@juspay/neurolink 13.8.17 → 13.8.19

package/dist/cli/commands/auth.js

@@ -26,7 +26,9 @@ import chalk from "chalk";
 import ora from "ora";
 import { logger } from "../../utils/logger.js";
 import { defaultTokenStore } from "../../auth/tokenStore.js";
-import { CLAUDE_CODE_CLIENT_ID, ANTHROPIC_AUTH_URL, ANTHROPIC_TOKEN_URL, ANTHROPIC_REDIRECT_URI, CLAUDE_CLI_USER_AGENT, OAUTH_BETA_HEADERS, } from "../../auth/anthropicOAuth.js";
+import { CLAUDE_CODE_CLIENT_ID, ANTHROPIC_AUTH_URL, ANTHROPIC_TOKEN_URL, ANTHROPIC_REDIRECT_URI, CLAUDE_CLI_USER_AGENT, OAUTH_BETA_HEADERS, buildSubscriptionAuthUrl, exchangePastedSubscriptionCode, parsePastedAuthorizationCode, } from "../../auth/anthropicOAuth.js";
+import { tightenProcessUmask, writePrivateFileAtomicallySync, } from "../../auth/secureFiles.js";
+import { normalizeAnthropicAccountKey } from "../../proxy/accountSelection.js";
 import { flushAccountQuotas, loadAccountQuotas, saveAccountQuota, } from "../../proxy/accountQuota.js";
 import { fetchAccountUsage, listAnthropicAccountsForUsage, usageToQuota, } from "../../proxy/accountUsage.js";
 import { importCodexAuthFile } from "../../auth/codexOAuth.js";
@@ -78,6 +80,7 @@ const AUTH_LOGIN_PROVIDERS = ["anthropic", "codex"];
  * (e.g., "anthropic:alice") to support multi-account pools.
  */
 export async function handleLogin(argv) {
+    tightenProcessUmask();
     try {
         const provider = argv.provider?.toLowerCase();
         // Validate provider
@@ -142,7 +145,7 @@ export async function handleCodexLogin(argv) {
             credential.email ??
             credential.accountId?.slice(0, 8) ??
             Date.now().toString(36).slice(-6);
-        const label = rawLabel.trim();
+        const label = validateAccountLabel(rawLabel);
         const compoundKey = `codex:${label}`;
         const scopeParts = ["codex"];
         if (credential.planType) {
@@ -1020,6 +1023,7 @@ async function handleCodexRefresh(argv) {
  * `neurolink auth refresh <provider>`
  */
 export async function handleRefresh(argv) {
+    tightenProcessUmask();
     try {
         const provider = argv.provider?.toLowerCase();
         // Validate provider
@@ -1093,15 +1097,25 @@ export async function handleRefresh(argv) {
                 createdAt: credentials.createdAt,
                 updatedAt: Date.now(),
             });
-            // Also update the TokenStore pool entries for this provider.
-            // Update both the bare provider key and compound "provider:label" keys
-            // so that pooled accounts created via saveAccountToPool() stay current.
+            // Also update the TokenStore pool entries for this provider — but only
+            // the entries that held the credential just refreshed. Writing the new
+            // token to every `provider:*` key collapsed a multi-account pool into
+            // one identity and threw the other accounts' refresh tokens away.
+            const previousAccessToken = credentials.oauth.accessToken;
+            const previousRefreshToken = credentials.oauth.refreshToken;
             try {
                 const allKeys = await defaultTokenStore.listProviders();
                 for (const key of allKeys) {
                     if (key === provider || key.startsWith(`${provider}:`)) {
                         const existingTokens = await defaultTokenStore.loadTokens(key);
-                        if (existingTokens) {
+                        const heldThisCredential = existingTokens !== null &&
+                            (existingTokens.accessToken === previousAccessToken ||
+                                (previousRefreshToken !== undefined &&
+                                    existingTokens.refreshToken === previousRefreshToken));
+                        if (existingTokens && !heldThisCredential) {
+                            logger.debug(`Skipping TokenStore entry ${key}: it holds a different account's credential`);
+                        }
+                        if (existingTokens && heldThisCredential) {
                             await defaultTokenStore.saveTokens(key, {
                                 accessToken: newTokens.accessToken,
                                 refreshToken: newTokens.refreshToken,
@@ -1945,11 +1959,13 @@ async function handleCreateApiKeyOAuth(provider) {
         logger.always(chalk.yellow("Copy that code and paste it back here.\n"));
     }
     const spinner = ora("Starting OAuth flow...").start();
-    // Generate PKCE challenge - OpenCode sets state = verifier
+    // PKCE verifier and an unrelated random state. The state is what the pasted
+    // code must come back with; the verifier never leaves this process.
     const codeVerifier = randomBytes(32).toString("base64url");
     const codeChallenge = createHash("sha256")
         .update(codeVerifier)
         .digest("base64url");
+    const oauthState = randomBytes(32).toString("base64url");
     // Build authorization URL using CONSOLE config (for API key creation scope)
     // Based on opencode-anthropic-auth implementation
     const authUrl = new URL(ANTHROPIC_CONSOLE_OAUTH_CONFIG.authorizationUrl);
@@ -1960,8 +1976,7 @@ async function handleCreateApiKeyOAuth(provider) {
     authUrl.searchParams.set("scope", ANTHROPIC_CONSOLE_OAUTH_CONFIG.scope);
     authUrl.searchParams.set("code_challenge", codeChallenge);
     authUrl.searchParams.set("code_challenge_method", "S256");
-    // OpenCode sets state = verifier for simplicity
-    authUrl.searchParams.set("state", codeVerifier);
+    authUrl.searchParams.set("state", oauthState);
     spinner.text = "Opening browser for authentication...";
     // Open browser
     try {
@@ -2005,15 +2020,17 @@ async function handleCreateApiKeyOAuth(provider) {
         },
     ]);
     const exchangeSpinner = ora("Exchanging authorization code for tokens...").start();
-    // Parse code#state format (e.g., "abc123#xyz789")
-    // IMPORTANT: OpenCode sets state = verifier in the auth URL, so the state
-    // returned in code#state IS the original verifier used for the code challenge!
-    const trimmedCode = authCode.trim();
-    const splits = trimmedCode.split("#");
-    const actualCode = splits[0];
-    const codeState = splits[1] || codeVerifier;
-    // Use the state as the verifier (since we set state = verifier in the auth URL)
-    const actualVerifier = codeState;
+    // The pasted value is `code#state`. The state must be the one this login
+    // generated, and the exchange always uses this process's own verifier — a
+    // code from someone else's login is refused before anything is sent.
+    let actualCode;
+    try {
+        actualCode = parsePastedAuthorizationCode(authCode, oauthState).code;
+    }
+    catch (error) {
+        exchangeSpinner.fail("Authorization code rejected");
+        throw error;
+    }
     // Exchange code for tokens using JSON body (per opencode-anthropic-auth)
     const tokenResponse = await fetch(ANTHROPIC_CONSOLE_OAUTH_CONFIG.tokenUrl, {
         method: "POST",
@@ -2022,11 +2039,11 @@ async function handleCreateApiKeyOAuth(provider) {
         },
         body: JSON.stringify({
             code: actualCode,
-            state: codeState,
+            state: oauthState,
             grant_type: "authorization_code",
             client_id: ANTHROPIC_CONSOLE_OAUTH_CONFIG.clientId,
             redirect_uri: ANTHROPIC_CONSOLE_OAUTH_CONFIG.redirectUri,
-            code_verifier: actualVerifier,
+            code_verifier: codeVerifier,
         }),
     });
     if (!tokenResponse.ok) {
@@ -2110,23 +2127,21 @@ async function handleOAuthAuth(provider) {
         logger.always(chalk.yellow("Copy that code and paste it back here.\n"));
     }
     const spinner = ora("Starting OAuth flow...").start();
-    // Generate PKCE challenge - state = verifier (OpenCode's approach)
+    // PKCE verifier and an unrelated random state, through the same builder the
+    // split-PKCE provisioning flow uses so the two cannot drift. The verifier
+    // never leaves this process; the state is what the pasted code must carry.
     const codeVerifier = randomBytes(32).toString("base64url");
     const codeChallenge = createHash("sha256")
         .update(codeVerifier)
         .digest("base64url");
-    // Build authorization URL using claude.ai (NOT console.anthropic.com)
-    // This is the direct OAuth flow for Claude Pro/Max
-    const authUrl = new URL(ANTHROPIC_OAUTH_CONFIG.authorizationUrl);
-    authUrl.searchParams.set("code", "true");
-    authUrl.searchParams.set("client_id", ANTHROPIC_OAUTH_CONFIG.clientId);
-    authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("redirect_uri", ANTHROPIC_OAUTH_CONFIG.redirectUri);
-    authUrl.searchParams.set("scope", ANTHROPIC_OAUTH_CONFIG.scope);
-    authUrl.searchParams.set("code_challenge", codeChallenge);
-    authUrl.searchParams.set("code_challenge_method", "S256");
-    // OpenCode sets state = verifier for simplicity
-    authUrl.searchParams.set("state", codeVerifier);
+    const oauthState = randomBytes(32).toString("base64url");
+    const authUrl = new URL(buildSubscriptionAuthUrl({
+        codeChallenge,
+        state: oauthState,
+        clientId: ANTHROPIC_OAUTH_CONFIG.clientId,
+        redirectUri: ANTHROPIC_OAUTH_CONFIG.redirectUri,
+        scope: ANTHROPIC_OAUTH_CONFIG.scope,
+    }));
     spinner.text = "Opening browser for authentication...";
     // Open browser
     try {
@@ -2171,36 +2186,35 @@ async function handleOAuthAuth(provider) {
     ]);
     const trimmedCode = authCode.trim();
     const exchangeSpinner = ora("Exchanging authorization code for tokens...").start();
-    // Parse code#state format (e.g., "abc123#xyz789")
-    // OpenCode sets state = verifier in the auth URL, so the state
-    // returned in code#state IS the original verifier used for the code challenge
-    const codeParts = trimmedCode.split("#");
-    const actualCode = codeParts[0];
-    const codeState = codeParts[1] || codeVerifier;
-    // Use the state as the verifier (since we set state = verifier in the auth URL)
-    const actualVerifier = codeState;
-    // Exchange code for tokens with Claude CLI User-Agent
-    // IMPORTANT: Uses JSON body, not URLSearchParams
-    const tokenResponse = await fetch(ANTHROPIC_OAUTH_CONFIG.tokenUrl, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-            code: actualCode,
-            state: codeState,
-            grant_type: "authorization_code",
-            client_id: ANTHROPIC_OAUTH_CONFIG.clientId,
-            redirect_uri: ANTHROPIC_OAUTH_CONFIG.redirectUri,
-            code_verifier: actualVerifier,
-        }),
-    });
-    if (!tokenResponse.ok) {
-        const errorText = await tokenResponse.text();
+    // The pasted value is `code#state`: the state must match this login and the
+    // exchange uses this process's verifier. A code from someone else's login is
+    // refused before anything is sent.
+    let exchanged;
+    try {
+        exchanged = await exchangePastedSubscriptionCode({
+            pasted: trimmedCode,
+            expectedState: oauthState,
+            codeVerifier,
+            clientId: ANTHROPIC_OAUTH_CONFIG.clientId,
+            redirectUri: ANTHROPIC_OAUTH_CONFIG.redirectUri,
+        });
+    }
+    catch (error) {
         exchangeSpinner.fail("Token exchange failed");
-        throw new Error(`Token exchange failed: ${tokenResponse.status} - ${errorText}`);
+        throw error;
     }
-    const tokenData = (await tokenResponse.json());
+    const tokenData = {
+        access_token: exchanged.accessToken,
+        refresh_token: exchanged.refreshToken,
+        expires_in: exchanged.expiresAt !== undefined
+            ? Math.max(1, Math.round((exchanged.expiresAt - Date.now()) / 1000))
+            : undefined,
+        token_type: exchanged.tokenType,
+        scope: exchanged.scope,
+        account: exchanged.accountEmail
+            ? { email_address: exchanged.accountEmail }
+            : undefined,
+    };
     // Save tokens
     const tokens = {
         accessToken: tokenData.access_token,
@@ -2290,11 +2304,17 @@ async function saveAccountToPool(provider, label) {
     const credEmail = credentials.email;
     let compoundKey;
     if (label) {
-        compoundKey = `${provider}:${label}`;
+        compoundKey = `${provider}:${validateAccountLabel(label)}`;
     }
     else {
         const autoLabel = credEmail ?? Date.now().toString(36).slice(-6);
-        compoundKey = `${provider}:${autoLabel}`;
+        compoundKey = `${provider}:${validateAccountLabel(autoLabel)}`;
+    }
+    if (provider === "anthropic") {
+        // The proxy compares Anthropic keys case-insensitively
+        // (normalizeAnthropicAccountKey); saving them as typed let `Alice` and
+        // `alice` coexist as two pool entries that every lookup treated as one.
+        compoundKey = normalizeAnthropicAccountKey(compoundKey);
     }
     // Decision 10A: Auto-prune stale token-prefix entries when email is known.
     // When we have a real email, remove old entries whose stored token value is
@@ -2542,14 +2562,36 @@ async function getStoredCredentials(provider) {
  * Save credentials to file
  */
 async function saveStoredCredentials(provider, credentials) {
-    // Ensure config directory exists
-    if (!fs.existsSync(NEUROLINK_CONFIG_DIR)) {
-        fs.mkdirSync(NEUROLINK_CONFIG_DIR, { recursive: true });
-    }
     const credentialsFile = path.join(NEUROLINK_CONFIG_DIR, `${provider}-credentials.json`);
-    fs.writeFileSync(credentialsFile, JSON.stringify(credentials, null, 2), {
-        mode: 0o600, // Restrict permissions
-    });
+    // Owner-only directory and an atomic owner-only write: the previous
+    // truncate-in-place write kept whatever mode the file already had and
+    // followed a symlink planted at the path.
+    //
+    // The refresh token stays in this file deliberately. It is the credential
+    // source for the SDK's Anthropic provider (`providers/anthropic/client.ts`)
+    // and for the proxy's legacy single-account path, both of which refresh from
+    // it; removing it would silently break every caller that never ran
+    // `auth login` against the pooled store.
+    writePrivateFileAtomicallySync(credentialsFile, JSON.stringify(credentials, null, 2));
+}
+/**
+ * An account label becomes part of a token-store key, a log line and a
+ * snapshot file name. Control characters and newlines have no place in any of
+ * those (a newline forges a log line), so they are refused rather than stored.
+ */
+function validateAccountLabel(label) {
+    const trimmed = label.trim();
+    if (trimmed === "") {
+        throw new Error("Account label must not be empty.");
+    }
+    // eslint-disable-next-line no-control-regex -- the point is to refuse them
+    if (/[\u0000-\u001f\u007f]/.test(trimmed)) {
+        throw new Error("Account label must not contain control characters or line breaks.");
+    }
+    if (trimmed.length > 200) {
+        throw new Error("Account label must be 200 characters or fewer.");
+    }
+    return trimmed;
 }
 /**
  * Check existing authentication status

package/dist/cli/commands/proxy.d.ts

@@ -78,6 +78,10 @@ export declare function createProxyStartApp(params: {
     updateControlToken?: string;
     /** Port of the gate-only share listener, when one is configured. */
     sharePort?: number;
+    /** Bearer every inbound caller must present; omitted means none is required. */
+    inboundToken?: string;
+    /** The bind policy already ran and accepted an unauthenticated listener. */
+    inboundAuthAcknowledged?: boolean;
 }): Promise<{
     app: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
     readiness: ProxyReadinessState;

package/dist/cli/commands/proxy.js

@@ -20,6 +20,9 @@ import { raceWithAbort, withTimeout, } from "../../utils/async/withTimeout.js";
 import { startProxyHttpTrace } from "../../proxy/proxyTracer.js";
 import { formatUptime, isProcessRunning, StateFileManager, } from "../utils/serverUtils.js";
 import { configureProxyKeepAliveDispatcher } from "../../proxy/proxyDispatcher.js";
+import { evaluateProxyBindPolicy, isUnauthenticatedBindAllowedByEnv, resolveInboundToken, } from "../../proxy/inboundAuth.js";
+import { isGrantRequiredByEnv } from "../../proxy/shareGate.js";
+import { tightenProcessUmask } from "../../auth/secureFiles.js";
 import { ProxyRuntimeConfigStore } from "../../proxy/runtimeConfig.js";
 import { sessionAffinity } from "../../proxy/sessionAffinity.js";
 import { startProxyLogCleanupScheduler } from "../../proxy/logCleanupScheduler.js";
@@ -1439,8 +1442,16 @@ export async function createProxyStartApp(params) {
     const { recordFinalError } = await import("../../proxy/usageStats.js");
     const { admitInboundShareRequest, isGrantRequiredByEnv } = await import("../../proxy/shareGate.js");
     const { runWithShareContext } = await import("../../proxy/shareContext.js");
+    const { authorizeInboundRequest, hasValidInboundToken, isInboundAuthExemptPath, secretsMatch, } = await import("../../proxy/inboundAuth.js");
     const { Hono } = await import("hono");
     const app = new Hono();
+    const inboundToken = params.inboundToken;
+    const inboundAuth = {
+        ...(inboundToken ? { token: inboundToken } : {}),
+        // The CLI ran the bind policy; a loopback or acknowledged listener must
+        // not re-trigger the route factories' unauthenticated-mount warning.
+        allowUnauthenticated: params.inboundAuthAcknowledged ?? true,
+    };
     /**
      * Is this request arriving on the gate-only share listener?
      *
@@ -1582,7 +1593,7 @@ export async function createProxyStartApp(params) {
     app.post("/internal/update-control", async (c) => {
         const suppliedToken = c.req.header("x-neurolink-update-token");
         const expectedToken = params.updateControlToken ?? PROXY_UPDATE_CONTROL_TOKEN;
-        if (!suppliedToken || suppliedToken !== expectedToken) {
+        if (!suppliedToken || !secretsMatch(expectedToken, suppliedToken)) {
             return c.json({ error: "not_found" }, 404);
         }
         const payload = await c.req
@@ -1665,12 +1676,11 @@ export async function createProxyStartApp(params) {
     const runtimeConfigProvider = runtimeConfigStore
         ? () => runtimeConfigStore.getSnapshot()
         : undefined;
-    const routeGroup = createClaudeProxyRoutes(params.modelRouter, "", params.strategy, params.passthrough, params.primaryAccountKey, runtimeConfigProvider
-        ? {
-            accountAllowlist: params.accountAllowlist,
-            runtimeConfigProvider,
-        }
-        : params.accountAllowlist);
+    const routeGroup = createClaudeProxyRoutes(params.modelRouter, "", params.strategy, params.passthrough, params.primaryAccountKey, {
+        accountAllowlist: params.accountAllowlist,
+        ...(runtimeConfigProvider ? { runtimeConfigProvider } : {}),
+        inboundAuth,
+    });
     const openaiRouteGroup = createOpenAIProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider, 
     // Keep bridge capabilities, accounting and cancellation in this worker
     // across supervisor generation switches; never re-enter the public listener.
@@ -1679,7 +1689,7 @@ export async function createProxyStartApp(params) {
     // Same in-process loopback discipline as the OpenAI->Anthropic bridge:
     // stay in this worker across supervisor generation switches, never
     // re-enter the public listener.
-    (request) => app.fetch(request));
+    (request) => app.fetch(request), inboundAuth);
     const geminiRouteGroup = createGeminiProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider);
     const allProxyRoutes = [
         ...routeGroup.routes,
@@ -1708,6 +1718,27 @@ export async function createProxyStartApp(params) {
                     },
                 }, 503);
             }
+            // Inbound token, before the body is even read. A request carrying a
+            // share token is left to the share gate below; everything else on a
+            // non-exempt path must present the operator's token.
+            if (inboundToken &&
+                metadata?.accountingScope !== "internal" &&
+                !isInboundAuthExemptPath(c.req.path)) {
+                const verdict = authorizeInboundRequest(Object.fromEntries(c.req.raw.headers.entries()), inboundToken);
+                if (!verdict.ok) {
+                    for (const [key, value] of Object.entries(verdict.response.headers)) {
+                        c.header(key, value);
+                    }
+                    if (metadata) {
+                        metadata.terminalErrorType = "inbound_auth_required";
+                        await recordRuntimeError(metadata, 401, "inbound_auth_required", "Request did not present the inbound token", {
+                            clientMessage: verdict.response.body.error.message,
+                            clientErrorType: verdict.response.body.error.type,
+                        });
+                    }
+                    return c.json(verdict.response.body, 401);
+                }
+            }
             const emptyBody = {};
             let body;
             let rawBody;
@@ -1946,6 +1977,18 @@ export async function createProxyStartApp(params) {
         }));
     });
     app.get("/status", async (c) => {
+        // `/status` is an operator surface. With an inbound token configured it
+        // is refused outright to anyone without it, not merely redacted.
+        if (inboundToken &&
+            !hasValidInboundToken(Object.fromEntries(c.req.raw.headers.entries()), inboundToken)) {
+            return c.json({
+                type: "error",
+                error: {
+                    type: "authentication_error",
+                    message: "This proxy requires an inbound token.",
+                },
+            }, 401);
+        }
         // A gated proxy is, by definition, one that may be exposed. `/status`
         // enumerates account labels — which for an OAuth account is an email — plus
         // quota and cooldown state, and it is not behind the request gate, so
@@ -1957,8 +2000,7 @@ export async function createProxyStartApp(params) {
         // token, and redacted for everyone else. Counters and health stay visible so
         // liveness tooling keeps working.
         const statusIdentityAllowed = !isGatedListener(c) ||
-            c.req.header("x-neurolink-update-token") ===
-                (params.updateControlToken ?? PROXY_UPDATE_CONTROL_TOKEN);
+            secretsMatch(params.updateControlToken ?? PROXY_UPDATE_CONTROL_TOKEN, c.req.header("x-neurolink-update-token") ?? "");
         const runtimeConfig = params.runtimeConfigStore?.getSnapshot();
         const runtimeConfigStatus = params.runtimeConfigStore?.getStatus();
         const activeStrategy = runtimeConfig
@@ -3104,6 +3146,7 @@ async function runLaunchdProxySupervisor(argv, spinner) {
     }
     const host = argv.host ?? "127.0.0.1";
     const port = argv.port ?? 55669;
+    enforceProxyBindPolicy(host, argv, spinner);
     const workerArgs = process.argv.slice(2);
     const supervisorStartedAt = new Date().toISOString();
     configureProxyLifecycleLogger({
@@ -3278,7 +3321,36 @@ export function registerProxySupervisorReload(activeWorkerPid) {
     process.on("SIGHUP", reload);
     return () => process.off("SIGHUP", reload);
 }
+/**
+ * Decide whether this listener may bind where it was asked to, after the env
+ * file has been loaded (the inbound token may live there). Refusal exits the
+ * process: an open proxy on a routable address is not a configuration to
+ * start and warn about.
+ */
+function enforceProxyBindPolicy(host, argv, spinner) {
+    const inboundToken = resolveInboundToken(argv.inboundToken);
+    const allowUnauthenticated = argv.allowUnauthenticated === true || isUnauthenticatedBindAllowedByEnv();
+    const decision = evaluateProxyBindPolicy({
+        host,
+        inboundToken,
+        requireGrant: isGrantRequiredByEnv(),
+        allowUnauthenticated,
+    });
+    if (!decision.allowed) {
+        if (spinner) {
+            spinner.fail(chalk.red("Refusing to start an unauthenticated proxy"));
+        }
+        logger.error(chalk.red(decision.reason));
+        process.exit(1);
+    }
+    if (decision.warning) {
+        logger.always(chalk.yellow(`[proxy] WARNING: ${decision.warning}`));
+    }
+    return { inboundToken, acknowledged: true };
+}
 async function startProxyCommandHandler(argv) {
+    // Everything this process creates under ~/.neurolink is owner-only.
+    tightenProcessUmask();
     const spinner = argv.quiet ? null : ora("Starting Claude proxy...").start();
     const isDev = argv.dev ?? false;
     const socketWorker = isProxySocketWorkerProcess();
@@ -3376,6 +3448,7 @@ async function startProxyCommandHandler(argv) {
             mainPort: port,
         });
         const host = argv.host ?? "127.0.0.1";
+        const bindPolicy = enforceProxyBindPolicy(host, argv, spinner);
         const { app, readiness } = await createProxyStartApp({
             neurolink,
             modelRouter,
@@ -3388,6 +3461,8 @@ async function startProxyCommandHandler(argv) {
             accountAllowlist,
             runtimeConfigStore,
             sharePort,
+            inboundToken: bindPolicy.inboundToken,
+            inboundAuthAcknowledged: bindPolicy.acknowledged,
         });
         await initializeProxyOpenTelemetry();
         if (spinner) {
@@ -3446,7 +3521,21 @@ export const proxyStartCommand = {
             type: "string",
             alias: "H",
             default: "127.0.0.1",
-            description: "Host to bind to",
+            description: "Host to bind to. A non-loopback host needs --inbound-token, " +
+                "NEUROLINK_PROXY_REQUIRE_GRANT=1 or --allow-unauthenticated",
+        })
+            .option("inbound-token", {
+            type: "string",
+            alias: "inboundToken",
+            description: "Bearer every caller must present (x-neurolink-inbound-token or " +
+                "Authorization: Bearer). Also NEUROLINK_PROXY_INBOUND_TOKEN",
+        })
+            .option("allow-unauthenticated", {
+            type: "boolean",
+            alias: "allowUnauthenticated",
+            default: false,
+            description: "Bind a non-loopback host with no inbound authentication (an " +
+                "authenticating reverse proxy must sit in front)",
         })
             .option("strategy", {
             type: "string",
@@ -5189,7 +5278,20 @@ export const proxyInstallCommand = {
         })
             .option("host", {
             type: "string",
-            description: "Proxy host",
+            description: "Proxy host. A non-loopback host needs --inbound-token, " +
+                "NEUROLINK_PROXY_REQUIRE_GRANT=1 or --allow-unauthenticated",
+        })
+            .option("inbound-token", {
+            type: "string",
+            alias: "inboundToken",
+            description: "Bearer every caller must present; persisted into the service " +
+                "environment as NEUROLINK_PROXY_INBOUND_TOKEN",
+        })
+            .option("allow-unauthenticated", {
+            type: "boolean",
+            alias: "allowUnauthenticated",
+            default: false,
+            description: "Install a non-loopback service with no inbound authentication",
         })
             .option("env-file", {
             type: "string",
@@ -5265,9 +5367,22 @@ export const proxyInstallCommand = {
             process.exit(1);
         }
         await loadProxyEnvFile({ explicitEnvFile: envFile });
+        tightenProcessUmask();
+        // The service inherits NEUROLINK_PROXY_* from this environment (see
+        // isProxyServiceEnvironmentKey), so a flag given here is persisted into
+        // the 0600 plist rather than echoed on the command line.
+        const installArgs = argv;
+        if (installArgs.inboundToken?.trim()) {
+            process.env.NEUROLINK_PROXY_INBOUND_TOKEN =
+                installArgs.inboundToken.trim();
+        }
+        if (installArgs.allowUnauthenticated === true) {
+            process.env.NEUROLINK_PROXY_ALLOW_UNAUTHENTICATED = "1";
+        }
+        enforceProxyBindPolicy(host, installArgs, null);
         const logsDir = join(homedir(), ".neurolink", "logs");
         if (!isProxyOtelOnly() && !existsSync(logsDir)) {
-            mkdirSync(logsDir, { recursive: true });
+            mkdirSync(logsDir, { recursive: true, mode: 0o700 });
         }
         if (!existsSync(PLIST_DIR)) {
             mkdirSync(PLIST_DIR, { recursive: true });

package/dist/cli/commands/serve.d.ts

@@ -34,7 +34,16 @@ export declare class ServeCommandFactory {
      */
     private static createAndStartServer;
     /**
-     * Put every route except health behind the API key(s) in
+     * The NeuroLink instance the server runs. Its registry holds no built-in
+     * tool unless `--enable-builtin-tools`: those tools read and write files
+     * under the server's working directory, and `/tools/execute` and the agent
+     * routes would hand them to every caller. The switch is the SDK's own
+     * (NEUROLINK_DISABLE_BUILTIN_TOOLS), set before the instance and its
+     * providers read it, so generate() in this process does not see them either.
+     */
+    private static createServerNeuroLink;
+    /**
+     * Put every route except the health probes behind the API key(s) in
      * NEUROLINK_SERVER_API_KEY. Must run before the routes are registered.
      */
     private static applyApiKeyAuth;