +122,9 @@ const transientCooldownAdmissionSchedules = new Map();
  * make room for another stream on the same account.
  */
 const accountAdmissionStates = new Map();
+const unlimitedAccountAdmissionLease = {
+    release: () => undefined,
+};
 function getAccountAdmissionState(accountKey) {
     let state = accountAdmissionStates.get(accountKey);
     if (!state) {
@@ -130,13 +133,6 @@ function getAccountAdmissionState(accountKey) {
     }
     return state;
 }
-function normalizeAccountAdmissionCapacity(capacity) {
-    return Number.isInteger(capacity) &&
-        capacity >= MIN_MAX_INFLIGHT_PER_ACCOUNT &&
-        capacity <= MAX_MAX_INFLIGHT_PER_ACCOUNT
-        ? capacity
-        : DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
-}
 function drainAccountAdmissionWaiters(accountKey, state) {
     while (state.waiters.length > 0 && state.active < state.waiters[0].capacity) {
         const waiter = state.waiters.shift();
@@ -167,8 +163,11 @@ function discardAccountAdmissionState(accountKey, state) {
     }
 }
 function tryAcquireAccountAdmission(accountKey, capacity) {
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        return unlimitedAccountAdmissionLease;
+    }
     const state = getAccountAdmissionState(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     if (state.waiters.length > 0 || state.active >= normalizedCapacity) {
         return undefined;
     }
@@ -176,13 +175,23 @@ function tryAcquireAccountAdmission(accountKey, capacity) {
     return createAccountAdmissionLease(accountKey, state);
 }
 function isAccountAdmissionAvailable(accountKey, capacity) {
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        return true;
+    }
     const state = accountAdmissionStates.get(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     return (!state || (state.waiters.length === 0 && state.active < normalizedCapacity));
 }
 function enqueueAccountAdmission(accountKey, capacity) {
+    // Validate BEFORE getAccountAdmissionState(), which inserts into the map as a
+    // side effect. Throwing after it would strand an empty entry for an account
+    // that never got admitted — and the throw path never calls
+    // discardAccountAdmissionState() to reap it.
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        throw new Error("Account admission queue requires an explicit capacity");
+    }
     const state = getAccountAdmissionState(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     let queued = true;
     let grantedLease;
     let resolveAdmission;
@@ -4309,12 +4318,12 @@ async function handleAnthropicRoutedClaudeRequest(args) {
             loopState.authCooldownMessage = `All ${orderedAccounts.length} Anthropic accounts are temporarily unavailable while OAuth refresh is cooling. Earliest retry at ${new Date(earliestRetryAt).toISOString()}.`;
         }
     }
-    const accountAdmissionCapacity = modelRouter?.getMaxInflightPerAccount?.() ??
-        DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
+    const accountAdmissionCapacity = modelRouter?.getMaxInflightPerAccount?.();
     // When every eligible account is busy, reserve the first account that frees
     // instead of arbitrarily waiting behind the last configured account.
     let queuedAccountAdmission;
-    if (effectiveAccounts.length > 0 &&
+    if (accountAdmissionCapacity !== undefined &&
+        effectiveAccounts.length > 0 &&
         effectiveAccounts.every((account) => !isAccountAdmissionAvailable(account.key, accountAdmissionCapacity))) {
         queuedAccountAdmission = await acquireFirstAvailableAccountAdmission(effectiveAccounts.map((account) => account.key), accountAdmissionCapacity, ctx.abortSignal);
     }
@@ -5275,12 +5284,16 @@ export const __testHooks = {
     acquireAccountAdmission,
     acquireFirstAvailableAccountAdmission,
     tryAcquireAccountAdmission,
+    enqueueAccountAdmission,
     getAccountAdmissionSnapshot: (accountKey) => {
         const state = accountAdmissionStates.get(accountKey);
         return state
             ? { active: state.active, waiting: state.waiters.length }
             : { active: 0, waiting: 0 };
     },
+    // The snapshot above reports {active:0, waiting:0} both for "no entry" and
+    // for "empty entry", so it cannot see a stranded allocation. This can.
+    hasAccountAdmissionState: (accountKey) => accountAdmissionStates.has(accountKey),
     describeTransportError,
     redactProviderErrorMessage,
     isUpstreamOverload,

package/dist/lib/types/cli.d.ts

@@ -870,6 +870,8 @@ export type ProxySupervisorState = {
     host: string;
     port: number;
     startTime: string;
+    /** Version loaded by the long-lived supervisor process. */
+    version?: string;
     updaterPid?: number;
     rolling: ProxyRollingState;
 };

package/dist/lib/types/livekit.d.ts

@@ -500,4 +500,13 @@ export type BuildRealtimeMcpToolsParams = {
     publishEvent: RealtimeEventPublisher;
     /** Opens a HITL confirmation for destructive tools and awaits the decision. */
     requestConfirmation: RealtimeConfirmationRequester;
+    /**
+     * Hard cap per MCP tool call, in milliseconds (default 30000).
+     *
+     * Without one, a stalled MCP server holds the realtime turn open forever:
+     * Gemini waits on the function result, so the user gets silence rather than
+     * an error. Bounding the call turns that into a normal tool failure the
+     * model can talk about.
+     */
+    toolTimeoutMs?: number;
 };

package/dist/lib/types/proxy.d.ts

@@ -30,7 +30,7 @@ export type ModelRouterInterface = {
     isClaudeTarget(requestedModel: string): boolean;
     getFallbackChain(): FallbackEntry[];
     isAutoFallbackEnabled?(): boolean;
-    getMaxInflightPerAccount?(): number;
+    getMaxInflightPerAccount?(): number | undefined;
     getModelMappings?: () => ModelMapping[];
     getPassthroughModels?: () => string[];
 };
@@ -1724,6 +1724,15 @@ export type UpdateState = {
     lastCheckAt: string;
     lastCheckVersion: string;
     suppressedVersions: Record<string, SuppressedVersion>;
+    /**
+     * Last package version whose stable trampoline was successfully validated.
+     *
+     * Optional because `UpdateState` is part of the published type surface and a
+     * required addition would break every downstream object literal — and because
+     * state files written before this field existed legitimately omit it.
+     * `loadUpdateState()` always materializes it, so runtime readers see a value.
+     */
+    installedVersion?: string | null;
     lastUpdateAt: string | null;
     lastUpdateVersion: string | null;
     /** Installed by the updater but not yet confirmed as the running version. */

package/dist/lib/types/subscription.d.ts

@@ -910,7 +910,13 @@ export type ProxyRoutingConfig = {
     fallbackChain: FallbackEntry[];
     /** Permit a last-resort provider chosen by the translation layer. Disabled by default. */
     autoFallback?: boolean;
-    /** Maximum in-flight upstream requests per OAuth account. Defaults to two. */
+    /**
+     * Optional in-flight upstream request cap per OAuth account.
+     *
+     * Unlimited admission is the result of omitting it AND of any value outside
+     * the accepted range — a non-integer, or anything below 1 or above 20 — since
+     * `normalizeMaxInflightPerAccount()` discards those rather than clamping.
+     */
     maxInflightPerAccount?: number;
     passthroughModels?: string[];
     /** Enable quota-aware fill-first account ordering. Defaults to true. */

package/dist/lib/voice/livekit/realtimeMcpTools.js

@@ -16,6 +16,14 @@
 import { z } from "zod";
 import { logger } from "../../utils/logger.js";
 import { findSchemaIssue, sanitizeToolParameters } from "./schemaSanitizer.js";
+/**
+ * Default hard cap per MCP tool call.
+ *
+ * Chosen to sit well inside a conversational turn: a realtime voice user is
+ * waiting in silence while a tool runs, so a call that has not returned in
+ * 30s has already failed as far as the conversation is concerned.
+ */
+const DEFAULT_TOOL_TIMEOUT_MS = 30_000;
 /**
  * The fields of an MCP tool result we render: text content parts and the error
  * flag. The result crosses a network boundary from an external MCP server, so it
@@ -86,7 +94,7 @@ function registerToolAliases(toolContext, mcpToolName, handler) {
  * filtering is needed.
  */
 export async function buildRealtimeMcpTools(params) {
-    const { mcpUrl, authToken, xContext, publishEvent, requestConfirmation } = params;
+    const { mcpUrl, authToken, xContext, publishEvent, requestConfirmation, toolTimeoutMs = DEFAULT_TOOL_TIMEOUT_MS, } = params;
     const { llm } = await import("@livekit/agents");
     const { Client: McpClient } = await import("@modelcontextprotocol/sdk/client/index.js");
     const { StreamableHTTPClientTransport } = await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
@@ -141,10 +149,14 @@ export async function buildRealtimeMcpTools(params) {
                     publishEvent("tool-start", { name: mcpTool.name });
                     const startedAt = Date.now();
                     try {
+                        // Third argument is RequestOptions; the SDK aborts the in-flight
+                        // request when `timeout` elapses. Without it a stalled server holds
+                        // the turn open indefinitely — Gemini blocks on the function
+                        // result, so the user hears nothing at all rather than an error.
                         const result = await client.callTool({
                             name: mcpTool.name,
                             arguments: args ?? {},
-                        });
+                        }, undefined, { timeout: toolTimeoutMs });
                         const text = mcpResultToText(result);
                         logger.info("realtime.tool.result", {
                             tool: mcpTool.name,