@juspay/neurolink 9.91.1 → 9.92.1

package/dist/lib/server/routes/claudeProxyRoutes.js

@@ -53,10 +53,9 @@ const BLOCKED_UPSTREAM_HEADERS = new Set([
 let primaryAccountIndex = 0;
 /** Track account count so we can reset primaryAccountIndex when it changes. */
 let lastKnownAccountCount = 0;
-/** Stable account key (e.g. "anthropic:user@example.com") of the configured
- *  home/primary account. Set once at proxy boot from routing.primaryAccount.
- *  When undefined, home semantics fall back to enabledAccounts[0] (insertion
- *  order) — preserves pre-existing behavior. */
+/** Stable account key used by legacy fixed-config route factories. Runtime
+ *  config providers pass the request generation's primary key explicitly.
+ *  When undefined, home semantics retain insertion-order behavior. */
 let configuredPrimaryAccountKey;
 let configuredAccountAllowlist;
 const MAX_AUTH_RETRIES = 5;
@@ -130,8 +129,7 @@ function advancePrimaryIfCurrent(accountKey, enabledCount, primaryAccountKey) {
  *  no key is configured or the key cannot be matched (account disabled/
  *  removed). The resolution is per-request because enabledAccounts membership
  *  can shift between requests. */
-function resolveHomeIndex(enabledAccounts) {
-    const primaryAccountKey = configuredPrimaryAccountKey;
+function resolveHomeIndex(enabledAccounts, primaryAccountKey = configuredPrimaryAccountKey) {
     if (!primaryAccountKey) {
         return 0;
     }
@@ -142,11 +140,11 @@ function resolveHomeIndex(enabledAccounts) {
  *  primaryAccountIndex back to its index so traffic returns to the preferred
  *  account once its rate limit window expires. Called at the start of each
  *  request. Home is resolved fresh per call via resolveHomeIndex. */
-function maybeResetPrimaryToHome(enabledAccounts) {
+function maybeResetPrimaryToHome(enabledAccounts, primaryAccountKey = configuredPrimaryAccountKey) {
     if (enabledAccounts.length <= 1) {
         return;
     }
-    const homeIndex = resolveHomeIndex(enabledAccounts);
+    const homeIndex = resolveHomeIndex(enabledAccounts, primaryAccountKey);
     if (primaryAccountIndex === homeIndex) {
         return;
     }
@@ -486,12 +484,7 @@ function accountSortMetrics(accountKey, now, sessionSoftLimit, sessionResetToler
  * Cooling/rejected accounts sort last, soonest-back-to-service first, as
  * last resort.
  */
-function orderAccountsByQuota(accounts, now) {
-    const primaryKey = configuredPrimaryAccountKey;
-    // Read the env-tunable thresholds once per sort: cheaper than per-compare,
-    // and a mid-sort env change can never make the comparator intransitive.
-    const sessionSoftLimit = getSessionSoftLimit();
-    const sessionResetToleranceMs = getSessionResetToleranceMs();
+function orderAccountsByQuota(accounts, now, primaryKey = configuredPrimaryAccountKey, sessionSoftLimit = getSessionSoftLimit(), sessionResetToleranceMs = getSessionResetToleranceMs()) {
     const metrics = (key) => accountSortMetrics(key, now, sessionSoftLimit, sessionResetToleranceMs);
     return [...accounts].sort((a, b) => {
         const ma = metrics(a.key);
@@ -1545,7 +1538,7 @@ async function handleClaudePassthroughJsonResponse(args) {
     return responseJson;
 }
 async function loadClaudeProxyAccounts(args) {
-    const { ctx, body, tracer, requestStartTime, accountStrategy, buildLoggedClaudeError, } = args;
+    const { ctx, body, tracer, requestStartTime, accountStrategy, primaryAccountKey = configuredPrimaryAccountKey, accountAllowlist = configuredAccountAllowlist, quotaRoutingEnabled = isQuotaRoutingEnabled(), sessionSoftLimit = getSessionSoftLimit(), sessionResetToleranceMs = getSessionResetToleranceMs(), buildLoggedClaudeError, } = args;
     const fs = await import("fs");
     const os = await import("os");
     const accounts = [];
@@ -1558,7 +1551,7 @@ async function loadClaudeProxyAccounts(args) {
     }
     const compoundKeys = await tokenStore.listByPrefix("anthropic:");
     for (const key of compoundKeys) {
-        if (!isAccountAllowed(key, configuredAccountAllowlist)) {
+        if (!isAccountAllowed(key, accountAllowlist)) {
             logger.debug(`[proxy] skipping account=${key} (not in account allowlist)`);
             continue;
         }
@@ -1665,7 +1658,7 @@ async function loadClaudeProxyAccounts(args) {
         addAccount();
     }
     if (accounts.length === 0 &&
-        shouldLoadFallbackCredential(compoundKeys.length, LEGACY_ANTHROPIC_ACCOUNT_KEY, configuredAccountAllowlist)) {
+        shouldLoadFallbackCredential(compoundKeys.length, LEGACY_ANTHROPIC_ACCOUNT_KEY, accountAllowlist)) {
         try {
             const creds = JSON.parse(fs.readFileSync(legacyCredPath, "utf8"));
             const legacyAccount = await tryLoadLegacyAccount(creds, legacyCredPath);
@@ -1679,7 +1672,7 @@ async function loadClaudeProxyAccounts(args) {
     }
     if (process.env.ANTHROPIC_API_KEY &&
         accounts.length === 0 &&
-        shouldLoadFallbackCredential(compoundKeys.length, ENV_ANTHROPIC_ACCOUNT_KEY, configuredAccountAllowlist)) {
+        shouldLoadFallbackCredential(compoundKeys.length, ENV_ANTHROPIC_ACCOUNT_KEY, accountAllowlist)) {
         accounts.push({
             key: ENV_ANTHROPIC_ACCOUNT_KEY,
             label: "env",
@@ -1688,7 +1681,7 @@ async function loadClaudeProxyAccounts(args) {
         });
     }
     if (accounts.length === 0) {
-        const noCredentialsMessage = configuredAccountAllowlist
+        const noCredentialsMessage = accountAllowlist
             ? "No allowed Anthropic credentials are currently available"
             : compoundKeys.length > 0
                 ? "Configured Anthropic accounts are disabled or unavailable"
@@ -1728,12 +1721,12 @@ async function loadClaudeProxyAccounts(args) {
     let orderedAccounts = [...enabledAccounts];
     const quotaOrdered = accountStrategy === "fill-first" &&
         orderedAccounts.length > 1 &&
-        isQuotaRoutingEnabled();
+        quotaRoutingEnabled;
     if (quotaOrdered) {
         // Fill-first with a smart fill order: spend the account whose window resets
         // soonest first (max utilization), proactively skipping any whose window is
         // rejected until its reset. Supersedes the static home/primary index.
-        orderedAccounts = orderAccountsByQuota(enabledAccounts, Date.now());
+        orderedAccounts = orderAccountsByQuota(enabledAccounts, Date.now(), primaryAccountKey, sessionSoftLimit, sessionResetToleranceMs);
         if (logger.shouldLog("debug")) {
             logger.debug(`[proxy] quota-ordered fill sequence: ${orderedAccounts
                 .map((a) => a.label)
@@ -1743,7 +1736,7 @@ async function loadClaudeProxyAccounts(args) {
     else {
         if (accountStrategy === "round-robin" &&
             orderedAccounts.length !== lastKnownAccountCount) {
-            primaryAccountIndex = resolveHomeIndex(orderedAccounts);
+            primaryAccountIndex = resolveHomeIndex(orderedAccounts, primaryAccountKey);
             lastKnownAccountCount = orderedAccounts.length;
         }
         if (orderedAccounts.length > 1) {
@@ -3768,7 +3761,7 @@ function shouldAttemptClaudeFallback(loopState) {
     return loopState.invalidRequestFailure === null;
 }
 async function handleAnthropicRoutedClaudeRequest(args) {
-    const { ctx, body, modelRouter, tracer, requestStartTime, accountStrategy, buildLoggedClaudeError, logProxyBody, logFinalRequest, } = args;
+    const { ctx, body, modelRouter, tracer, requestStartTime, accountStrategy, primaryAccountKey, accountAllowlist, quotaRoutingEnabled = isQuotaRoutingEnabled(), sessionSoftLimit = getSessionSoftLimit(), sessionResetToleranceMs = getSessionResetToleranceMs(), buildLoggedClaudeError, logProxyBody, logFinalRequest, } = args;
     const parsedRequest = parseClaudeRequest(body);
     const loadedAccounts = await loadClaudeProxyAccounts({
         ctx,
@@ -3776,6 +3769,11 @@ async function handleAnthropicRoutedClaudeRequest(args) {
         tracer,
         requestStartTime,
         accountStrategy,
+        primaryAccountKey,
+        accountAllowlist,
+        quotaRoutingEnabled,
+        sessionSoftLimit,
+        sessionResetToleranceMs,
         buildLoggedClaudeError,
     });
     if ("response" in loadedAccounts) {
@@ -3798,9 +3796,9 @@ async function handleAnthropicRoutedClaudeRequest(args) {
     // from live quota (soonest-reset-first) rather than a static home index.
     const usingQuotaOrder = accountStrategy === "fill-first" &&
         enabledAccounts.length > 1 &&
-        isQuotaRoutingEnabled();
+        quotaRoutingEnabled;
     if (!usingQuotaOrder) {
-        maybeResetPrimaryToHome(enabledAccounts);
+        maybeResetPrimaryToHome(enabledAccounts, primaryAccountKey);
     }
     // Never re-hammer accounts with a known active cooldown. When every account
     // is cooling, report the earliest persisted retry time without an upstream
@@ -4154,6 +4152,11 @@ async function handleAnthropicRoutedClaudeRequest(args) {
 // ---------------------------------------------------------------------------
 // Route factory
 // ---------------------------------------------------------------------------
+function isClaudeProxyRouteRuntimeOptions(value) {
+    return (value !== undefined &&
+        "runtimeConfigProvider" in value &&
+        typeof value.runtimeConfigProvider === "function");
+}
 /**
  * Create Claude-compatible proxy routes.
  *
@@ -4164,7 +4167,13 @@ async function handleAnthropicRoutedClaudeRequest(args) {
  * @param basePath    - Base path prefix (default: "" since Claude API uses /v1/...).
  * @returns RouteGroup with Claude-compatible endpoints.
  */
-export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrategy = "fill-first", passthroughMode = false, primaryAccountKey, accountAllowlist) {
+export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrategy = "fill-first", passthroughMode = false, primaryAccountKey, accountAllowlistOrRuntimeOptions) {
+    const accountAllowlist = isClaudeProxyRouteRuntimeOptions(accountAllowlistOrRuntimeOptions)
+        ? accountAllowlistOrRuntimeOptions.accountAllowlist
+        : accountAllowlistOrRuntimeOptions;
+    const runtimeConfigProvider = isClaudeProxyRouteRuntimeOptions(accountAllowlistOrRuntimeOptions)
+        ? accountAllowlistOrRuntimeOptions.runtimeConfigProvider
+        : undefined;
     configuredPrimaryAccountKey = primaryAccountKey;
     configuredAccountAllowlist = accountAllowlist
         ? new Set(accountAllowlist)
@@ -4179,6 +4188,18 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                 method: "POST",
                 path: `${basePath}/v1/messages`,
                 handler: async (ctx) => {
+                    const requestRouting = runtimeConfigProvider?.() ?? {
+                        generation: 0,
+                        strategy: accountStrategy,
+                        modelRouter,
+                        passthrough: passthroughMode,
+                        primaryAccountKey,
+                        accountAllowlist,
+                        quotaRoutingEnabled: isQuotaRoutingEnabled(),
+                        sessionSoftLimit: getSessionSoftLimit(),
+                        sessionResetToleranceMs: getSessionResetToleranceMs(),
+                    };
+                    const requestModelRouter = requestRouting.modelRouter;
                     const body = ctx.body;
                     // 1. Validate
                     if (typeof body?.model !== "string" ||
@@ -4188,12 +4209,12 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                     // 2. Resolve model via router (or pass through to anthropic)
                     // Guard: without a model router, only Claude models are allowed.
                     const modelLower = body.model.toLowerCase();
-                    if (!modelRouter && !modelLower.startsWith("claude-")) {
+                    if (!requestModelRouter && !modelLower.startsWith("claude-")) {
                         return buildClaudeError(404, `Model '${body.model}' is not an Anthropic model. ` +
                             `The proxy only supports Claude models. ` +
                             `Use a model router to route non-Claude models to other providers.`);
                     }
-                    const route = modelRouter?.resolve(body.model) ?? {
+                    const route = requestModelRouter?.resolve(body.model) ?? {
                         provider: "anthropic",
                         model: body.model,
                     };
@@ -4213,7 +4234,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                         }
                         if (route.provider === "anthropic") {
                             tracer?.setMode("passthrough");
-                            if (passthroughMode) {
+                            if (requestRouting.passthrough) {
                                 return handleClaudePassthroughRequest({
                                     ctx,
                                     body,
@@ -4226,10 +4247,15 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                             return handleAnthropicRoutedClaudeRequest({
                                 ctx,
                                 body,
-                                modelRouter,
+                                modelRouter: requestModelRouter,
                                 tracer,
                                 requestStartTime,
-                                accountStrategy,
+                                accountStrategy: requestRouting.strategy,
+                                primaryAccountKey: requestRouting.primaryAccountKey,
+                                accountAllowlist: requestRouting.accountAllowlist,
+                                quotaRoutingEnabled: requestRouting.quotaRoutingEnabled,
+                                sessionSoftLimit: requestRouting.sessionSoftLimit,
+                                sessionResetToleranceMs: requestRouting.sessionResetToleranceMs,
                                 buildLoggedClaudeError,
                                 logProxyBody,
                                 logFinalRequest,
@@ -4243,7 +4269,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                     provider: route.provider,
                                     model: route.model,
                                 },
-                                modelRouter,
+                                modelRouter: requestModelRouter,
                                 tracer,
                                 requestStartTime,
                                 logProxyBody,
@@ -4274,11 +4300,16 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
             {
                 method: "GET",
                 path: `${basePath}/v1/models`,
-                handler: async (_ctx) => withSpan({
-                    name: "neurolink.http.claudeProxy.listModels",
-                    tracer: tracers.http,
-                    attributes: { "http.route": `${basePath}/v1/models` },
-                }, async () => buildAnthropicModelsListResponse(modelRouter)),
+                handler: async (_ctx) => {
+                    const requestModelRouter = runtimeConfigProvider
+                        ? runtimeConfigProvider().modelRouter
+                        : modelRouter;
+                    return withSpan({
+                        name: "neurolink.http.claudeProxy.listModels",
+                        tracer: tracers.http,
+                        attributes: { "http.route": `${basePath}/v1/models` },
+                    }, async () => buildAnthropicModelsListResponse(requestModelRouter));
+                },
                 description: "List available models (Anthropic schema)",
                 tags: ["claude-proxy", "models"],
             },

package/dist/lib/server/routes/openaiProxyRoutes.d.ts

@@ -11,8 +11,7 @@
  * An optional ModelRouter can remap incoming model names to different
  * provider/model pairs (e.g. "gpt-4o" -> vertex/gemini-2.5-pro).
  */
-import type { ModelRouter } from "../../proxy/modelRouter.js";
-import type { RouteGroup } from "../../types/index.js";
+import type { ModelRouterInterface, ProxyRuntimeConfigProvider, RouteGroup } from "../../types/index.js";
 /**
  * Create OpenAI-compatible proxy routes.
  *
@@ -27,4 +26,4 @@ import type { RouteGroup } from "../../types/index.js";
  *                        headers — to avoid SSRF.
  * @returns RouteGroup with OpenAI-compatible endpoints.
  */
-export declare function createOpenAIProxyRoutes(modelRouter?: ModelRouter, basePath?: string, loopbackPort?: number): RouteGroup;
+export declare function createOpenAIProxyRoutes(modelRouter?: ModelRouterInterface, basePath?: string, loopbackPort?: number, runtimeConfigProvider?: ProxyRuntimeConfigProvider): RouteGroup;

package/dist/lib/server/routes/openaiProxyRoutes.js

@@ -227,7 +227,7 @@ async function handleOpenAIToAnthropicBridge(args) {
  *                        headers — to avoid SSRF.
  * @returns RouteGroup with OpenAI-compatible endpoints.
  */
-export function createOpenAIProxyRoutes(modelRouter, basePath = "", loopbackPort = DEFAULT_LOOPBACK_PORT) {
+export function createOpenAIProxyRoutes(modelRouter, basePath = "", loopbackPort = DEFAULT_LOOPBACK_PORT, runtimeConfigProvider) {
     return {
         prefix: `${basePath}/v1`,
         routes: [
@@ -239,6 +239,9 @@ export function createOpenAIProxyRoutes(modelRouter, basePath = "", loopbackPort
                 path: `${basePath}/v1/chat/completions`,
                 description: "OpenAI-compatible chat completions (translation mode)",
                 handler: async (ctx) => {
+                    const requestModelRouter = runtimeConfigProvider
+                        ? runtimeConfigProvider().modelRouter
+                        : modelRouter;
                     const requestStartTime = Date.now();
                     const body = ctx.body;
                     // --- Validation ---
@@ -246,8 +249,8 @@ export function createOpenAIProxyRoutes(modelRouter, basePath = "", loopbackPort
                         return buildOpenAIErrorResponse(400, "Request must include 'model' and 'messages' fields");
                     }
                     // --- Resolve target provider/model ---
-                    const route = modelRouter
-                        ? modelRouter.resolve(body.model)
+                    const route = requestModelRouter
+                        ? requestModelRouter.resolve(body.model)
                         : { provider: null, model: body.model };
                     const targetProvider = route.provider ?? undefined;
                     const targetModel = route.model ?? body.model;
@@ -302,7 +305,7 @@ export function createOpenAIProxyRoutes(modelRouter, basePath = "", loopbackPort
                     const plan = buildProxyTranslationPlan({
                         provider: targetProvider ?? "auto",
                         model: targetModel,
-                    }, modelRouter?.getFallbackChain() ?? [], body.model, 
+                    }, requestModelRouter?.getFallbackChain() ?? [], body.model, 
                     // The classifier only reads fields present on both types.
                     adapted);
                     const attempts = plan.attempts;
@@ -369,7 +372,10 @@ export function createOpenAIProxyRoutes(modelRouter, basePath = "", loopbackPort
                 path: `${basePath}/v1/models`,
                 description: "List available models in OpenAI format",
                 handler: async () => {
-                    return buildModelsListResponse(modelRouter);
+                    const requestModelRouter = runtimeConfigProvider
+                        ? runtimeConfigProvider().modelRouter
+                        : modelRouter;
+                    return buildModelsListResponse(requestModelRouter);
                 },
             },
         ],

package/dist/lib/types/cli.d.ts

@@ -837,6 +837,14 @@ export type ProxyState = {
     managedBy?: "launchd" | "manual";
     /** Whether the proxy is running in transparent passthrough mode */
     passthrough?: boolean;
+    /** Active hot-reload configuration generation. */
+    configGeneration?: number;
+    /** Timestamp when the active configuration generation was loaded. */
+    configLoadedAt?: string;
+    /** Last rejected hot-reload error, when any. */
+    lastConfigReloadError?: string;
+    /** Absolute path watched for proxy routing configuration changes. */
+    configFile?: string;
 };
 /** Stored credentials for an authenticated provider. */
 export type StoredCredentials = {

package/dist/lib/types/proxy.d.ts

@@ -18,7 +18,7 @@ import type { Hono } from "hono";
 import type { Ora } from "ora";
 import type { MCPToolRegistry } from "../mcp/toolRegistry.js";
 import type { ProxyTracer } from "../proxy/proxyTracer.js";
-import type { FallbackEntry, ProxyRoutingConfig, CloakingConfig } from "./subscription.js";
+import type { FallbackEntry, ModelMapping, ProxyRoutingConfig, CloakingConfig } from "./subscription.js";
 import type { RouteDeprecation } from "./server.js";
 /**
  * Type describing the ModelRouter contract.
@@ -28,6 +28,8 @@ export type ModelRouterInterface = {
     resolve(requestedModel: string): RouteResult;
     isClaudeTarget(requestedModel: string): boolean;
     getFallbackChain(): FallbackEntry[];
+    getModelMappings?: () => ModelMapping[];
+    getPassthroughModels?: () => string[];
 };
 /** A single text block in a Claude content array. */
 export type ClaudeTextBlock = {
@@ -1245,6 +1247,70 @@ export type LoadedProxyConfig = {
         strategy?: ProxyStartStrategy;
     };
 };
+/** Routing values captured once when a proxy request begins. */
+export type ProxyRequestRoutingSnapshot = {
+    generation: number;
+    strategy: ProxyStartStrategy;
+    modelRouter?: ModelRouterInterface;
+    passthrough: boolean;
+    primaryAccountKey?: string;
+    accountAllowlist?: ReadonlySet<string>;
+    quotaRoutingEnabled: boolean;
+    sessionSoftLimit: number;
+    sessionResetToleranceMs: number;
+};
+/** Immutable last-known-good proxy configuration published at runtime. */
+export type ProxyRuntimeConfigSnapshot = ProxyRequestRoutingSnapshot & {
+    loadedAt: string;
+    configHash: string;
+    proxyConfig: LoadedProxyConfig | null;
+};
+/** Source that requested a runtime configuration reload. */
+export type ProxyRuntimeConfigReloadSource = "startup" | "watch" | "sighup" | "manual";
+/** Result returned after a serialized runtime configuration reload attempt. */
+export type ProxyRuntimeConfigReloadResult = {
+    applied: boolean;
+    changed: boolean;
+    generation: number;
+    error?: string;
+};
+/** Safe runtime configuration diagnostics exposed through proxy status. */
+export type ProxyRuntimeConfigStatus = {
+    configPath: string;
+    envFilePath?: string;
+    generation: number;
+    loadedAt: string;
+    configHash: string;
+    watching: boolean;
+    lastReloadAttemptAt?: string;
+    lastReloadAt?: string;
+    lastReloadSource?: ProxyRuntimeConfigReloadSource;
+    lastReloadError?: string;
+    consecutiveFailures: number;
+};
+/** Constructor options for the proxy runtime configuration store. */
+export type ProxyRuntimeConfigStoreOptions = {
+    configPath: string;
+    configRequired: boolean;
+    envFilePath?: string;
+    envFileRequired?: boolean;
+    baseEnv: Record<string, string | undefined>;
+    strategyOverride?: ProxyStartStrategy;
+    passthrough: boolean;
+    watchIntervalMs?: number;
+    watchDebounceMs?: number;
+};
+/** Runtime configuration provider captured by route factories. */
+export type ProxyRuntimeConfigProvider = () => ProxyRequestRoutingSnapshot;
+/** Optional runtime configuration wiring for Claude proxy route factories. */
+export type ClaudeProxyRouteRuntimeOptions = {
+    accountAllowlist?: AccountAllowlist;
+    runtimeConfigProvider: ProxyRuntimeConfigProvider;
+};
+/** Listener invoked after a new configuration generation is published. */
+export type ProxyRuntimeConfigListener = (snapshot: ProxyRuntimeConfigSnapshot) => void;
+/** Listener invoked after every successful or rejected reload attempt. */
+export type ProxyRuntimeConfigReloadListener = (result: ProxyRuntimeConfigReloadResult, status: ProxyRuntimeConfigStatus) => void;
 /**
  * Handle for a NeuroLink runtime created by the proxy start command.
  * The `neurolink` field is typed structurally (only the method used by the

package/dist/lib/types/subscription.d.ts

@@ -909,6 +909,12 @@ export type ProxyRoutingConfig = {
     modelMappings: ModelMapping[];
     fallbackChain: FallbackEntry[];
     passthroughModels?: string[];
+    /** Enable quota-aware fill-first account ordering. Defaults to true. */
+    quotaRouting?: boolean;
+    /** Session utilization threshold used to proactively demote an account. */
+    sessionSoftLimit?: number;
+    /** Reset-time bucket width used when ordering quota windows. */
+    sessionResetToleranceMs?: number;
     /** Email/label of the Anthropic account that should be tried first
      *  ("home"). When absent, falls back to insertion-order index 0.
      *  Resolved per-request to a stable key (anthropic:<email>); does not

package/dist/neurolink.js

@@ -5968,14 +5968,19 @@ Current user's request: ${currentInput}`;
             instanceConfig: this.toolsConfig,
             builtinToolNames: Object.keys(directAgentTools),
         });
-        const record = {};
+        // Null prototype + own-property checks: a tool named "__proto__" must
+        // become an own entry — with a plain `{}`, `"__proto__" in record` is
+        // truthy via the prototype and the tool would be silently dropped from
+        // the listing while surviving the native gate. Matches the hardening on
+        // every other record in the tool-resolution pipeline.
+        const record = Object.create(null);
         for (const tool of tools) {
-            if (!(tool.name in record)) {
+            if (!Object.hasOwn(record, tool.name)) {
                 record[tool.name] = tool;
             }
         }
         const gated = applyToolGate(record, policy);
-        const filtered = tools.filter((t) => t.name in gated);
+        const filtered = tools.filter((t) => Object.hasOwn(gated, t.name));
         if (filtered.length !== tools.length) {
             logger.debug(`Tool info filtering applied for system prompt`, {
                 beforeCount: tools.length,

package/dist/proxy/proxyConfig.js

@@ -227,6 +227,33 @@ export function validateProxyConfig(config) {
                 });
             }
         }
+        const rawQuotaRouting = routing["quota-routing"] ?? routing.quotaRouting;
+        const normalizedQuotaRouting = typeof rawQuotaRouting === "string"
+            ? rawQuotaRouting.trim().toLowerCase()
+            : undefined;
+        if (rawQuotaRouting !== undefined &&
+            typeof rawQuotaRouting !== "boolean" &&
+            normalizedQuotaRouting !== "true" &&
+            normalizedQuotaRouting !== "false") {
+            errors.push("routing.quota-routing must be a boolean");
+        }
+        const rawSessionSoftLimit = routing["session-soft-limit"] ?? routing.sessionSoftLimit;
+        if (rawSessionSoftLimit !== undefined) {
+            const sessionSoftLimit = Number(rawSessionSoftLimit);
+            if (!Number.isFinite(sessionSoftLimit) ||
+                sessionSoftLimit <= 0 ||
+                sessionSoftLimit > 1) {
+                errors.push("routing.session-soft-limit must be a number in (0, 1]");
+            }
+        }
+        const rawSessionResetToleranceMs = routing["session-reset-tolerance-ms"] ?? routing.sessionResetToleranceMs;
+        if (rawSessionResetToleranceMs !== undefined) {
+            const sessionResetToleranceMs = Number(rawSessionResetToleranceMs);
+            if (!Number.isInteger(sessionResetToleranceMs) ||
+                sessionResetToleranceMs <= 0) {
+                errors.push("routing.session-reset-tolerance-ms must be a positive integer");
+            }
+        }
     }
     if (!hasAccounts && !hasRouting) {
         errors.push('Config must contain at least one of "accounts" or "routing"');
@@ -296,6 +323,9 @@ function warnPlaintextApiKeys(accounts) {
  * - `model-mappings` / `modelMappings` — array of {from, to, provider}
  * - `fallback-chain` / `fallbackChain` — array of {provider, model}
  * - `passthroughModels` / `passthrough-models` — array of model IDs
+ * - `quota-routing` / `quotaRouting` — quota-aware fill-first ordering
+ * - `session-soft-limit` / `sessionSoftLimit` — proactive handoff threshold
+ * - `session-reset-tolerance-ms` / `sessionResetToleranceMs` — reset bucket
  * - `account-allowlist` / `accountAllowlist` — allowed Anthropic account IDs
  *
  * Accepts both camelCase and kebab-case keys for YAML-friendliness.
@@ -353,6 +383,42 @@ function parseRoutingConfig(raw) {
     if (Array.isArray(rawPassthrough)) {
         result.passthroughModels = rawPassthrough.map(String);
     }
+    const rawQuotaRouting = raw["quota-routing"] ?? raw.quotaRouting;
+    if (rawQuotaRouting !== undefined) {
+        if (typeof rawQuotaRouting === "boolean") {
+            result.quotaRouting = rawQuotaRouting;
+        }
+        else if (typeof rawQuotaRouting === "string" &&
+            ["true", "false"].includes(rawQuotaRouting.trim().toLowerCase())) {
+            result.quotaRouting = rawQuotaRouting.trim().toLowerCase() === "true";
+        }
+        else {
+            logger.warn(`[proxy-config] Ignoring routing.quotaRouting: expected boolean, got ${typeof rawQuotaRouting}`);
+        }
+    }
+    const rawSessionSoftLimit = raw["session-soft-limit"] ?? raw.sessionSoftLimit;
+    if (rawSessionSoftLimit !== undefined) {
+        const sessionSoftLimit = Number(rawSessionSoftLimit);
+        if (Number.isFinite(sessionSoftLimit) &&
+            sessionSoftLimit > 0 &&
+            sessionSoftLimit <= 1) {
+            result.sessionSoftLimit = sessionSoftLimit;
+        }
+        else {
+            logger.warn(`[proxy-config] Ignoring routing.sessionSoftLimit: expected number in (0, 1], got ${String(rawSessionSoftLimit)}`);
+        }
+    }
+    const rawSessionResetToleranceMs = raw["session-reset-tolerance-ms"] ?? raw.sessionResetToleranceMs;
+    if (rawSessionResetToleranceMs !== undefined) {
+        const sessionResetToleranceMs = Number(rawSessionResetToleranceMs);
+        if (Number.isInteger(sessionResetToleranceMs) &&
+            sessionResetToleranceMs > 0) {
+            result.sessionResetToleranceMs = sessionResetToleranceMs;
+        }
+        else {
+            logger.warn(`[proxy-config] Ignoring routing.sessionResetToleranceMs: expected positive integer, got ${String(rawSessionResetToleranceMs)}`);
+        }
+    }
     // Primary account (accept kebab-case or camelCase). Email or label of the
     // Anthropic account that should be tried first ("home"). Resolved to a
     // stable key (anthropic:<email>) at proxy boot; absence preserves the

package/dist/proxy/runtimeConfig.d.ts

@@ -0,0 +1,26 @@
+import type { ProxyRuntimeConfigListener, ProxyRuntimeConfigReloadListener, ProxyRuntimeConfigReloadResult, ProxyRuntimeConfigReloadSource, ProxyRuntimeConfigSnapshot, ProxyRuntimeConfigStatus, ProxyRuntimeConfigStoreOptions } from "../types/index.js";
+/** Atomic last-known-good runtime configuration with file-triggered reloads. */
+export declare class ProxyRuntimeConfigStore {
+    private readonly options;
+    private currentSnapshot;
+    private status;
+    private readonly listeners;
+    private readonly reloadListeners;
+    private reloadQueue;
+    private reloadTimer;
+    private configFileObserved;
+    private envFileObserved;
+    private readonly watchListener;
+    private constructor();
+    static create(options: ProxyRuntimeConfigStoreOptions): Promise<ProxyRuntimeConfigStore>;
+    getSnapshot(): ProxyRuntimeConfigSnapshot;
+    getStatus(): ProxyRuntimeConfigStatus;
+    subscribe(listener: ProxyRuntimeConfigListener): () => void;
+    subscribeReload(listener: ProxyRuntimeConfigReloadListener): () => void;
+    reload(source?: ProxyRuntimeConfigReloadSource): Promise<ProxyRuntimeConfigReloadResult>;
+    startWatching(): void;
+    stopWatching(): void;
+    private scheduleWatchReload;
+    private performReload;
+    private notifyReloadListeners;
+}