@juspay/neurolink 10.8.12 → 10.8.13

package/dist/cli/commands/mcp.js

@@ -116,6 +116,40 @@ const POPULAR_MCP_SERVERS = {
     },
 };
 const MCP_STATUS_TIMEOUT_MS = 30_000;
+/** Where `externalServerManager` looks for manually configured servers. */
+const MCP_CONFIG_FILENAME = ".mcp-config.json";
+/**
+ * Explain an empty server list in terms of what the user's directory actually
+ * looks like.
+ *
+ * "Found 0 MCP servers" plus two generic tips reads as an error with no cause:
+ * the common case is simply that this project has no `.mcp-config.json`, and
+ * saying so turns a dead end into a next step. When the file *is* present, the
+ * cause is different — it parsed but declared nothing usable — so the advice
+ * has to be different too, otherwise we'd send the user to create a file they
+ * already have.
+ */
+function explainEmptyServerList() {
+    const configPath = path.join(process.cwd(), MCP_CONFIG_FILENAME);
+    const configExists = fs.existsSync(configPath);
+    const lines = [];
+    if (configExists) {
+        lines.push(chalk.blue(`📄 Found ${MCP_CONFIG_FILENAME}, but it declares no usable servers.`), chalk.blue(`   Check the "mcpServers" object in ${configPath} — each entry needs a "command" (stdio) or "url" (http/sse/websocket).`));
+    }
+    else {
+        lines.push(chalk.blue(`📄 No ${MCP_CONFIG_FILENAME} in this directory (${process.cwd()}).`), chalk.blue("   That file is where NeuroLink reads manually configured servers from."));
+    }
+    // Neither `install` nor `add` persists anything: both route through
+    // NeuroLink.addInMemoryMCPServer(), which registers into the in-process tool
+    // registry and is gone when the process exits. Nothing in the CLI writes
+    // MCP_CONFIG_FILENAME. Saying otherwise sends the user looking for a file
+    // that was never created — so the persistent path is spelled out as the
+    // manual edit it actually is.
+    lines.push("", chalk.blue("Next steps:"), chalk.blue(configExists
+        ? `  • Add an entry to the "mcpServers" object in ${MCP_CONFIG_FILENAME} — editing that file is the only way to configure a server permanently.`
+        : `  • Create ${MCP_CONFIG_FILENAME} here with an "mcpServers" object — each entry needs a "command" (stdio) or "url" (http/sse/websocket). Writing that file is the only way to configure a server permanently.`), chalk.blue("  • neurolink mcp install <server>   register a popular server for the current run only"), chalk.blue("  • neurolink mcp discover           discover tools from servers already reachable"), chalk.blue("  • neurolink mcp --help             all MCP subcommands"));
+    return lines.join("\n");
+}
 /**
  * MCP CLI command factory
  */
@@ -199,9 +233,9 @@ export class MCPCommandFactory {
                     default: false,
                     description: "Suppress non-essential output",
                 })
-                    .example("neurolink discover", "Discover MCP servers from all sources")
-                    .example("neurolink discover --source claude-desktop", "Discover from Claude Desktop only")
-                    .example("neurolink discover --auto-install", "Discover and auto-install servers");
+                    .example("neurolink mcp discover", "Discover MCP servers from all sources")
+                    .example("neurolink mcp discover --source claude-desktop", "Discover from Claude Desktop only")
+                    .example("neurolink mcp discover --auto-install", "Discover and auto-install servers");
             },
             handler: async (argv) => await MCPCommandFactory.executeDiscover(argv),
         };
@@ -357,8 +391,7 @@ export class MCPCommandFactory {
             }
             if (allServers.length === 0) {
                 logger.always(chalk.yellow("No MCP servers configured."));
-                logger.always(chalk.blue("💡 Use 'neurolink mcp install <server>' to install popular servers"));
-                logger.always(chalk.blue("💡 Use 'neurolink discover' to find existing servers"));
+                logger.always(explainEmptyServerList());
                 return;
             }
             // Format and display results

package/dist/lib/proxy/modelRouter.d.ts

@@ -1,8 +1,18 @@
 import type { FallbackEntry, ModelMapping, ProxyRoutingConfig, RouteResult } from "../types/index.js";
-/** Default and accepted range for concurrent upstream requests per OAuth account. */
+/** Accepted range for an explicitly configured OAuth account admission cap. */
 export declare const MIN_MAX_INFLIGHT_PER_ACCOUNT = 1;
 export declare const MAX_MAX_INFLIGHT_PER_ACCOUNT = 20;
-export declare const DEFAULT_MAX_INFLIGHT_PER_ACCOUNT = 2;
+/**
+ * The single definition of "a usable admission cap": an integer inside the
+ * accepted range. Anything else — `0`, `1.5`, `21`, `NaN` — means unlimited.
+ *
+ * `parseProxyConfig()` already drops invalid YAML values, but `ProxyRoutingConfig`
+ * is an exported type, so a programmatic caller can hand `ModelRouter` a value
+ * that never passed through it. Without this, `getMaxInflightPerAccount()` would
+ * report a bound (`0`, `21`) that the admission path ignores as unlimited, and
+ * the two would disagree about whether the account is capped.
+ */
+export declare function normalizeMaxInflightPerAccount(capacity: number | undefined): number | undefined;
 export declare class ModelRouter {
     private readonly mappings;
     private readonly passthrough;
@@ -15,8 +25,8 @@ export declare class ModelRouter {
     getFallbackChain(): FallbackEntry[];
     /** Whether translation-layer auto-provider fallback is explicitly enabled. */
     isAutoFallbackEnabled(): boolean;
-    /** Maximum concurrent upstream requests admitted for each OAuth account. */
-    getMaxInflightPerAccount(): number;
+    /** Explicit per-account admission cap, or undefined when admission is unlimited. */
+    getMaxInflightPerAccount(): number | undefined;
     /** Return the raw model mapping entries (used by /v1/models). */
     getModelMappings(): ModelMapping[];
     /** Return models configured for passthrough (used by /v1/models). */

package/dist/lib/proxy/modelRouter.js

@@ -1,7 +1,24 @@
-/** Default and accepted range for concurrent upstream requests per OAuth account. */
+/** Accepted range for an explicitly configured OAuth account admission cap. */
 export const MIN_MAX_INFLIGHT_PER_ACCOUNT = 1;
 export const MAX_MAX_INFLIGHT_PER_ACCOUNT = 20;
-export const DEFAULT_MAX_INFLIGHT_PER_ACCOUNT = 2;
+/**
+ * The single definition of "a usable admission cap": an integer inside the
+ * accepted range. Anything else — `0`, `1.5`, `21`, `NaN` — means unlimited.
+ *
+ * `parseProxyConfig()` already drops invalid YAML values, but `ProxyRoutingConfig`
+ * is an exported type, so a programmatic caller can hand `ModelRouter` a value
+ * that never passed through it. Without this, `getMaxInflightPerAccount()` would
+ * report a bound (`0`, `21`) that the admission path ignores as unlimited, and
+ * the two would disagree about whether the account is capped.
+ */
+export function normalizeMaxInflightPerAccount(capacity) {
+    return typeof capacity === "number" &&
+        Number.isInteger(capacity) &&
+        capacity >= MIN_MAX_INFLIGHT_PER_ACCOUNT &&
+        capacity <= MAX_MAX_INFLIGHT_PER_ACCOUNT
+        ? capacity
+        : undefined;
+}
 export class ModelRouter {
     mappings;
     passthrough;
@@ -13,8 +30,7 @@ export class ModelRouter {
         this.passthrough = new Set(config.passthroughModels ?? []);
         this.fallback = config.fallbackChain;
         this.autoFallback = config.autoFallback === true;
-        this.maxInflightPerAccount =
-            config.maxInflightPerAccount ?? DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
+        this.maxInflightPerAccount = normalizeMaxInflightPerAccount(config.maxInflightPerAccount);
     }
     resolve(requestedModel) {
         const mapping = this.mappings.get(requestedModel);
@@ -42,7 +58,7 @@ export class ModelRouter {
     isAutoFallbackEnabled() {
         return this.autoFallback;
     }
-    /** Maximum concurrent upstream requests admitted for each OAuth account. */
+    /** Explicit per-account admission cap, or undefined when admission is unlimited. */
     getMaxInflightPerAccount() {
         return this.maxInflightPerAccount;
     }

package/dist/lib/server/routes/claudeProxyRoutes.d.ts

@@ -12,8 +12,9 @@
 import { buildTranslationOptions } from "../../proxy/proxyTranslationEngine.js";
 import { ProxyTracer } from "../../proxy/proxyTracer.js";
 import { isPermanentRefreshFailure } from "../../proxy/tokenRefresh.js";
-import type { AccountAllowlist, AccountAdmissionLease, AccountCooldownPlan, AccountQuota, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicLoopState, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyQuotaCooldownUpdate, ProxyPassthroughAccount, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
-declare function tryAcquireAccountAdmission(accountKey: string, capacity: number): AccountAdmissionLease | undefined;
+import type { AccountAllowlist, AccountAdmissionLease, AccountCooldownPlan, AccountQuota, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicLoopState, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyQuotaCooldownUpdate, ProxyPassthroughAccount, QueuedAccountAdmission, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
+declare function tryAcquireAccountAdmission(accountKey: string, capacity: number | undefined): AccountAdmissionLease | undefined;
+declare function enqueueAccountAdmission(accountKey: string, capacity: number): QueuedAccountAdmission;
 declare function acquireAccountAdmission(accountKey: string, capacity: number, abortSignal?: AbortSignal, timeoutMs?: number): Promise<AccountAdmissionLease | undefined>;
 declare function acquireFirstAvailableAccountAdmission(accountKeys: string[], capacity: number, abortSignal?: AbortSignal, timeoutMs?: number): Promise<{
     accountKey: string;
@@ -375,10 +376,12 @@ export declare const __testHooks: {
     acquireAccountAdmission: typeof acquireAccountAdmission;
     acquireFirstAvailableAccountAdmission: typeof acquireFirstAvailableAccountAdmission;
     tryAcquireAccountAdmission: typeof tryAcquireAccountAdmission;
+    enqueueAccountAdmission: typeof enqueueAccountAdmission;
     getAccountAdmissionSnapshot: (accountKey: string) => {
         active: number;
         waiting: number;
     };
+    hasAccountAdmissionState: (accountKey: string) => boolean;
     describeTransportError: typeof describeTransportError;
     redactProviderErrorMessage: typeof redactProviderErrorMessage;
     isUpstreamOverload: typeof isUpstreamOverload;

package/dist/lib/server/routes/claudeProxyRoutes.js

@@ -29,7 +29,7 @@ import { createSSEInterceptor } from "../../proxy/sseInterceptor.js";
 import { createStreamTerminalOutcomeTracker, mergeStreamTerminalOutcome, preflightAnthropicStream, } from "../../proxy/streamOutcome.js";
 import { isPermanentRefreshFailure, needsRefresh, persistTokens, refreshToken, refreshTokenFromLatest, } from "../../proxy/tokenRefresh.js";
 import { buildProxyTranslationPlan, parseRetryAfterMs, } from "../../proxy/routingPolicy.js";
-import { DEFAULT_MAX_INFLIGHT_PER_ACCOUNT, MAX_MAX_INFLIGHT_PER_ACCOUNT, MIN_MAX_INFLIGHT_PER_ACCOUNT, } from "../../proxy/modelRouter.js";
+import { normalizeMaxInflightPerAccount } from "../../proxy/modelRouter.js";
 import { writeJsonSnapshotAtomically } from "../../proxy/snapshotPersistence.js";
 import { recordAttempt, recordAttemptError, recordFinalError, recordFinalSuccess, } from "../../proxy/usageStats.js";
 import { sanitizeForLog } from "../../utils/logSanitize.js";
@@ -122,6 +122,9 @@ const transientCooldownAdmissionSchedules = new Map();
  * make room for another stream on the same account.
  */
 const accountAdmissionStates = new Map();
+const unlimitedAccountAdmissionLease = {
+    release: () => undefined,
+};
 function getAccountAdmissionState(accountKey) {
     let state = accountAdmissionStates.get(accountKey);
     if (!state) {
@@ -130,13 +133,6 @@ function getAccountAdmissionState(accountKey) {
     }
     return state;
 }
-function normalizeAccountAdmissionCapacity(capacity) {
-    return Number.isInteger(capacity) &&
-        capacity >= MIN_MAX_INFLIGHT_PER_ACCOUNT &&
-        capacity <= MAX_MAX_INFLIGHT_PER_ACCOUNT
-        ? capacity
-        : DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
-}
 function drainAccountAdmissionWaiters(accountKey, state) {
     while (state.waiters.length > 0 && state.active < state.waiters[0].capacity) {
         const waiter = state.waiters.shift();
@@ -167,8 +163,11 @@ function discardAccountAdmissionState(accountKey, state) {
     }
 }
 function tryAcquireAccountAdmission(accountKey, capacity) {
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        return unlimitedAccountAdmissionLease;
+    }
     const state = getAccountAdmissionState(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     if (state.waiters.length > 0 || state.active >= normalizedCapacity) {
         return undefined;
     }
@@ -176,13 +175,23 @@ function tryAcquireAccountAdmission(accountKey, capacity) {
     return createAccountAdmissionLease(accountKey, state);
 }
 function isAccountAdmissionAvailable(accountKey, capacity) {
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        return true;
+    }
     const state = accountAdmissionStates.get(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     return (!state || (state.waiters.length === 0 && state.active < normalizedCapacity));
 }
 function enqueueAccountAdmission(accountKey, capacity) {
+    // Validate BEFORE getAccountAdmissionState(), which inserts into the map as a
+    // side effect. Throwing after it would strand an empty entry for an account
+    // that never got admitted — and the throw path never calls
+    // discardAccountAdmissionState() to reap it.
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        throw new Error("Account admission queue requires an explicit capacity");
+    }
     const state = getAccountAdmissionState(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     let queued = true;
     let grantedLease;
     let resolveAdmission;
@@ -4309,12 +4318,12 @@ async function handleAnthropicRoutedClaudeRequest(args) {
             loopState.authCooldownMessage = `All ${orderedAccounts.length} Anthropic accounts are temporarily unavailable while OAuth refresh is cooling. Earliest retry at ${new Date(earliestRetryAt).toISOString()}.`;
         }
     }
-    const accountAdmissionCapacity = modelRouter?.getMaxInflightPerAccount?.() ??
-        DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
+    const accountAdmissionCapacity = modelRouter?.getMaxInflightPerAccount?.();
     // When every eligible account is busy, reserve the first account that frees
     // instead of arbitrarily waiting behind the last configured account.
     let queuedAccountAdmission;
-    if (effectiveAccounts.length > 0 &&
+    if (accountAdmissionCapacity !== undefined &&
+        effectiveAccounts.length > 0 &&
         effectiveAccounts.every((account) => !isAccountAdmissionAvailable(account.key, accountAdmissionCapacity))) {
         queuedAccountAdmission = await acquireFirstAvailableAccountAdmission(effectiveAccounts.map((account) => account.key), accountAdmissionCapacity, ctx.abortSignal);
     }
@@ -5275,12 +5284,16 @@ export const __testHooks = {
     acquireAccountAdmission,
     acquireFirstAvailableAccountAdmission,
     tryAcquireAccountAdmission,
+    enqueueAccountAdmission,
     getAccountAdmissionSnapshot: (accountKey) => {
         const state = accountAdmissionStates.get(accountKey);
         return state
             ? { active: state.active, waiting: state.waiters.length }
             : { active: 0, waiting: 0 };
     },
+    // The snapshot above reports {active:0, waiting:0} both for "no entry" and
+    // for "empty entry", so it cannot see a stranded allocation. This can.
+    hasAccountAdmissionState: (accountKey) => accountAdmissionStates.has(accountKey),
     describeTransportError,
     redactProviderErrorMessage,
     isUpstreamOverload,

package/dist/lib/types/livekit.d.ts

@@ -500,4 +500,13 @@ export type BuildRealtimeMcpToolsParams = {
     publishEvent: RealtimeEventPublisher;
     /** Opens a HITL confirmation for destructive tools and awaits the decision. */
     requestConfirmation: RealtimeConfirmationRequester;
+    /**
+     * Hard cap per MCP tool call, in milliseconds (default 30000).
+     *
+     * Without one, a stalled MCP server holds the realtime turn open forever:
+     * Gemini waits on the function result, so the user gets silence rather than
+     * an error. Bounding the call turns that into a normal tool failure the
+     * model can talk about.
+     */
+    toolTimeoutMs?: number;
 };

package/dist/lib/types/proxy.d.ts

@@ -30,7 +30,7 @@ export type ModelRouterInterface = {
     isClaudeTarget(requestedModel: string): boolean;
     getFallbackChain(): FallbackEntry[];
     isAutoFallbackEnabled?(): boolean;
-    getMaxInflightPerAccount?(): number;
+    getMaxInflightPerAccount?(): number | undefined;
     getModelMappings?: () => ModelMapping[];
     getPassthroughModels?: () => string[];
 };

package/dist/lib/types/subscription.d.ts

@@ -910,7 +910,13 @@ export type ProxyRoutingConfig = {
     fallbackChain: FallbackEntry[];
     /** Permit a last-resort provider chosen by the translation layer. Disabled by default. */
     autoFallback?: boolean;
-    /** Maximum in-flight upstream requests per OAuth account. Defaults to two. */
+    /**
+     * Optional in-flight upstream request cap per OAuth account.
+     *
+     * Unlimited admission is the result of omitting it AND of any value outside
+     * the accepted range — a non-integer, or anything below 1 or above 20 — since
+     * `normalizeMaxInflightPerAccount()` discards those rather than clamping.
+     */
     maxInflightPerAccount?: number;
     passthroughModels?: string[];
     /** Enable quota-aware fill-first account ordering. Defaults to true. */

package/dist/lib/voice/livekit/realtimeMcpTools.js

@@ -16,6 +16,14 @@
 import { z } from "zod";
 import { logger } from "../../utils/logger.js";
 import { findSchemaIssue, sanitizeToolParameters } from "./schemaSanitizer.js";
+/**
+ * Default hard cap per MCP tool call.
+ *
+ * Chosen to sit well inside a conversational turn: a realtime voice user is
+ * waiting in silence while a tool runs, so a call that has not returned in
+ * 30s has already failed as far as the conversation is concerned.
+ */
+const DEFAULT_TOOL_TIMEOUT_MS = 30_000;
 /**
  * The fields of an MCP tool result we render: text content parts and the error
  * flag. The result crosses a network boundary from an external MCP server, so it
@@ -86,7 +94,7 @@ function registerToolAliases(toolContext, mcpToolName, handler) {
  * filtering is needed.
  */
 export async function buildRealtimeMcpTools(params) {
-    const { mcpUrl, authToken, xContext, publishEvent, requestConfirmation } = params;
+    const { mcpUrl, authToken, xContext, publishEvent, requestConfirmation, toolTimeoutMs = DEFAULT_TOOL_TIMEOUT_MS, } = params;
     const { llm } = await import("@livekit/agents");
     const { Client: McpClient } = await import("@modelcontextprotocol/sdk/client/index.js");
     const { StreamableHTTPClientTransport } = await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
@@ -141,10 +149,14 @@ export async function buildRealtimeMcpTools(params) {
                     publishEvent("tool-start", { name: mcpTool.name });
                     const startedAt = Date.now();
                     try {
+                        // Third argument is RequestOptions; the SDK aborts the in-flight
+                        // request when `timeout` elapses. Without it a stalled server holds
+                        // the turn open indefinitely — Gemini blocks on the function
+                        // result, so the user hears nothing at all rather than an error.
                         const result = await client.callTool({
                             name: mcpTool.name,
                             arguments: args ?? {},
-                        });
+                        }, undefined, { timeout: toolTimeoutMs });
                         const text = mcpResultToText(result);
                         logger.info("realtime.tool.result", {
                             tool: mcpTool.name,

package/dist/proxy/modelRouter.d.ts

@@ -1,8 +1,18 @@
 import type { FallbackEntry, ModelMapping, ProxyRoutingConfig, RouteResult } from "../types/index.js";
-/** Default and accepted range for concurrent upstream requests per OAuth account. */
+/** Accepted range for an explicitly configured OAuth account admission cap. */
 export declare const MIN_MAX_INFLIGHT_PER_ACCOUNT = 1;
 export declare const MAX_MAX_INFLIGHT_PER_ACCOUNT = 20;
-export declare const DEFAULT_MAX_INFLIGHT_PER_ACCOUNT = 2;
+/**
+ * The single definition of "a usable admission cap": an integer inside the
+ * accepted range. Anything else — `0`, `1.5`, `21`, `NaN` — means unlimited.
+ *
+ * `parseProxyConfig()` already drops invalid YAML values, but `ProxyRoutingConfig`
+ * is an exported type, so a programmatic caller can hand `ModelRouter` a value
+ * that never passed through it. Without this, `getMaxInflightPerAccount()` would
+ * report a bound (`0`, `21`) that the admission path ignores as unlimited, and
+ * the two would disagree about whether the account is capped.
+ */
+export declare function normalizeMaxInflightPerAccount(capacity: number | undefined): number | undefined;
 export declare class ModelRouter {
     private readonly mappings;
     private readonly passthrough;
@@ -15,8 +25,8 @@ export declare class ModelRouter {
     getFallbackChain(): FallbackEntry[];
     /** Whether translation-layer auto-provider fallback is explicitly enabled. */
     isAutoFallbackEnabled(): boolean;
-    /** Maximum concurrent upstream requests admitted for each OAuth account. */
-    getMaxInflightPerAccount(): number;
+    /** Explicit per-account admission cap, or undefined when admission is unlimited. */
+    getMaxInflightPerAccount(): number | undefined;
     /** Return the raw model mapping entries (used by /v1/models). */
     getModelMappings(): ModelMapping[];
     /** Return models configured for passthrough (used by /v1/models). */

package/dist/proxy/modelRouter.js

@@ -1,7 +1,24 @@
-/** Default and accepted range for concurrent upstream requests per OAuth account. */
+/** Accepted range for an explicitly configured OAuth account admission cap. */
 export const MIN_MAX_INFLIGHT_PER_ACCOUNT = 1;
 export const MAX_MAX_INFLIGHT_PER_ACCOUNT = 20;
-export const DEFAULT_MAX_INFLIGHT_PER_ACCOUNT = 2;
+/**
+ * The single definition of "a usable admission cap": an integer inside the
+ * accepted range. Anything else — `0`, `1.5`, `21`, `NaN` — means unlimited.
+ *
+ * `parseProxyConfig()` already drops invalid YAML values, but `ProxyRoutingConfig`
+ * is an exported type, so a programmatic caller can hand `ModelRouter` a value
+ * that never passed through it. Without this, `getMaxInflightPerAccount()` would
+ * report a bound (`0`, `21`) that the admission path ignores as unlimited, and
+ * the two would disagree about whether the account is capped.
+ */
+export function normalizeMaxInflightPerAccount(capacity) {
+    return typeof capacity === "number" &&
+        Number.isInteger(capacity) &&
+        capacity >= MIN_MAX_INFLIGHT_PER_ACCOUNT &&
+        capacity <= MAX_MAX_INFLIGHT_PER_ACCOUNT
+        ? capacity
+        : undefined;
+}
 export class ModelRouter {
     mappings;
     passthrough;
@@ -13,8 +30,7 @@ export class ModelRouter {
         this.passthrough = new Set(config.passthroughModels ?? []);
         this.fallback = config.fallbackChain;
         this.autoFallback = config.autoFallback === true;
-        this.maxInflightPerAccount =
-            config.maxInflightPerAccount ?? DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
+        this.maxInflightPerAccount = normalizeMaxInflightPerAccount(config.maxInflightPerAccount);
     }
     resolve(requestedModel) {
         const mapping = this.mappings.get(requestedModel);
@@ -42,7 +58,7 @@ export class ModelRouter {
     isAutoFallbackEnabled() {
         return this.autoFallback;
     }
-    /** Maximum concurrent upstream requests admitted for each OAuth account. */
+    /** Explicit per-account admission cap, or undefined when admission is unlimited. */
     getMaxInflightPerAccount() {
         return this.maxInflightPerAccount;
     }

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -12,8 +12,9 @@
 import { buildTranslationOptions } from "../../proxy/proxyTranslationEngine.js";
 import { ProxyTracer } from "../../proxy/proxyTracer.js";
 import { isPermanentRefreshFailure } from "../../proxy/tokenRefresh.js";
-import type { AccountAllowlist, AccountAdmissionLease, AccountCooldownPlan, AccountQuota, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicLoopState, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyQuotaCooldownUpdate, ProxyPassthroughAccount, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
-declare function tryAcquireAccountAdmission(accountKey: string, capacity: number): AccountAdmissionLease | undefined;
+import type { AccountAllowlist, AccountAdmissionLease, AccountCooldownPlan, AccountQuota, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicLoopState, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyQuotaCooldownUpdate, ProxyPassthroughAccount, QueuedAccountAdmission, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
+declare function tryAcquireAccountAdmission(accountKey: string, capacity: number | undefined): AccountAdmissionLease | undefined;
+declare function enqueueAccountAdmission(accountKey: string, capacity: number): QueuedAccountAdmission;
 declare function acquireAccountAdmission(accountKey: string, capacity: number, abortSignal?: AbortSignal, timeoutMs?: number): Promise<AccountAdmissionLease | undefined>;
 declare function acquireFirstAvailableAccountAdmission(accountKeys: string[], capacity: number, abortSignal?: AbortSignal, timeoutMs?: number): Promise<{
     accountKey: string;
@@ -375,10 +376,12 @@ export declare const __testHooks: {
     acquireAccountAdmission: typeof acquireAccountAdmission;
     acquireFirstAvailableAccountAdmission: typeof acquireFirstAvailableAccountAdmission;
     tryAcquireAccountAdmission: typeof tryAcquireAccountAdmission;
+    enqueueAccountAdmission: typeof enqueueAccountAdmission;
     getAccountAdmissionSnapshot: (accountKey: string) => {
         active: number;
         waiting: number;
     };
+    hasAccountAdmissionState: (accountKey: string) => boolean;
     describeTransportError: typeof describeTransportError;
     redactProviderErrorMessage: typeof redactProviderErrorMessage;
     isUpstreamOverload: typeof isUpstreamOverload;

package/dist/server/routes/claudeProxyRoutes.js

@@ -29,7 +29,7 @@ import { createSSEInterceptor } from "../../proxy/sseInterceptor.js";
 import { createStreamTerminalOutcomeTracker, mergeStreamTerminalOutcome, preflightAnthropicStream, } from "../../proxy/streamOutcome.js";
 import { isPermanentRefreshFailure, needsRefresh, persistTokens, refreshToken, refreshTokenFromLatest, } from "../../proxy/tokenRefresh.js";
 import { buildProxyTranslationPlan, parseRetryAfterMs, } from "../../proxy/routingPolicy.js";
-import { DEFAULT_MAX_INFLIGHT_PER_ACCOUNT, MAX_MAX_INFLIGHT_PER_ACCOUNT, MIN_MAX_INFLIGHT_PER_ACCOUNT, } from "../../proxy/modelRouter.js";
+import { normalizeMaxInflightPerAccount } from "../../proxy/modelRouter.js";
 import { writeJsonSnapshotAtomically } from "../../proxy/snapshotPersistence.js";
 import { recordAttempt, recordAttemptError, recordFinalError, recordFinalSuccess, } from "../../proxy/usageStats.js";
 import { sanitizeForLog } from "../../utils/logSanitize.js";
@@ -122,6 +122,9 @@ const transientCooldownAdmissionSchedules = new Map();
  * make room for another stream on the same account.
  */
 const accountAdmissionStates = new Map();
+const unlimitedAccountAdmissionLease = {
+    release: () => undefined,
+};
 function getAccountAdmissionState(accountKey) {
     let state = accountAdmissionStates.get(accountKey);
     if (!state) {
@@ -130,13 +133,6 @@ function getAccountAdmissionState(accountKey) {
     }
     return state;
 }
-function normalizeAccountAdmissionCapacity(capacity) {
-    return Number.isInteger(capacity) &&
-        capacity >= MIN_MAX_INFLIGHT_PER_ACCOUNT &&
-        capacity <= MAX_MAX_INFLIGHT_PER_ACCOUNT
-        ? capacity
-        : DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
-}
 function drainAccountAdmissionWaiters(accountKey, state) {
     while (state.waiters.length > 0 && state.active < state.waiters[0].capacity) {
         const waiter = state.waiters.shift();
@@ -167,8 +163,11 @@ function discardAccountAdmissionState(accountKey, state) {
     }
 }
 function tryAcquireAccountAdmission(accountKey, capacity) {
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        return unlimitedAccountAdmissionLease;
+    }
     const state = getAccountAdmissionState(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     if (state.waiters.length > 0 || state.active >= normalizedCapacity) {
         return undefined;
     }
@@ -176,13 +175,23 @@ function tryAcquireAccountAdmission(accountKey, capacity) {
     return createAccountAdmissionLease(accountKey, state);
 }
 function isAccountAdmissionAvailable(accountKey, capacity) {
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        return true;
+    }
     const state = accountAdmissionStates.get(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     return (!state || (state.waiters.length === 0 && state.active < normalizedCapacity));
 }
 function enqueueAccountAdmission(accountKey, capacity) {
+    // Validate BEFORE getAccountAdmissionState(), which inserts into the map as a
+    // side effect. Throwing after it would strand an empty entry for an account
+    // that never got admitted — and the throw path never calls
+    // discardAccountAdmissionState() to reap it.
+    const normalizedCapacity = normalizeMaxInflightPerAccount(capacity);
+    if (normalizedCapacity === undefined) {
+        throw new Error("Account admission queue requires an explicit capacity");
+    }
     const state = getAccountAdmissionState(accountKey);
-    const normalizedCapacity = normalizeAccountAdmissionCapacity(capacity);
     let queued = true;
     let grantedLease;
     let resolveAdmission;
@@ -4309,12 +4318,12 @@ async function handleAnthropicRoutedClaudeRequest(args) {
             loopState.authCooldownMessage = `All ${orderedAccounts.length} Anthropic accounts are temporarily unavailable while OAuth refresh is cooling. Earliest retry at ${new Date(earliestRetryAt).toISOString()}.`;
         }
     }
-    const accountAdmissionCapacity = modelRouter?.getMaxInflightPerAccount?.() ??
-        DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
+    const accountAdmissionCapacity = modelRouter?.getMaxInflightPerAccount?.();
     // When every eligible account is busy, reserve the first account that frees
     // instead of arbitrarily waiting behind the last configured account.
     let queuedAccountAdmission;
-    if (effectiveAccounts.length > 0 &&
+    if (accountAdmissionCapacity !== undefined &&
+        effectiveAccounts.length > 0 &&
         effectiveAccounts.every((account) => !isAccountAdmissionAvailable(account.key, accountAdmissionCapacity))) {
         queuedAccountAdmission = await acquireFirstAvailableAccountAdmission(effectiveAccounts.map((account) => account.key), accountAdmissionCapacity, ctx.abortSignal);
     }
@@ -5275,12 +5284,16 @@ export const __testHooks = {
     acquireAccountAdmission,
     acquireFirstAvailableAccountAdmission,
     tryAcquireAccountAdmission,
+    enqueueAccountAdmission,
     getAccountAdmissionSnapshot: (accountKey) => {
         const state = accountAdmissionStates.get(accountKey);
         return state
             ? { active: state.active, waiting: state.waiters.length }
             : { active: 0, waiting: 0 };
     },
+    // The snapshot above reports {active:0, waiting:0} both for "no entry" and
+    // for "empty entry", so it cannot see a stranded allocation. This can.
+    hasAccountAdmissionState: (accountKey) => accountAdmissionStates.has(accountKey),
     describeTransportError,
     redactProviderErrorMessage,
     isUpstreamOverload,

package/dist/types/livekit.d.ts

@@ -500,4 +500,13 @@ export type BuildRealtimeMcpToolsParams = {
     publishEvent: RealtimeEventPublisher;
     /** Opens a HITL confirmation for destructive tools and awaits the decision. */
     requestConfirmation: RealtimeConfirmationRequester;
+    /**
+     * Hard cap per MCP tool call, in milliseconds (default 30000).
+     *
+     * Without one, a stalled MCP server holds the realtime turn open forever:
+     * Gemini waits on the function result, so the user gets silence rather than
+     * an error. Bounding the call turns that into a normal tool failure the
+     * model can talk about.
+     */
+    toolTimeoutMs?: number;
 };

package/dist/types/proxy.d.ts

@@ -30,7 +30,7 @@ export type ModelRouterInterface = {
     isClaudeTarget(requestedModel: string): boolean;
     getFallbackChain(): FallbackEntry[];
     isAutoFallbackEnabled?(): boolean;
-    getMaxInflightPerAccount?(): number;
+    getMaxInflightPerAccount?(): number | undefined;
     getModelMappings?: () => ModelMapping[];
     getPassthroughModels?: () => string[];
 };

package/dist/types/subscription.d.ts

@@ -910,7 +910,13 @@ export type ProxyRoutingConfig = {
     fallbackChain: FallbackEntry[];
     /** Permit a last-resort provider chosen by the translation layer. Disabled by default. */
     autoFallback?: boolean;
-    /** Maximum in-flight upstream requests per OAuth account. Defaults to two. */
+    /**
+     * Optional in-flight upstream request cap per OAuth account.
+     *
+     * Unlimited admission is the result of omitting it AND of any value outside
+     * the accepted range — a non-integer, or anything below 1 or above 20 — since
+     * `normalizeMaxInflightPerAccount()` discards those rather than clamping.
+     */
     maxInflightPerAccount?: number;
     passthroughModels?: string[];
     /** Enable quota-aware fill-first account ordering. Defaults to true. */