@juspay/neurolink 9.91.1 → 9.92.1

package/dist/cli/commands/auth.js

@@ -855,7 +855,7 @@ function readPrimaryFromRouting(routing) {
 }
 /** Best-effort detection of a running proxy. Mirrors `proxy status` semantics
  *  without importing the proxy module. */
-function detectRunningProxyPid() {
+function detectRunningProxyState() {
     try {
         const stateFile = path.join(NEUROLINK_CONFIG_DIR, "proxy-state.json");
         if (!fs.existsSync(stateFile)) {
@@ -866,12 +866,33 @@ function detectRunningProxyPid() {
             return undefined;
         }
         process.kill(parsed.pid, 0);
-        return parsed.pid;
+        return parsed;
     }
     catch {
         return undefined;
     }
 }
+function reportRunningProxyConfigUpdate(filePath) {
+    const state = detectRunningProxyState();
+    if (!state) {
+        return;
+    }
+    logger.always("");
+    const editedPath = path.resolve(filePath);
+    const watchedPath = state.configFile
+        ? path.resolve(state.configFile)
+        : undefined;
+    if (watchedPath === editedPath) {
+        logger.always(chalk.green(`✓ Running proxy PID ${state.pid} is watching this file and will apply the change automatically.`));
+        logger.always(chalk.gray("  Verify the active generation with `neurolink proxy status`."));
+        return;
+    }
+    if (watchedPath) {
+        logger.always(chalk.yellow(`⚠ Running proxy PID ${state.pid} watches ${watchedPath}, not ${editedPath}; this change will not affect that process.`));
+        return;
+    }
+    logger.always(chalk.yellow(`⚠ Running proxy PID ${state.pid} does not report hot-reload support. Restart it to pick up the change.`));
+}
 /**
  * Handle the set-primary subcommand
  * `neurolink auth set-primary <email> [--config <path>]`
@@ -910,13 +931,7 @@ export async function handleSetPrimary(argv) {
                 "  `neurolink auth login --add` to add it. The proxy will fall\n" +
                 "  back to the first enabled account until then."));
         }
-        // Restart hint
-        const pid = detectRunningProxyPid();
-        if (pid) {
-            logger.always("");
-            logger.always(chalk.yellow(`⚠ A proxy is currently running (PID ${pid}). Restart it to pick\n` +
-                "  up the change: `neurolink proxy stop && neurolink proxy start`."));
-        }
+        reportRunningProxyConfigUpdate(filePath);
     }
     catch (err) {
         logger.error(chalk.red("Failed to set primary account:"));
@@ -991,12 +1006,7 @@ export async function handleClearPrimary(argv) {
         await writeProxyConfigFile(filePath, doc);
         logger.always(chalk.green(`✓ Cleared primary account (was: ${before})`));
         logger.always(chalk.green(`✓ Saved to ${filePath}`));
-        const pid = detectRunningProxyPid();
-        if (pid) {
-            logger.always("");
-            logger.always(chalk.yellow(`⚠ A proxy is currently running (PID ${pid}). Restart it to pick\n` +
-                "  up the change: `neurolink proxy stop && neurolink proxy start`."));
-        }
+        reportRunningProxyConfigUpdate(filePath);
     }
     catch (err) {
         logger.error(chalk.red("Failed to clear primary account:"));

package/dist/cli/commands/proxy.d.ts

@@ -10,12 +10,12 @@
  * (generate/stream), with an optional ModelRouter for model remapping.
  */
 import type { CommandModule } from "yargs";
-import type { AccountAllowlist, LoadedProxyConfig, ProxyGuardArgs, ProxyNeurolinkRuntime, ProxyStartArgs, ProxyStartStrategy, ProxyStatusArgs, ProxyTelemetryArgs } from "../../lib/types/index.js";
-import type { ModelRouter } from "../../lib/proxy/modelRouter.js";
+import type { AccountAllowlist, LoadedProxyConfig, ModelRouterInterface, ProxyGuardArgs, ProxyNeurolinkRuntime, ProxyStartArgs, ProxyStartStrategy, ProxyStatusArgs, ProxyTelemetryArgs } from "../../lib/types/index.js";
+import { ProxyRuntimeConfigStore } from "../../lib/proxy/runtimeConfig.js";
 export declare function mapClaudeErrorTypeToStatus(errorType?: string): number;
 export declare function createProxyStartApp(params: {
     neurolink: ProxyNeurolinkRuntime["neurolink"];
-    modelRouter: ModelRouter | undefined;
+    modelRouter: ModelRouterInterface | undefined;
     strategy: ProxyStartStrategy;
     passthrough: boolean;
     port: number;
@@ -23,6 +23,7 @@ export declare function createProxyStartApp(params: {
     proxyConfig: LoadedProxyConfig | null;
     primaryAccountKey: string | undefined;
     accountAllowlist: AccountAllowlist | undefined;
+    runtimeConfigStore?: ProxyRuntimeConfigStore;
 }): Promise<{
     app: import("hono").Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
     readiness: import("../../lib/types/proxy.js").ProxyReadinessState;

package/dist/cli/commands/proxy.js

@@ -18,6 +18,7 @@ import { buildProxyHealthResponse, createProxyReadinessState, markProxyReady, wa
 import { logger } from "../../lib/utils/logger.js";
 import { formatUptime, isProcessRunning, StateFileManager, } from "../utils/serverUtils.js";
 import { configureProxyKeepAliveDispatcher } from "../../lib/proxy/proxyDispatcher.js";
+import { ProxyRuntimeConfigStore } from "../../lib/proxy/runtimeConfig.js";
 import { anthropicAccountKeysEqual, createAccountAllowlist, ENV_ANTHROPIC_ACCOUNT_KEY, isAccountAllowed, LEGACY_ANTHROPIC_ACCOUNT_KEY, normalizeAnthropicAccountKey, shouldLoadFallbackCredential, } from "../../lib/proxy/accountSelection.js";
 import { beginProxyRequest, getProxyActivitySnapshot, trackProxyResponse, } from "../../lib/proxy/proxyActivity.js";
 import { describeInstallFailure, getGlobalInstallArgs, resolveGlobalInstaller, validateInstalledVersion, } from "../../lib/proxy/globalInstaller.js";
@@ -709,107 +710,6 @@ async function createProxyNeurolinkRuntime(logsDir) {
     cleanupLogs(7, 500);
     return { neurolink, cleanupLogs };
 }
-async function loadProxyStartConfiguration(argv, spinner) {
-    const configPath = argv.config ?? join(homedir(), ".neurolink", "proxy-config.yaml");
-    let proxyConfig = null;
-    try {
-        const { loadProxyConfig } = await import("../../lib/proxy/proxyConfig.js");
-        proxyConfig = (await loadProxyConfig(configPath));
-        if (spinner) {
-            spinner.text = `Loaded proxy config from ${configPath}`;
-        }
-    }
-    catch (configError) {
-        const isNotFound = configError instanceof Error &&
-            "code" in configError &&
-            configError.code === "ENOENT";
-        if (argv.config || !isNotFound) {
-            if (spinner) {
-                spinner.fail(chalk.red(`Failed to load proxy config: ${configPath}`));
-            }
-            throw configError;
-        }
-    }
-    const strategy = (argv.strategy ??
-        proxyConfig?.routing?.strategy ??
-        "fill-first");
-    let modelRouter;
-    if (proxyConfig?.routing) {
-        const { ModelRouter } = await import("../../lib/proxy/modelRouter.js");
-        modelRouter = new ModelRouter({
-            strategy,
-            modelMappings: proxyConfig.routing.modelMappings ?? [],
-            fallbackChain: proxyConfig.routing.fallbackChain ?? [],
-            passthroughModels: proxyConfig.routing.passthroughModels,
-        });
-    }
-    const primaryAccountKey = await resolveBootPrimaryAccountKey(proxyConfig?.routing?.primaryAccount);
-    const accountAllowlist = await resolveBootAccountAllowlist(proxyConfig?.routing?.accountAllowlist);
-    if (primaryAccountKey &&
-        !isAccountAllowed(primaryAccountKey, accountAllowlist)) {
-        throw new Error(`Configured routing.primaryAccount=${proxyConfig?.routing?.primaryAccount} is excluded by routing.accountAllowlist`);
-    }
-    return {
-        configPath,
-        proxyConfig,
-        strategy,
-        modelRouter,
-        passthrough: argv.passthrough ?? false,
-        primaryAccountKey,
-        accountAllowlist,
-    };
-}
-async function resolveBootAccountAllowlist(configuredAccounts) {
-    const allowlist = createAccountAllowlist(configuredAccounts);
-    if (allowlist === undefined) {
-        return undefined;
-    }
-    if (allowlist.size === 0) {
-        logger.warn("[proxy] routing.accountAllowlist is empty; all stored Anthropic credentials are denied");
-        return allowlist;
-    }
-    try {
-        const { tokenStore } = await import("../../lib/auth/tokenStore.js");
-        const known = new Set((await tokenStore.listByPrefix("anthropic:")).map(normalizeAnthropicAccountKey));
-        known.add(LEGACY_ANTHROPIC_ACCOUNT_KEY);
-        known.add(ENV_ANTHROPIC_ACCOUNT_KEY);
-        for (const key of allowlist) {
-            if (!known.has(key)) {
-                logger.warn(`[proxy] WARN: routing.accountAllowlist entry ${key} is allowed but not currently authenticated`);
-            }
-        }
-    }
-    catch (err) {
-        logger.debug(`[proxy] could not validate account allowlist against token store: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    return allowlist;
-}
-/** Resolve the operator's configured primary email to a stable token-store
- *  key (anthropic:<email>). Cross-checks the token store and emits a one-time
- *  startup warning if the configured account isn't authenticated — but still
- *  returns the key so it activates automatically once the user runs
- *  `auth login --add`. */
-async function resolveBootPrimaryAccountKey(primaryEmail) {
-    const trimmed = primaryEmail?.trim();
-    if (!trimmed) {
-        return undefined;
-    }
-    const key = normalizeAnthropicAccountKey(trimmed);
-    try {
-        const { tokenStore } = await import("../../lib/auth/tokenStore.js");
-        const known = await tokenStore.listByPrefix("anthropic:");
-        if (!known.some((knownKey) => anthropicAccountKeysEqual(knownKey, key))) {
-            logger.warn(`[proxy] WARN: configured routing.primaryAccount=${trimmed} not ` +
-                `found in token store; falling back to first enabled account. ` +
-                `Run \`neurolink auth login --add\` to authenticate it, or ` +
-                `\`neurolink auth clear-primary\` to remove the setting.`);
-        }
-    }
-    catch (err) {
-        logger.debug(`[proxy] could not validate primary account against token store: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    return key;
-}
 export async function createProxyStartApp(params) {
     const { createClaudeProxyRoutes } = await import("../../lib/server/routes/claudeProxyRoutes.js");
     const { createOpenAIProxyRoutes } = await import("../../lib/server/routes/openaiProxyRoutes.js");
@@ -904,8 +804,17 @@ export async function createProxyStartApp(params) {
             throw error;
         }
     });
-    const routeGroup = createClaudeProxyRoutes(params.modelRouter, "", params.strategy, params.passthrough, params.primaryAccountKey, params.accountAllowlist);
-    const openaiRouteGroup = createOpenAIProxyRoutes(params.modelRouter, "", params.port);
+    const runtimeConfigStore = params.runtimeConfigStore;
+    const runtimeConfigProvider = runtimeConfigStore
+        ? () => runtimeConfigStore.getSnapshot()
+        : undefined;
+    const routeGroup = createClaudeProxyRoutes(params.modelRouter, "", params.strategy, params.passthrough, params.primaryAccountKey, runtimeConfigProvider
+        ? {
+            accountAllowlist: params.accountAllowlist,
+            runtimeConfigProvider,
+        }
+        : params.accountAllowlist);
+    const openaiRouteGroup = createOpenAIProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider);
     const allProxyRoutes = [...routeGroup.routes, ...openaiRouteGroup.routes];
     for (const route of allProxyRoutes) {
         const method = route.method.toLowerCase();
@@ -1032,12 +941,31 @@ export async function createProxyStartApp(params) {
             return c.json(result ?? {});
         });
     }
-    app.get("/health", (c) => c.json(buildProxyHealthResponse(readiness, {
-        strategy: params.strategy,
-        passthrough: params.passthrough,
-        version: PROXY_VERSION,
-    })));
+    app.get("/health", (c) => {
+        const runtimeConfig = params.runtimeConfigStore?.getSnapshot();
+        return c.json(buildProxyHealthResponse(readiness, {
+            strategy: runtimeConfig ? runtimeConfig.strategy : params.strategy,
+            passthrough: runtimeConfig
+                ? runtimeConfig.passthrough
+                : params.passthrough,
+            version: PROXY_VERSION,
+        }));
+    });
     app.get("/status", async (c) => {
+        const runtimeConfig = params.runtimeConfigStore?.getSnapshot();
+        const runtimeConfigStatus = params.runtimeConfigStore?.getStatus();
+        const activeStrategy = runtimeConfig
+            ? runtimeConfig.strategy
+            : params.strategy;
+        const activePassthrough = runtimeConfig
+            ? runtimeConfig.passthrough
+            : params.passthrough;
+        const activeProxyConfig = runtimeConfig
+            ? runtimeConfig.proxyConfig
+            : params.proxyConfig;
+        const activeAccountAllowlist = runtimeConfig
+            ? runtimeConfig.accountAllowlist
+            : params.accountAllowlist;
         const { getStats } = await import("../../lib/proxy/usageStats.js");
         const { loadAccountCooldowns } = await import("../../lib/proxy/accountCooldown.js");
         const stats = getStats();
@@ -1056,11 +984,11 @@ export async function createProxyStartApp(params) {
         }
         const now = Date.now();
         const health = buildProxyHealthResponse(readiness, {
-            strategy: params.strategy,
-            passthrough: params.passthrough,
+            strategy: activeStrategy,
+            passthrough: activePassthrough,
             version: PROXY_VERSION,
         });
-        const primaryAccount = await resolveStatusPrimaryAccount(params.proxyConfig);
+        const primaryAccount = await resolveStatusPrimaryAccount(activeProxyConfig);
         return c.json({
             status: "running",
             ready: health.ready,
@@ -1069,7 +997,7 @@ export async function createProxyStartApp(params) {
             pid: process.pid,
             port: params.port,
             host: params.host,
-            strategy: params.strategy,
+            strategy: activeStrategy,
             uptime: process.uptime(),
             version: PROXY_VERSION,
             health,
@@ -1134,14 +1062,30 @@ export async function createProxyStartApp(params) {
                     }
                     : null,
             },
-            config: params.proxyConfig
+            config: params.runtimeConfigStore
                 ? {
-                    hasRouting: !!params.proxyConfig.routing,
-                    accountAllowlist: params.accountAllowlist
-                        ? [...params.accountAllowlist]
+                    hasRouting: !!activeProxyConfig?.routing,
+                    accountAllowlist: activeAccountAllowlist
+                        ? [...activeAccountAllowlist]
                         : null,
+                    generation: runtimeConfig?.generation ?? null,
+                    loadedAt: runtimeConfig?.loadedAt ?? null,
+                    hash: runtimeConfig?.configHash ?? null,
+                    watching: runtimeConfigStatus?.watching ?? false,
+                    lastReloadAttemptAt: runtimeConfigStatus?.lastReloadAttemptAt ?? null,
+                    lastReloadAt: runtimeConfigStatus?.lastReloadAt ?? null,
+                    lastReloadSource: runtimeConfigStatus?.lastReloadSource ?? null,
+                    lastReloadError: runtimeConfigStatus?.lastReloadError ?? null,
+                    consecutiveFailures: runtimeConfigStatus?.consecutiveFailures ?? 0,
                 }
-                : null,
+                : params.proxyConfig
+                    ? {
+                        hasRouting: !!params.proxyConfig.routing,
+                        accountAllowlist: params.accountAllowlist
+                            ? [...params.accountAllowlist]
+                            : null,
+                    }
+                    : null,
         });
     });
     return { app, readiness };
@@ -1321,13 +1265,13 @@ async function refreshProxyTokensInBackground(accountAllowlist) {
         // non-fatal
     }
 }
-function startProxyBackgroundMaintenance(cleanupLogs, accountAllowlist) {
+function startProxyBackgroundMaintenance(cleanupLogs, getAccountAllowlist) {
     const refreshInterval = setInterval(() => {
         if (backgroundRefreshInProgress) {
             return;
         }
         backgroundRefreshInProgress = true;
-        void refreshProxyTokensInBackground(accountAllowlist)
+        void refreshProxyTokensInBackground(getAccountAllowlist())
             .catch((error) => {
             logger.debug(`[proxy] background token refresh cycle failed: ${error instanceof Error ? error.message : String(error)}`);
         })
@@ -1385,6 +1329,7 @@ function registerProxyShutdownHandlers(params) {
         clearInterval(params.refreshInterval);
         clearInterval(params.logCleanupInterval);
         params.updaterSupervisor?.stop();
+        params.stopRuntimeConfig?.();
         logger.always(`\nShutting down proxy (${signal})...`);
         let exitCode = signal === "SIGINT" ? 0 : 1;
         try {
@@ -1485,15 +1430,29 @@ async function startProxyRuntime(params) {
         })
         : undefined;
     const updaterPid = updaterSupervisor?.currentPid();
-    const fallbackChain = params.proxyConfig?.routing?.fallbackChain?.map((entry) => ({
+    const initialRuntimeConfig = params.runtimeConfigStore?.getSnapshot();
+    const activeStrategy = initialRuntimeConfig
+        ? initialRuntimeConfig.strategy
+        : params.strategy;
+    const activeProxyConfig = initialRuntimeConfig
+        ? initialRuntimeConfig.proxyConfig
+        : params.proxyConfig;
+    const activeAccountAllowlist = initialRuntimeConfig
+        ? initialRuntimeConfig.accountAllowlist
+        : params.accountAllowlist;
+    const activePassthrough = initialRuntimeConfig
+        ? initialRuntimeConfig.passthrough
+        : params.passthrough;
+    const fallbackChain = activeProxyConfig?.routing?.fallbackChain?.map((entry) => ({
         provider: entry.provider,
         model: entry.model,
     }));
+    const initialConfigStatus = params.runtimeConfigStore?.getStatus();
     saveProxyState({
         pid: process.pid,
         port: params.port,
         host: params.host,
-        strategy: params.strategy,
+        strategy: activeStrategy,
         startTime: new Date().toISOString(),
         ready: true,
         readyAt: params.readiness.readyAtMs
@@ -1503,28 +1462,73 @@ async function startProxyRuntime(params) {
         statusPath: "/status",
         envFile: params.loadedEnvFile,
         fallbackChain,
-        accountAllowlist: params.accountAllowlist
-            ? [...params.accountAllowlist]
+        accountAllowlist: activeAccountAllowlist
+            ? [...activeAccountAllowlist]
             : undefined,
         guardPid,
         updaterPid,
         managedBy: managedByLaunchd ? "launchd" : "manual",
-        passthrough: params.passthrough,
+        passthrough: activePassthrough,
+        configGeneration: initialRuntimeConfig?.generation,
+        configLoadedAt: initialRuntimeConfig?.loadedAt,
+        lastConfigReloadError: initialConfigStatus?.lastReloadError,
+        configFile: initialConfigStatus?.configPath,
     });
+    const persistRuntimeConfig = (snapshot) => {
+        const state = loadProxyState();
+        if (!state || state.pid !== process.pid) {
+            return;
+        }
+        const status = params.runtimeConfigStore?.getStatus();
+        const currentFallbackChain = snapshot.proxyConfig?.routing?.fallbackChain?.map((entry) => ({
+            provider: entry.provider,
+            model: entry.model,
+        }));
+        saveProxyState({
+            ...state,
+            strategy: snapshot.strategy,
+            fallbackChain: currentFallbackChain,
+            accountAllowlist: snapshot.accountAllowlist
+                ? [...snapshot.accountAllowlist]
+                : undefined,
+            passthrough: snapshot.passthrough,
+            configGeneration: snapshot.generation,
+            configLoadedAt: snapshot.loadedAt,
+            lastConfigReloadError: status?.lastReloadError,
+        });
+    };
+    let stopRuntimeConfig;
+    if (params.runtimeConfigStore) {
+        const runtimeConfigStore = params.runtimeConfigStore;
+        const unsubscribeReload = runtimeConfigStore.subscribeReload(() => {
+            persistRuntimeConfig(runtimeConfigStore.getSnapshot());
+        });
+        const reloadOnSighup = () => {
+            void runtimeConfigStore.reload("sighup");
+        };
+        runtimeConfigStore.startWatching();
+        process.on("SIGHUP", reloadOnSighup);
+        stopRuntimeConfig = () => {
+            process.off("SIGHUP", reloadOnSighup);
+            unsubscribeReload();
+            runtimeConfigStore.stopWatching();
+        };
+        logger.always(`[proxy] watching configuration generation ${initialRuntimeConfig?.generation ?? 1}; send SIGHUP to reload immediately`);
+    }
     if (params.spinner) {
         params.spinner.succeed(chalk.green("Claude proxy started successfully"));
     }
     const isDev = params.argv.dev ?? false;
     const normalizedHost = params.host === "0.0.0.0" ? "localhost" : params.host;
     const url = `http://${normalizedHost}:${params.port}`;
-    printProxyBanner(url, params.strategy);
+    printProxyBanner(url, activeStrategy);
     if (isDev) {
         logger.always(`  ${chalk.bold("Mode:")}       ${chalk.magenta("dev (isolated — state in .neurolink-dev/)")}`);
     }
     else {
-        logger.always(`  ${chalk.bold("Mode:")}       ${chalk.cyan(params.passthrough ? "passthrough" : "full")}`);
+        logger.always(`  ${chalk.bold("Mode:")}       ${chalk.cyan(activePassthrough ? "passthrough" : "full")}`);
     }
-    if (params.passthrough) {
+    if (activePassthrough) {
         logger.always(chalk.yellow("  ! Passthrough mode forwards client auth directly to Anthropic"));
         logger.always(chalk.dim("    Stored proxy OAuth/API credentials are ignored; clients need their own valid Anthropic auth."));
     }
@@ -1554,13 +1558,16 @@ async function startProxyRuntime(params) {
     else {
         logger.always(chalk.dim("  ⊘ Dev mode: skipping client auto-configuration"));
     }
-    const maintenance = startProxyBackgroundMaintenance(params.cleanupLogs, params.accountAllowlist);
+    const maintenance = startProxyBackgroundMaintenance(params.cleanupLogs, () => params.runtimeConfigStore
+        ? params.runtimeConfigStore.getSnapshot().accountAllowlist
+        : params.accountAllowlist);
     registerProxyShutdownHandlers({
         server,
         host: params.host,
         port: params.port,
         isDev,
         updaterSupervisor,
+        stopRuntimeConfig,
         ...maintenance,
     });
 }
@@ -1587,13 +1594,34 @@ async function startProxyCommandHandler(argv) {
         if (!isDev) {
             await ensureProxyStartAllowed(spinner);
         }
+        const baseEnv = { ...process.env };
+        const envResolution = resolveProxyEnvFile({
+            explicitEnvFile: argv.envFile,
+            env: baseEnv,
+        });
         const loadedEnvFile = await loadProxyStartEnv(argv, spinner);
         // Reuse upstream TCP connections (longer keep-alive + bounded pool) instead
         // of opening a new flow per request — cuts outbound flow churn through host
         // content-filters. Runs once, after env load so it can be tuned via env.
         configureProxyKeepAliveDispatcher();
         const { neurolink, cleanupLogs } = await createProxyNeurolinkRuntime(devPaths?.logsDir);
-        const { proxyConfig, strategy, modelRouter, passthrough, primaryAccountKey, accountAllowlist, } = await loadProxyStartConfiguration(argv, spinner);
+        const configPath = argv.config
+            ? resolve(argv.config)
+            : join(homedir(), ".neurolink", "proxy-config.yaml");
+        const runtimeConfigStore = await ProxyRuntimeConfigStore.create({
+            configPath,
+            configRequired: Boolean(argv.config),
+            envFilePath: envResolution.path ?? join(homedir(), ".neurolink", ".env"),
+            envFileRequired: envResolution.required,
+            baseEnv,
+            strategyOverride: argv.strategy,
+            passthrough: argv.passthrough ?? false,
+        });
+        const initialConfig = runtimeConfigStore.getSnapshot();
+        const { proxyConfig, strategy, modelRouter, passthrough, primaryAccountKey, accountAllowlist, } = initialConfig;
+        if (spinner && proxyConfig) {
+            spinner.text = `Loaded proxy config from ${configPath}`;
+        }
         if (spinner) {
             spinner.text = "Configuring server...";
         }
@@ -1609,6 +1637,7 @@ async function startProxyCommandHandler(argv) {
             proxyConfig,
             primaryAccountKey,
             accountAllowlist,
+            runtimeConfigStore,
         });
         await initializeProxyOpenTelemetry();
         if (spinner) {
@@ -1627,6 +1656,7 @@ async function startProxyCommandHandler(argv) {
             loadedEnvFile,
             passthrough,
             cleanupLogs,
+            runtimeConfigStore,
         });
     }
     catch (error) {
@@ -1810,6 +1840,9 @@ export const proxyStatusCommand = {
                 envFile: null,
                 fallbackChain: null,
                 accountAllowlist: null,
+                configGeneration: null,
+                configLoadedAt: null,
+                lastConfigReloadError: null,
                 autoUpdateEnabled: isProxyAutoUpdateEnabled(),
                 updaterPid: null,
                 updaterRunning: false,
@@ -1830,6 +1863,9 @@ export const proxyStatusCommand = {
                 status.envFile = state.envFile ?? null;
                 status.fallbackChain = state.fallbackChain ?? null;
                 status.accountAllowlist = state.accountAllowlist ?? null;
+                status.configGeneration = state.configGeneration ?? null;
+                status.configLoadedAt = state.configLoadedAt ?? null;
+                status.lastConfigReloadError = state.lastConfigReloadError ?? null;
                 status.updaterPid = state.updaterPid ?? null;
                 status.updaterRunning = state.updaterPid
                     ? isProcessRunning(state.updaterPid)
@@ -1837,12 +1873,24 @@ export const proxyStatusCommand = {
             }
             // Fetch live stats before rendering (JSON or text)
             let liveStats = null;
+            let liveConfig = null;
             if (status.running && status.url) {
                 try {
                     const statusResp = await fetch(`${status.url}/status`);
                     if (statusResp.ok) {
                         const statusData = (await statusResp.json());
                         liveStats = statusData.stats;
+                        liveConfig = statusData.config;
+                        if (typeof liveConfig?.generation === "number") {
+                            status.configGeneration = liveConfig.generation;
+                        }
+                        if (typeof liveConfig?.loadedAt === "string") {
+                            status.configLoadedAt = liveConfig.loadedAt;
+                        }
+                        status.lastConfigReloadError =
+                            typeof liveConfig?.lastReloadError === "string"
+                                ? liveConfig.lastReloadError
+                                : null;
                     }
                 }
                 catch {
@@ -1850,7 +1898,7 @@ export const proxyStatusCommand = {
                 }
             }
             if (argv.format === "json") {
-                logger.always(JSON.stringify({ ...status, stats: liveStats }, null, 2));
+                logger.always(JSON.stringify({ ...status, stats: liveStats, config: liveConfig }, null, 2));
                 return;
             }
             // Text format
@@ -1864,6 +1912,15 @@ export const proxyStatusCommand = {
                 logger.always(`  ${chalk.bold("URL:")}        ${chalk.cyan(status.url)}`);
                 logger.always(`  ${chalk.bold("Strategy:")}   ${chalk.cyan(status.strategy)}`);
                 logger.always(`  ${chalk.bold("Mode:")}       ${chalk.cyan(status.mode ?? "full")}`);
+                if (status.configGeneration !== null) {
+                    logger.always(`  ${chalk.bold("Config:")}     ${chalk.cyan(`generation ${status.configGeneration}`)}` +
+                        (status.configLoadedAt
+                            ? chalk.gray(` (${status.configLoadedAt})`)
+                            : ""));
+                }
+                if (status.lastConfigReloadError) {
+                    logger.always(`  ${chalk.bold("Config error:")} ${chalk.red(status.lastConfigReloadError)}`);
+                }
                 logger.always(`  ${chalk.bold("Started:")}    ${chalk.cyan(status.startTime)}`);
                 logger.always(`  ${chalk.bold("Uptime:")}     ${chalk.cyan(formatUptime(status.uptime ?? 0))}`);
                 logger.always(`  ${chalk.bold("Auto-update:")} ${status.autoUpdateEnabled ? chalk.green(status.updaterRunning ? `enabled (PID ${status.updaterPid})` : "enabled (worker unavailable)") : chalk.yellow("disabled")}`);

package/dist/core/baseProvider.js

@@ -550,6 +550,11 @@ export class BaseProvider {
     getToolPolicy(options) {
         return resolveToolPolicy({
             options: {
+                // Defense-in-depth: both current call sites already zero the tool
+                // record via shouldUseTools before the gate runs, but forwarding
+                // disableTools makes the gate self-sufficient for any future call
+                // site that forgets the upstream check.
+                disableTools: options.disableTools,
                 toolFilter: options.toolFilter,
                 excludeTools: options.excludeTools,
                 enabledToolNames: options.enabledToolNames,

package/dist/lib/core/baseProvider.js

@@ -550,6 +550,11 @@ export class BaseProvider {
     getToolPolicy(options) {
         return resolveToolPolicy({
             options: {
+                // Defense-in-depth: both current call sites already zero the tool
+                // record via shouldUseTools before the gate runs, but forwarding
+                // disableTools makes the gate self-sufficient for any future call
+                // site that forgets the upstream check.
+                disableTools: options.disableTools,
                 toolFilter: options.toolFilter,
                 excludeTools: options.excludeTools,
                 enabledToolNames: options.enabledToolNames,

package/dist/lib/neurolink.js

@@ -5968,14 +5968,19 @@ Current user's request: ${currentInput}`;
             instanceConfig: this.toolsConfig,
             builtinToolNames: Object.keys(directAgentTools),
         });
-        const record = {};
+        // Null prototype + own-property checks: a tool named "__proto__" must
+        // become an own entry — with a plain `{}`, `"__proto__" in record` is
+        // truthy via the prototype and the tool would be silently dropped from
+        // the listing while surviving the native gate. Matches the hardening on
+        // every other record in the tool-resolution pipeline.
+        const record = Object.create(null);
         for (const tool of tools) {
-            if (!(tool.name in record)) {
+            if (!Object.hasOwn(record, tool.name)) {
                 record[tool.name] = tool;
             }
         }
         const gated = applyToolGate(record, policy);
-        const filtered = tools.filter((t) => t.name in gated);
+        const filtered = tools.filter((t) => Object.hasOwn(gated, t.name));
         if (filtered.length !== tools.length) {
             logger.debug(`Tool info filtering applied for system prompt`, {
                 beforeCount: tools.length,